Blog

ISO 27002 puts Threat Intelligence center stage

02.Dec.2022

The updated ISO 27002 adds 11 new controls spanning a range of security services, including the addition of threat intelligence control 5.7.

Threat Actor of the Month - Sodinokibi

16.Nov.2022

Meet "Sodinokibi" this month, the threat group behind the eponymous Sodinokibi ransomware, also known as “REvil”, to understand their tactics and how you can better secure your system from this threat

Threat Actor of the Month - Guacamaya

17.Oct.2022

Meet Guacamaya – a hacktivist group advocating for the indigenous people of Central America

Introducing GraceWrapper, TA505’s sophisticated post-exploitation enabler

12.Oct.2022

David Catalán, Senior Reverse Engineer, Outpost24

Since its inception almost a decade ago and the MirrorBlast campaign, the threat actor group known as TA505 has continued to plague the financial, retail and restaurant sectors. Learn more about the GraceWrapper post-exploitation enabler and how its detection evasion technique works

Threat Actor of the Month - Shathak

19.Sep.2022

Meet Shathak – a threat group tied to malware used in the Russian-speaking underground targeting enterprises across different sectors in the Americas, Europe and Asia

How Hive becomes one of the most dangerous ransomware group

25.Aug.2022

Jose Miguel Esparza, Head of Threat Intelligence

The Hive Gang is a Ransomware as a Service (RaaS) providers first identified in June 2021. Although relatively new, their aggressive tactics and ever evolving malware variants have made them one of the most successful RaaS groups of its kind. Find out how the group has risen through the ranks with their advanced ransomware kit, API based portal and negotiation services.

Threat Actor of the Month - GhostSec

12.Aug.2022

This month we’re introducing you to GhostSec, a threat group with ties to the Anonymous collective, and their shift from hacktivist to financially motivated hacking activities

Ransomware as a Service: Behind the Scenes

08.Jul.2022

Jose Miguel Esparza, Head of Threat Intelligence

Ransomware attack is growing at an alarming rate thanks to Ransomware as a Service (RaaS) operations. Read this blog and learn what is RaaS and how the threat actors operate these attacks to help you understand why ransomware attribution is an industry problem, and the preemptive measures you need to take to protect your organization.

A History of Ransomware

13.Jun.2022

Jose Miguel Esparza, Head of Threat Intelligence

Ransomware is the biggest cyber threat to businesses. First burst onto the scene in 1989, it has evolved significantly over the past few years from widespread attacks to highly targeted ransomware-as-a-service (RaaS) operations affecting organizations of all sizes and sectors. This article takes a look at the evolution of the ransomware ecosystem – what it looks like today, and how it has changed over time.

Possible Link Between Jester Stealer and Eternity Stealer

08.Jun.2022

Jester stealer is an information stealer that has been around since mid-July 2021. Originally sold by the Russian speaking threat group "Jester_Stealer", in several underground forums and Telegram channels, they operate under a Malware-as-a-Service (MaaS) model and present themselves as a group of programmers. Here we delved into the Jester stealer functionalities with a code-level analysis and highlight the possible link between Jester stealer and the new breed of Eternity stealer.