Threat Research Archives

Securonix-Threat-Research-Report-Detecting-LockerGoga_Page_01

Securonix Threat Research Report: Detecting LockerGoga Targeted IT/OT Cyber Sabotage/Ransomware Attacks

The Securonix Threat Research Team has been closely monitoring the LockerGoga targeted cyber sabotage/ransomware (TC/R) attacks impacting Norsk Hydro (one of the largest aluminum companies worldwide), Hexion/Momentive (a chemical manufacturer), and other companies’ IT and operational technology (OT) infrastructure, causing...

Securonix_Threat_Research_Moanacroner_XBash_Page_01

Securonix Threat Research Report: Detecting Persistent Cloud Infrastructure/Hadoop/YARN Attacks Using Security Analytics: Moanacroner, XBash

In recent months, we have been observing an increase in the number of automated attacks targeting exposed cloud infrastructure/Hadoop/YARN instances. Some of the attacks we have been seeing – for example, Moanacroner (a variant of Sustes) – are fairly trivial,...

Securonix Threat Research Report: British Airways Breach: Magecart Formgrabbing Supply Chain Attack Detection

The data breach suffered by British Airways earlier this year affected around 380,000 customers and resulted in the theft of customer data including personal and financial details. The attack was highly targeted and utilized customized JavaScript/digital card skimmers loaded from...

Securonix Threat Research Report: KRONOS/Osiris Banking Trojan Attack

The KRONOS malware was first discovered in June 2014 as a Banker Trojan available for purchase in a Russian underground forum for $7,000. After staying dormant for few years, a new variant of KRONOS, known as Osiris, was discovered in...

Securonix-Threat-Research-Cosmos-Bank-Report_Page_01

Securonix Threat Research Report: Cosmos Bank SWIFT/ATM US$13.5 Million Cyber Attack Detection Using Security Analytics

The Securonix Threat Research team recently learned of a new high-profile cyber attack targeting SWIFT/ATM infrastructure of Cosmos Bank (COSDINBB), a 112-year old cooperative bank in India and the second largest in the country, resulting in over US$13.5 million stolen.

Securonix Threat Research Report: GandCrab Ransomware Attack

The GandCrab ransomware attacks are some of the most prevalent ransomware threats of 2018. In recent months, the GandCrab attackers were able to infect more than 50,000 victims and generate more than $600,000 in ransom payments from victims. Securonix Threat...

Securonix Threat Research Report: Cryptojacking Attacks

Cryptojacking is the unauthorized use of someone else’s computer to secretly mine cryptocurrency (also known as virtual or digital currency). According to a recent report from Fortinet, Cryptojacking attacks impacted over 28 percent of companies this year, a spike representing...

Securonix Threat Research: SamSam Ransomware Detection Using Security Analytics

SamSam is a prevalent ransomware that has been observed across multiple industries including healthcare, government, and critical infrastructure/ industrial control systems (ICS) in 2016, 2017, and 2018. In March, the ransomware targeted five of the Atlanta’s thirteen local government departments...

Securonix Threat Research: Olympic Destroyer aka NotPetya v2 “False Flag” Cyber Sabotage Attack Detection Using Security Analytics

Last month, we learned of a new cyber attack against the 2018 Winter Olympic Games in South Korea. Securonix Threat Research Team has been actively investigating and monitoring this attack since the attack was reported to help our customers understand...

Securonix Threat Research: Spectre and Meltdown Vulnerabilities

Securonix Threat Research Team (STR) has been actively investigating the details of the Spectre and Meltdown Side-Channel Information Disclosure Vulnerabilities since last week to help our customers mitigate/respond to the vulnerabilities.

Securonix Threat Research: Uber Hack: Software Code Repository/VCS Leaked Credential Usage Detection

Just about a week ago we learned of a new cyber attack, this time involving Uber–the leading ride-sharing app and company. Uber disclosed that it paid hackers $100,000 so that they would delete sensitive data stolen from Uber data stores....

Securonix Threat Research: Detecting Bad Rabbit Cyber Attack Using Security Analytics

On October 24, 2017, we learned of a new cyber attack involving the Bad Rabbit ransomware malicious implant (MI)/threat instance. Securonix Threat Research Team has been actively investigating and closely monitoring this attack since the attack was launched to help...

Threat Research