Who Will Bend the Knee in RaaS Game of Thrones in 2022?

ARCHIVED STORY Who Will Bend the Knee in RaaS Game of Thrones in 2022? By John Fokker and Raj Samani · November 07, 2021 McAfee Enterprise and FireEye recently released its 2022 Threat Predictions. In this blog, we take a deeper dive into a Game of Thrones power struggle among...

McAfee ATR Thinks in Graphs | McAfee Blogs

ARCHIVED STORY McAfee ATR Thinks in Graphs By Valentine Mairet · MAR 08, 2021 · 19 MIN READ 0. Introduction John Lambert, a distinguished researcher specializing in threat intelligence at Microsoft, once said these words that changed perspectives: “Defenders think in lists. Attackers think in...

Six Hundred Million Reasons to Celebrate: No More Ransom Turns FOUR!!

ARCHIVED STORY Six Hundred Million Reasons to Celebrate: No More Ransom Turns FOUR!! By John Fokker · July 27, 2020 Happy Birthday! Today we mark the fourth anniversary of the NoMoreRansom initiative with over 4.2 million visitors, from 188 countries, stopping an estimated $632 million in ransom...

Ransomware Maze

ARCHIVED STORY Ransomware Maze Alexandre Mundo · MAR 26, 2020 Overview The Maze ransomware, previously known in the community as “ChaCha ransomware”, was discovered on May the 29th 2019 by Jerome Segura1. The main goal of the ransomware is to crypt all files that it can in an infected system and...

Triton Malware Spearheads Latest Attacks on Industrial Systems | McAfee Blogs

ARCHIVED STORY Triton Malware Spearheads Latest Attacks on Industrial Systems Alexandre Mundo · MAR 26, 2020 Malware that attacks industrial control systems ICS, such as the Stuxnet campaign in 2010, is a serious threat. This class of cyber sabotage can spy on, disrupt, or destroy systems that...

The Cloning of The Ring – Who Can Unlock Your Door?

ARCHIVED STORY The Cloning of The Ring - Who Can Unlock Your Door? By Eoin Carroll · January 06, 2020 Steve Povolny contributed to this report. The Cloning of The Ring McAfee’s Advanced Threat Research team performs security analysis of products and technologies across nearly every industry...

Your Smart Coffee Maker is Brewing Up Trouble

ARCHIVED STORY Your Smart Coffee Maker is Brewing Up Trouble By Sam Quinn · Febraury 25, 2019 IOT devices are notoriously insecure and this claim can be backed up with a laundry list of examples. With more devices “needing” to connect to the internet, the possibility of your WiFi enabled toaster...

Shamoon Returns to Wipe Systems in Middle East, Europe

ARCHIVED STORY Shamoon Returns to Wipe Systems in Middle East, Europe By Alexandre Mundo · December 14, 2018 Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims. Destructive...

Poor Security Exposes Medical Data to Cybercriminals

ARCHIVED STORY McAfee Researchers Find Poor Security Exposes Medical Data to Cybercriminals By Christiaan Beek · March 11, 2018 The nonperishable nature of medical data makes an irresistible target for cybercriminals. The art of hacking requires significant time and effort, encouraging experience...

McAfee Labs Advanced Threat Research Aids Arrest of Suspected Cybercrime Gang Linked to Top Malware CTB Locker

ARCHIVED STORY McAfee Labs Advanced Threat Research Aids Arrest of Suspected Cybercrime Gang Linked to Top Malware CTB Locker By Trellix · December 20, 2017 In our recent research, we interviewed the actors behind ransomware campaigns. One of the interesting findings was cybercriminals seemed to...

Operation Dragonfly Analysis Suggests Links to Earlier Attacks

ARCHIVED STORY Operation Dragonfly Analysis Suggests Links to Earlier Attacks By Trellix · December 17, 2017 On September 6, Symantec published details of the Dragonfly campaign, which targeted dozens of energy companies throughout 2017. This attack was effectively Dragonfly 2.0, an update to a...

IoT Devices: The Gift that Keeps on Giving… to Hackers

ARCHIVED STORY IoT Devices: The Gift that Keeps on Giving… to Hackers By Tim Hux · November 16, 2017 McAfee Advanced Threat Research on Most Hackable Gifts You’ve probably noticed the recent increase in Internet connected drones, digital assistants, toys, appliances and other devices hitting the...

