CloudSEK TRIAD

CloudSEK Threat Research and Information Analytics Division

Blogs & Articles

Read all Blogs from this Author

Inside a Tor Backed Supply Chain Worm

CloudSEK TRIAD uncovered a sophisticated npm supply chain attack using a typosquatted package, crypto-javascri, to mimic crypto-js. The malware steals npm and GitHub credentials, hijacks maintainer accounts, republishes trojanized packages, and uses Tor-based command-and-control. The campaign targets Linux developer systems and CI/CD environments, creating serious downstream supply chain risk.

RedSun: Windows 0day when Defender becomes the attacker

RedSun exposes a critical logic flaw in Windows Defender that allows a standard user to escalate privileges to SYSTEM without admin rights or kernel exploits. By exploiting a missing reparse point validation during file restoration, attackers can redirect Defender’s write operation into System32 and execute arbitrary code. The attack is reliable, unpatched, and affects modern Windows systems with Defender enabled, making it a serious security concern.

Whitepapers and Reports

Read all Whitepapers and reports from this Author

Threat Landscape Report for Middle East 2024

Beyond the Storefront: E-commerce and Retail Threat Insights

The report "Beyond the Storefront: E-commerce and Retail Threat Insights" highlights the growing cyber threats to the e-commerce and retail sectors, including a surge in ransomware attacks, hacktivist activities, and data breaches. It emphasizes the need for enhanced security measures as these industries face increasing risks from financially motivated attacks and politically driven hacktivism.

MichaMichaBot: Unveiling the Exploitation of Missing "X-Frame-Options" HTTP Headers in Phishing Attacks

The report "MichaMichaBot: Unmasking the Threats Exploiting Missing 'X-Frame-Options' Headers" reveals how cybercriminals exploit this vulnerability to launch phishing attacks by embedding legitimate websites in iframes with fake login panels. It provides insights into these attack methods and practical strategies to secure digital assets against such threats.

Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware

Our whitepaper, "Unveiling Maorrisbot: The Inner Workings of an Android Trojan Malware," explores the sophisticated methods and impacts of Maorrisbot malware, offering insights and strategies to protect your devices. Download it to learn how to safeguard against this significant Android threat.

Knowledge Base

Read all knowledge base articles from this Author

No Knowledge base articles found.