Understanding the Avaddon Ransomware: Is your organization equipped to stop zero-day threats?

Recently, The Financial Times reported that Asian subsidiaries of a French Global insurance company were hit by a latest ransomware attack known as Avaddon. Attackers seized 3TB of data, impacting IT operations in Thailand, Malaysia, Hong Kong and the Philippines, taking hold of sensitive information like medical records and hospital data. What is Avaddon ransomware […]

MITRE ATT&CK Carbanak+FIN7 Evaluation: ReaQta-Hive Achieves 100% Detection Coverage across the Cyber Kill Chain Autonomously and in Real-Time

For the 2020 MITRE Engenuity evaluations, MITRE chose to evaluate two well-known threat actors: Carbanak and FIN7. While last year’s evaluation, covering APT29, was focused on governmental espionage, this last round was focused on financially-motivated threat actors and it included, for the first time, testing on both Windows and Linux endpoints. Both threat groups are […]

Detecting HAFNIUM Exchange Exploitation Campaign with ReaQta-Hive

A hunting query to identify post-exploitation activities Customized Detection Strategy (DeStra) to detect future exploitation attempts On the 11th of March, Microsoft reported an active exploitation campaign of several zero-day vulnerabilities affecting on-premise versions of Microsoft Exchange Servers allegedly from a state-sponsored adversary, HAFNIUM. The attack starts by exploiting vulnerabilities — CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and […]

MITRE ATT&CK Evaluation Confirms ReaQta-Hive Advanced Detection Capabilities

The attack unfolded over 2 days in which the attackers gradually moved deeper into the network after obtaining initial access. The vast majority of operations were carried out using powershell, as opposed to custom tools and malware, in order to maintain a low detection profile. The evaluation goal is to show how tested solutions respond to the attack and what kind of visibility is provided along the entire kill-chain.

Ave_Maria Malware: there's more than meets the eye

Introduction AVE_MARIA, a malware used in phishing campaigns and so far identified only as an info-stealer, appears to be more complex and insidious, offering a wide range of capabilities, from privilege escalation to camera exfiltration, RDP connections, email extraction and more. For the past few months we have been monitoring various phishing campaign delivering AVE_MARIA […]

Silence group targeting Russian Banks via Malicious CHM

In November 2018 we followed up on a tweet mentioning a potential malicious code disseminated in CHM (Microsoft Compiled HTML Help). A preliminary analysis caught the attention of our Threat Analysis and Intelligence team as it yielded interesting data that, among other things, shows that the attack campaign was targeting employees from financial entities, specifically […]

ReaQta Behavioral Engine and Virustotal

Over the past 3 months ReaQta has been working closely with VirusTotal to integrate ReaQta-Hive‘s behavioral engine, today we are excited to announce that the integration is complete and available to the public. VirusTotal is a free service that analyzes files and URLs to detect malicious content, the platform is well-known among security researchers as it […]

Spear-phishing campaign targeting Qatar and Turkey

During our daily threat hunting activities we have come across a tweet reporting an active spear-phishing campaign apparently targeting Turkey. After an initial assessment we decided to investigate further, finding similarities with other campaigns active in the recent past and possibly coming from the same actors.

Close Bitnami banner
Bitnami