How A Simple Misconfiguration Can Fuel Offline Attacker Tools

How A Simple Misconfiguration Can Fuel Offline Attacker Tools By Grant McDonald · April 9, 2026 It’s no secret that misconfigurations are a gateway for attackers. But that doesn’t mean misconfigurations won’t happen or that attackers won’t attempt to exploit them. In the latest research from our...

The Fake Domain Controller You Didn’t See Coming: Detecting DCShadow Attacks Using Trellix NDR

The Fake Domain Controller You Didn’t See Coming: Detecting DCShadow Attacks Using Trellix NDR By Maulik Maheta and Chao Sun · December 17, 2025 Executive summary DCShadow is a covert post-exploitation technique that enables an attacker to impersonate a domain controller and make unauthorized,...

Dark Web Roast - October 2025 Edition

Dark Web Roast - October 2025 Edition By Trellix Advanced Research Center · November 13, 2025 Executive Summary Welcome to October 2025, where the cybercrime underground has officially become more absurd than a fever dream. This month’s headline was xltshirt being royally fleeced out of $3,000 fo...

The Evolution of Russian Physical-Cyber Espionage

The Evolution of Russian Physical-Cyber Espionage By Ryan Slaney · October 6, 2025 Russian state-sponsored cyber operations, primarily those conducted by hackers belonging to its Main Intelligence Directorate GRU, also known as APT28, have long combined digital intrusions with physical tradecraft...

npm Account Hijacking and the Rise of Supply Chain Attacks

npm Account Hijacking and the Rise of Supply Chain Attacks By Trellix Advanced Research Center · September 26, 2025 Contributed by John Fokker, Ilya Kolmanovich, Pavan Podila, Mo Cashman and Jeffrey Sman Key Takeaways Software Supply Chain Attacks are on the Rise: The "Shai-Hulud" worm targeting...

When AD Gets Breached: Detecting NTDS.dit Dumps and Exfiltration with Trellix NDR

When AD Gets Breached: Detecting NTDS.dit Dumps and Exfiltration with Trellix NDR By Maulik Maheta · September 25, 2025 Executive summary Active Directory AD stores the digital keys to an organization's kingdom. When attackers gain access to a network, they often target the NTDS.dit file, which...

Understanding Iranian Capabilities and Hacktivist Activities

Understanding Iranian Capabilities and Hacktivist Activities By John Fokker · June 23, 2025 As geopolitical tensions flare again in the Middle East, cyber operations are increasingly becoming an extension of physical conflict. State-aligned threat actors, patriotic hackers, and ideologically...

Closing the Security Gap From Threat Hunting to Detection Engineering

Closing the Security Gap From Threat Hunting to Detection Engineering By Ilya Kolmanovich, Alejandro Houspanossian, Joe Malenfant and Tomer Shloman · April 16, 2025 In today's rapidly evolving AI-fueled threat landscape, every organization is trying to stop threats as early as possible. Threat...

Phobos: Stealthy Ransomware That Operated Under the Radar - Until Now

Phobos: Stealthy Ransomware That Operated Under the Radar - Until Now By Jambul Tologonov, John Fokker and Duy-Phuc Pham · November 20, 2024 On November 18th, the US Justice Department unsealed criminal charges against a Russian national for allegedly administering the sale, distribution, and...

Cyber Threats Targeting the US Government During the Democratic National Convention

Cyber Threats Targeting the US Government During the Democratic National Convention By Anne An · October 2, 2024 Introduction Trellix global sensors detected increased threat activities during the days that the Democratic National Convention DNC was held in August 2024, culminating into a massive...

Managing Risk During the CrowdStrike Global Tech Outage

Managing Risk During the CrowdStrike Global Tech Outage By Mo Cashman & Trellix Advanced Research Center · July 19, 2024 Updated: July 25, 2024 How it Happened A defective content update provided by cybersecurity firm CrowdStrike caused Microsoft Windows systems to crash, disrupting airline trave...

A New Program for Your Peloton – Whether You Like It or Not | McAfee Blogs

ARCHIVED STORY A New Program for Your Peloton – Whether You Like It or Not Sam Quinn · JUN 15, 2021 Executive Summary For those that are not familiar with Peloton, it is a brand that has combined high end exercise equipment with cutting-edge technology. Its products are equipped with a large tabl...

