Ave_Maria RAT

Ave_Maria Malware: there’s more than meets the eye

Posted by admin on

Introduction

AVE_MARIA, a malware used in phishing campaigns and so far identified only as an info-stealer, appears to be more complex and insidious, offering a wide range of capabilities, from privilege escalation to camera exfiltration, RDP connections, email extraction and more. For the past few months we have been monitoring various phishing campaign delivering AVE_MARIA and we are now able to prove that AVE_MARIA is in fact a complete and multi-purpose malware.
Continue reading “Ave_Maria Malware: there’s more than meets the eye” →

Fileless Malware Attacks

Hunting Fileless Malware: Invisible but not Undetected

Posted by admin on

Fileless malware attacks are a growing concern in cyber-security with an interesting history that dates back to 2001. After remaining almost silent for several years, this type of threat began to gain fresh traction in 2014 with new concepts introduced at a fast pace. Today such attacks are so common that new strategies had to be developed to identify and contain them.
Continue reading “Hunting Fileless Malware: Invisible but not Undetected” →

Silence group targeting Russian Banks via Malicious CHM

Posted by admin on

In November 2018 we followed up on a tweet mentioning a potential malicious code disseminated in CHM (Microsoft Compiled HTML Help). A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that, among other things, shows that the attack campaign was targeting employees from financial entities, specifically in the Russian Federation and the Republic of Belarus. We conclude that the actor behind the attack is Silence group, a relatively new threat actor that’s been operating since mid-2016. Continue reading “Silence group targeting Russian Banks via Malicious CHM” →

ReaQta Behavioral Engine and Virustotal

Posted by admin on

Over the past 3 months ReaQta has been working closely with VirusTotal to integrate ReaQta-Hive‘s behavioral engine, today we are excited to announce that the integration is complete and available to the public. VirusTotal is a free service that analyzes files and URLs to detect malicious content, the platform is well-known among security researchers as it offers powerful threat hunting features and automated scanning over a multitude of Antivirus solutions.
Continue reading “ReaQta Behavioral Engine and Virustotal” →

Proactive Threat Hunting with A.I.

Posted by admin on

Proactive Threat Hunting helps in the early detection of new threats and in the discovery of weak spots that can be leveraged by an attacker to gain or maintain access to an infrastructure.  Traditional IOCs, combined with ATT&CK Mitre TTPs and Artificial Intelligence for discovery of new behaviors raises the bar for the attackers, helping responders to identify breaches at a very early stage, enabling them to contain and mitigate the attacks quickly and effectively.
Continue reading “Proactive Threat Hunting with A.I.” →

Ursnif reloaded: tracing the latest trojan campaigns

Posted by admin on

On the 9th of October our customers started reporting the same kind of incident over the span of a few hours. The identified activity appears to be linked to the banking Trojan Ursnif, a long active malware, whose roots can be traced back to 2007 together with ZeuS and SpyEye, still with strong infection capabilities in each of its campaigns. The attack vector was a malicious email with a Word document attached.
Continue reading “Ursnif reloaded: tracing the latest trojan campaigns” →

Banks and crypto wallets: unveiling a global malware campaign using Zeus/Panda

Posted by admin on

For the past weeks our Threat Intelligence team has been following an enxtesive campaign, possibly operated by the same group, targeting a large amount of financial institutions, cyptocurrency wallets and the occasional Google and Apple accounts. The attackers target their victims both with Phishing emails, typo-squatted domains and malicious attachments that eventually lead to the installation of Zeus/Panda banking malware. The group appears to be active since at least 2015 and it’s most likely related to several campaigns identified by the security community in the past 3 years.
Continue reading “Banks and crypto wallets: unveiling a global malware campaign using Zeus/Panda” →

Active Learning as a powerful tool in the Cyber Security arsenal

Posted by admin on

When datasets are hard to label or highly skewed, Active Learning shows great potential to help both the algorithms and the analyst to make sense of data faster and more efficiently.

The promise of AI in cyber-security has long been that of helping humans to automate and simplify the daunting task of preventing data loss by detecting, tracking and blocking malicious software and intruders. AI is a tremendously powerful tool for such a task but, unlike what happens in other domains, gathering and labelling data to train any kind of engine/classifier is not only expensive but also hard.
Continue reading “Active Learning as a powerful tool in the Cyber Security arsenal” →