WithSecure Labs.
Most up-to-date information regarding WithSecure
Blog post
The ‘vice’ in tech advice: ClickFix-style commands disguised as tech tips across social media platforms and beyond
Source: https://labs.withsecure.com/publications/clickfix-social-media
Blog post
Ivanti EPMM Exploitation: Hit-and-Run
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
Blog post
The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know
Back in 2023, when we last wrote about Cybercrime-as-a-Service, we described cybercrime as an economy that had figured out how to scale
Blog post
To the past and beyond: Andariel’s latest arsenal and cyberattacks
WithSecure proactively identified and notified a European customer belonging to the public/legal sector of a breach attributed with high confidence to the Andariel group, a state-sponsored cyber group linked to the Reconnaissance General Bureau (RGB) 3rd bureau of Democratic People’s Republic of Korea (DPRK).
Blog post
TangleCrypt: a sophisticated but buggy malware packer
WithSecure's STINGR Group is releasing a detailed technical analysis of TangleCrypt, a previously undocumented packer for Windows malware.
Blog post
WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization
WithSecure’s STINGR has been investigating a malware campaign, tracked as WEBJACK, which compromises Microsoft IIS servers
Blog post
Email-Delivered RMM: Abusing PDFs for Silent Initial Access
Since November 2024, WithSecure has been tracking a slight uptick of targeted activities leveraging Remote Monitoring and Management (RMM) tools embedded within PDF documents.
Research
EDR bypassing via memory manipulation techniques
Endpoint Detection & Response systems (EDR), delivered by in-house teams or as part of a managed service, are a feature of modern intrusion detection and remediation operations.
Blog post
FIN7 tradecraft seen in attacks against Veeam backup servers
WithSecure Intelligence identified attacks which occurred in late March 2023 against internet-facing servers running Veeam Backup & Replication software.
Research
Silkloader
Commercial and open-source command-and-control (C2) frameworks have become a staple in most adversary toolkits, with Cobalt Strike (CS) being one of the most popular.
Research
Ducktail
The threat actor targets individuals and employees that may have access to a Facebook Business account with an information-stealer malware.
Not Found
No results found, please try something else!