Operation North Star: Summary Of Our Latest Analysis | McAfee Blogs

Operation North Star: Summary Of Our Latest Analysis By Trellix · NOV 05, 2020 McAfee’s Advanced Threat Research ATR today released research that uncovers previously undiscovered information on how Operation North Star evaluated its prospective victims and launched attacks on organizations in...

Robot Character Analysis Reveals Trust Issues

ARCHIVED STORY Robot Character Analysis Reveals Trust Issues By Douglas McKee · August 05, 2020 Retired Marine fighter pilot and Top Gun instructor Dave Berke said “Every single thing you do in your life, every decision you make, is an OODA Loop.” OODA Loop? Observe–Orient–Decide–Act, the “OODA...

Ransomware Maze

ARCHIVED STORY Ransomware Maze Alexandre Mundo · MAR 26, 2020 Overview The Maze ransomware, previously known in the community as “ChaCha ransomware”, was discovered on May the 29th 2019 by Jerome Segura1. The main goal of the ransomware is to crypt all files that it can in an infected system and...

CSI: Evidence Indicators for Targeted Ransomware Attacks - Part II | McAfee Blogs

CSI: Evidence Indicators for Targeted Ransomware Attacks – Part II Christiaan Beek · FEB 20, 2020 In our first article we discussed the growing pattern of targeted ransomware attacks where the first infection stage is often an info-stealer kind of malware used to gain credentials/access to...

What’s in the Box?

ARCHIVED STORY What’s in the Box? By Sam Quinn · February 25, 2019 2018 was another record-setting year in the continuing trend for consumer online shopping. With an increase in technology and efficiency, and a decrease in cost and shipping time, consumers have clearly made a statement that...

Shamoon Returns to Wipe Systems in Middle East, Europe

ARCHIVED STORY Shamoon Returns to Wipe Systems in Middle East, Europe By Alexandre Mundo · December 14, 2018 Destructive malware has been employed by adversaries for years. Usually such attacks are carefully targeted and can be motivated by ideology, politics, or even financial aims. Destructive...

Gandcrab Ransomware Puts Pinch On Victims

ARCHIVED STORY GandCrab Ransomware Puts the Pinch on Victims By Alexandre Mundo · July 31, 2018 Update: On August 9 we added our analysis of Versions 4.2.1 and 4.3. The GandCrab ransomware first appeared in January and has been updated rapidly during its short life. It is the leading ransomware...

IoT Devices: The Gift that Keeps on Giving… to Hackers

ARCHIVED STORY IoT Devices: The Gift that Keeps on Giving… to Hackers By Tim Hux · November 16, 2017 McAfee Advanced Threat Research onMost Hackable Gifts You’ve probably noticed the recent increase in Internet connected drones, digital assistants, toys, appliances and other devices hitting the...

The Ghost in the Machine: Unmasking CrazyHunter's Stealth Tactics

The Ghost in the Machine: Unmasking CrazyHunter's Stealth Tactics By Aswath A · January 6, 2026 CrazyHunter ransomware has emerged as a significant and concerning threat, highlighting the increasing sophistication of cybercriminal tactics. Trellix has been actively tracking this ransomware since...

The Silent Threat in Active Directory: How AS-REP Roasting Steals Passwords Without a Trace and Trellix NDR’s Rapid Detection

The Silent Threat in Active Directory: How AS-REP Roasting Steals Passwords Without a Trace and Trellix NDR’s Rapid Detection By Maulik Maheta · October 15, 2025 Executive summary Adversaries use AS-REP Roasting to extract and crack password hashes from Active Directory AD accounts with Kerberos...

Unmasking Hidden Threats: Spotting a DPRK IT-Worker Campaign

Unmasking Hidden Threats: Spotting a DPRK IT-Worker Campaign By Duy-Phuc Pham and John Fokker · September 23, 2025 In today's complex threat landscape, staying ahead of sophisticated adversaries is paramount. Organizations face constant pressure to identify threats that do not always involve...

Blurring the Lines: How Nation-States and Organized Cybercriminals Are Becoming Alike

Blurring the Lines: How Nation-States and Organized Cybercriminals Are Becoming Alike By Tomer Shloman · January 7, 2025 The distinction between nation-state actors and organized cybercriminals is becoming increasingly blurred in our rapidly evolving cyber landscape. Historically, these groups ha...

