Zscaler Cloud Security Logo
Company > Blog

News and views from the leading voice in secure digital transformation

Hero Panel Image
Security Research
Advanced Persistent Threats
Insights and Research
15 Min read

Return of the Evilnum APT with updated TTPs and new targets

Summary Since the beginning of 2022, ThreatLabz has been closely monitoring the activities of the Evilnum APT group. We identified several instances of their low-volume targeted attack campaigns launched against our customers in the UK and Europe region. The new instances of the campaign use updated tactics, techniques, and procedures. In ear...
A digital cloud with a lock inside
Insights and Research
10 Min read

Uncovering and Remediating Cloud Risks with Posture Control

Introduction Cloud environments are becoming increasingly complex and challenging to manage from a security standpoint. In a cloud-native application infrastructure, “workloads” are built by developers using code (infrastructure as code, or IaC) and controlled by DevOps using automated “pipelines.” The new infrastructure is constantly evolving, ...
voicemail-themed phishing campaign steals Microsoft credentials
Insights and Research
4 Min read

Resurgence of Voicemail-themed Phishing Attacks Targeting Key Industry Verticals in US

Summary Since May 2022, ThreatLabz has been closely monitoring the activities of a threat actor which targets users in various US-based organizations with malicious voicemail-notification-themed emails in an attempt to steal their Office365 and Outlook credentials. The tactics, techniques, and procedures (TTPs) of this threat actor have a high o...
Technical Analysis of PureCrypter
Insights and Research
14 Min read

Technical Analysis of PureCrypter: A Fully-Functional Loader Distributing Remote Access Trojans and Information Stealers

Key points PureCrypter is a fully-featured loader being sold since at least March 2021 The malware has been observed distributing a variety of remote access trojans and information stealers The loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus softwar...
Lyceum .NET DNS Backdoor
Insights and Research
9 Min read

Lyceum .NET DNS Backdoor

Active since 2017, Lyceum group is a state-sponsored Iranian APT group that is known for targeting Middle Eastern organizations in the energy and telecommunication sectors and mostly relying on .NET based malwares. Zscaler ThreatLabz recently observed a new campaign where the Lyceum Group was utilizing a newly developed and customized .NET base...
Coverage Advisory for CVE-2022-30190
Insights and Research
3 Min read

Coverage Advisory for CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Background On May 27, 2022, nao_sec found a malicious Word document submitted to Virustotal from a Belarus IP address. The document was abusing MS-MSDT URI scheme to execute PowerShell within the context of Word bypassing local Office macro policies. Microsoft has since released protection guidance and assigned CVE-2022-30190 to this vulnerabili...
The 2022 ThreatLabz State of Ransomware Report
Ransomware
6 Min read

The 2022 ThreatLabz State of Ransomware Report

Ransomware attacks increased by yet another 80% between February 2021 and March 2022, based on an analysis of ransomware payloads seen across the Zscaler cloud. Double-extortion attacks, which include data exfiltration in addition to encryption, are rising even faster at 117% year-over-year. The 2022 ThreatLabz State of Ransomware report breaks ...
Browser-in-the Browser sextortion scam makes victims pay by imitating Indian Gov
Insights and Research
6 Min read

Browser-in-the Browser sextortion scam makes victims pay by imitating Indian Gov

Phishing has been a prominent cyber threat for decades, stealing the spotlight as the most prevalent attack vector for years, but the latest breed of attacks is more sophisticated and complicated to protect against than ever before. Attackers are always looking for new techniques to bypass security measures and remain undetected by victims. In the ...
cover image
Insights and Research
11 Min read

Vidar distributed through backdoored Windows 11 downloads and abusing Telegram

Summary In April 2022, ThreatLabz discovered several newly registered domains, which were created by a threat actor to spoof the official Microsoft Windows 11 OS download portal. We discovered these domains by monitoring suspicious traffic in our Zscaler cloud. The spoofed sites were created to distribute malicious ISO files which lead to a Vida...
Analysis of BlackByte Ransomware's Go-Based Variants
Ransomware
23 Min read

Analysis of BlackByte Ransomware's Go-Based Variants

Key Points BlackByte is a full-featured ransomware family that first emerged around July 2021 The ransomware was originally written in C# and later redeveloped in the Go programming language around September 2021 The threat group exfiltrates data prior to deploying ransomware and leaks the stolen information if a ransom is not paid The ...

Explore More Topics