Kristina Balaam discusses her work attributing two new mobile malware families to APT41.

UNC4990 uses USB devices for initial infection, targets users based in Italy, and is likely motivated by financial gain.

We are very excited to add a new machine learning (ML) layer to this defense-in-depth endpoint strategy: MalwareGuard.

Our adversaries are familiar with the RTF format and the inner workings of Microsoft Word, and can devise obfuscation tricks to evade traditional signature-based detection. Understanding hackers perform obfuscation can in turn help us improve our detection of this type of malware.

FireEye is activity that involves the interactive deployment of Ryuk ransomware following TrickBot malware infections.

Iteratively annotating functions is one strategy for a malware analyst, but it can be a tedious process.

In the middle of June, we observed an active campaign leveraging HawkEye malware that is not targeting any specific group of industries or any specific region.