Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
Malware
Insights and Research
9 Min read

The Ares Banking Trojan Learns Old Tricks: Adds the Defunct Qakbot DGA

Summary: ThreatLabz observed an update to the Ares banking trojan that introduces a domain generation algorithm (DGA), which mirrors the Qakbot DGA. Based on analyzing the malware code, there does not appear to be a direct link between these two malware families. The Ares DGA may be an effort for the threat actor to maximize the lifetime of an infe...
Technical Analysis of Prynt Stealer/WorldWind/DarkEye Spiderman meme
Insights and Research
12 Min read

No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed

Stealing information is fundamental to cybercriminals today to scope and gain access to systems, profile organizations, and execute bigger payday schemes like ransomware. Information stealer malware families including Prynt Stealer are often configured through a builder to facilitate the process for less sophisticated threat actors. However, Zscale...
Infostealer malwares mimick pirated-software
Insights and Research
8 Min read

Making victims pay, infostealer malwares mimick pirated-software download sites

Summary: Threat actors distributing infostealers are gaining momentum by targeting victims seeking to illegally download pirated software. Because obtaining and using pirated software is against the law, many individuals partaking in this type of behavior suspend proper scrutiny for the source of their download. As a result, whether they are goo...
Banking Malware
Insights and Research
14 Min read

Grandoreiro Banking Trojan with New TTPs Targeting Various Industry Verticals

Introduction Recently Zscaler ThreatLabz observed a Grandoreiro campaign targeting organizations in the Spanish-speaking nations of Mexico and Spain that work across a variety of different industry verticals such as Automotive, Chemicals Manufacturing and others. In this campaign, the threat actors impersonate government officials from the Attor...
Gmail phishing attack
Insights and Research
6 Min read

AitM Phishing Attack Targeting Enterprise Users of Gmail

Summary This blog is a follow-up to our recent publication which described the details of a large-scale phishing campaign targeting enterprise users of Microsoft email services. Beginning in mid-July 2022, ThreatLabz started observing instances of adversary-in-the-middle (AitM) phishing attacks targeted towards enterprise users of Gmail. U...
An analysis and comparison study of X-files stealer variants.
Insights and Research
6 Min read

X-FILES Stealer Evolution - An Analysis and Comparison Study

Introduction Zscaler’s ThreatLabz threat research team recently has spotted a new variant of the emerging X-FILES infostealer attack with enhanced features to exfiltrate sensitive information. X-FILES is a stealer that aims to steal sensitive information, including logins and financial data. This blog will walk through the differences between...
AiTM Phishing attack
Insights and Research
20 Min read

Large-Scale AiTM Attack targeting enterprise users of Microsoft email services

Summary ThreatLabz has discovered a new strain of a large-scale phishing campaign, which uses adversary-in-the-middle (AiTM) techniques along with several evasion tactics. Similar AiTM phishing techniques were used in another phishing campaign described by Microsoft recently here. In June 2022, researchers at ThreatLabz observed an incr...
Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)
Insights and Research
3 Min read

Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)

In July 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed a vulnerability that is identified as CVE-2022-34233 discovered by the Zscaler ThreatLabz research team. In this blog, we present our analysis of CVE-2022-34233, ​​a Use-After-Free vulnerability in Adobe Acrobat and Reader. Vulne...
Ransomware
Ransomware
8 Min read

Technical Analysis of Industrial Spy Ransomware

Industrial Spy is a relatively new ransomware group that emerged in April 2022. In some instances, the threat group appears to only exfiltrate and ransom data, while in other cases they encrypt, exfiltrate and ransom data. Industrial Spy started as a data extortion marketplace where criminals could buy large companies' internal data; they promoted ...
insight and research
Insights and Research
9 Min read

Raccoon Stealer v2: The Latest Generation of the Raccoon Family

Introduction Raccoon is a malware family that has been sold as malware-as-a-service on underground forums since early 2019. In early July 2022, a new variant of this malware was released. The new variant, popularly known as Raccoon Stealer v2, is written in C unlike previous versions which were mainly written in C++. The Raccoon Malware is a ...

Explore More Topics