Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
cover image
Insights and Research
11 Min read

Vidar distributed through backdoored Windows 11 downloads and abusing Telegram

Summary In April 2022, ThreatLabz discovered several newly registered domains, which were created by a threat actor to spoof the official Microsoft Windows 11 OS download portal. We discovered these domains by monitoring suspicious traffic in our Zscaler cloud. The spoofed sites were created to distribute malicious ISO files which lead to a Vida...
Analysis of BlackByte Ransomware's Go-Based Variants
Ransomware
23 Min read

Analysis of BlackByte Ransomware's Go-Based Variants

Key Points BlackByte is a full-featured ransomware family that first emerged around July 2021 The ransomware was originally written in C# and later redeveloped in the Go programming language around September 2021 The threat group exfiltrates data prior to deploying ransomware and leaks the stolen information if a ransom is not paid The ...
Cyber honeycomb containing locks.
Insights and Research
7 Min read

Peeking into PrivateLoader

Key Points PrivateLoader is a downloader malware family that was first identified in early 2021 The loader’s primary purpose is to download and execute additional malware as part of a pay-per-install (PPI) malware distribution service PrivateLoader is used by multiple threat actors to distribute ransomware, information stealers, banking t...
Thailand pass delivers AsyncRAT campaign
Insights and Research
8 Min read

Targeted attack on Thailand Pass customers delivers AsyncRAT

The Zscaler ThreatLabz research team has recently discovered a malware campaign targeting users applying for Thailand travel passes. The end payload of many of these attacks is AsyncRAT, a Remote Access Trojan that can be used to monitor, control, and steal sensitive data from victims' machines. Thailand Pass is an online travel agency that brok...
Advanced Persistent Threats
Insights and Research
10 Min read

A "Naver"-ending game of Lazarus APT

Zscaler’s ThreatLabz research team has been closely monitoring a campaign targeting users in South Korea. This threat actor has been active for more than a year and continues to evolve its tactics, techniques, and procedures (TTPs); we believe with high confidence that the threat actor is associated with Lazarus Group, a sophisticated North Korean...
Zscaler ThreatLabz Discovers Multiple Product Bugs in Adobe Acrobat
Insights and Research
3 Min read

Zscaler ThreatLabz Discovers Multiple Product Bugs in Adobe Acrobat

In April 2022, Adobe released security update APSB22-16. This update fixed five product bugs that Zscaler’s ThreatLabz reported in Adobe Acrobat that are related to EMF (Enhanced Metafile Format) parsing. Adobe determined that Acrobat is secure by default for converting EMF to PDF. Specifically, abuse requires administrative privileges to modify th...
2022 ThreatLabz Phishing Report
Insights and Research
6 Min read

Uncovering new techniques and phishing attack trends from the cloud

Download your free copy of the 2022 ThreatLabz Phishing Report, and check out our infographic. For decades, phishing has been a complex and time-consuming challenge for every security team. As the findings of the ThreatLabz 2022 Phishing Report reveal, the challenge is getting harder: adversaries are getting craftier, and attackers are growing i...
Stealer Targeting Social Media Platform Users
Insights and Research
12 Min read

FFDroider Stealer Targeting Social Media Platform Users

Introduction Credential stealing malware is commonly observed in the landscape of cyber attacks today. Zscaler ThreatLabz team has discovered many new types of stealer malwares across different attack campaigns. Stealers are malicious programs that threat actors use to collect sensitive information with various techniques including keylogging, c...
Spring Cloud Framework Vulnerabilities
Insights and Research
5 Min read

Analysis of Spring Cloud Framework Vulnerabilities

Background: Over the past few days, the Zscaler ThreatLabz team has been closely monitoring the reports of potential RCEs in Spring Cloud Framework and Spring Cloud Function. Spring is an open-source lightweight Java platform which many developers use as their application development framework. As part of the Spring echo system, Spring Cloud ...
BlackGuard Stealer
Insights and Research
5 Min read

Analysis of BlackGuard - A New Info Stealer Malware Being Sold In A Russian Hacking Forum

Introduction: Hacking forums often double up as underground marketplaces where cybercriminals buy, rent, and sell all kinds of malicious illegal products, including software, trojans, stealers, exploits, and leaked credentials. Malware-as-a-service has contributed substantially to the growth of ransomware and phishing attacks (among other attack...

Explore More Topics