Dragon News Blog

Sep 5, 20225 min read

Mythic Case Study: Assessing Common Offensive Security Tools

Having covered the Sliver C2 framework in a previous post, this blog will continue our examination of Cobalt Strike “alternatives”,...

An Analysis of Infrastructure linked to the Hagga Threat Actor

tcblogposts

Jul 12, 20226 min read

An Analysis of Infrastructure linked to the Hagga Threat Actor

Summary As this research reveals, mapping out adversary infrastructure has distinct advantages that enable a proactive response to future...

The Sliding Scale of Threat Actor Sophistication When Reacting to 0-day Vulnerabilities

S2 Research Team

Jun 29, 20225 min read

The Sliding Scale of Threat Actor Sophistication When Reacting to 0-day Vulnerabilities

Threat Telemetry Analysis for the Disclosure of CVE-2022-26134 SUMMARY Team Cymru’s S2 Research Team has highlighted why it is important...

Bablosoft; Lowering the Barrier of Entry for Malicious Actors

S2 Research Team

May 25, 20224 min read

Bablosoft; Lowering the Barrier of Entry for Malicious Actors

Free-to-use browser automation framework creates thriving criminal community Summary Evidence suggests an increasing number of threat...

Sliver Case Study: Assessing Common Offensive Security Tools

S2 Research Team

May 3, 20226 min read

Sliver Case Study: Assessing Common Offensive Security Tools

The Use of the Sliver C2 Framework for Malicious Purposes The proliferation of Cobalt Strike during the early 2020s has been undeniable,...

MoqHao Part 2: Continued European Expansion

S2 Research Team

Apr 7, 20224 min read

MoqHao Part 2: Continued European Expansion

Monitoring Roaming Mantis Operations with Pure Signal™ Recon This blog is a product of ongoing collaboration with @ninoseki, a...

Raccoon Stealer – An Insight into Victim “Gates”

S2 Research Team

Mar 23, 20224 min read

Raccoon Stealer – An Insight into Victim “Gates”

Tracking Infostealers with Team Cymru's Botnet Analysis and Reporting Service (BARS) Raccoon Stealer is one of 40-plus malware families...

Insights into North Korean ‘Internet Outages’

S2 Research Team

Feb 3, 20224 min read

Insights into North Korean ‘Internet Outages’

About Team Cymru Internet weather reports: Our Internet weather reports are intended to provide data and technical analysis of...

Analysis of a Management IP Address linked to Molerats APT

S2 Research Team

Jan 26, 20224 min read

Analysis of a Management IP Address linked to Molerats APT

Enrichment of Zscaler Research into Middle Eastern Espionage Attacks Key Findings Higher order infrastructure, utilizing IP addresses...

Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns

S2 Research Team

Nov 3, 20214 min read

Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns

A Case Study on the Value of Threat Reconnaisance The contents of this blog were shared with Team Cymru’s community partners in the first...

Collaborative Research on the CONTI Ransomware Group

S2 Research Team

Oct 5, 20211 min read

Collaborative Research on the CONTI Ransomware Group

An Insight into the 'Customer' Negotiation Process and Some Lessons Learnt Ransomware remains one of the pre-eminent cyber threats, with...

MoqHao Part 1.5: High-Level Trends of Recent Campaigns Targeting Japan

S2 Research Team

Aug 11, 20214 min read

MoqHao Part 1.5: High-Level Trends of Recent Campaigns Targeting Japan

Using Pure Signal™ Intelligence to Determine the Scale and Impact of Threat Activity Having last looked at the MoqHao (or Roaming Mantis)...

Enriching Threat Intelligence for the Carbine Loader Crypto-jacking Campaign

S2 Research Team

Jul 8, 20213 min read

Enriching Threat Intelligence for the Carbine Loader Crypto-jacking Campaign

How Victimology Tells a Story beyond the Standard Crypto-jacking Tale Co-authored by Andy Kraus and Dan Heywood Cloud security provider...

Transparent Tribe APT Infrastructure Mapping - Part 2

S2 Research Team

Jul 2, 20219 min read

Transparent Tribe APT Infrastructure Mapping - Part 2

Part 2: A Deeper Dive into the Identification of CrimsonRAT Infrastructure October 2020 – June 2021 Introduction Transparent Tribe...

S2 Research Team

May 19, 20213 min read

Tracking BokBot (IcedID) Infrastructure

Mapping a Vast and Currently Active IcedID Network BokBot (also known as IcedID) started life as a banking trojan using...

Transparent Tribe APT Infrastructure Mapping - Part 1

S2 Research Team

Apr 16, 20214 min read

Transparent Tribe APT Infrastructure Mapping - Part 1

Part 1: A High-Level Study of CrimsonRAT Infrastructure October 2020 – March 2021 INTRODUCTION Transparent Tribe (APT36, Mythic Leopard,...

FIN8: BADHATCH Threat Indicator Enrichment

S2 Research Team

Mar 15, 20212 min read

FIN8: BADHATCH Threat Indicator Enrichment

FIN8 research identifies ongoing campaigns against entities in Germany, Sweden and the US. INTRODUCTION Last week (10 March 2021),...

S2 Research Team

Jan 26, 20212 min read

GhostDNSbusters (Part 3)

Illuminating GhostDNS Infrastructure This research was undertaken in collaboration with Manabu Niseki (@ninoseki on Twitter) and CERT.br...

MoqHao Part 1: Identifying Phishing Infrastructure

S2 Research Team

Jan 20, 20212 min read

MoqHao Part 1: Identifying Phishing Infrastructure

Cyber Reconnaissance with Team Cymru's Pure Signal™ Platform In mid-January, Twitter users @NaomiSuzuki_ and @KesaGataMe0 identified...

Mapping out AridViper Infrastructure Using Recon’s Malware Module

S2 Research Team

Dec 16, 20202 min read

Mapping out AridViper Infrastructure Using Recon’s Malware Module

Cyber Reconnaissance with Team Cymru's Pure Signal™ Platform Twitter user @BaoshengbinCumt posted malware hash...