strafer

Strafer Elasticsearch 감염이 기하급수적으로 증가하고 있습니다. 공격자들은 오픈되어 노출된 Elasticsearch 인터페이스를 악용하여 클라우드 및 비클라우드 환경에서 감염을 유발하고 있습니다. 이번 발표에서는 "STRAFER"라는 도구를 공개하여 Elasticsearch 인스턴스의 잠재적 감염을 탐지하도록 할 것입니다. 이 도구는 보안 연구원, 침투 테스터 및 위협 인텔리전스 전문가가 악성 코드를 실행하는 손상되거나 감염된 Elasticsearch 인스턴스를 탐지할 수 있게 해줍니다. 또한 클라우드...

ransomwhere

Ransomwhere 파일을 암호화하여 랜섬웨어 탐지 및 방지 전략을 테스트할 수 있는 개념 증명PoC 랜섬웨어 샘플입니다. 인자가 제공되지 않으면 ransomwhere는 원본 파일을 삭제하지 않고 자동으로 encrypt 모드를 실행합니다. 이 소프트웨어로 인해 발생한 어떠한 손해에도 저는 책임지지 않습니다. 빌드 with make and Go installed % make build 사용법 % ransomwhere -h Usage of ransomwhere: -delete Delete files after encrypting...

melee

MELEE: MySQL 인스턴스에서 랜섬웨어 감염을 탐지하는 도구 공격자들은 인터넷 상에서 악의적인 작업을 수행하기 위해 MySQL 인스턴스를 악용하고 있습니다. 사이버 범죄자들은 노출된 MySQL 인스턴스를 표적으로 삼아 대규모 감염을 유발하여 데이터를 빼내고, 데이터를 파괴하며, 랜섬을 통해 금전을 갈취하고 있습니다. 예를 들어 MySQL 배포판이 직면한 주요 위협 중 하나는 랜섬웨어입니다. 우리는 MySQL 인스턴스에서 잠재적인 감염을 탐지하기 위해 "MELEE"라는 도구를 제작했습니다. 이 도구는 보안 연구원, 침투...

ESXi-Ransomware-Scanner-mi

ESXiransomwarescanner A program that scans IP addresses for signs of ESXi compromise by grabbing the ransom note from an html page and comparing the strings. Requirements python 3.x requests BeautifulSoup tqdm colorama Installation Use the package manager pip to install the required packages. pip...

Malware

랜섬웨어 패밀리를 위한 YARA 규칙 및 프로그램: Akira Babuk Beast BlackByte BlackCat ALPHV BlackMatter BlueLocker MemeCryptor Cerber Conti DarkBit DeadBolt Dharma Enmity GarrantyDecrypt GlobeImposter / NewBomani GoodMorning / SD HardBit Hive / Hunters International HsHarada / Rapture Hunters International INC / Lyn...

KilledProcessCanary

Windows Killed Process Canary A Windows Service to detect if it has been shutdown and hibernate if multiple instances are. Released as open source by NCC Group Plc - http://www.nccgroup.com/ Developed by Ollie Whitehouse, ollie dot whitehouse at nccgroup dot com...

detect-ransomware-filenames

Detect Ransomware Filenames This package/script watches SMB transactions to look for known bad filenames that ransomware is known to use. It rides on top of the Anti-Ransomware File System Resource Manager Lists maintained here. How to use A Python script download-list.py is included to be able t...

TL-RL-FusionNet: An Adaptive and Efficient Reinforcement Learning-Driven Transfer Learning Framework for Detecting Evolving Ransomware Threats

Modern ransomware exhibits polymorphic and evasive behaviors by frequently modifying execution patterns to evade detection. This dynamic nature disrupts feature spaces and limits the effectiveness of static or predefined models. To address this challenge, we propose TL-RL-FusionNet, a reinforceme...

Explainable Attention-Based LSTM Framework for Early Detection of AI-Assisted Ransomware Via File System Behavioral Analysis

Ransomware continues to evolve as one of the most disruptive cyber threats, with recent variants increasingly leveraging automated and AI-assisted techniques to evade traditional signature-based defenses. Early detection of such attacks remains a significant challenge, particularly when malicious...

Privacy-Aware Machine Unlearning with SISA for Reinforcement Learning-Based Ransomware Detection

Ransomware detection systems increasingly rely on behavior-based machine learning to address evolving attack strategies. However, emerging privacy compliance, data governance, and responsible AI deployment demand not only accurate detection but also the ability to efficiently remove the influence...

RansomTrack: A Hybrid Behavioral Analysis Framework for Ransomware Detection

Ransomware poses a serious and fast-acting threat to critical systems, often encrypting files within seconds of execution. Research indicates that ransomware is the most reported cybercrime in terms of financial damage, highlighting the urgent need for early-stage detection before encryption is...

Automating Cloud Security and Forensics through a Secure-By-Design Generative AI Framework

As cloud environments become increasingly complex, cybersecurity and forensic investigations must evolve to meet emerging threats. Large Language Models LLMs have shown promise in automating log analysis and reasoning tasks, yet they remain vulnerable to prompt injection attacks and lack forensic...

An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases

In 2025, a total of 134 ransomware incidents were reported in Japan, marking a 17.5% increase compared to 2024. Among these, 22 incidents were attributed to Qilin, representing 16.4% of the total. In 2025, Qilin ransomware was highly active. Looking ahead to 2026, unless there is significant...

Malware and Ransomware Detection in M365

Availability Requirement Threat Detection is available to Veeam Data Cloud for Microsoft 365 customers with Premium or Advanced plans. Customers must opt in to AI settings to enable this feature. Contact your Veeam account team or see your plan details to confirm availability. Supported Workloads...

BullWall Ransomware Containment and Server Intrusion Protection multiple vulnerabilities

RISK EVALUATION BullWall Ransomware Containment and Server Intrusion Protection are products used for ransomware containment. Multiple vulnerabilities were reported that when used individually or in conjunction could allow a remote attacker with valid credentials to log in to a system with...

CVE-2025-62000: Incomplete Comparison with Missing Factors

BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and preventing this particular method fro...

Interpretable Ransomware Detection Using Hybrid Large Language Models: A Comparative Analysis of BERT, RoBERTa, and DeBERTa through LIME and SHAP

Ransomware continues to evolve in complexity, making early and explainable detection a critical requirement for modern cybersecurity systems. This study presents a comparative analysis of three Transformer-based Large Language Models LLMs BERT, RoBERTa, and DeBERTa for ransomware detection using...

Federated Cyber Defense: Privacy-Preserving Ransomware Detection across Distributed Systems

Detecting malware, especially ransomware, is essential to securing today's interconnected ecosystems, including cloud storage, enterprise file-sharing, and database services. Training high-performing artificial intelligence AI detectors requires diverse datasets, which are often distributed acros...

Cloud Investigation Automation Framework (CIAF): An AI-Driven Approach to Cloud Forensics

Large Language Models LLMs have gained prominence in domains including cloud security and forensics. Yet cloud forensic investigations still rely on manual analysis, making them time-consuming and error-prone. LLMs can mimic human reasoning, offering a pathway to automating cloud log analysis. To...

Qualys Achieves 100% Major Step Detection in the 2024 MITRE ATT&CK Evaluations, Enterprise

How Qualys Transformed from Risk Leader to EDR Powerhouse In today’s rapidly evolving threat landscape, ransomware continues to dominate as one of the most significant cybersecurity challenges. To help organizations evaluate their defenses against these sophisticated threats, the MITRE ATT&CK...