Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
Log4Shell-Linked Malicious Domains Behind CDN Infrastructure: OTX Pulse Analysis of Shared-IP C2 & Precision Blocking — Enterprise Detection Pack
Threat Summary This OTX pulse documents a live SOC investigation (Incident ES_00244) that captures one of the most operationally dangerous p...
Ransomware Affiliate Betrayal, WhatsApp RAT, and Malicious Dev Packages: A Defender's Playbook for the Latest ThreatsDay Roundup
When the Criminals Can't Trust Each Other Either This week's ThreatsDay roundup is a useful reminder that operational security failures are ...
BraZetsu Access Broker Infrastructure Exposed: Hunting Nuitka-Compiled Python Malware and Persistent C2 Patterns
Introduction The most valuable lesson from Hunt.io's recent tracking of the BraZetsu access broker isn't a hash, an IP, or a domain — it's t...
Microsoft Teams Help Desk Vishing Campaign: Fake IT Support Delivers Malware for Lateral Movement — OTX Detection Pack
Microsoft Teams Help Desk Vishing Campaign: Fake IT Support Delivers Malware for Lateral Movement Threat Summary An AlienVault OTX pulse pub...
Moobot/Mirai Botnet Resurgence: Open Directory Exposure of 'StresD Pro+' DDoS-as-a-Service Panel — OTX Pulse Analysis & Detection Pack
Moobot/Mirai Botnet Resurgence: Open Directory Exposure of 'StresD Pro+' DDoS-as-a-Service Panel Threat Summary A single but high-value OTX ...
Typosquatted AI Platform Malware Distribution: 'claude.ai.download-app.us' Credential-Harvesting Campaign — OTX Detection Pack
Threat Summary A new OTX pulse (AlienVault, TLP:WHITE) confirms what our dark web monitoring has been forecasting for two quarters: trusted ...
Expired Domain Dropcatching: How Attackers Weaponize Your Abandoned Domains for Malware Delivery and C2 — Detection and Defense Guide
Introduction A new wave of domain abuse is exploiting something most organizations treat as an administrative afterthought: the expiration o...
TrickBot DNS Tunneling Variant: C2 Infrastructure & Persistence Analysis
TrickBot DNS Tunneling Variant: C2 Infrastructure & Persistence Analysis Threat Summary A distinct variant of the TrickBot banking trojan (S...
Operation Capsule Vault: APT37 RokRAT v2 Phishing Campaign — OTX Pulse Analysis
Threat Summary Recent OTX pulse data has uncovered a sophisticated spear-phishing campaign attributed to the North Korean threat actor APT37...