Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
Analysis of Xloader’s C2 Network Encryption
Insights and Research
8 Min read

Analysis of Xloader’s C2 Network Encryption

Introduction Xloader is an information stealing malware that is the successor to Formbook, which had been sold in hacking forums since early 2016. In October 2020, Formbook was rebranded as Xloader and some significant improvements were introduced, especially related to the command and control (C2) network encryption. With the arrival of Xloader...
Advanced Persistent Threats
Insights and Research
13 Min read

New espionage attack by Molerats APT targeting users in the Middle East

Introduction In December 2021, the ThreatLabz research team identified several macro-based MS office files uploaded from Middle Eastern countries such as Jordan to OSINT sources such as VT. These files contained decoy themes related to geo-political conflicts between Israel and Palestine. Such themes have been used in previous attack campaigns w...
Three Cybersecurity Tips for a Safe and Happy Holiday
Insights and Research
2 Min read

Three Cybersecurity Tips for a Safe and Happy Holiday

Security researchers have long marveled at one of the most pervasive and persistent threats that hits each year in late December. Dubbed “Santa Claus,” this North Pole-based adversary uses a Chimney loader to deposit a payload named “presents.exe” before erasing any cookies from the system. Santa Claus is known to target home networks with young en...
Cybersecurity Lessons to Carry Into 2022
Insights and Research
4 Min read

Cybersecurity Lessons to Carry Into 2022

The end of the year is a time for reflection. In the world of cybersecurity, that means looking back at how the threat landscape has evolved and what changes we can make to better prepare for the year ahead. ThreatLabz monitors security trends every single day, and publishes research throughout the year in addition to using it to continuously impro...
What We’ve Learned About the Log4j Vulnerability
Insights and Research
5 Min read

Weekly Roundup: What We’ve Learned About the Log4j Vulnerability

ON-DEMAND: Hear from our CISO, Deepen Desai, and Sr. Product Director, Rick Miles, as they discuss Log4Shell and steps your organization should take. It’s been a long week for IT and security professionals as we’ve peeled back the layers of impact resulting from the Log4j vulnerability CVE-2021-44228, dubbed “Log4Shell.” This vulnerability has ...
Cover Image
Insights and Research
7 Min read

New DarkHotel APT attack chain identified

Summary In November 2021, ThreatLabz identified a previously undocumented variant of an attack chain used by the South Korea-based Dark Hotel APT group. We also discovered new activity on the command-and-control (C2) infrastructure previously associated with this APT group. The new activity on their infrastructure aligns with the type of targets...
ThreatLabz analysis - Log4Shell CVE-2021-44228 Exploit Attempts
Insights and Research
6 Min read

ThreatLabz analysis - Log4Shell CVE-2021-44228 Exploit Attempts

The Zscaler ThreatLabz team has been actively monitoring exploit attempts related to the Apache Log4j 0-day Remote Code Execution Vulnerability (CVE-2021-44228), also known as “Log4Shell.” In this blog we will share our analysis of the exploit payloads being delivered using this vulnerability. We will continue to update this blog and share more ...
A fingerprint and a keyboard
Insights and Research
4 Min read

Neutralizing Apache Log4j Exploits with Identity-Based Segmentation

On December 11, Zscaler’s TheatLabz observed exploit attempts of the Log4j in the wild, analyzed the vulnerability, and recommended protection strategies. Read the blogs here and here. Among the recommendations to mitigate the impact of the vulnerability was to apply app-to-app microsegmentation using identity. This post explains why identity-based...
Return of Emotet: Malware Analysis
Insights and Research
9 Min read

Return of Emotet: Malware Analysis

Key Points Emotet is a downloader malware used to download and execute additional modules and payloads. In January 2021, a law enforcement action disrupted the malware, its infrastructure, and some of its threat actors. After almost a year-long hiatus, Emotet returned to the threat landscape in November 2021. Emotet modules focus on cre...
CVE-2021-44228 log4j2 Remote Code Execution (RCE) Vulnerability
Insights and Research
3 Min read

Security Advisory: Log4j 0-day Remote Code Execution Vulnerability (CVE-2021-44228)

Background The Apache Software Foundation has released a security advisory with patch and mitigation details to address a remote code execution vulnerability (CVE-2021-44228) affecting Log4j versions 2.0-beta9 to 2.14.1. Over the past 24 hours, Zscaler ThreatlabZ has noticed several in-the-wild exploit attempts of this issue and expect this trend ...

Explore More Topics