MEGA provides free cloud storage with convenient and powerful always-on privacy. Claim your free 50GB now

PowDesk is a simple, PowerShell-based malware targeting hosts that run LANDesk Management Agent. We attribute this new malware, with a medium-high level of certainty, to APT34 (known as OilRig and HelixKitten) – an infamous Iranian APT. This malware shares similarities with the group’s previously reported malware named QUADAGENT[1], however PowDesk itself appears to be completely […]

Summary: Recently, Volon Threat Research identified a malware sample that was uploaded to Public File scanning service on Dec 23, 2019, and was able to acquire the malware and perform further research. Our analysis indicates that the malware appears to be targeting hosts that run LANDesk Management Agent. Public reporting on the malware suggests, based…

Nowadays Iran’s Cybersecurity capabilities are under microscope, many news sites, gov. agencies and security experts warn about a possible cybersecurity infiltration from Iranian government a…

You knew where this was heading. In our previous articles we identified a constellation of front companies for APT activity in Hainan and a computer science specialist at Hainan University who is l…

A blog from the world class Intelligence Group, Talos, Cisco's Intelligence Group

New York Times journalist Ben Hubbard was targeted with NSO Group’s Pegasus spyware via a June 2018 SMS message promising details about “Ben Hubbard and the story of the Saudi Royal Family.” The SMS contained a hyperlink to a website used by a Pegasus operator that we call KINGDOM. We have linked KINGDOM to Saudi Arabia. In 2018, KINGDOM also targeted Saudi dissidents including Omar Abdulaziz, Ghanem al-Masarir, and Yahya Assiri, as well as a staff member at Amnesty International.

ESET researchers have discovered a new campaign of the Winnti Group that deploys ShadowPad and Winnti malware to target universities in Hong Kong.

We have discovered a new phishing campaign conducted by APT34. The Iranian-backed group is using an updated toolset tailored to US-based companies with the intent to evade detection.

Malaysia Computer Emergency Response Team MyCERT