Since at least 2022, the hacking collective tracked as UAC-0024 has been launching a series of offensive operations targeting Ukraine’s defense forces. The group’s cyber-espionage activity mainly focuses on intelligence gathering leveraging CAPIBAR malware. Based on attacker TTPs along with the uncovered use of another malware dubbed Kazuar, the adversary activity can be linked to […]

The post CAPIBAR and KAZUAR Malware Detection: Turla aka UAC-0024 or UAC-0003 Launches Targeted Cyber-Espionage Campaigns Against Ukraine appeared first on SOC Prime.

LOLBins, also known as “Living off the Land Binaries,” are binaries that use legitimate commands and pre-installed executables of the operating system to perform malicious activities. LOLBins use local system binaries to bypass detection, deliver malware, and remain undetected. When leveraging LOLBins, adversaries can improve their chances of staying unnoticed by using legitimate cloud services […]

The post What Are LOLBins? appeared first on SOC Prime.

Since russia’s full-fledged invasion of Ukraine, the aggressor’s offensive forces have launched thousands of targeted cyber attacks against Ukraine. One of the most persistent threats belongs to the infamous cyber-espionage gang tracked as UAC-0010 (Armageddon). This article provides an overview of the group’s adversary activity against Ukraine largely exploiting the phishing attack vector as of […]

The post UAC-0010 aka Armageddon APT Attacks Detection: Overview of Group’s Ongoing Offensive Operations Targeting Ukraine appeared first on SOC Prime.

Threat detection engineering (DE) is more complex than it might seem initially. It goes far beyond the detection of events or abnormal activities. The DE process includes detecting states and conditions, which is often more applicable to incident response or digital forensics. As Florian Roth mentions in his blog, the definition of detection engineering “should […]

The post What Is Detection Engineering? appeared first on SOC Prime.

Heads up! Cyber defenders are notified of a new wave of phishing attacks leveraging the invoice-relate email subjects with the infection chain triggered by opening a malicious VBS file, which leads to spreading SmokeLoader malware on the affected devices. According to the investigation, the malicious activity can be attributed to the financially-motivated UAC-0006 hacking gang […]

The post SmokeLoader Detection: UAC-0006 Group Launches a New Phishing Campaign Against Ukraine appeared first on SOC Prime.

Cybersecurity researchers have unveiled a new offensive operation launched by the russia-backed Storm-0978 aka DEV-0978 group, which is also tracked as RomCom based on the name of the nefarious backdoor they are associated with. In this campaign, hackers are targeting defense organizations and public authorities in Europe and North America leveraging the phishing attack vector […]

The post Storm-0978 Attacks Detection: russia-linked Hackers Exploit CVE-2023-36884 to Spread a Backdoor Targeting Defense and Public Sector Organizations  appeared first on SOC Prime.

Cybersecurity researchers have uncovered traces of new malicious activity attributed to the nefarious BlackCat aka ALPHV ransomware gang. The adversary campaign involves the distribution of malware via cloned webpages of legitimate companies, including the webpage of a popular WinSCP file-transferring service. BlackCat is also observed using SpyBoy Terminator for its offensive purposes to hinder anti-malware […]

The post BlackCat aka ALPHV Attack Detection: Hackers Abuse Malvertising to Spread Malware and Leverage SpyBoy Terminator to Hinder Security Protection appeared first on SOC Prime.

Cybersecurity researchers issue a heads-up covering a new targeted cyber attack by the UAC-0057 group against Ukrainian public officials leveraging XLS files that contain a malicious macro spreading PicassoLoader malware. The malicious loader is capable of dropping another malicious strain dubbed njRAT to spread the infection further. PicassoLoader and njRAT Malware Distribution by UAC-0057 Hackers: […]

The post PicassoLoader and njRAT Detection: UAC-0057 Hackers Perform a Targeted Attack Against Ukrainian Public Entities appeared first on SOC Prime.

CERT-UA researchers recently uncovered a fraudulent copy of the English-language version of the Ukrainian World Congress website at https://www.ukrainianworldcongress.org/. The fake web resource contains a couple of DOCX documents that trigger an infection chain once opened. As a result of the attack chain, hackers can deploy MAGICSPELL payload intended to download, decipher, and maintain the […]

The post MAGICSPELL Malware Detection: UAC-0168 Hackers Launch a Targeted Attack Using the Subject of Ukraine’s NATO Membership as a Phishing Lure  appeared first on SOC Prime.

Quantum ransomware, a strain that has garnered significant attention since its discovery in July 2021, has proven to be an especially malicious and rapidly evolving form of ransomware. As cybersecurity professionals strive to stay one step ahead of cybercriminals, understanding the intricacies and potential impact of Quantum ransomware becomes imperative. It is a sub-variant of […]

The post What is Quantum Ransomware? appeared first on SOC Prime.