DejaBlue - Multiple Wormable RDS vulnerabilities affecting latest windows versions

enSilo Corporate and Product

On the latest Patch Tuesday, August 13th, Microsoft disclosed multiple pre-authentication remotely exploitable vulnerabilities in Windows remote desktop services (RDS). This means that the vulnerabilities can be exploited without any authentication or user interaction.
Read More

DealPly Revisited: Leveraging Reputation Services To Remain Under The Radar

Research, enSilo Breaking Malware

Usually, Adwares are not a particularly interesting research subject. However, when we detected a DealPly variant that evaded AV detection we decided to dig deeper.

Read More

GandCrab Doppelgänged His Shell?

Malware, enSilo Breaking Malware, Process Doppelganging, Threat Intelligence

A new loader-type malware adopted a technique similar to Process Doppelgänging and spread like wildfire in the last year and half. This loader is a significant threat, besides GandCrab, that closed up shop earlier this year, it delivers over a dozen other payloads like FormBook, LokiBot, SmokeLoader, AZORult, NetWire, njRat and Pony stealer.

Read More

The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable

Malware, enSilo Breaking Malware, Threat Intelligence

Article Summary

In May 2019, enSilo’s Threat Intelligence team observed activity by a cybercrime group, spreading Metamorfo - A Brazilian banking trojan. The variants we discovered abuse an executable digitally signed by Avast, which is one of the most popular AV products in the world for consumers. We were able to connect this activity to a

Read More

Unveiling Version 4.0 of the enSilo Endpoint Security Platform

enSilo Corporate and Product

Version 4.0 is a key part of our mission to protect businesses around the world from data breaches and disruption caused by cyber attacks. It squarely addresses the challenge faced by security and operations teams of combating the growth in the attack surface created by rising numbers of vulnerabilities and devices. We’ve added predictive and

Read More

Uncovering New Activity By APT10

Malware, APT, enSilo Breaking Malware, APT10, Threat Intelligence

Article Summary

In April 2019, enSilo detected what it believes to be new activity by Chinese cyber espionage group APT10. The variants discovered by enSilo are previously unknown and deploy malware that is unique to the threat actor. These malware families have a rich history of being used in many targeted attacks against government and

Read More

Why You Need to Be Concerned About Microsoft’s Latest Vulnerability

cybersecurity, enSilo Corporate and Product

In 2017 we said, "By now everyone knows about WannaCry and the problem with unpatched systems. But, what happens when the next Windows vulnerability is released, and no patch is issued on an end-of-life product?" That moment might have arrived.

Read More

Threat Hunting using YETI and Elastic Stack

enSilo Breaking Malware

Combining YETI, an open-source threat intelligence project, with Elastic Stack is a great way to simplify and enhance the work performed by researchers and threat hunters.

 

Read More

enSilo Co-Founders Deliver Presentation at RSA Conference 2019 on Cryptomining

cybersecurity, enSilo Corporate and Product

enSilo CEO Roy Katmor and CTO Udi Yavo delivered an in-depth presentation at RSA Conference 2019 called “The New Gold Rush: How to Hack Your Own Best Mining Rig”. The session addressed the state of cryptominers versus ransomware, how to build a stealthy and well-distributed miner, and several miner detection methods. Also, the team unveiled

Read More

Cyax Malware - Evasive Loader Reemerges

cybersecurity, enSilo Corporate and Product

Towards the end of 2018, enSilo blocked a suspicious attack attempt originating from a generic PowerShell script. While investigating the attack our team discovered an interesting loader malware that delivers different payloads. During the time of writing this post, commercial Anti-Viruses (AVs) did not identify this script as hostile.

Read More