blog.fox-it.com 25. 9. 2024Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation – blog.fox-it.com 25. 4. 2024Sifting through the spines: identifying (potential) Cactus ransomware victims – blog.fox-it.com 28. 3. 2024Android Malware Vultur Expands Its Wingspan – blog.fox-it.com 25. 1. 2024Memory Scanning for the Masses – blog.fox-it.com 14. 12. 2023Reverse, Reveal, Recover: Windows Defender Quarantine Forensics – blog.fox-it.com 15. 11. 2023The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses – blog.fox-it.com 1. 11. 2023Popping Blisters for research: An overview of past payloads and exploring recent developments – blog.fox-it.com 11. 9. 2023From ERMAC to Hook: Investigating the technical differences between two Android malware variants – blog.fox-it.com 15. 8. 2023Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign – blog.fox-it.com 22. 2. 2023From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager – blog.fox-it.com 15. 2. 2023Threat spotlight: Hydra – blog.fox-it.com 28. 12. 2022CVE-2022-27510, CVE-2022-27518 – Measuring Citrix ADC & Gateway version adoption on the Internet – blog.fox-it.com 12. 12. 2022One Year Since Log4Shell: Lessons Learned for the next ‘code red’ – blog.fox-it.com 18. 10. 2022I’m in your hypervisor, collecting your evidence – blog.fox-it.com 2. 9. 2022Sharkbot is back in Google Play – blog.fox-it.com 11. 8. 2022Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study – blog.fox-it.com 29. 6. 2022Flubot: the evolution of a notorious Android Banking Malware – blog.fox-it.com 29. 4. 2022Adventures in the land of BumbleBee – blog.fox-it.com 3. 3. 2022SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store – blog.fox-it.com 14. 12. 2021log4j-jndi-be-gone: A simple mitigation for CVE-2021-44228 – blog.fox-it.com 12. 12. 2021Log4Shell: Reconnaissance and post exploitation network detection – blog.fox-it.com 7. 12. 2021Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm – blog.fox-it.com 2. 12. 2021Tracking a P2P network related to TA505 – blog.fox-it.com 8. 11. 2021TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access – blog.fox-it.com 12. 10. 2021Reverse engineering and decrypting CyberArk vault credential files – blog.fox-it.com 11. 10. 2021SnapMC skips ransomware, steals data – blog.fox-it.com 4. 5. 2021RM3 – Curiosities of the wildest banking malware – blog.fox-it.com 12. 1. 2021Abusing cloud services to fly under the radar – blog.fox-it.com 16. 11. 2020TA505: A Brief History Of Their Time – blog.fox-it.com 11. 11. 2020Decrypting OpenSSH sessions for fun and profit – blog.fox-it.com 10. 9. 2020StreamDivert: Relaying (specific) network connections – blog.fox-it.com 2. 9. 2020Machine learning from idea to reality: a PowerShell case study – blog.fox-it.com 1. 7. 2020A Second Look at CVE-2019-19781 (Citrix NetScaler / ADC) – blog.fox-it.com 23. 6. 2020WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group – blog.fox-it.com 2. 6. 2020In-depth analysis of the new Team9 malware family – blog.fox-it.com 19. 3. 2020LDAPFragger: Command and Control over LDAP attributes – blog.fox-it.com 15. 1. 2020Hunting for beacons – blog.fox-it.com 16. 10. 2019Detecting random filenames using (un)supervised machine learning – blog.fox-it.com 11. 9. 2019Office 365: prone to security breaches? – blog.fox-it.com 11. 6. 2019Using Anomaly Detection to find malicious domains – blog.fox-it.com 6. 6. 2019Syncing yourself to Global Administrator in Azure Active Directory – blog.fox-it.com 4. 6. 2019Export corrupts Windows Event Log files – blog.fox-it.com 25. 4. 2019Getting in the Zone: dumping Active Directory DNS using adidnsdump – blog.fox-it.com 28. 3. 2019mkYARA – Writing YARA rules for the lazy analyst – blog.fox-it.com 27. 3. 2019PsiXBot: The Evolution Of A Modular .NET Bot – blog.fox-it.com 26. 2. 2019Identifying Cobalt Strike team servers in the wild – blog.fox-it.com 18. 12. 2018Your trust, our signature – blog.fox-it.com 14. 8. 2018Phishing – Ask and ye shall receive – blog.fox-it.com 9. 8. 2018Bokbot: The (re)birth of a banker – blog.fox-it.com 17. 5. 2018Introducing Team Foundation Server decryption tool – blog.fox-it.com 9. 5. 2018Introducing Orchestrator decryption tool – blog.fox-it.com 26. 4. 2018Escalating privileges with ACLs in Active Directory – blog.fox-it.com 6. 4. 2018Compromising Citrix ShareFile on-premise via 7 chained vulnerabilities – blog.fox-it.com
