T1098 – Account Manipulation

Blog | Scenario

The Trigona ransomware
ByDetecteam 2023-10-112023-10-11

TLP TLP TLP CLEAR Author Jordi M. Lobo Summary The Trigona ransomware, emerging in late 2022, has rapidly evolved with continuous updates. By April 2023, it started targeting MSSQL servers through brute force methods. This threat is linked to the CryLock ransomware group and possibly ALPHV (BlackCat), though their involvement remains uncertain. The US and…

Read More The Trigona ransomware
Blog | Scenario

Barracuda ESG Zero-Day Vulnerability
ByDetecteam 2023-09-062023-09-06

TLP TLP TLP CLEAR Author David Deflache Summary In May 2023, Barracuda disclosed a zero-day vulnerability (CVE-2023-2868) exploited by UNC4841, a suspected Chinese espionage actor. UNC4841 targeted Barracuda Email Security Gateways (ESG) since October 2022, using malicious email attachments. They deployed code families (SALTWATER, SEASPY, SEASIDE) to infiltrate and maintain control, often disguising as legitimate…

Read More Barracuda ESG Zero-Day Vulnerability

End of content

End of content