Threat Research

August 3, 2017

THREAT RESEARCH

Taking the FIRST look at Crypt0l0cker

This post is authored by Matthew Molyett. Executive Summary In March, Talos reported on the details of Crypt0l0cker based on an extensive analysis I carried out on the sample binaries. Binaries — plural — because, as noted in the original blog, the Crypt0l0cker payload leveraged numerous executable files which shared the same codebase. Those executables had nearly identical […]

June 27, 2017

THREAT RESEARCH

New Ransomware Variant “Nyetya” Compromises Systems Worldwide

Note: This blog post discusses active research by Talos into a new threat. This information should be considered preliminary and will be updated as research continues. For the most current info, please read our full blog on TalosIntelligence.com. Since the SamSam attacks that targeted US healthcare entities in March 2016, Talos has been concerned about […]

June 19, 2017

THREAT RESEARCH

Delphi Used To Score Against Palestine

Executive Summary This blog was authored by Paul Rascagneres and Warren Mercer with contributions from Emmanuel Tacheau, Vanja Svajcer and Martin Lee. Talos continuously monitors malicious emails campaigns. We identified one specific spear phishing campaign launched against targets within Palestine, and specifically against Palestinian law enforcement agencies. This campaign started in April 2017, using a […]

May 26, 2017

THREAT RESEARCH

Threat Round-up for May 19 – May 26

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed between May 19 and May 26. As with previous round-ups, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically […]

May 24, 2017

THREAT RESEARCH

File2pcap – The Talos Swiss Army Knife of Snort Rule Creation

This post was authored by Martin Zeiser with contributions by Joel Esler At Talos we are constantly on the lookout for threats to our customers networks, and part of the protection process is creating Snort rules for the latest vulnerabilities in order to detect any attacks. To improve your understanding of the rule development process, consider […]

May 3, 2017

THREAT RESEARCH

Gmail Worm Requiring You To Give It A Push And Apparently You All Are Really Helpful

This post authored Sean Baird and Nick Biasini Attackers are always looking for creative ways to send large amount of spam to victims. A short-lived, but widespread Google Drive themed phishing campaign has affected a large number of users across a variety of verticals. This campaign would be bcc’d to a target while being sent […]

March 10, 2017

THREAT RESEARCH

Threat Roundup for the Week of Mar 6 – Mar 10

Today, Talos is publishing a glimpse into the most prevalent threats we’ve observed over the past week. As with our previous threat round-up, this post isn’t meant to be an in-depth analysis. Instead, this post will summarize the threats we’ve observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically […]

March 8, 2017

THREAT RESEARCH

Content-Type: Malicious – New Apache Struts2 0-day Under Attack

This Post Authored by Nick Biasini UPDATE: It was recently disclosed that in addition to Content-Type being vulnerable, both Content-Disposition and Content-Length can be manipulated to trigger this particular vulnerability. No new CVE was listed, however details of the vulnerability and remediation are available in this security advisory. Talos has observed a new Apache vulnerability […]

January 31, 2017

THREAT RESEARCH

Cisco Coverage for Shamoon 2

Shamoon is a type of destructive malware that has been previously associated with attacks against the Saudi Arabian energy sector we’ve been tracking since 2012. We’ve observed that a variant of Shamoon, identified as Shamoon 2, has recently been used against several compromised organizations and institutions. Talos is aware of the recent increase in Shamoon […]