Silent Domain Hijack: Detecting DCSync with Trellix NDR

Silent Domain Hijack: Uncovering the DCSync Attack and Detecting with Trellix NDR By Maulik Maheta and Chao Sun · December 10, 2025 Executive summary DCSync is one of the most powerful and stealthy techniques an attacker can use once they have gained access to an Active Directory AD environment...

Exposing PathWiper: DCOM Abuse and Network Erasure

Exposing PathWiper: A Deep Dive into DCOM Abuse and Network Erasure With Trellix NDR By Maulik Maheta and Lishoy Mathew · August 12, 2025 Executive summary Ukraine’s national energy and telecommunications infrastructure was the primary targets of the PathWiper attack in 2025. The attack was...

Automagic Reverse Engineering

Automagic Reverse Engineering By Trellix · July 1, 2025 This blog was written by Max Kersten Over the last few years, I have looked into methods to improve the reverse engineering process. This saves essential time during the analysis, which helps while defending from well prepared threat actors...

No symbols? No problem!

No symbols? No problem! By Trellix · August 9, 2024 This blog was written by Max Kersten Malware analysts know it all too well: the ominous feeling that washes over you when opening an unknown file in your favorite analysis tool and being greeted with hundreds or thousands of unknown functions,...

Cracking Cobalt Strike: Taking Down Malicious Cybercriminal Infrastructure with Threat Intelligence

Cracking Cobalt Strike Taking Down Malicious Cybercriminal Infrastructure with Threat Intelligence By Joao Marques, John Fokker and Leandro Velasco · July 3, 2024 Introduction In a significant global effort to combat cybercrime, law enforcement agencies from around the world have joined forces to...

Resilient Security Requires Mature Cyber Threat Intelligence Capabilities

Resilient Security Requires Mature Cyber Threat Intelligence Capabilities By Trellix Advanced Research Center · August 5, 2023 Threat intelligence and the ability to add context to each technology environment to global threats has never been more important to the role of the CISO, or to the board...

China-Taiwan Tensions Spark Surge in Cyberattacks on Taiwan

China-Taiwan Tensions Spark Surge in Cyberattacks on Taiwan By Daksh Kapur, Leandro Velasco · May 17, 2023 Figure 1 image from freepik.com “In the past few years, we noticed that geopolitical conflicts are one of the main drivers for cyber-attacks on a variety of industries and institutions...

Email Cyberattacks on Arab Countries Rise in Lead to Global Football Tournament

Email Cyberattacks on Arab Countries Rise in Lead to Global Football Tournament By Daksh Kapur · November 17, 2022 This story was also written by Sparsh Jain. Figure 1 Global eyes are soon to be turned to the first global football tournament to be held in the Arab world kicking off on November 20...

The Race to Secure eBPF for Windows

The Race to Secure eBPF for Windows By Trellix · August 11, 2022 This blog was written by Douglas McKee Innovation often improves functionality and even security; however, adoption starts slow. Adoption often doesn’t increase at a linear rate but at an exponential rate leaving behind attack...

Get To Know John Fokker

Meet John Fokker Head of Cyber Investigations for Trellix Threat Labs By Trellix · April 28, 2022 This blog was written by Michael Alicea At Trellix, we celebrate and champion our people. This week, I sat down with John Fokker, Head of Cyber Investigations for Trellix Threat Labs and one of the...

Detection of ‘Leave Behinds’ From Nation-State Actors

Who left the backdoor open? By Trellix · March 28, 2022 In our recent report, In the Crosshairs: Companies and Nation-State Cyber Threats, over 800 IT decision makers from around the world were interviewed on their experiences with nation-state cyber attacks. One of the questions sought to...

Executive Summary: Organizations and Nation-State Cyber Threats

Executive Summary: Organizations and Nation-State Cyber Threats By John Fokker · March 28, 2022 Traditionally when we talk about threat actors, we first need to make the split between cybercrime and nation-state sponsored operations. Where cybercrime is mostly focused on financial gain,...

Cyberattacks Targeting Ukraine and HermeticWiper Protections

Trellix Global Defenders: Cyberattacks Targeting Ukraine and HermeticWiper Protections By Taylor Mullins · February 28, 2022 Trellix is monitoring the ongoing cyberattacks targeting the Ukraine and any threat activity targeting entities outside of the Ukraine. Trellix is continuing to add...

