Cluster25 analyzed a recent attack linked to the North Korean APT group “Konni” targeting Russian diplomatic sector using a spear phishing theme for New Year’s Eve festivities as lure. Once the malicious email attachment is opened and executed, a chain composed by multiple stages is triggered, allowing actor to install ...
Dharma, a family of ransomware first spotted in 2016, is a malicious program that encrypts a victim’s files and takes as hostage the data on demand for the ransom payment to restore the data back. It belongs to a fairly widespread ransomware family that has been successful over time, especially ...
Recent geopolitical events are leading to an increase in cyber operations in the Central Asian region. Among the actors involved in these activities there are certainly those believed to be close to the Indian government, such as RattleSnake. It is probably currently engaged in supporting a policy of raising the ...
This paper presents an analysis of a new and never publicly reported malware internally dubbed as SkinnyBoy. Based on long-term observations and technical evidences, Cluster25 cyber intelligence research team associates this implant, with medium-high degree of confidence, with the threat actor known as APT28 / Fancy Bear / Pawn Storm. ...
This is the welcome post for Cluster25 threat intelligence research blog. Through this space, the team will share analysis and evidence relating to internal global threat hunting activities. Happy reading!
