Get to Know Fred House

Meet Fred House Senior Director, Product Detection and Research By Trellix · July 12, 2022 This blog was written by Michael Alicea At Trellix, we celebrate and champion our people. For a long time now, I’ve been looking forward to connecting with Fred House, a Senior Director at Trellix Threat La...

The Sound of Malware

The Sound of Malware By Trellix · June 23, 2022 Do, a debugger, you often use Re, a reverse engineer Mi, a name, I call myself Anyways…. By now, you must be very thankful I reminded you of this famous song; I am sure it will be stuck in your head the rest of the day. You’re welcome! Confused on h...

Executive Summary: Organizations and Nation-State Cyber Threats

Executive Summary: Organizations and Nation-State Cyber Threats By John Fokker · March 28, 2022 Traditionally when we talk about threat actors, we first need to make the split between cybercrime and nation-state sponsored operations. Where cybercrime is mostly focused on financial gain,...

Cyberattacks Targeting Ukraine and HermeticWiper Protections

Trellix Global Defenders: Cyberattacks Targeting Ukraine and HermeticWiper Protections By Taylor Mullins · February 28, 2022 Trellix is monitoring the ongoing cyberattacks targeting the Ukraine and any threat activity targeting entities outside of the Ukraine. Trellix is continuing to add...

Ryuk Ransomware Attack: Rush to Attribution Misses the Point

ARCHIVED STORY Ryuk Ransomware Attack: Rush to Attribution Misses the Point By John Fokker · January 09, 2019 Senior analyst Ryan Sherstobitoff contributed to this report. During the past week, an outbreak of Ryuk ransomware that impeded newspaper printing services in the United States has garner...

BIOS Boots What? Finding Evil in Boot Code at Scale! | Trellix

ARCHIVED STORY BIOS Boots What? Finding Evil in Boot Code at Scale! By Ryan Fisher, Andrew Davis · August 08, 2018 Malware continues to take advantage of a legacy component of modern systems designed in the 1980s. Despite the cyber threat landscape continuing to evolve at an ever-increasing pace,...

Gandcrab Ransomware Puts Pinch On Victims

ARCHIVED STORY GandCrab Ransomware Puts the Pinch on Victims By Alexandre Mundo · July 31, 2018 Update: On August 9 we added our analysis of Versions 4.2.1 and 4.3. The GandCrab ransomware first appeared in January and has been updated rapidly during its short life. It is the leading ransomware...

Cybercrime in the Spotlight: How Crooks Capitalize on Cultural Events

ARCHIVED STORY Cybercrime in the Spotlight: How Crooks Capitalize on Cultural Events By John Fokker · July 03, 2018 Every four years, everyone’s head around the globe turns toward the television. The Olympics, the World Cup – world events like these have all eyes viewing friendly competition...

McAfee Labs Advanced Threat Research Aids Arrest of Suspected Cybercrime Gang Linked to Top Malware CTB Locker

ARCHIVED STORY McAfee Labs Advanced Threat Research Aids Arrest of Suspected Cybercrime Gang Linked to Top Malware CTB Locker By Trellix · December 20, 2017 In our recent research, we interviewed the actors behind ransomware campaigns. One of the interesting findings was cybercriminals seemed to...

Today’s threat landscape demands a proactive OT security strategy

Today’s threat landscape demands a proactive OT security strategy By John Fokker and Mo Cashman · November 18, 2025 Overview: The operational technology OT security landscape is undergoing rapid transformation, marked by an escalation in advanced threats. As reported in Trellix’s November...

Cyber Threat Landscape Q&A with Trellix Head of Threat Intelligence John Fokker

Cyber Threat Landscape Q&A with Trellix Head of Threat Intelligence John Fokker By Trellix · January 27, 2025 As we step into 2025, it's time to reflect on the seismic changes that shaped the cybersecurity landscape in 2024 and anticipate what's on the horizon for 2025. The past year saw...

Cyber Threats Targeting the US Government During the Democratic National Convention

Cyber Threats Targeting the US Government During the Democratic National Convention By Anne An · October 2, 2024 Introduction Trellix global sensors detected increased threat activities during the days that the Democratic National Convention DNC was held in August 2024, culminating into a massive...

