Web Shells, Tunnels, and Ransomware: Dissecting a Warlock Attack
Following initial access, the threat actors conducted extensive lateral movement using a combination of legitimate administration tools and credential abuse....
initial
Initial access techniques used by Iran-based threat actors
Iranian‑linked threat groups often use a core set of initial access methods. The threat actors favor cost-effective, repeatable intrusion techniques...
Creating unstructured data pipelines for retrieval augmented generation
Our initial release of Tonic Textual focused on generating redacted versions of unstructured text and image files. This is...
Master XDR Investigations: A Deep Dive into the GravityZone XDR Demo Incident
An attacker’s initial access, whether through phishing, unmanaged devices, exploited vulnerabilities, or a compromised supply chain, marks the beginning...
TA584 threat actor leverages Tsundere Bot and XWorm for network access
A prolific initial access broker, identified as TA584, has been observed employing the Tsundere Bot in conjunction with the XWorm...
