Threat Research
BlackMatter Ransomware: In-Depth Analysis & Recommendations
Nov 02, 2021
CISA has issued a security bulletin regarding the BlackMatter 'big game hunter' ransomware group following a sharp increase in cases targeting U.S. businesses. To mitigate these attacks, it is recommended...
Abusing Misconfigured Salesforce Communities for Recon and Data Theft
Oct 21, 2021
Our research team has discovered numerous publicly accessible Salesforce Communities that are misconfigured and expose sensitive information.
Good for Evil: DeepBlueMagic Ransomware Group Abuses Legit Encryption Tools
Oct 19, 2021
A group known as "DeepBlueMagic" is suspected of launching a ransomware attack against Hillel Yaffe Medical Center in Israel, violating a loose "code of conduct" that many ransomware groups operate...
Lessons from the Twitch Data Leak
Oct 07, 2021
What happened? Increasingly covered by the mainstream press throughout Wednesday, October 6, 2021, the impact of the recent Twitch leak will undoubtedly grow as bad actors take advantage of the...
Return of the Darkside: Analysis of a Large-Scale Data Theft Campaign
Mar 18, 2021
Our team has recently led several high-profile investigations of attacks attributed to an up-and-coming cybercrime group, Darkside ransomware
How to Unpack Malware with x64dbg
Mar 17, 2021
This article is an x64dbg tutorial in which reverse engineering malware methodology will be explained and demonstrated.
February 2021 Malware Trends Report
Feb 18, 2021
This Februrary 2021 malware trends report is intended to help you better understand the evolving threat landscape and adapt your defenses accordingly.
SolarWinds SUNBURST Backdoor: Inside the Stealthy APT Campaign
Dec 18, 2020
Learn how detect and defend against the SolarWinds Sunburst malware that has compromised versions of SolarWinds’ Orion solution
November 2020 Malware Trends Report
Dec 02, 2020
This Malware Trends Report November 2020 is intended to help you better understand the evolving threat landscape and adapt your defenses accordingly.
Exploiting BGInfo to Infiltrate a Corporate Network
Sep 25, 2020
This post details how a clever attacker can embed a path to a malicious script within a BGInfo config file (.bgi), bypass email security, and execute code remotely.
A Queen’s Ransom: Varonis Uncovers Fast-Spreading “SaveTheQueen” Ransomware
Aug 12, 2020
A new strain of ransomware encrypts files and appends them with the extension, “.SaveTheQueen,” and propagates using the SYSVOL share on Active Directory Domain Controllers. Our customers encountered this malware...
Varonis Exposes Global Cyber Campaign: C2 Server Actively Compromising Thousands of Victims
Jun 17, 2020
The Varonis Security Research team discovered a global cyber attack campaign leveraging a new strain of the Qbot banking malware. The campaign is actively targeting U.S. corporations but has hit networks...
Try Varonis free.
Deploys in minutes.