Uptycs Threat Research
Research and updates from the Uptycs Threat Research team.
Research by: Siddartha Sharma and Adhokshaj Mishra
In our previous blog, we discussed the common utilities in Linux which are generally used by threat actors in the attack chain. This blog discusses the common defense evasion techniques which are mostly used in malicious shell scripts and how Uptycs detects them.
Research by Siddartha Sharma and Ashwin Vamshi
Uptycs' threat research team has discovered a new Botnet named ‘Simps’ attributed to Keksec group primarily focussed on DDOS activities. We discovered the Simps Botnet binaries downloaded via shell script sample and Remote Code Execution vulnerability exploits by Gafgyt - detailed in our earlier post.
Research by Ashwin Vamshi and Abhijit Mohanta
Quick-Look Summary:
- IcedID appears to be taking the place of Emotet, based on a significant influx of samples in our threat intelligence systems
- A majority of these IcedID samples are distributed via xlsm files attached to emails
- We’ve identified three ways these Excel 4 Macros are evading detection
Research by Ashwin Vamshi and Abhijit Mohanta
The Uptycs threat research team is monitoring ongoing targeted attacks and trends. We’ve recently seen threat actors and APT groups frequently using two document-based techniques: template injection and the Equation Editor exploit. In this piece, we’ll cover these oft-used techniques and provide details on the APT groups applying them.
Research by Abhijit Mohanta and Ashwin Vamshi
Uptycs' threat research team published a piece about Warzone RAT and its advanced capabilities in November 2020. During the first week of January 2021, we discovered an ongoing targeted attack campaign related to Confucius APT, a threat actor / group primarily targeting government sectors in South Asia. This attack was identified by our in-house osquery-based sandbox that triggered a detection on Warzone RAT activity.