Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
3CX supply chain attack
Security Insights
2 Min read

Coverage Advisory for 3CX Supply Chain Attack

Background: On 30th March 2023, 3CX released a security alert for 3CX Electron Windows App shipped in Update 7, which informed users about a supply chain attack. The issue has affected the executables for both Windows and Mac operating systems. What is the issue? The impacted 3CX Electron Desktop App was bundled with an infected library ...
Technical Analysis of Xloader’s Code Obfuscation in Version 4.3
Threatlabz Research
14 Min read

Technical Analysis of Xloader’s Code Obfuscation in Version 4.3

Key Points Xloader is a popular information stealing malware family that is the successor to Formbook. In early 2020, Formbook was rebranded as Xloader and the threat actors moved to a malware-as-a-service (MaaS) business model, renting C2 infrastructure to customers. Xloader implements different obfuscation methods and several encryption...
DBatLoader: Actively Distributing Malwares Targeting European Businesses
Security Insights
13 Min read

DBatLoader: Actively Distributing Malwares Targeting European Businesses

This Zscaler ThreatLabz research article investigates the latest malware campaign of DBatLoader, which is being used by threat actors to target various businesses in European countries with Remcos RAT and Formbook. The article provides a detailed analysis of DBatLoader's behavior and its attack process, which includes creating a mock trusted direct...
cover image
Threatlabz Research
21 Min read

The Unintentional Leak: A glimpse into the attack vectors of APT37

Summary At Zscaler ThreatLabz, we have been closely monitoring the tools, techniques and procedures (TTPs) of APT37 (also known as ScarCruft or Temp.Reaper) - a North Korea-based advanced persistent threat actor. This threat actor has been very active in February and March 2023 targeting individuals in various South Korean organizations. Duri...
Coverage advisory for CVE-2023-23397
Security Insights
2 Min read

Coverage Advisory for CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability

Background: On 14th March 2023, Microsoft released a security update guide for a critical severity vulnerability CVE-2023-23397. This vulnerability targets Microsoft Outlook and allows NTLM credentials theft which could be used for privilege escalation attacks. What is the issue? An attacker can send an email to the victim with an extended...
Nevada ransomware
Ransomware
6 Min read

Nevada Ransomware: Yet Another Nokayawa Variant

Key Points Nevada ransomware was advertised in criminal forums in December 2022 as part of a new ransomware-as-a-service affiliate program Nevada is written in the Rust programming language with support for Linux and 64-bit versions of Windows Zscaler ThreatLabz has identified significant code similarities between Nevada and Nokoyawa ran...
OneNote Malware Campaign
Security Insights
11 Min read

OneNote: A Growing Threat for Malware Distribution

Attackers are increasingly using OneNote documents to distribute malware, due to the heightened security measures against macro-based attacks and the widespread adoption and popularity of the platform. Analyzing several related case studies, this article showcases the obfuscation techniques used by threat actors to bypass threat detection measures ...
Snip3 Crypter
Security Insights
19 Min read

Snip3 Crypter Reveals New TTPs Over Time

Zscaler ThreatLabz researchers observed multiple threat campaigns utilizing the Snip3 crypter, a multi-stage remote access trojan (RAT) loader with new TTPs and available since 2021 as a crypter-as-a-service offering. The Snip3 Crypter service uses advanced evasion, obfuscation, and reflective code loading techniques in its multi-stage infection...
Technical Analysis of Rhadamanthys Obfuscation Techniques
Security Insights
8 Min read

Technical Analysis of Rhadamanthys Obfuscation Techniques

Key Points Rhadamanthys is an information stealer that consists of two components, the loader and the main module (responsible for exfiltrating collected credentials). The malware implements complex anti-analysis techniques by using a public open source library. Rhadamanthys is capable of extracting credentials of various applications suc...
ThreatLabz 2022 Cloud Security Report exposes your risk.
Security Insights
10 Min read

2022 Cloud (In)Security Report

The convenience and ease of public cloud technology have changed our world, enabling scalable business operations, work-from-anywhere, and increased productivity everywhere. As public cloud adoption continues to accelerate, organizations need to hold up their end of the shared responsibility model to protect against cloud security threats. Meanwhil...

Explore More Topics