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect - Part 2

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect - Part 2 By Maulik Maheta · May 21, 2023 This blog was also written by Chintan Shah Executive summary In the part 1 of this series we discussed in depth about the known Lateral movement attacks like abusing weak service...

ChatGPT: A tool for offensive cyber operations?! Not so fast!

ChatGPT: A tool for offensive cyber operations?! Not so fast! By Trellix · March 09, 2023 This story was also written by John Rodriguez. To ChatGPT or to not ChatGPT? That is a predominant question in the cyber landscape these days. It’s no surprise that AI bots have taken society by storm. On th...

Wipermania: An All You Can Wipe Buffet

Wipermania: An All You Can Wipe Buffet By Max Kersten · November 15, 2022 In early 2022, Ukrainian companies were struck by multiple destructive wipers, attacking various organizations across sectors. This raised questions about the usage and impact of “digital weapons” within the security...

Cyberattacks Rise Targeting Infrastructure and Geo Tensions

Trellix Threat Labs Research Report: Cyberattacks Targeting Critical Infrastructure Rise Along with Geopolitical Tensions By Trellix · April 27, 2022 The release of our Trellix Threat Labs Research Report: April 2022 examines cybercriminal behavior and activity related to cyber threats in the...

5G: The Final Frontier

5G: The Final Frontier This story was written by Kevin Mcgrath · April 7th, 2022 Today Trellix Threat Labs is excited to announce the release of a whitepaper dedicated to 5G and its potential security concerns. As we look at the potential of 5G, we foresee it impacting nearly every facet of digit...

Executive Summary: Organizations and Nation-State Cyber Threats

Executive Summary: Organizations and Nation-State Cyber Threats By John Fokker · March 28, 2022 Traditionally when we talk about threat actors, we first need to make the split between cybercrime and nation-state sponsored operations. Where cybercrime is mostly focused on financial gain,...

Detection of ‘Leave Behinds’ From Nation-State Actors

Who left the backdoor open? By Trellix · March 28, 2022 In our recent report, In the Crosshairs: Companies and Nation-State Cyber Threats, over 800 IT decision makers from around the world were interviewed on their experiences with nation-state cyber attacks. One of the questions sought to...

Who Will Bend the Knee in RaaS Game of Thrones in 2022?

ARCHIVED STORY Who Will Bend the Knee in RaaS Game of Thrones in 2022? By John Fokker and Raj Samani · November 07, 2021 McAfee Enterprise and FireEye recently released its 2022 Threat Predictions. In this blog, we take a deeper dive into a Game of Thrones power struggle among...

Six Hundred Million Reasons to Celebrate: No More Ransom Turns FOUR!!

ARCHIVED STORY Six Hundred Million Reasons to Celebrate: No More Ransom Turns FOUR!! By John Fokker · July 27, 2020 Happy Birthday! Today we mark the fourth anniversary of the NoMoreRansom initiative with over 4.2 million visitors, from 188 countries, stopping an estimated $632 million in ransom...

Ransomware Maze

ARCHIVED STORY Ransomware Maze Alexandre Mundo · MAR 26, 2020 Overview The Maze ransomware, previously known in the community as “ChaCha ransomware”, was discovered on May the 29th 2019 by Jerome Segura1. The main goal of the ransomware is to crypt all files that it can in an infected system and...

What’s in the Box?

ARCHIVED STORY What’s in the Box? By Sam Quinn · February 25, 2019 2018 was another record-setting year in the continuing trend for consumer online shopping. With an increase in technology and efficiency, and a decrease in cost and shipping time, consumers have clearly made a statement that...

Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks

ARCHIVED STORY Organizations Leave Backdoors Open to Cheap Remote Desktop Protocol Attacks By John Fokker · July 11, 2018 Thanks to my colleague Christiaan Beek for his advice and contributions. While researching underground hacker marketplaces, the McAfee Advanced Threat Research team has...

