Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

More From This Author

Profile picture for user MSadique@zscaler.com

Mohd Sadique

Security Researcher
Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload
Insights and Research
8 Min read

Kaseya Supply Chain Ransomware Attack - Technical Analysis of the REvil Payload

On July 2, 2021, Kaseya, an IT Management software firm, disclosed a security incident impacting their on-premises version of Kaseya's Virtual System Administrator (VSA) software. Kaseya VSA is a cloud-based Managed Serv...
Gabble-Babble of RATs
Insights and Research
14 Min read

Catching RATs Over Custom Protocols

Adversaries generally use Standard Application Layer Protocols for communication between malware and command and control (C&C) servers. This is for several reasons: first, malicious traffic blends in more easily with...
RDP Brute Force attack delivers Ransomware and can propagate laterally
Ransomware
4 Min read

Ransomware Delivered Using RDP Brute-Force Attack

Zscaler ThreatLabZ recently published a report on the 2020 State of Public Cloud Security that showed security misconfiguration to be the leading cause of cyberattacks against public cloud infrastructure. In this blog, w...
Spear Phishing Campaign Delivering Buer and Bazar Malware
Insights and Research
10 Min read

Spear Phishing Campaign Delivers Buer and Bazar Malware

Zscaler ThreatLabZ became aware of a prevalent phishing campaign targeting employees of various organizations. During the past couple of weeks, many enterprise users have been getting spear phishing emails indicating tha...
PurpleWave—A New Infostealer from Russia
Insights and Research
8 Min read

PurpleWave—A New Infostealer from Russia

Infostealer is one of the most profitable tools for cybercriminals, as information gathered from systems infected with this malware could be sold in the cybercrime underground or used for credential stuffing attacks. The...
CyberGate RAT and RedLine Stealer Delivered in Ongoing AutoIt Malware Campaigns
Insights and Research
13 Min read

CyberGate RAT and RedLine Stealer Delivered in Ongoing AutoIt Malware Campaigns

In our most recent blog, we had detailed a malware campaign that uses a malicious document (DOC) file to deliver an AutoIt script which, in turn, delivers the Taurus stealer to steal credentials, cookies, history, system...
Glupteba Campaign that Exploits MikroTik Routers Still at Large
Insights and Research
6 Min read

Glupteba Campaign that Exploits MikroTik Routers Still at Large

As we have written about before, cybercriminals will look to exploit vulnerabilities in all types of equipment, including VPNs, routers, and more. One such campaign that emerged in the latter part of 2019 used the Gl...
New Distribution Mechanism for the NanoCore RAT
Insights and Research
4 Min read

New Distribution Mechanism for the NanoCore RAT

Bad actors have changed the distribution mechanism for the NanoCore RAT over time. Previously, we saw the NanoCore payload being distributed via a DOC file with auto executable macros or via a malicious PDF file. Then, w...
Fake VPN Sites Deliver Infostealers
Insights and Research
7 Min read

Fake VPN Sites Deliver Infostealers

Because of the worldwide call for social distancing, many people working from home and taking classes online for the first time are turning to the virtual private network (VPN) for security and privacy. But, as we’ve all...
Targeted Attack on Indian Financial Institution Delivers Crimson RAT
Insights and Research
5 Min read

Targeted Attack on Indian Financial Institution Delivers Crimson RAT

In 2016, the Crimson remote-access trojan (RAT) made headlines when it was found to be used against Indian diplomatic and military resources in an advanced persistent threat (APT) attack called “Operation Transparent Tri...
A look at the recent BuleHero botnet payload
Insights and Research
16 Min read

A look at the recent BuleHero botnet payload

Ever since the 2017 outbreak of WannaCry, NotPetya, and BadRabbit ransomware, as well as the WannaMine cryptocurrency campaign, there has been a steep increase in malware that uses the now infamous ShadowBroker’s leaked ...
Fileless malware campaign roundup
Insights and Research
5 Min read

Fileless malware campaign roundup

Criminals frequently get caught because they leave evidence at the scene of the crime—fingerprints, DNA, and the like. Cybercriminals are no different, often leaving files behind on the systems they infect. In an effo...
Magecart activity and campaign enhancements
Insights and Research
5 Min read

Magecart activity and campaign enhancements

Magecart is a hacker group known for skimming credit or debit card details by injecting malicious JavaScript code into e-commerce sites. Back in September 2018, the Zscaler ThreatLabZ research team published a blog on Ma...
Abuse of hidden “well-known” directory in HTTPS sites
Insights and Research
11 Min read

Abuse of hidden “well-known” directory in HTTPS sites

WordPress and Joomla are among the most popular Content Management Systems (CMSs). They have also become popular for malicious actors, as cybercriminals target sites on these platforms for hacking and injecting malicious...
Qealler – a new JAR-based information stealer
Insights and Research
7 Min read

Qealler – a new JAR-based information stealer

Recently, the Zscaler ThreatLabZ team came across a new type of malware called Qealler, which is written in Java and designed to silently steal sensitive information from an infected machine. Qealler is a highly obfus...
Spam campaigns leveraging .tk domains
Insights and Research
4 Min read

Spam campaigns leveraging .tk domains

For the last couple quarters, the Zscaler ThreatLabZ research team has been closely monitoring services that provide free domain names. We’ve identified a campaign utilizing '.tk' TLD (top level domain) domains that sta...
CVE-2017-8570 and CVE-2018-0802 exploits being used to spread LokiBot
Insights and Research
6 Min read

CVE-2017-8570 and CVE-2018-0802 exploits being used to spread LokiBot

Zscaler ThreatLabZ has been tracking the usage of malicious RTF documents that leverage CVE-2017-8570 and more recently CVE-2018-0802 vulnerability exploits to install malicious payload on the victim machine. In this blo...
Cryptomining is here to stay in the enterprise
Insights and Research
8 Min read

Cryptomining is here to stay in the enterprise

After Bitcoin hit highs above $19,000 in December, cryptocurrency has received even more attention as speculation about the currency continues. It should be no surprise then that there has been a rise in cryptomining ac...
CVE-2017-11882 serving RAT and encrypted phishing campaign
Insights and Research
4 Min read

CVE-2017-11882 serving RAT and encrypted phishing campaign

Introduction Malicious documents remain one of the most popular vectors for cybercriminals to deliver malware payloads on a user's system. While we continue to see many types of VBA macro-based malware, there has been...
Microsoft DDE protocol based malware attacks
Insights and Research
6 Min read

Microsoft DDE protocol based malware attacks

Introduction Over the past few weeks, there have been several reports about the Microsoft Dynamic Data Exchange (DDE) vulnerability. To no one's surprise, hackers have been quick to exploit this vulnerability to sprea...

Explore More Topics