HAWKEYE

Advanced Persistent Threat, Cyber Security, Managed SOC Services

Using Steganography to Hide Malware – Witchetty APT Case Study

Steganography has been used in the real world on the Windows and macOS operating systems. Attackers have been detected to […]

Advanced Persistent Threat, Cyber Security, Managed SOC Services

The Evolution of SideWinder APT and their Modus-Operandi

A suspected Indian threat actor group, Sidewinder, has been operating at least since 2012. They have been seen attacking businesses, […]

Advanced Persistent Threat, Cyber Security, Managed SOC Services

Opera1er APT Group Targeting Banks, Financial Institutes, and Mobile Operators across Africa, Asia and LATAM

Since 2016, OPERA1ER, also known as DESKTOP-GROUP, Common Raven, and NXSMS, has been reported to operate with the intention of […]

Cyber Security, Incident Response, Managed SOC Services, Ransomware Protection

Royal Ransomware

Royal has been in existence since at least the beginning of 2022, making it a relatively new business. The goal […]

Cyber Security, Cyber Threat Management, Managed SOC Services

How to Detect Typosquatting using DNSTwist

Typosquatting is a social engineering attack in which a threat actor registers domains with purposefully misspelled versions of well-known companies’ […]

Cyber Security, Malware Protection, Managed SOC Services, Security Operations Center

Ursnif/Gozi Malware Evolution and Associated IoC

Gozi is a powerful piece of malware with a wide range of intricate characteristics. It began as a basic banking […]

Cyber Security, Incident Response, Managed SOC Services, Security Operations Center

Detecting Cyber-Attacks on Kubernetes Environment

Kubernetes is a container orchestration system that acts as a management abstraction layer. It is an open-source system that aids […]

Advanced Persistent Threat, Cyber Security, Malware Protection, Managed SOC Services

An overview of FIN11 and their motivations

A financially driven threat group FIN11 has run some of the most extensive and longest-running malware dissemination campaigns. Researchers have […]

Advanced Persistent Threat, Alert Advisory, Cyber Threat Management, Managed SOC Services

Alert Advisory: Insight into APT29

Threat group APT29 is allegedly operated by Russia’s Foreign Intelligence Service (SVR). They have been active since 2008 and frequently […]

Advanced Persistent Threat, Alert Advisory, Cyber Security, Incident Response, Managed Security Services, Managed SOC Services

Alert Advisory: Insight into APT42

APT42 is a state-sponsored cyber espionage group in Iran. The gang, which has been active at least since 2015, is […]

Alert Advisory, Incident Response, Managed Security Services, Managed SOC Services, Security Operations Center, Threat Hunting, XDR

Alert Advisory: New Microsoft Exchange Zero-Days

Late on September 29, 2022, Microsoft acknowledged both zero-day vulnerabilities and stated that they were aware of “limited, targeted attacks […]

Breach Detection, Cyber Security, Managed SOC Services

Recent Uber Breach and Lessons Learnt

Uber acknowledged reports of a widespread cybersecurity compromise on September 15th. The security investigation found that the company’s system had […]

Cyber Security, Managed Security Services, Managed SOC Services

Usage of NPPSpy

Extracting Windows credentials from Domain based hosts is one of the common attack techniques hackers use to obtain user credentials […]

Cyber Security, Machine Learning, Malware Protection, Managed SOC Services

Malware Evasion Techniques and Recommendations for Threat Protection

Malware evasion methods are frequently employed to evade detection, analysis, and comprehension. Due to the fact that sandboxes are now […]

Cyber Security, Cyber Threat Intelligence, Machine Learning, Managed Security Services, Managed SOC Services, Security Operations Center, Threat Hunting, Threat Intelligence

Data Exfiltration and Detection through Anomaly Detection

Data exfiltration is the unauthorised transfer of critical and sensitive data and/or information from a targeted network to the cyber […]

Cyber Security, Machine Learning, Managed Security Services, Managed SOC Services

DGA Detection Using Machine Learning

Domain Generation algorithm (DGA) is an automation technique used by cyber attackers for a variety of attacks like Data exfiltration, […]

Cyber Security, Machine Learning, Managed SOC Services, UEBA

Augmenting Traditional UEBA with ML and Deep Learning

User and entity behavior analytics (UEBA) is a threat detection technology that is based on analytics. UEBA employs machine learning […]

Cyber Security, Security Operations Center

Tools Used for Dumping of RDPCreds via comsvcs.dll

Remote Desktop Protocol (RDP) is commonly used by administrators to manage Windows environments remotely. It is also typical for RDP […]

Cyber Security, Managed SOC Services, Security Operations Center

Sniffing Attacks – Packet Capture Techniques Used by Attackers

Sniffing attacks are data thefts caused by capturing network traffic with packet sniffers, which can illegally access and read unencrypted […]

Cyber Security, Managed SOC Services, Security Operations Center

LSASS Dumping Techniques

Local Security Authority Subsystem Service (LSASS) is the process on Microsoft Windows that handles all user authentication, password changes, creation […]

Cyber Security, Reconnaissance Tools

Common Reconnaissance Tools Used by Threat Actors

Reconnaissance consists of techniques that involve adversaries actively or passively gathering information that can be used to support targeting. Background […]

Cyber Security, Managed SOC Services, XDR

DNS Tunneling and Countermeasures in an Enterprise

DNS tunneling is one of the significant threats that an organization faces when it comes to attacker tactics and techniques […]

Alert Advisory, Cyber Security, Managed SOC Services, Ransomware Protection, Security Operations Center, XDR

Alert Advisory: Analysis of BlackCat Ransomware

BlackCat, also known as ALPHV-ng, ALPHV, and Noberus, is a Ransomware-as-a-Service (RaaS) threat that targets organizations across multiple sectors worldwide […]

Cyber Security

SSO SAML Tokens Attack

SAML (In)Security Security Assertion Markup Language (SAML) is a method for exchanging authentication and authorization between trusted parties. It’s essentially […]

Using Steganography to Hide Malware – Witchetty APT Case Study

The Evolution of SideWinder APT and their Modus-Operandi

Opera1er APT Group Targeting Banks, Financial Institutes, and Mobile Operators across Africa, Asia and LATAM

Royal Ransomware

How to Detect Typosquatting using DNSTwist

Ursnif/Gozi Malware Evolution and Associated IoC

Detecting Cyber-Attacks on Kubernetes Environment

An overview of FIN11 and their motivations

Alert Advisory: Insight into APT29

Alert Advisory: Insight into APT42

Alert Advisory: New Microsoft Exchange Zero-Days

Recent Uber Breach and Lessons Learnt

Usage of NPPSpy

Malware Evasion Techniques and Recommendations for Threat Protection

DGA Detection Using Machine Learning

Augmenting Traditional UEBA with ML and Deep Learning

Tools Used for Dumping of RDPCreds via comsvcs.dll

Sniffing Attacks – Packet Capture Techniques Used by Attackers

LSASS Dumping Techniques

Common Reconnaissance Tools Used by Threat Actors

DNS Tunneling and Countermeasures in an Enterprise

Alert Advisory: Analysis of BlackCat Ransomware

SSO SAML Tokens Attack

Ready to get started?

Ready to get started?

Packages

CSOC

Explore