Apply MITRE’s ‘ATT&CK’ Model to Check Your Defenses

ARCHIVED STORY Apply MITRE’s ‘ATT&CK’ Model to Check Your Defenses By Trellix · June 18, 2018 Every week we read about adversaries attacking their targets as part of online criminal campaigns. Information gathering, strategic advantage, and theft of intellectual property are some of the...

IoT Devices: The Gift that Keeps on Giving… to Hackers

ARCHIVED STORY IoT Devices: The Gift that Keeps on Giving… to Hackers By Tim Hux · November 16, 2017 McAfee Advanced Threat Research onMost Hackable Gifts You’ve probably noticed the recent increase in Internet connected drones, digital assistants, toys, appliances and other devices hitting the...

The Bug Report – August 2026 Edition

The Bug Report – August 2026 Edition By Jonathan Omakun · September 3, 2026 Why am I here? Sharpen your pencils and pull out those fresh notebooks; we're back with the bug report! Half the world is squeezing the last drops of joy out of their summer vacations, and the other half is on the...

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect By Maulik Maheta and Adithya Chandra · July 17, 2025 Executive summary This blog marks the third installment in our series on detecting and visualizing lateral movement attacks with Trellix Helix Connect. A lateral...

When Guardians Become Predators: How Malware Corrupts the Protectors

When Guardians Become Predators: How Malware Corrupts the Protectors By Trellix · November 20, 2024 This blog was also written by Trishaan Kalra Introduction We often trust our security software to stand as an unbreakable wall against malware and attacks, but what happens when that very wall is...

Nation-State Crosshairs: Australia, India & Japan

In The Nation-State Crosshairs: Australia, India & Japan By Trellix · March 28, 2022 Today Trellix and the Center for Strategic and International Studies CSIS released a global report, In the Crosshairs: Organizations and Nation-State Cyber Threats, examining security professionals’ mindsets...

McAfee ATR Thinks in Graphs | McAfee Blogs

ARCHIVED STORY McAfee ATR Thinks in Graphs By Valentine Mairet · MAR 08, 2021 · 19 MIN READ 0. Introduction John Lambert, a distinguished researcher specializing in threat intelligence at Microsoft, once said these words that changed perspectives: “Defenders think in lists. Attackers think in...

Additional Analysis into the SUNBURST Backdoor | McAfee Blogs

ARCHIVED STORY Additional Analysis into the SUNBURST Backdoor Christiaan Beek · DEC 17, 2020 Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoC...

Additional Analysis into the SUNBURST Backdoor | McAfee Blogs

ARCHIVED STORY Additional Analysis into the SUNBURST Backdoor Christiaan Beek · DEC 17, 2020 Executive Summary There has been considerable focus on the recent disclosures associated with SolarWinds, and while existing analysis on the broader campaign has resulted in detection against specific IoC...

My Adventures Hacking the iParcelBox

ARCHIVED STORY My Adventures Hacking the iParcelBox By Sam Quinn · June 18, 2020 In 2019, McAfee Advanced Threat Research ATR disclosed a vulnerability in a product called BoxLock. Sometime after this, the CEO of iParcelBox, a U.K. company, reached out to us and offered to send a few of their...

Poor Security Exposes Medical Data to Cybercriminals

ARCHIVED STORY McAfee Researchers Find Poor Security Exposes Medical Data to Cybercriminals By Christiaan Beek · March 11, 2018 The nonperishable nature of medical data makes an irresistible target for cybercriminals. The art of hacking requires significant time and effort, encouraging experience...

DDoS Attacks in the Netherlands Reveal Teen Gamers on Troublesome Path

ARCHIVED STORY DDoS Attacks in the Netherlands Reveal Teen Gamers on Troublesome Path By John Fokker · Febraury 22, 2018 At the end of January, the Netherlands was plagued by distributed denial of service DDoS attacks targeting various financial institutions, tech sites, and the Dutch tax...

Taiwan Bank Heist and the Role of Pseudo Ransomware

ARCHIVED STORY Taiwan Bank Heist and the Role of Pseudo Ransomware By Trellix · October 12, 2017 Widespread reports claim the Far Eastern International Bank in Taiwan has become a victim of hacking. The attacks demonstrate the global nature of cybercrime, with the cybercriminals attempting to wir...