Looking Over the Nation-State Actors’ Shoulders

Looking over the nation-state actors’ shoulders: Even they have a difficult day sometimes By Trellix and Marc Elias · Febraury 17, 2022 Have you ever been curious about how nation-state actors operate and what their day-to-day work looks like? This blog reveals some of these details observed base...

Trellix Global Defenders: BlackCat Ransomware as a Service - The Cat is certainly out of the bag!

Trellix Global Defenders: BlackCat Ransomware as a Service - The Cat is certainly out of the bag! By Trellix · February 8, 2022 Research Contributions and Analysis: Filippo Sitzia This story was written by Arnab Roy Threat Summary Blackcat also known as ALPHV/Noberus is a Ransomware as a Service...

Breaking the Security Barrier of a Globally Deployed Infusion Pump

ARCHIVED STORY Overmedicated: Breaking the Security Barrier of a Globally Deployed Infusion Pump By Douglas McKee, Steve Povolny and Philippe Laulheret · August 24, 2021 Cyberattacks on medical centers are one of the most despicable forms of cyber threat there is. For instance, on October 28th,...

Babuk Ransomware

ARCHIVED STORY Babuk Ransomware By Alexandre Mundo · February 23, 2021 Executive Summary Babuk ransomware is a new ransomware threat discovered in 2021 that has impacted at least five big enterprises, with one already paying the criminals $85,000 after negotiations. As with other variants, this...

Additional Analysis into the SUNBURST Backdoor | McAfee Blogs

ARCHIVED STORY Additional Analysis into the SUNBURST Backdoor Christiaan Beek · DEC 17, 2020 Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoC...

Additional Analysis into the SUNBURST Backdoor | McAfee Blogs

ARCHIVED STORY Additional Analysis into the SUNBURST Backdoor Christiaan Beek · DEC 17, 2020 Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoC...

Operation North Star: Summary Of Our Latest Analysis | McAfee Blogs

Operation North Star: Summary Of Our Latest Analysis By Trellix · NOV 05, 2020 McAfee’s Advanced Threat Research ATR today released research that uncovers previously undiscovered information on how Operation North Star evaluated its prospective victims and launched attacks on organizations in...

RagnarLocker Ransomware Threatens to Release Confidential Information | McAfee Blogs

ARCHIVED STORY RagnarLocker Ransomware Threatens to Release Confidential Information Alexandre Mundo · JUN 09, 2020 EXECUTIVE SUMMARY The RagnarLocker ransomware first appeared in the wild at the end of December 2019 as part of a campaign against compromised networks targeted by its operators. Th...

Model Hacking ADAS to Pave Safer Roads for Autonomous Vehicles

ARCHIVED STORY Model Hacking ADAS to Pave Safer Roads for Autonomous Vehicles Steve Povolny · FEB 19, 2020 The last several years have been fascinating for those of us who have been eagerly observing the steady move towards autonomous driving. While semi-autonomous vehicles have existed for many...

We Be Jammin’ – Bypassing Chamberlain myQ Garage Doors

ARCHIVED STORY We Be Jammin’ – Bypassing Chamberlain myQ Garage Doors Sam Quinn · JAN 06, 2020 The idea of controlling your garage door remotely and verifying that everything is secure at home, or having packages delivered directly into your garage is enticing for many people. The convenience tha...

Analysis of LooCipher, a New Ransomware Family Observed This Year

ARCHIVED STORY Analysis of LooCipher, a New Ransomware Family Observed This Year By ATR Operational Intelligence Team · December 05, 2019 Co-authored by Marc RiveroLopez. Initial Discovery This year seems to again be the year for ransomware. Notorious attacks were made using ransomware and new...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money

ARCHIVED STORY McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – Follow The Money By John Fokker · October 14, 2019 Episode 3: Follow the Money This is the third installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi and its connections to GandCrab, the mos...

