T1546.003 – Event Triggered Execution: Windows Management Instrumentation Event Subscription

Blog | Scenario

Shadowpad, PlugX, China Chopper, Stowaway RAT
ByDetecteam 2023-12-072023-12-07

TLP TLP TLP CLEAR Author David Deflache, Sebastien Tricaud Summary This week, we share data from another attack being exploited. In mid-Autumn 2021, Kaspersky experts uncovered a ShadowPad malware campaign targeting a national telecom company in Pakistan. The attack, presumed to have begun in winter 2021, exploited MS Exchange vulnerability (CVE-2021-26855) to install a Cobalt…

Read More Shadowpad, PlugX, China Chopper, Stowaway RAT
Blog | Scenario

SELECT XMRig FROM SQLServer
ByDetecteam 2023-06-092023-06-09

TLP TLP TLP CLEAR Author David Deflache Summary The attack on the Microsoft SQL Server involved a series of sophisticated techniques employed by the adversaries. It began with the initial stage of reconnaissance, where the attackers sought to identify vulnerabilities and potential entry points. They then proceeded to exploit a known vulnerability in the server…

Read More SELECT XMRig FROM SQLServer

End of content

End of content