Feeding Gophers to Ghidra

Feeding Gophers to Ghidra By Max Kersten · June 6, 2023 The scripts discussed in the article are based on the magnificent work of Dorka Palotay from CUJOai. Golang malware is becoming increasingly prevalent, requiring analysts to know how to effectively analyze these files without diving into a...

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and *nix Systems? | McAfee Blogs

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and nix Systems? Thibault Seret · JUL 28, 2021 Co-written with Northwave’s Noël Keijzer. Executive Summary For a long time, ransomware gangs were mostly focused on Microsoft Windows operating systems. Yes, we observed the...

Iran Cyber Threat Update

ARCHIVED STORY Iran Cyber Threat Update By Trellix · January 08, 2020 Recent political tensions in the Middle East region have led to significant speculation of increased cyber-related activities. McAfee is on a heightened state of alert to monitor the evolving threats and rapidly implement...

Dark Web Roast - August 2026 Edition

Dark Web Roast – August 2026 Edition By Trellix Advanced Research Center · September 24, 2026 Executive Summary August 2026 was another month where the underground did most of our investigative work for us, and this time it barely required a magnifying glass. The headline act was comedyclub on...

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations

No Privileges, No Lockout, No Trace: Kerberoasting with SPN Misconfigurations By Maulik Maheta and Henry Bernabe · August 27, 2026 Executive Summary Active Directory misconfigurations are vulnerabilities that attackers can exploit before defenders notice them. This blog exposes a stealthier...

Managing Risk During the CrowdStrike Global Tech Outage

Managing Risk During the CrowdStrike Global Tech Outage By Mo Cashman & Trellix Advanced Research Center · July 19, 2024 Updated: July 25, 2024 How it Happened A defective content update provided by cybersecurity firm CrowdStrike caused Microsoft Windows systems to crash, disrupting airline trave...

A Catalog of Hazardous AV Sites – A Tale of Malware Hosting

A Catalog of Hazardous AV Sites – A Tale of Malware Hosting By Trellix · May 23, 2024 This blog was written by Gurumoorthi Ramanathan Executive summary In mid-April 2024, Trellix Advanced Research Center team members observed multiple fake AV sites hosting highly sophisticated malicious files suc...

The Race to Secure eBPF for Windows

The Race to Secure eBPF for Windows By Trellix · August 11, 2022 This blog was written by Douglas McKee Innovation often improves functionality and even security; however, adoption starts slow. Adoption often doesn’t increase at a linear rate but at an exponential rate leaving behind attack...

Breaking the Security Barrier of a Globally Deployed Infusion Pump

ARCHIVED STORY Overmedicated: Breaking the Security Barrier of a Globally Deployed Infusion Pump By Douglas McKee, Steve Povolny and Philippe Laulheret · August 24, 2021 Cyberattacks on medical centers are one of the most despicable forms of cyber threat there is. For instance, on October 28th,...

Robot Character Analysis Reveals Trust Issues

ARCHIVED STORY Robot Character Analysis Reveals Trust Issues By Douglas McKee · August 05, 2020 Retired Marine fighter pilot and Top Gun instructor Dave Berke said “Every single thing you do in your life, every decision you make, is an OODA Loop.” OODA Loop? Observe–Orient–Decide–Act, the “OODA...

Shamoon Returns to Wipe Systems in Middle East, Europe

ARCHIVED STORY Shamoon Returns to Wipe Systems in Middle East, Europe By Alexandre Mundo · December 14, 2018 Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims. Destructive...

When the Directory Becomes the Weapon: Understanding NTDS.dit Theft

When the Directory Becomes the Weapon: Understanding NTDS.dit Theft By Maulik Maheta and Henry Bernabe · September 21, 2026 Executive Summary While adversaries continually update their attack tools, their fundamental techniques, such as extracting credentials from Active Directory's NTDS.dit and...

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment

SideCopy Threat Intel: MSHTA-driven Execution and RAT Deployment By Boggavarapu R S S Srinivas Gupta and Ravishankar N C · September 17, 2026 Introduction The modern cyber warfare landscape has evolved significantly as threat actors pivot toward simple yet highly effective and evasive malware...