Mr. Coffee with WeMo: Double Roast

ARCHIVED STORY Mr. Coffee with WeMo: Double Roast By Sam Quinn · May 30, 2019 McAfee Advanced Threat Research recently released a blog detailing a vulnerability in the Mr. Coffee Coffee Maker with WeMo. Please refer to the earlier blog to catch up with the processes and techniques I used to...

Crypto Currency Laundering Service, BestMixer.io, Taken Down by Law Enforcement

ARCHIVED STORY Cryptocurrency Laundering Service, BestMixer.io, Taken Down by Law Enforcement By John Fokker · May 22, 2019 A much overlooked but essential part in financially motivated cybercrime is making sure that the origins of criminal funds are obfuscated or made to appear legitimate, a...

Crypto Currency Laundering Service, BestMixer.io, Taken Down by Law Enforcement

ARCHIVED STORY Cryptocurrency Laundering Service, BestMixer.io, Taken Down by Law Enforcement By John Fokker · May 22, 2019 A much overlooked but essential part in financially motivated cybercrime is making sure that the origins of criminal funds are obfuscated or made to appear legitimate, a...

Gandcrab Ransomware Puts Pinch On Victims

ARCHIVED STORY GandCrab Ransomware Puts the Pinch on Victims By Alexandre Mundo · July 31, 2018 Update: On August 9 we added our analysis of Versions 4.2.1 and 4.3. The GandCrab ransomware first appeared in January and has been updated rapidly during its short life. It is the leading ransomware...

Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks

ARCHIVED STORY Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks By John Fokker · July 11, 2018 Thanks to my colleague Christiaan Beek for his advice and contributions. While researching underground hacker marketplaces, the McAfee Advanced Threat Research team has...

Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks

ARCHIVED STORY Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks By John Fokker · July 11, 2018 Thanks to my colleague Christiaan Beek for his advice and contributions. While researching underground hacker marketplaces, the McAfee Advanced Threat Research team has...

Poor Security Exposes Medical Data to Cybercriminals

ARCHIVED STORY McAfee Researchers Find Poor Security Exposes Medical Data to Cybercriminals By Christiaan Beek · March 11, 2018 The nonperishable nature of medical data makes an irresistible target for cybercriminals. The art of hacking requires significant time and effort, encouraging experience...

DDoS Attacks in the Netherlands Reveal Teen Gamers on Troublesome Path

ARCHIVED STORY DDoS Attacks in the Netherlands Reveal Teen Gamers on Troublesome Path By John Fokker · Febraury 22, 2018 At the end of January, the Netherlands was plagued by distributed denial of service DDoS attacks targeting various financial institutions, tech sites, and the Dutch tax...

Malware-As-A-Service Redefined: Why XWorm is outpacing every other RAT in the underground malware market

Malware-As-A-Service Redefined: Why XWorm is outpacing every other RAT in the underground malware market By Boggavarapu R S S Srinivas Gupta and Ravishankar N C · March 12, 2026 Introduction In the evolving landscape of cybercrime, threat actors are constantly pursuing the "perfect" weapon: malwa...

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution

Fileless Multi-Stage Remcos RAT: From Phishing to Memory-Resident Execution By Madhini Muralidharan · March 11, 2026 Traditional malware campaigns rely heavily on dropping executable files to disk—artifacts that defenders can scan, quarantine, and analyze with signature-based security tools. Mode...

From Digital Innovation to Patient Harm: Why Healthcare Cybersecurity Is Now a C-Suite Imperative

From Digital Innovation to Patient Harm: Why Healthcare Cybersecurity Is Now a C-Suite Imperative By John Fokker · January 27, 2026 For decades, healthcare systems were designed with one core principle: patient safety. Clinical devices operated in largely closed environments, disconnected from th...

Dark Web Roast December 2025 Edition

Dark Web Roast - December 2025 Edition By Trellix Advanced Research Center · January 15, 2026 Executive summary December 2025 delivered a spectacular finale to the year's cybercriminal comedy show, featuring Global Ransomware-as-a-Service RaaS operator liquidating their empire for pocket change,...

How Trellix Helix detects AS-REP Roasting in Active Directory

How Trellix Helix detects AS-REP Roasting in Active Directory By Adithya Chandra and Maulik Maheta · November 13, 2025 Executive Summary Adversaries use AS-REP Roasting to extract and crack password hashes from Active Directory AD accounts with Kerberos preauthentication disabled, a...

