Fake Malware TOAD via Malvertizing
Aaron Samala
TL;DR There was a campaign for a Fake Malware TOAD via Malvertizing. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN AND DO NOT REFLECT…
PDFChampions YAPA Browser Hijacker/Loader Analysis
TL;DR PDFChampions is a YAPA Browser Hijacker, delivered via ads, that changes the browsers default search engine and also functions as a loader. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS…
ConvertyFile Browser Hijacker
TL;DR ConvertyFile is a browser hijacker, delivered via ads, that changes the browser’s default search engine. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN…
Convert Master Browser Hijacker Analysis
TL;DR Convert Master is a browser hijacker, delivered via ads, that changes the browsers default search engine – and I’ve observed it using a redirector for the “Retro Revive” fake…
Teams Transcript Page Lure Delivers GoTo RMM
TL;DR This documents a Teams transcript download page lure that delivers GoTo RMM. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN AND DO NOT…
PoisonSeed YouTube-themed Career Phishing
TL;DR This documents a YouTube-themed Career Phishing campaign that I assess is likely related to PoisonSeed. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN…
BLOG: My thoughts on improving analysis and reporting
TL;DR I share my thoughts on how I can improve, scoping the reporting, and such. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN AND…
Thruntellisearch Analyst’s Pivot Checklist
TL;DR This is a checklist that thruntellisearch analysts can use in their quest to uncover additional adversary infrastructure. It may help provide a structured analysis. Tactical Pause THE CONTENT, VIEWS,…
Oyster Malware Delivery via Teams Fake App
TL;DR Oyster malware delivery via MS Teams Fake App. Tactical Pause THE CONTENT, VIEWS, AND OPINIONS EXPRESSED ON THIS DOCUMENT ARE MY OWN AND DO NOT REFLECT THOSE OF MY…
Malformed Rhadamanthys DoH Query
TL;DR This analysis documents how the Rhadamanthys malware sends a malformed DoH query with the Host field specified twice. It fails in Any Run tasks that have the MITM Proxy…