Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
Agent Tesla
Insights and Research
15 Min read

Agent Tesla RAT Delivered by Quantum Builder With New TTPs

Zscaler ThreatLabz has observed a campaign that delivers Agent Tesla, a .NET based keylogger and remote access trojan (RAT) active since 2014, using a builder named “Quantum Builder” sold on the dark web. This campaign features enhancements and a shift toward LNK (Windows shortcut) files when compared to similar attacks in the past. Quantum Bui...
Technical Analysis of Crytox Ransomware
Insights and Research
9 Min read

Technical Analysis of Crytox Ransomware

Key points Crytox is a ransomware family consisting of several stages of encrypted code that was first observed in 2020 The ransomware encrypts local disks and network drives and leaves a ransom note with a five day ultimatum, but does not exfiltrate data from the victim Crytox drops the uTox messenger application on the infected system t...
Malware
Insights and Research
9 Min read

The Ares Banking Trojan Learns Old Tricks: Adds the Defunct Qakbot DGA

Summary: ThreatLabz observed an update to the Ares banking trojan that introduces a domain generation algorithm (DGA), which mirrors the Qakbot DGA. Based on analyzing the malware code, there does not appear to be a direct link between these two malware families. The Ares DGA may be an effort for the threat actor to maximize the lifetime of an infe...
Technical Analysis of Prynt Stealer/WorldWind/DarkEye Spiderman meme
Insights and Research
12 Min read

No Honor Among Thieves - Prynt Stealer’s Backdoor Exposed

Stealing information is fundamental to cybercriminals today to scope and gain access to systems, profile organizations, and execute bigger payday schemes like ransomware. Information stealer malware families including Prynt Stealer are often configured through a builder to facilitate the process for less sophisticated threat actors. However, Zscale...
Infostealer malwares mimick pirated-software
Insights and Research
8 Min read

Making victims pay, infostealer malwares mimick pirated-software download sites

Summary: Threat actors distributing infostealers are gaining momentum by targeting victims seeking to illegally download pirated software. Because obtaining and using pirated software is against the law, many individuals partaking in this type of behavior suspend proper scrutiny for the source of their download. As a result, whether they are goo...
Banking Malware
Insights and Research
14 Min read

Grandoreiro Banking Trojan with New TTPs Targeting Various Industry Verticals

Introduction Recently Zscaler ThreatLabz observed a Grandoreiro campaign targeting organizations in the Spanish-speaking nations of Mexico and Spain that work across a variety of different industry verticals such as Automotive, Chemicals Manufacturing and others. In this campaign, the threat actors impersonate government officials from the Attor...
Gmail phishing attack
Insights and Research
6 Min read

AitM Phishing Attack Targeting Enterprise Users of Gmail

Summary This blog is a follow-up to our recent publication which described the details of a large-scale phishing campaign targeting enterprise users of Microsoft email services. Beginning in mid-July 2022, ThreatLabz started observing instances of adversary-in-the-middle (AitM) phishing attacks targeted towards enterprise users of Gmail. U...
An analysis and comparison study of X-files stealer variants.
Insights and Research
6 Min read

X-FILES Stealer Evolution - An Analysis and Comparison Study

Introduction Zscaler’s ThreatLabz threat research team recently has spotted a new variant of the emerging X-FILES infostealer attack with enhanced features to exfiltrate sensitive information. X-FILES is a stealer that aims to steal sensitive information, including logins and financial data. This blog will walk through the differences between...
AiTM Phishing attack
Insights and Research
20 Min read

Large-Scale AiTM Attack targeting enterprise users of Microsoft email services

Summary ThreatLabz has discovered a new strain of a large-scale phishing campaign, which uses adversary-in-the-middle (AiTM) techniques along with several evasion tactics. Similar AiTM phishing techniques were used in another phishing campaign described by Microsoft recently here. In June 2022, researchers at ThreatLabz observed an incr...
Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)
Insights and Research
3 Min read

Analysis of Adobe Acrobat Reader Javascript Doc.print() Use-After-Free Vulnerability (CVE-2022-34233)

In July 2022, Adobe released a security update for vulnerabilities in Adobe Acrobat and Reader. The update fixed a vulnerability that is identified as CVE-2022-34233 discovered by the Zscaler ThreatLabz research team. In this blog, we present our analysis of CVE-2022-34233, ​​a Use-After-Free vulnerability in Adobe Acrobat and Reader. Vulne...

Explore More Topics