Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
cover image
Threatlabz Research
21 Min read

The Unintentional Leak: A glimpse into the attack vectors of APT37

Summary At Zscaler ThreatLabz, we have been closely monitoring the tools, techniques and procedures (TTPs) of APT37 (also known as ScarCruft or Temp.Reaper) - a North Korea-based advanced persistent threat actor. This threat actor has been very active in February and March 2023 targeting individuals in various South Korean organizations. Duri...
Coverage advisory for CVE-2023-23397
Security Insights
2 Min read

Coverage Advisory for CVE-2023-23397: Microsoft Outlook Elevation of Privilege Vulnerability

Background: On 14th March 2023, Microsoft released a security update guide for a critical severity vulnerability CVE-2023-23397. This vulnerability targets Microsoft Outlook and allows NTLM credentials theft which could be used for privilege escalation attacks. What is the issue? An attacker can send an email to the victim with an extended...
Nevada ransomware
Ransomware
6 Min read

Nevada Ransomware: Yet Another Nokayawa Variant

Key Points Nevada ransomware was advertised in criminal forums in December 2022 as part of a new ransomware-as-a-service affiliate program Nevada is written in the Rust programming language with support for Linux and 64-bit versions of Windows Zscaler ThreatLabz has identified significant code similarities between Nevada and Nokoyawa ran...
OneNote Malware Campaign
Security Insights
11 Min read

OneNote: A Growing Threat for Malware Distribution

Attackers are increasingly using OneNote documents to distribute malware, due to the heightened security measures against macro-based attacks and the widespread adoption and popularity of the platform. Analyzing several related case studies, this article showcases the obfuscation techniques used by threat actors to bypass threat detection measures ...
Snip3 Crypter
Security Insights
19 Min read

Snip3 Crypter Reveals New TTPs Over Time

Zscaler ThreatLabz researchers observed multiple threat campaigns utilizing the Snip3 crypter, a multi-stage remote access trojan (RAT) loader with new TTPs and available since 2021 as a crypter-as-a-service offering. The Snip3 Crypter service uses advanced evasion, obfuscation, and reflective code loading techniques in its multi-stage infection...
Technical Analysis of Rhadamanthys Obfuscation Techniques
Security Insights
8 Min read

Technical Analysis of Rhadamanthys Obfuscation Techniques

Key Points Rhadamanthys is an information stealer that consists of two components, the loader and the main module (responsible for exfiltrating collected credentials). The malware implements complex anti-analysis techniques by using a public open source library. Rhadamanthys is capable of extracting credentials of various applications suc...
ThreatLabz 2022 Cloud Security Report exposes your risk.
Security Insights
10 Min read

2022 Cloud (In)Security Report

The convenience and ease of public cloud technology have changed our world, enabling scalable business operations, work-from-anywhere, and increased productivity everywhere. As public cloud adoption continues to accelerate, organizations need to hold up their end of the shared responsibility model to protect against cloud security threats. Meanwhil...
Havoc Across the Cyberspace
Security Insights
13 Min read

Havoc Across the Cyberspace

Zscaler ThreatLabz research team observed a new campaign targeting a Government organization in which the threat actors utilized a new Command & Control (C2) framework named Havoc. While C2 frameworks are prolific, the open-source Havoc framework is an advanced post-exploitation command and control framework capable of bypassing the most curren...
Dynamic Approaches seen in AveMaria's Distribution Strategy
Security Insights
14 Min read

Dynamic Approaches seen in AveMaria's Distribution Strategy

Zscaler’s ThreatLabz research team diligently monitors and tracks active threat campaigns globally to rapidly detect new developments and proactively safeguard Zscaler customers. The seven case studies that follow provide an in-depth analysis of the AveMaria infostealer attack chain and how it has been shifting over the past six months. Key...
Job scams impersonate companies still hiring following tech layoffs
Security Insights
5 Min read

Job scams impersonate companies still hiring following tech layoffs

Summary In the midst of significant layoffs hitting the previously immune tech industry, scammers have mobilized and doubled down on targeting job seekers with various employment scams. Stealing personal information and extorting victims for money, these scams leverage fake job postings, sites or portals, and forms, wrapped in social engineering...

Explore More Topics