PinnedQakBot Detection: DUCK HUNTIn Russia, Ducks hunt you. A skilled and high operational tempo Russian / Eastern European adversary group known as Mallard Spider, TA570, or by the groups developed malware’s name QBot / QakBot has been observed leveraging Follina (CVE-2022–30190) in the wild. The attack flow is simple. As of this writing…Follina4 min readFollina4 min read
Jan 4Part-time Threat Hunting: Considering its EfficacyThis article is my response to two excellent blog posts by the Crowdstrike Overwatch team making the case against part-time threat hunting. In this article, I make a case for part-time threat hunting in certain circumstances and discuss one of many strategies to compensate for the disadvantages of only a…Threat Hunting8 min readThreat Hunting8 min read
Oct 4, 2022QakBot Hunting: Autumn SpiceAutumn marks the beginning of the return of many familiar experiences. Familiar Halloween movies return to the screen; charming Fall time decor returns to the seasonal shopping aisle; many rejoice at the return of the seasonal Pumpkin Spice Latte to their cafe of choice. …7 min read7 min read
Jul 13, 2022QakBot Detection: DUCK HUNT Part 2 — The .LNKAs promised in Part 1 of QakBot Detection: DUCK HUNT, we have a few more concepts to examine regarding the QakBot malware. In Part 1, we focus on the adversary group Mallard Spider, discuss their use of the then recently popularized Follina vulnerability, and reveal some practical issues and opportunities…Malware6 min readMalware6 min read
Mar 18, 2022Prophet Spider Exploits Citrix ShareFile to Deploy WebshellThe adversary group nicknamed Prophet Spider by Crowdstrike has chosen a new vulnerability to include in its exploitation tool kit. This group has been observed leveraging CVE-2021–22941 to deploy an open-source webshell pulled from GitHub. Occasionally, Prophet Spider compromises have resulted in Ransomware infections. In the past, compromises conducted by…Threat Intelligence4 min readThreat Intelligence4 min read
Jun 7, 2021What do we actually know about the Darkside Ransomware operators?You have likely heard a great deal about attacks on U.S. companies from Russian hacking groups such as Darksides attack on Colonial Pipelines, which shut down gasoline supply to half the country, or how REvil’s attack on JBS shutdown the largest meat processing company in the world. …Dark Side8 min readDark Side8 min read
Apr 5, 2021GitHub Actions Abuse by CryptominersAdversaries are abusing GitHub Actions to run known Cryptominers. GitHub Actions is a CI/CD solution to run scheduled tasks and provide CI/CD automation services for GitHub Repos. This attack doesn’t require any action from the repository owners and only requires the repository to behave GitHub Actions enabled. This isn’t the…Cybersecurity3 min readCybersecurity3 min read
