APT

How attackers gain access to corporate services without stealing passwords or cookies: we’re analyzing the Shadow Token via Remote Debug technique used in ToddyCat APT attacks.

GReAT experts have analyzed a new targeted campaign by the ForumTroll APT group.

Two campaigns by the BlueNoroff APT group target developers and executives in the crypto industry.

Archives are being used in targeted phishing and other attacks on organizations. What tools, settings, and policies can mitigate the threat?

Our technologies have helped to detect the zero-day vulnerability CVE-2025-2783 in Google Chrome, which was used in a sophisticated APT attack.

What information does an MDR service need to protect a company from complex targeted attacks?

What IT and cybersecurity leaders need to know about implementing network detection and response.

Cybercriminals are using AitM techniques to compromise accounts of company executives. How do they do this, and how to protect against it?

Are Macs as safe as their owners think they are? A few recent stories about malware targeting macOS users.

Espionage operations to hack corporate routers are now commonplace — and all organizations need to be aware of this.

Four major studies presented by our experts at the SAS 2023 international conference.

APT operators are showing increasing interest in mobile devices. Our experts have studied one of their tools.

The BlueNoroff APT group has adopted methods to bypass the Mark-of-the-Web mechanism

Avast solutions have a pretty good reputation, but a handful of incidents call their safety into question. Read on to learn whether Avast can be trusted.

Servers with the Zimbra Collaboration suit installed are being attacked via an archive unpacking tool.

Our experts studied the WinDealer malware created by the LuoYu APT group.

The Lazarus group continues to prey on cryptocurrency: cybercriminals distribute DeFi wallets with built-in backdoor.

How to protect your iPhone or Android smartphone from Pegasus and similar mobile APTs.

Our experts have discovered a malicious campaign targeting fintech companies.

At the SAS 2021 conference, our experts talked about the Tomiris backdoor, which appears to be linked to the DarkHalo group.

The most active groups targeting companies, encrypting data, and demanding ransom.