Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

More From This Author

Profile picture for user Sudeep Singh

Sudeep Singh

APT Research Tech Lead
cover image
Threatlabz Research
21 Min read

The Unintentional Leak: A glimpse into the attack vectors of APT37

Summary At Zscaler ThreatLabz, we have been closely monitoring the tools, techniques and procedures (TTPs) of APT37 (also known as ScarCruft or Temp.Reaper) - a North Korea-based advanced persistent threat actor. This...
Job scams impersonate companies still hiring following tech layoffs
Security Insights
5 Min read

Job scams impersonate companies still hiring following tech layoffs

Summary In the midst of significant layoffs hitting the previously immune tech industry, scammers have mobilized and doubled down on targeting job seekers with various employment scams. Stealing personal information a...
cover image
Security Insights
10 Min read

Black Friday Alert: 4 Emerging Skimming Attacks to Watch for This Holiday Season

Summary At Zscaler ThreatLabz, we have been closely monitoring web threats such as payment card skimming attacks against e-commerce stores. Starting in July 2022, we have observed an increase in such activity targeted...
APT-36
Security Insights
27 Min read

APT-36 Uses New TTPs and New Tools to Target Indian Governmental Organizations

Summary APT-36 (also known as Transparent Tribe) is an advanced persistent threat group attributed to Pakistan that primarily targets users working at Indian government organizations. Zscaler ThreatLabz has been close...
Gmail phishing attack
Security Insights
6 Min read

AitM Phishing Attack Targeting Enterprise Users of Gmail

Summary This blog is a follow-up to our recent publication which described the details of a large-scale phishing campaign targeting enterprise users of Microsoft email services. Beginning in mid-July 2022, Threa...
AiTM Phishing attack
Security Insights
20 Min read

Large-Scale AiTM Attack targeting enterprise users of Microsoft email services

Summary ThreatLabz has discovered a new strain of a large-scale phishing campaign, which uses adversary-in-the-middle (AiTM) techniques along with several evasion tactics. Similar AiTM phishing techniques were us...
Advanced Persistent Threats
Security Insights
15 Min read

Return of the Evilnum APT with updated TTPs and new targets

Summary Since the beginning of 2022, ThreatLabz has been closely monitoring the activities of the Evilnum APT group. We identified several instances of their low-volume targeted attack campaigns launched against our c...
voicemail-themed phishing campaign steals Microsoft credentials
Security Insights
4 Min read

Resurgence of Voicemail-themed Phishing Attacks Targeting Key Industry Verticals in US

Summary Since May 2022, ThreatLabz has been closely monitoring the activities of a threat actor which targets users in various US-based organizations with malicious voicemail-notification-themed emails in an attempt t...
cover image
Security Insights
11 Min read

Vidar distributed through backdoored Windows 11 downloads and abusing Telegram

Summary In April 2022, ThreatLabz discovered several newly registered domains, which were created by a threat actor to spoof the official Microsoft Windows 11 OS download portal. We discovered these domains by monitor...
Advanced Persistent Threats
Security Insights
10 Min read

A "Naver"-ending game of Lazarus APT

Zscaler’s ThreatLabz research team has been closely monitoring a campaign targeting users in South Korea. This threat actor has been active for more than a year and continues to evolve its tactics, techniques, and proce...
Advanced Persistent Threats
Security Insights
13 Min read

New espionage attack by Molerats APT targeting users in the Middle East

Introduction In December 2021, the ThreatLabz research team identified several macro-based MS office files uploaded from Middle Eastern countries such as Jordan to OSINT sources such as VT. These files contained decoy...
Cover Image
Security Insights
7 Min read

New DarkHotel APT attack chain identified

Summary In November 2021, ThreatLabz identified a previously undocumented variant of an attack chain used by the South Korea-based Dark Hotel APT group. We also discovered new activity on the command-and-control (C2) ...
cover image
Security Insights
13 Min read

CloudFall Targets Researchers and Scientists Invited to International Military Conferences in Central Asia and Eastern Europe

In August 2021, Zscaler ThreatLabz identified several malicious Microsoft Word documents which used a multi-stage attack-chain abusing Cloudflare Workers and features of MS Office Word to target users in Central Asia and...
Minebridge RAT
Security Insights
7 Min read

Demystifying the full attack chain of MineBridge RAT

Introduction In March 2021, threat actors started distributing MineBridge RAT with an updated distribution mechanism. Morphisec blogged about the partial attack chain of this new attack but they could not find the ori...
Cover image
Security Insights
15 Min read