When Guardians Become Predators: How Malware Corrupts the Protectors

When Guardians Become Predators: How Malware Corrupts the Protectors By Trellix · November 20, 2024 This blog was also written by Trishaan Kalra Introduction We often trust our security software to stand as an unbreakable wall against malware and attacks, but what happens when that very wall is...

Trellix Global Defenders: Analysis and Protections for Destructive Wipers

Trellix Global Defenders: Analysis and Protections for Destructive Wipers By Ayed Al Qartah · November 17, 2022 Modern cyber warfare involves the actions of a nation-state or their proxies organized crime and hacker groups to attack and attempt to damage other nations’ computers or information...

Get to Know Steve Povolny

Meet Steve Povolny Head of Advanced Threat Research for Trellix Threat Labs By Michael Alicea · May 17, 2022 At Trellix, we celebrate and champion our people. This week, I sat down with Steve Povolny, Head of Advanced Threat Research for Trellix Threat Labs. As he is one of the leading...

Cyberattacks Rise Targeting Infrastructure and Geo Tensions

Trellix Threat Labs Research Report: Cyberattacks Targeting Critical Infrastructure Rise Along with Geopolitical Tensions By Trellix · April 27, 2022 The release of our Trellix Threat Labs Research Report: April 2022 examines cybercriminal behavior and activity related to cyber threats in the...

Nation-State Crosshairs: Australia, India & Japan

In The Nation-State Crosshairs: Australia, India & Japan By Trellix · March 28, 2022 Today Trellix and the Center for Strategic and International Studies CSIS released a global report, In the Crosshairs: Organizations and Nation-State Cyber Threats, examining security professionals’ mindsets...

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections By Taylor Mullins · March 23, 2022 Trellix is continuing to monitor the threat activity related to the LAPSUS$ threat group and their recent breaches of large organizations such as NVIDIA, Samsung, Microsoft, and Okta. This...

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service - The All-Stars | McAfee Blogs

McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – The All-Stars John Fokker · OCT 02, 2019 Episode 2: The All-Stars Analyzing Affiliate Structures in Ransomware-as-a-Service Campaigns This is the second installment of the McAfee Advanced Threat Research ATR analysis of Sodinokibi...

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense

DCSync Detection Without Signatures: Trellix NDR and the Power of Technique-Based Defense By Maulik Maheta and Chao Sun · April 14, 2026 Executive summary A DCSync attack is one of the most formidable techniques an adversary can deploy after gaining a foothold in an Active Directory AD environmen...

Getting Roasted? Trellix Helix sees through AS-REP Attack

Getting Roasted? Trellix Helix sees through AS-REP Attack By Adithya Chandra and Maulik Maheta · March 17, 2026 Executive summary Threat actors regularly target Active Directory environments, continuously refining their toolsets and modifying attack frameworks to bypass security controls. However...

XWorm’s Evolving Infection Chain: From Predictable to Deceptive

XWorm’s Evolving Infection Chain: From Predictable to Deceptive By Prashanth A N and Satish Chimakurthi · September 3, 2025 A sophisticated and evolving prevalent XWorm backdoor campaign has recently been identified by the Trellix Advanced Research Center, marking a significant strategic shift in...

Let’s Be Objective: A Deep Dive into 0bj3ctivityStealer's Features

Let’s Be Objective: A Deep Dive into 0bj3ctivityStealer's Features By Ernesto Fernández Provecho · July 28, 2025 The infostealer landscape keeps evolving year over year, and we are beginning to observe new features, targeting more applications and data, and the implementation of new obfuscation a...

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect

Detecting and Visualizing Lateral Movement Attacks with Trellix Helix Connect By Maulik Maheta and Adithya Chandra · July 17, 2025 Executive summary This blog marks the third installment in our series on detecting and visualizing lateral movement attacks with Trellix Helix Connect. A lateral...

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities

From Click to Compromise: Unveiling the Sophisticated Attack of DoNot APT Group on Southern European Government Entities By Aniket Choukde, Aparna Aripirala, Alisha Kadam, Akhil Reddy, Pham Duy Phuc and Alex Lanstein · July 8, 2025 Introduction The DoNot APT group, also identified by various...

DarkGate again but... Improved?

DarkGate again but... Improved? By Ernesto Fernández Provecho · June 3, 2024 Executive summary During 2023, DarkGate made a comeback with a version full of new features, becoming one of the most preferred Remote Access Trojans RATs by malicious actors. However, this momentum also required...