FIN7: The Truth Doesn't Need to be so STARK
First and foremost, our thanks go to the threat research team at Silent Push and the security team at Stark Industries Solutions...
top of page
10/08/24: Please be advised that due to the impact of Hurricane Milton, response times may be delayed.
Dragon News Blog
S2 Research Team
Aug 77 min
Botnet 7777: Are You Betting on a Compromised Router?
Firstly, we extend our thanks to Chris Fearnley and Gi7w0rm, two threat researchers who assisted us behind the scenes with our...
S2 Research Team
Apr 41 min
Latrodectus: This Spider Bytes Like Ice
For this research, we partnered with Proofpoint’s Threat Research team in a collaborative effort to provide a comprehensive overview of...
S2 Research Team
Mar 514 min
Coper / Octo - A Conductor for Mobile Mayhem… With Eight Limbs?
Analysis of an Android Malware-as-a-Service Operation Coper, a descendant of the Exobot malware family, was first observed in the wild in...
S2 Research Team
Aug 7, 202315 min
Visualizing Qakbot Infrastructure Part II: Uncharted Territory
A Data-Driven Approach Based on Analysis of Network Telemetry In this blog post, we will provide an update on our high-level analysis of...
S2 Research Team
Jul 28, 202311 min
Inside the IcedID BackConnect Protocol (Part 2)
Introduction In this blog post, we will provide an update on our continued analysis and tracking of infrastructure associated with...
S2 Research Team
Jun 15, 20235 min
Darth Vidar: The Aesir Strike Back
At the beginning of this year, we released a detailed publication on Vidar infrastructure, encompassing both the primary administrative...
S2 Research Team
May 16, 20236 min
Visualizing QakBot Infrastructure
A Data-Driven Approach based on Analysis of Network Telemetry This blog post seeks to draw out some high-level trends and anomalies based...
S2 Research Team
Apr 19, 20235 min
AllaKore(d) the SideCopy Train
Identifying Connected Infrastructure and Management Activities Introduction This blog post seeks to build on recent public reporting on...
S2 Research Team
Mar 16, 20235 min
MoqHao Part 3: Recent Global Targeting Trends
Introduction This blog post is part of an ongoing series of analysis on MoqHao (also referred to as Wroba and XLoader), a malware family...
S2 Research Team
Feb 24, 20235 min
Desde Chile con Malware (From Chile with Malware)
Spoiler Alert: They weren't actually from Chile. Introduction This blog post provides a short update on our ongoing tracking of...
S2 Research Team
Jan 27, 20237 min
A Blog with NoName
UPDATE: Since publishing this blog piece, we have worked in cooperation with Stark Industries Solutions to assist in the reduction of...
S2 Research Team
Jan 19, 20238 min
Darth Vidar: The Dark Side of Evolving Threat Infrastructure
Summary Three key takeaways from our analysis of Vidar infrastructure: Russian VPN gateways are potentially providing anonymity for Vidar...
S2 Research Team
Dec 21, 20229 min
Inside the IcedID BackConnect Protocol
Deriving Threat Actor TTPs from Management Infrastructure Tracking You can find our previous work on Stage 1 and Stage 2 of IcedID’s...
S2 Research Team
Dec 8, 20223 min
Iranian Exploitation Activities Continue as of November 2022
Telemetry Data Suggests 107.173.231.114 Remains an Active IOC Introduction This blog provides a short update on Team Cymru’s ongoing...
S2 Research Team
Nov 3, 20227 min
Inside the V1 Raccoon Stealer’s Den
Exposing links to Kharkiv (Ukraine) and the CC2BTC Marketplace Introduction Team Cymru’s S2 Research Team has blogged previously on the...
S2 Research Team
Oct 7, 202210 min
A Visualizza into Recent IcedID Campaigns:
Reconstructing Threat Actor Metrics with Pure Signal™ Recon Introduction IcedID (also known as BokBot) started life in early 2017 as a...
