Threat Research

Explore Secure Blink's Threat Research. In-depth analysis on ransomware, malware families, and APT groups. Stay ahead with actionable insights.

Onion

APT

TOR

OnionPoison: YouTube Channels spreading malicious TOR browsers installers

OnionPoison involved in wild infection chain of TOR Browser installer spread via YouTube channels

21-Oct-2022

10 min read

Twilio

Phishing

EvilProxy

EvilProxy: Scaling Phishing Attacks Keeping MFA At Bay

EvilProxy operators leverage Reverse Proxy & Cookie Injection methods to evade MFA – proxyfying victim’s session...

21-Sep-2022

7 min read

Golang

BianLian

Ransomware

BianLian: A new golan based cross functional ransomware in action

Increases in the command and control infrastructure of the new cross-platform ransomware BianLian this month suggest a quickening of the rate at which it is being developed and deployed......

16-Sep-2022

7 min read

APT

Backdoor

TA428

CotSam, Never Before Seen Malware linked to TA428 involved in EU attack

CotSam: a never seen before malware strain involved in the targeted attacks across several European & Afghanistan institutions linked to infamous APT group TA428......

09-Aug-2022

7 min read

APT

ToddyCat APT targeting high profile cyberespionage across Europe & Asia

A new APT group, tracked as ToddyCat, to a series of attacks targeting entities in Europe and Asia since at least December 2020...

25-Jun-2022

7 min read

Malware

Backdoor

Linux

BPFDoor an evasive backdoor malware targeting Linux & Solaris systems

BPFDoor is a Linux/Unix backdoor that allows threat actors to remotely connect to a Linux shell to gain complete access to a compromised device... ...

31-May-2022

7 min read

Phishing

Backdoor

Saitama Backdoor: Jordan's Foreign Ministry Targeted by Spear Phishing

FortiGuard Labs attributed the campaign to an Iranian cyber espionage threat actor tracked under the moniker APT34, citing resemblances

13-May-2022

2 min read

Rebrand

Black Basta

Ransomware

Black Basta: a new ransomware group or rebranded ransomware operation

Black Basta, a newly emerged name around the ransomware families, is getting popular across the masses, indicating an attempt to rebrand the previously dissolved ransomware family... ...

03-May-2022

6 min read

Vulnerability

Linux

Root

Nimbuspwn: Linux Endpoint Vulnerabilities allowing Root Privilege Escalation

Microsoft Researchers located previously undiscovered vulnerabilities in Linux systems tracked as Nimbuspwn, if chained together, may provide elevated root access......

28-Apr-2022

7 min read

Trojan

Infostealer

Malware

MetaStealer malware: An improved version of RedLine actively distributed via mal...

MetaStealer, a newly emerged infostealer malware actively circulated via a malspam campaign to steal user credentials & cryptocurrency wallet details…...

25-Apr-2022

1 min read