Category: Reports & Threat Intel
The Tailored Intelligence Team at Prevailion has detected a new campaign—at least a facet of which is currently active—dubbed The Curious Case of the Criminal Curriculum Vitae.
Prevailion’s Tailored Intelligence team has followed an active supply chain attack that has been ongoing since late 2017, we named this campaign “PHPs Labyrinth.”
Prevailion’s Tailored Intelligence team has discovered new campaigns associated with the Gorgon Group, suspected Pakistani based actors, who previously operated the MasterMana botnet. While this group relied upon an amalgamation of multiple open-source and commercially available tools, they have proven themselves to be highly capable.
Prevailion’s first APEX™ Report demonstrates its unique visibility into the top compromised industries. Prevailion is an evolved solution for an evolved threat. We believe the next generation of intelligence that will lead businesses into a new era of security is Compromise Intelligence. This report shows the active compromises that organizations are up against.
Prevailion’s Tailored Intelligence Team has continued to follow an evolving threat actor group dubbed TA505 – a known cyber criminal organization that has likely been active since at least 2017, whose motives are speculated to be financial in nature. This group has been known to infect victims through business email compromise. Once a victim’s system is initially compromised, TA505 has been observed utilizing a wide variety of commercially available and custom remote access trojans. Upon gaining access, with a trojan in the network, they have been observed stealing sensitive financial data and in some cases deploying ransomware as recently as October of 2019.
The Tailored Intelligence Team at Prevailion has uncovered new aspects of sophisticated campaigns that we associate with high confidence to the Muddy Water threat actors. Security researchers, such as FireEye, have stated Muddy Water’ activity was tied to a group with an Iran-nexus. We have dubbed this campaign “Summer Mirage,” and we assess that it is a continuation of activity previously reported campaign called “BlackWater”.