The Bug Report – August 2025 Edition

The Bug Report – August 2025 Edition By Jonathan Omakun, Tola Olawale · August 27, 2025 Why am I here? Welcome back to The Bug Report! Did you miss us? The Trellix Advanced Research Center has been playing a high-stakes game of whack-a-mole with this month's vulnerabilities. We've dug through all...

Dark Web Roast - June 2025 Edition

Dark Web Roast - June 2025 Edition By Trellix Advanced Research Center · July 21, 2025 Executive Summary Welcome to the very first Dark Web Roast! Each month, we're going to take a peek into the shadowy world of cybercrime and playfully "roast" some of its characters, all with a little help from...

Cyber Threat Landscape Q&A with Trellix Head of Threat Intelligence John Fokker

Cyber Threat Landscape Q&A with Trellix Head of Threat Intelligence John Fokker By Trellix · January 27, 2025 As we step into 2025, it's time to reflect on the seismic changes that shaped the cybersecurity landscape in 2024 and anticipate what's on the horizon for 2025. The past year saw...

Transforming Threat Actor Research into a Strong Defense Strategy

Transforming Threat Actor Research into a Strong Defense Strategy By James Murphy, Ale Houspanossian, Leandro Velasco LV and Ilya Kolmanovich · November 14, 2024 What does it take to transform threat actor research into detection engineering? If we look at threat intelligence at its core, then we...

OneDrive Pastejacking

OneDrive Pastejacking: The crafty phishing and downloader campaign By Rafael Pena · July 29, 2024 Over the past few weeks, the Trellix Advanced Research Center has observed a sophisticated Phishing/downloader campaign targeting Microsoft OneDrive users. This campaign heavily relies on social...

Tale of Greatness: Journey Through Dark Roads

Tale of Greatness: Journey Through Dark Roads By Daksh Kapur, Vihar Shah, Pooja Khyadgi · May 22, 2024 Cybercriminals have a new weapon in their arsenal: Greatness, a PaaS tool specifically designed to steal your Microsoft 365 login credentials. First detected in mid-2022, it allows attackers to...

Cybercrooks leveraging anti automation toolkit for phishing campaigns

Cybercrooks Leveraging Anti Automation Toolkit for Phishing Campaigns By Vihar Shah and Rohan Shah · December 18, 2023 Threat actors have a track record of abusing tools hosted on GitHub for malicious purposes. Last year we showed how attackers abused Python’s tarfile module. Trellix Advanced...

We Don’t Just Patch – We Hack

We Don’t Just Patch – We Hack By Trellix · February 1, 2023 This blog was written by Douglas McKee If you have read any security advisories, technology news articles or even our very own Bug Report, you have continually been bombarded with the message to patch, patch, patch! Patching is critical ...

The Race to Secure eBPF for Windows

The Race to Secure eBPF for Windows By Trellix · August 11, 2022 This blog was written by Douglas McKee Innovation often improves functionality and even security; however, adoption starts slow. Adoption often doesn’t increase at a linear rate but at an exponential rate leaving behind attack...

The Sound of Malware

The Sound of Malware By Trellix · June 23, 2022 Do, a debugger, you often use Re, a reverse engineer Mi, a name, I call myself Anyways…. By now, you must be very thankful I reminded you of this famous song; I am sure it will be stuck in your head the rest of the day. You’re welcome! Confused on h...

Utilizing the Adaptive Defense Model Against Information Stealers

Trellix Global Defenders: Utilizing the Adaptive Defense Model Against Information Stealers By Taylor Mullins · May 23, 2022 Trellix is continuing to observe the continued growth in usage and general availability of Information Stealers that have the functionality to collect passwords, cookies,...

Who Will Bend the Knee in RaaS Game of Thrones in 2022?

ARCHIVED STORY Who Will Bend the Knee in RaaS Game of Thrones in 2022? By John Fokker and Raj Samani · November 07, 2021 McAfee Enterprise and FireEye recently released its 2022 Threat Predictions. In this blog, we take a deeper dive into a Game of Thrones power struggle among...