Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

More From This Author

Profile picture for user Atinderpal Singh

Atinderpal Singh

Sr. Security Researcher II
Technical Analysis of Prynt Stealer/WorldWind/DarkEye Spiderman meme
Insights and Research
12 Min read

No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed

Stealing information is fundamental to cybercriminals today to scope and gain access to systems, profile organizations, and execute bigger payday schemes like ransomware. Information stealer malware families including Pr...
Ransomware
Ransomware
8 Min read

Technical Analysis of Industrial Spy Ransomware

Industrial Spy is a relatively new ransomware group that emerged in April 2022. In some instances, the threat group appears to only exfiltrate and ransom data, while in other cases they encrypt, exfiltrate and ransom dat...
Malware delivered via Microsoft Teams
Insights and Research
2 Min read

Malware delivered via Microsoft Teams

Background Recently, Avanan released a blog post mentioning the interest of adversaries in Microsoft Teams as a launchpad for their malicious attacks. Attackers have always targeted online collaboration tools like Sla...
Malware campaign
Insights and Research
11 Min read

A look at HydroJiin campaign

Zscaler ThreatLabZ recently came across an interesting campaign involving multiple infostealer RAT families and miner malware. We’ve dubbed the campaign “HydroJiin” based on aliases used by the threat actor. The threat a...
Spear Phishing Campaign Delivering Buer and Bazar Malware
Insights and Research
10 Min read

Spear Phishing Campaign Delivers Buer and Bazar Malware

Zscaler ThreatLabZ became aware of a prevalent phishing campaign targeting employees of various organizations. During the past couple of weeks, many enterprise users have been getting spear phishing emails indicating tha...
LinkedIn Job Seeker Phishing Campaign Spreads Agent Tesla
Insights and Research
19 Min read

LinkedIn Job Seeker Phishing Campaign Spreads Agent Tesla

Making the decision to leave your current job and seek employment elsewhere can be an exciting time as you imagine how much better your life and career will be when you find that dream job. But that excitement can quickl...
Targeted Attack Leverages India-China Border Dispute to Lure Victims
Insights and Research
9 Min read

Targeted Attack Leverages India-China Border Dispute to Lure Victims

Malicious threat actors are always ready to take advantage of current affairs to maximize the success rate of their attacks. The Zscaler ThreatLabZ team recently came across one such attack trying to leverage the current...
The Return of the Higaisa APT
Insights and Research
26 Min read

The Return of the Higaisa APT

Cybercriminals will often use LNK files attached in an email to launch an attack on unsuspecting victims. And we recently noticed another campaign using this technique. In May 2020, we observed several LNK files in th...
TrickBot Emerges with a Few New Tricks
Insights and Research
9 Min read

TrickBot Emerges with a Few New Tricks

First observed in 2016, TrickBot is a successor of the banking trojan Dyre and has become one of the most prevalent and dangerous malware strains in today's threat landscape, which is constantly monitored by the Zscaler ...
FTCODE Ransomware — New Version Includes Stealing Capabilities
Ransomware
6 Min read

FTCODE Ransomware — New Version Includes Stealing Capabilities

Recently, the Zscaler ThreatLabZ team came across PowerShell-based ransomware called “FTCODE,” which targets Italian-language users. An earlier version of FTCODE ransomware was being downloaded using a document file that...
Emotet is back in action after a short break
Insights and Research
6 Min read

Emotet is back in action after a short break

It’s common for cybercriminals to launch an attack, then shortly thereafter stop the campaign before they are detected. These breaks also give these bad actors a chance to change tactics to, once again, attempt to avoid ...
NovaLoader, yet another Brazilian banking malware family
Insights and Research
6 Min read

NovaLoader, yet another Brazilian banking malware family

As part of our daily threat tracking activity, ThreatLabZ researchers recently came across an interesting Brazilian banking malware campaign. The malware, NovaLoader, was written in Delphi and made extensive use of Visua...
Anti-Coinminer Mining Campaign
Insights and Research
8 Min read

Anti-Coinminer Mining Campaign

Coinminer malware has been on the rise for some time. As more and more users become aware of this threat and try to take measures to protect themselves, cybercriminals are attempting to cash on that fear by serving crypt...
Cryptominers and stealers – malware edition
Insights and Research
10 Min read

Cryptominers and stealers – malware edition

It all started in 2008 with a paper on the first decentralized digital currency, Bitcoin, created by an unknown person or persons referred to as Satoshi Nakamoto. Bitcoin is a peer-to-peer currency based on cryptography ...
njRAT pushes Lime ransomware and Bitcoin wallet stealer
Ransomware
4 Min read

njRAT pushes Lime ransomware and Bitcoin wallet stealer

Updated - April 1, 2018 Updated - April 3, 2018 (added IOCs) njRAT, also known as Bladabindi, is a remote access Trojan (RAT) that was first seen in 2013 and continues to be one of the most prevalent malware family...
Malicious Chrome Extension Steals Cookies and Credentials of Bank Customers
Insights and Research
7 Min read

Malicious Chrome Extension Steals Cookies and Credentials of Bank Customers

Introduction While going through new malware samples in our cloud we came across an interesting payload written in Delphi which unlike traditional banking Trojans uses a malicious chrome extension for stealing sensiti...
Cobian RAT – A backdoored RAT
Insights and Research
5 Min read

Cobian RAT – A backdoored RAT

Introduction The Zscaler ThreatLabZ research team has been monitoring a new remote access Trojan (RAT) family called Cobian RAT since February 2017. The RAT builder for this family was first advertised on multiple und...
A look at recent Stampado ransomware variant
Ransomware
11 Min read

A look at recent Stampado ransomware variant

Introduction Stampado is one of the many new ransomware strains we have seen in 2016. Stampado was first seen in the wild in July 2016, as one of the cheapest pieces of ransomware available on the underground forums. ...
iSpy Keylogger
Insights and Research
7 Min read

iSpy Keylogger

Keyloggers have always been present in attackers’ toolkits. They give attackers the power to record every keystroke from a victim’s machine and steal sensitive information. Zscaler ThreatLabZ recently came across a signe...

Related Articles

Explore More Topics