Zach Hilbert

What is LockerGoga? LockerGoga is a recently discovered ransomware that has also made systems irrecoverable in some cases due to how the malware modifies victim computers. FireEye has attributed LockerGoga to the FIN6 attack group. Originally, FireEye found this group compromising payment card information from hospitality and retail industries. Point-of-sale

What is gh0st? "GH0ST RAT is a backdoor derived from public source code. It may also be detected as Backdoor.APT.Gh0stRat. The compiled source code provides attackers with many ways to control a victim’s system, including the ability to create, manipulate, delete, launch, or transfer files; perform

What is FF-RAT? FF-RAT is a proxy-aware RAT that has been in use for more than 7 years. FF-RAT provides attackers complete control of infected systems. The malware uses many different methods to avoid detection and maintain persistence. [1] Aliases No known aliases. Associated Individuals Not explicitly known but C2

What is Etumbot? Etumbot is a malware family that ASERT Threat Intelligence wrote about in June 2014. ASERT attributed Etumbot to Chinese actor APT12 and compared it with IXESHE "based on similar system and network artifacts that are common between the malware families." [1] The Technical Review written

What is NotPetya? NotPetya, or EternalPetya as it’s sometimes referred as, was a type of ransomware variant which completely destroyed infected systems by encrypting its contents and removing the ability for anyone to recover data from the hard drive. NotPetya used EternalBlue and Mimikatz to propagate throughout a network.

What is CRASHOVERRIDE? CRASHOVERRIDE is the first ICS malware framework discovered in an attack against a Ukrainian substation on December 17th, 2016. Robert Lee believes the Kiev attack was a test for future attacks. Based on Robert's assessment of CRASHOVERRIDE functionality, there are components that weren't

Who is TEMP.Periscope? TEMP.Periscope, also known as Leviathan, TEMP.Jumpter, and APT40 is likely a Chinese, state-sponsored group that has focused its efforts on engineering and maritime industries, especially entities connected to issues involving the South China Sea. Some of the engineering organizations include research and academic institutions

Who is APT31? APT31 is an advanced group often attributed to the Chinese government. As with most APT groups tied to the Chinese government, APT31 targets a variety of industries including US defense, aerospace, energy, finance, and technology among others. The attacks associated with APT31 demonstrate significant technical expertise and

Who is APT27? APT27 is a threat group that has been linked to China. This group uses tactics consistent with a moderately sophisticated skillset but also demonstrate discipline and an ability to plan and act strategically. APT27 targets very specific groups of victims and will often limit their attacks to

Who is APT18? APT18 is a sophisticated threat group that has been attributed to China and active since 2009. This group is quick to make use of newly discovered vulnerabilities and exploits in order to compromise victims. FireEye compares APT18 to the activity of APT3. [2] While they share usage