Blog / Threat Research (4)
Threat Research (4)
Threat Update #10
Oct 22, 2020
An alert notifies you that something suspicious is going on. Minutes matter, so you call the Varonis Incident Response team to help. Security investigators must act fast, but where do...
Exploiting BGInfo to Infiltrate a Corporate Network
Sep 25, 2020
This post details how a clever attacker can embed a path to a malicious script within a BGInfo config file (.bgi), bypass email security, and execute code remotely.
A Queen’s Ransom: Varonis Uncovers Fast-Spreading “SaveTheQueen” Ransomware
Aug 12, 2020
A new strain of ransomware encrypts files and appends them with the extension, “.SaveTheQueen,” and propagates using the SYSVOL share on Active Directory Domain Controllers. Our customers encountered this malware...
Varonis Exposes Global Cyber Campaign: C2 Server Actively Compromising Thousands of Victims
Jun 17, 2020
The Varonis Security Research team discovered a global cyber attack campaign leveraging a new strain of the Qbot banking malware. The campaign is actively targeting U.S. corporations but has hit networks...
Azure Skeleton Key: Exploiting Pass-Through Auth to Steal Credentials
Apr 22, 2020
EDIT: Security researcher Adam Chester had previously written about Azure AD Connect for Red Teamers, talking about hooking the authentication function. Check out his awesome write-up here. Should an attacker...
COVID-19 Threat Update #1
Mar 19, 2020
Varonis sees the highest number of VPN and O365 events ever recorded across customer base. Click to watch our security experts discuss what they’re seeing on the front lines, and what...
Varonis Uncovers New Malware Strains and a Mysterious Web Shell During a Monero Crypto Jacking Investigation
Feb 05, 2020
The Varonis Security Research team recently investigated an ongoing cryptomining infection that had spread to nearly every device at a mid-size company. Analysis of the collected malware samples revealed a...
Varonis Uncovers Another New Strain of the Qbot Banking Malware
Jan 27, 2020
Varonis has discovered and reverse engineered another new strain of Qbot, a sophisticated, well-known type of malware that collects sensitive data, such as browser cookies, digital certificate information, keystrokes, credentials, and session data from its victims to commit financial fraud.
No overhead. Just outcomes.