WithSecure Labs
Asiantuntijoidemme uusimmat tutkimukset, päivitykset ja työkalut käyttöösi.
Blog post
DarkGate Rises: New version of DarkGate malware hunts like a Duck but bites like a RAT
On 4th August 2023, WithSecure Detection and Response Team (DRT) received an alert regarding spoofed process injection with abnormal memory characteristics on a host belonging to a WithSecure Countercept MDR customer.
Uncategorised
Reverse engineering a Lumma infection
Lumma is an information stealer that the WithSecure Detection and Response Team (DRT) have encountered several times. It has seen wider use over the past couple of years, and makes for an interesting threat to monitor.
Uncategorised
Machine learning-driven malware analysis
With the rapid emergence of new malware variants, accurately classifying and attributing malware samples has become more challenging than ever
Blog post
DarkGate malware campaign
Vietnamese cybercrime groups are using multiple different Malware as a Service (MaaS) infostealers and Remote Access Trojans (RATs) to target the digital marketing sector.
Blog post
The ’vice’ in tech advice: ClickFix-style commands disguised as tech tips across social media platforms and beyond
Threat actors constantly look for ways to circumvent traditional security measures to deliver malware to unsuspecting users.
Blog post
Ivanti EPMM Exploitation: Hit-and-Run
This blogpost, written by WithSecure’s STINGR Group, presents the analysis of a security incident that happened in February 2026 and was investigated by the WithSecure Incident Response team.
Blog post
The Changing Economics of Cybercrime-as-a-Service: What Defenders Need to Know
Back in 2023, when we last wrote about Cybercrime-as-a-Service, we described cybercrime as an economy that had figured out how to scale
Blog post
To the past and beyond: Andariel’s latest arsenal and cyberattacks
WithSecure proactively identified and notified a European customer belonging to the public/legal sector of a breach attributed with high confidence to the Andariel group, a state-sponsored cyber group linked to the Reconnaissance General Bureau (RGB) 3rd bureau of Democratic People’s Republic of Korea (DPRK).
Blog post
TangleCrypt: a sophisticated but buggy malware packer
WithSecure's STINGR Group is releasing a detailed technical analysis of TangleCrypt, a previously undocumented packer for Windows malware.
Blog post
WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization
WithSecure’s STINGR has been investigating a malware campaign, tracked as WEBJACK, which compromises Microsoft IIS servers
Uncategorised
TamperedChef: Malvertising to Credential Theft
TamperedChef is a sophisticated malware campaign that leveraged a convincing advertising campaign strategy and a fully functional decoy application to target European organizations.
Blog post
Email-Delivered RMM: Abusing PDFs for Silent Initial Access
Since November 2024, WithSecure has been tracking a slight uptick of targeted activities leveraging Remote Monitoring and Management (RMM) tools embedded within PDF documents.
Results not found
Results not found