25. 9. 2024Red Teaming in the age of EDR: Evasion of Endpoint Detection Through Malware Virtualisation – blog.fox-it.com 25. 4. 2024Sifting through the spines: identifying (potential) Cactus ransomware victims – blog.fox-it.com 28. 3. 2024Android Malware Vultur Expands Its Wingspan – blog.fox-it.com 25. 1. 2024Memory Scanning for the Masses – blog.fox-it.com 14. 12. 2023Reverse, Reveal, Recover: Windows Defender Quarantine Forensics – blog.fox-it.com 15. 11. 2023The Spelling Police: Searching for Malicious HTTP Servers by Identifying Typos in HTTP Responses – blog.fox-it.com 1. 11. 2023Popping Blisters for research: An overview of past payloads and exploring recent developments – blog.fox-it.com 11. 9. 2023From ERMAC to Hook: Investigating the technical differences between two Android malware variants – blog.fox-it.com 15. 8. 2023Approximately 2000 Citrix NetScalers backdoored in mass-exploitation campaign – blog.fox-it.com 22. 2. 2023From Backup to Backdoor: Exploitation of CVE-2022-36537 in R1Soft Server Backup Manager – blog.fox-it.com 15. 2. 2023Threat spotlight: Hydra – blog.fox-it.com 28. 12. 2022CVE-2022-27510, CVE-2022-27518 – Measuring Citrix ADC & Gateway version adoption on the Internet – blog.fox-it.com 12. 12. 2022One Year Since Log4Shell: Lessons Learned for the next ‘code red’ – blog.fox-it.com 18. 10. 2022I’m in your hypervisor, collecting your evidence – blog.fox-it.com 2. 9. 2022Sharkbot is back in Google Play – blog.fox-it.com 11. 8. 2022Detecting DNS implants: Old kitten, new tricks – A Saitama Case Study – blog.fox-it.com 29. 6. 2022Flubot: the evolution of a notorious Android Banking Malware – blog.fox-it.com 29. 4. 2022Adventures in the land of BumbleBee – blog.fox-it.com 3. 3. 2022SharkBot: a “new” generation Android banking Trojan being distributed on Google Play Store – blog.fox-it.com 14. 12. 2021log4j-jndi-be-gone: A simple mitigation for CVE-2021-44228 – blog.fox-it.com 12. 12. 2021Log4Shell: Reconnaissance and post exploitation network detection – blog.fox-it.com 7. 12. 2021Encryption Does Not Equal Invisibility – Detecting Anomalous TLS Certificates with the Half-Space-Trees Algorithm – blog.fox-it.com 2. 12. 2021Tracking a P2P network related to TA505 – blog.fox-it.com 8. 11. 2021TA505 exploits SolarWinds Serv-U vulnerability (CVE-2021-35211) for initial access – blog.fox-it.com 12. 10. 2021Reverse engineering and decrypting CyberArk vault credential files – blog.fox-it.com 11. 10. 2021SnapMC skips ransomware, steals data – blog.fox-it.com 4. 5. 2021RM3 – Curiosities of the wildest banking malware – blog.fox-it.com 12. 1. 2021Abusing cloud services to fly under the radar – blog.fox-it.com 16. 11. 2020TA505: A Brief History Of Their Time – blog.fox-it.com 11. 11. 2020Decrypting OpenSSH sessions for fun and profit – blog.fox-it.com 10. 9. 2020StreamDivert: Relaying (specific) network connections – blog.fox-it.com 2. 9. 2020Machine learning from idea to reality: a PowerShell case study – blog.fox-it.com 1. 7. 2020A Second Look at CVE-2019-19781 (Citrix NetScaler / ADC) – blog.fox-it.com 23. 6. 2020WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group – blog.fox-it.com 2. 6. 2020In-depth analysis of the new Team9 malware family – blog.fox-it.com 19. 3. 2020LDAPFragger: Command and Control over LDAP attributes – blog.fox-it.com 15. 1. 2020Hunting for beacons – blog.fox-it.com 16. 10. 2019Detecting random filenames using (un)supervised machine learning – blog.fox-it.com 11. 9. 2019Office 365: prone to security breaches? – blog.fox-it.com 11. 6. 2019Using Anomaly Detection to find malicious domains – blog.fox-it.com 6. 6. 2019Syncing yourself to Global Administrator in Azure Active Directory – blog.fox-it.com 4. 6. 2019Export corrupts Windows Event Log files – blog.fox-it.com 25. 4. 2019Getting in the Zone: dumping Active Directory DNS using adidnsdump – blog.fox-it.com 28. 3. 2019mkYARA – Writing YARA rules for the lazy analyst – blog.fox-it.com 27. 3. 2019PsiXBot: The Evolution Of A Modular .NET Bot – blog.fox-it.com 26. 2. 2019Identifying Cobalt Strike team servers in the wild – blog.fox-it.com 18. 12. 2018Your trust, our signature – blog.fox-it.com 14. 8. 2018Phishing – Ask and ye shall receive – blog.fox-it.com 9. 8. 2018Bokbot: The (re)birth of a banker – blog.fox-it.com 17. 5. 2018Introducing Team Foundation Server decryption tool – blog.fox-it.com 9. 5. 2018Introducing Orchestrator decryption tool – blog.fox-it.com 26. 4. 2018Escalating privileges with ACLs in Active Directory – blog.fox-it.com 6. 4. 2018Compromising Citrix ShareFile on-premise via 7 chained vulnerabilities – blog.fox-it.com