analysis
Hunting injected processes by the modules they keep
A relatively recent post showed how Metasploit's Meterpreter module made some noise on endpoints when the migrate command was used to move the agent code into a legitimate process, spoolsv.exe in our ...
Analyzing an Instance of Meterpreter’s Shellcode
In my previous post on detecting and investigating Meterpreter's Migrate functionality, I went down a rabbit hole on the initial PowerShell attack spawned by and Excel macro. In that payload was a ...
Magecart hits again, leveraging compromised sites and newly registered domains
During alert monitoring, ThreatLabZ researchers came across multiple cases of shopping sites being compromised and injected with a skimming script. This injected script looks for the payment method and personally identifiable information ...
Hyperfocused Security for the Cloud
The cloud is the future and the future has arrived. Gartner predicts the worldwide public cloud service market will grow from $182.4 billion in 2018 to $331.2 billion in 2022, representing an ...
How can I check if I am GDPR compliant?
It’s been two years since the GDPR (General Data Protection Regulation) took effect, and despite many people saying it was a lot of fuss over nothing, it has had a significant effect ...
Abuse of hidden “well-known” directory in HTTPS sites
WordPress and Joomla are among the most popular Content Management Systems (CMSs). They have also become popular for malicious actors, as cybercriminals target sites on these platforms for hacking and injecting malicious ...
Qealler – a new JAR-based information stealer
Recently, the Zscaler ThreatLabZ team came across a new type of malware called Qealler, which is written in Java and designed to silently steal sensitive information from an infected machine. Qealler is ...
Deeper Down the Rabbit Hole: Second-Stage Attack and a Fileless Finale
In our last blog, “Following a Trail of Confusion: PowerShell in Malicious Office Documents”, we systematically unraveled multiple layers of obfuscation initiated by a weaponized first-stage Microsoft Word document to reveal a ...
Following a Trail of Confusion: PowerShell in Malicious Office Documents
While the threat landscape continues to evolve, Microsoft Office documents continue to see steady usage by malicious actors. These documents, often times equipped with nothing more than the built-in capability offered by ...
Spam campaigns leveraging .tk domains
For the last couple quarters, the Zscaler ThreatLabZ research team has been closely monitoring services that provide free domain names. We’ve identified a campaign utilizing '.tk' TLD (top level domain) domains that ...
