Active C2 Discovery Using Protocol Emulation Part1 (HYDSEVEN NetWire)

Malware C2 addresses can be an important IOC to detect known threats. In order to obtain C2 information, we first need malware samples which are then analyzed dynamically or statically. However the analysis task is often times not straightforward. Increasingly anti-analysis methods are implemente...

Delta Tau Power PMAC-NC Machine Interface Panel MIP22

Binary data 764742.prm...

Evolving Threat Hunting with the MITRE ATT&CK Framework at CB Connect

Evolving Threat Hunting with the MITRE ATT&CK Framework – Join me at CB Connect San Diego! There are a number of techniques you can use to uncover security gaps leveraging the MITRE ATT&CK matrix. At CB Connect San Diego, our annual user conference June 4-5th, I will speaking on “How to Evolve Yo...

CB TAU Threat Intelligence Notification: Hunting APT28 Downloaders

Recently the Carbon Black Threat Analysis Unit TAU analyzed the APT28 downloaders SedUploader and Zebrocy which has been observed over the previous six months. There have been several good publications regarding the code analysis of SedUploader and Zebrocy already 125679. Therefore, in this artic...

CB TAU Threat Intelligence Notification – Recent Emotet Campaign Leverages Phishing, PDFs & Droppers Impersonating Legitimate Applications

This past week, CB ThreatSight analysts were investigating suspicious events in an environment. This customer had installed the CB Defense sensor on a subset of systems in monitor only mode for evaluation. While investigating suspicious events, a CB ThreatSight analyst uncovered a new Emotet...

TAU Threat Intelligence Notification: New macOS Malware Variant of Shlayer (OSX) Discovered

Carbon Black’s Threat Analysis Unit TAU recently discovered a new variant of a family of macOS malware which was first discovered in February of 2018 by researchers from Intego. TAU has obtained new samples of this malware and observed downloads of the malware from multiple sites, primarily...

Carbon Black TAU & ThreatSight Analysis: GandCrab and Ursnif Campaign

Summary Analysis conducted by Andrew Costis, Cathy Cramer, Emily Miner and Jared Myers. The Carbon Black ThreatSight team observed an interesting campaign over the last month. ThreatSight worked with the Threat Analysis Unit TAU to research the campaign. This report is being released to help...

Cb Customer Spotlight Series: Q&A Landmark Credit Union’s Matt Goodacre

Featuring Matt Goodacre, Security Analyst at Landmark Credit Union With all their endpoints in high enforcement mode, Matt Goodacre, Security Analyst at Landmark Credit Union in Wisconsin, is confident the organization’s workstations are up to locked down when it comes to security. Here’s how...

Security Bulletin: Vulnerability in OpenSSL affect Rational Tau (CVE-2016-2180)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by Rational Tau. Rational Tau has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2180 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by an out-of-bounds read in the...

Security Bulletin: Vulnerability in OpenSSL affect Rational Tau (CVE-2016-2177)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project. OpenSSL is used by Rational Tau. Rational Tau has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2177 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by the incorrect use of pointer...

Security Bulletin: Vulnerabilities in OpenSSL affect Rational Tau (CVE-2016-2107, CVE-2016-2176)

Summary OpenSSL vulnerabilities were disclosed on May 3, 2016 by the OpenSSL Project. OpenSSL is used by Rational Tau. Rational Tau has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2016-2107 DESCRIPTION: OpenSSL could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Vulnerability in OpenSSL affects Rational Tau (CVE-2015-3194)

Summary OpenSSL vulnerabilities were disclosed on December 3, 2015 by the OpenSSL Project. OpenSSL is used by Rational Tau. Rational Tau has addressed the applicable CVE CVE-2015-3194. Vulnerability Details CVEID: CVE-2015-3194 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused by ...

Security Bulletin: Vulnerability in OpenSSL affects Rational Tau (CVE-2015-1793)

Summary OpenSSL vulnerabilities were disclosed by the OpenSSL Project and affect Rational Tau. This includes the alternate chains certificate forgery vulnerability CVE-2015-1793. Rational Tau has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2015-1793 DESCRIPTION: OpenSSL could...

Security Bulletin: Vulnerability in Diffie-Hellman ciphers affects Rational Tau (CVE-2015-4000)

Summary The Logjam Attack on TLS connections using the Diffie-Hellman DH key exchange protocol affects Rational Tau Vulnerability Details CVEID: CVE-2015-4000 DESCRIPTION: The TLS protocol could allow a remote attacker to obtain sensitive information, caused by the failure to properly convey a...

Security Bulletin: Vulnerability in RC4 stream cipher affects Rational Tau (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects Rational Tau. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION:The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit this vulnerabilit...

Security Bulletin: Vulnerability in SSLv3 affects Rational Tau (CVE-2014-3566)

Summary SSLv3 contains a vulnerability that has been referred to as the Padding Oracle On Downgraded Legacy Encryption POODLE attack. SSLv3 is enabled in Rational Tau Vulnerability Details CVE-ID: CVE-2014-3566 DESCRIPTION: Product could allow a remote attacker to obtain sensitive information,...

Security Bulletin: Rational Tau is affected by OpenSSL vulnerabilities (CVE-2014-0224)

Summary Security vulnerabilities have been discovered in OpenSSL that were reported on June 5, 2014 by the OpenSSL Project. Vulnerability Details | Subscribe to My Notifications to be notified of important product support alerts like this. Follow this link for more information requires login with...

Threat Analysis: Recent Attack Technique Attempts to Bypass Whitelisting by Leveraging MS Office Document Macros, MSBuild, Certutil

Carbon Black continues to monitor and track evolving techniques that attackers leverage. Over the last several years, there has been an increase in attackers leveraging open source frameworks and proof of concept POC techniques that are released publically by researchers. A document was recently...

Threat Analysis: Pylot (Travle) Malware Family

The Pylot or Travle malware family appears to be an evolution of the NetTravler malware family which has been linked to attackers out of China by numerous sources. Over the last year a variant has been observed as a secondary payload often used in conjunction with malicious carrier files typicall...

Carbon Black TAU Threat Analysis: A Deeper Look at BadRabbit Shows Overlapping Similarities to NotPetya

BadRabbit was a ransomware variant initially detected in the wild on October 24, 2017. On that day, Carbon Black and several other research organizations conducted triage analysis of the sample and provided write ups. Carbon Black also provided an internal post in the User Exchange documenting IO...