Malware analysis

What is Operation Dream Job by Lazarus?

The Lazarus Group uses malware to attack financial institutions and spy on other countries.

Trojan URSA malware: How it works and how to prevent it

This articles shares the modus operandi of the URSA trojan as well as some preventative measures to counter potential infections.

VMware vCenter vulnerability: Inside a critical remote code execution flaw

We dive into this remote code execution vulnerability, highlighting the most important details of this flaw.

Top 7 malware sample databases and datasets for research and training

Research malware with these top-of-the-line malware sample databases and datasets.

TeamTNT evades detection with new malware using ld_preload technique

A new piece of malware from the TeamTNT threat group is using a different Unix technique to evade detection and to install a bot in the compromised machines

Blackrota abused Docker remote API to deliver CobalStrike beacon

The Blackrota backdoor is a piece of malware analyzed by NetLab and is the most obfuscated Go-developed executable and linkable format (ELF) malware found to date.

APT Sandworm (NotPetya) technical overview

Sandworm, also known as Telebots, is one of the most dangerous Russian threat actors impacting industrial control systems.

MRBMiner malware: What it is, how it works and how to prevent it | Malware spotlight

MrbMiner is a recent malware discovered and documented by the Tencent Team last September. It targets MSSQL databases and implants cryptomining modules on ta

Fileless Windows Error Reporting (WER) malware attack: Technical overview and walkthrough

In October 2020, a newly uncovered malware named Kraken was observed in the wild. This malicious piece of malware is abusing the Windows Error Reporting serv

Bandook malware: What it is, how it works and how to prevent it

Bandook malware is a remote access trojan (RAT) first seen in 2007 and active for several years. Bandook RAT, written in both Delphi and C++, was first se