Threat Actors Distribute Malicious VPN Apps Masquerading as Popular Vendors

Introduction In May 2021, Zscaler ThreatLabZ observed several new domains registered by a threat actor for distribution of spoofed and malicious versions of popular VPN softwares. Threat actors have shifted their tact...
Cover Image
Security Insights
11 Min read

Android apps targeting JIO users in India

Introduction In March 2021, through Zscaler cloud we identified a few download requests for malicious Android applications which were hosted on sites crafted by the threat actor to social engineer users in India. This...
Cover image
Security Insights
18 Min read

Low-volume multi-stage attack leveraging AzureEdge and Shopify CDNs

Introduction In Feb 2021, Threatlabz observed a few instances of a low-volume multi-stage web attack in Zscaler cloud. This web attack leveraged legitimate servers of Microsoft (azureedge.net), Dropbox and content ...
cover image
Security Insights
10 Min read

Return of the MINEBRIDGE RAT With New TTPs and Social Engineering Lures

Introduction In Jan 2021, Zscaler ThreatLabZ discovered new instances of the MINEBRIDGE remote-access Trojan (RAT) embedded in macro-based Word document files crafted to look like valid job resumes (CVs). Such lu...
APT-31 leverages COVID-19 Vaccine theme and abuses legitimate online services
Security Insights
32 Min read

APT-31 Leverages COVID-19 Vaccine Theme and Abuses Legitimate Online Services

Recently, Zscaler's ThreatLabZ team discovered several malicious MSI installer binaries that were hosted on attacker-controlled GitHub accounts and distributed in-the-wild in August 2020. These MSI binaries dropped and d...
cover image
Security Insights
17 Min read

Targeted Attacks on Oil and Gas Supply Chain Industries in the Middle East

Cybercriminals are known to look to current events to make their schemes and campaigns more engaging and relevant to unsuspecting victims. These events don't need to be global in nature, and are often only of local or re...
LinkedIn Job Seeker Phishing Campaign Spreads Agent Tesla
Security Insights
19 Min read

LinkedIn Job Seeker Phishing Campaign Spreads Agent Tesla

Making the decision to leave your current job and seek employment elsewhere can be an exciting time as you imagine how much better your life and career will be when you find that dream job. But that excitement can quickl...
New Voicemail-Themed Phishing Attacks Use Evasion Techniques and Steal Credentials
Security Insights
11 Min read

New Voicemail-Themed Phishing Attacks Use Evasion Techniques and Steal Credentials

In July 2020, researchers at ThreatLabZ observed an increase in the use of voicemail as a theme for social engineering attacks. Through the intelligence gathered from the Zscaler cloud, we discovered several newly regist...
The Return of the Higaisa APT
Security Insights
26 Min read

The Return of the Higaisa APT

Cybercriminals will often use LNK files attached in an email to launch an attack on unsuspecting victims. And we recently noticed another campaign using this technique. In May 2020, we observed several LNK files in th...
ShellReset RAT Spread Through Macro-Based Documents Using AppLocker Bypass
Security Insights
11 Min read

ShellReset RAT Spread Through Macro-Based Documents Using AppLocker Bypass

As we've mentioned in previous blogs, cybercriminals will often tie their attacks to current events. So, it isn't surprising that we noticed another one of these, with this particular one using tech events in London as t...
Targeted Attacks on Indian Government and Financial Institutions Using the JsOutProx RAT
Security Insights
11 Min read

Targeted Attacks on Indian Government and Financial Institutions Using the JsOutProx RAT

It is not uncommon for cybercriminals to target specific countries or regions. They often employ this strategy In April 2020, ThreatLabZ observed several instances of targeted attacks on Indian government establishmen...
Compromised WordPress Sites Used to Distribute the Adwind RAT
Security Insights
16 Min read

Compromised WordPress Sites Used to Distribute the Adwind RAT

With more than 60 million websites, including 33.4 percent of the top 10 million global websites, built on the WordPress platform, it is big news when a new attack aimed at this popular tool surfaces. And, as you can pro...
Multistage FreeDom Loader Used to Spread AZORult and NanoCore RAT
Security Insights
11 Min read

Multistage FreeDom Loader Used to Spread AZORult and NanoCore RAT

In March 2020, ThreatLabz observed several Microsoft Office PowerPoint files being used in the wild by a threat actor to spread AZORult and NanoCore RAT. The malicious files in this campaign used an interesting payload d...
Coronavirus-Themed Document Targets Brazilian Users
Security Insights
6 Min read

Coronavirus-Themed Document Targets Brazilian Users

During the ongoing COVID-19 outbreak, threat actors are leveraging different techniques to infect victims around the world. ThreatLabZ researchers came across an attack vector used in the wild on March 19 with a very ...

Related Articles

Explore More Topics