How the Iranian Cyber Security Agency Detects Emissary Panda Malware

Other threat intelligence groups have previously publicised that the Chinese-attributed threat group, Emissary Panda (aka APT27, TG-3390, BRONZE UNION, Iron Tiger and LuckyMouse), have been targeting various sectors in the Middle East, including government organisations. On 15 December 2019, Iran's Minister of Communications and Information Technology, Mohammad Javad Azari-Jahromi, announced that Iranian authorities had detected foreign spying malware on their government servers which they attributed... Continue Reading →

RISE-Colombia has been cancelled

We note that our friends at LACNIC have now cancelled their LACNIC-33 event in May in Colombia, and as such Team Cymru is also canceling our part of this event (RISE-COLOMBIA): In-Person LACNIC 33 Event Has Been Canceled We are sorry for any inconvenience this might cause you and we are working hard on possible... Continue Reading →

Team Cymru Events Update

Cali, Colombia May 6-7, 2020 This message is to give you an update on our events for this year, as at March 11th, 2020.At this time, Team Cymru is moving forward and planning to be in Colombia for RISE in May and Strasbourg for UE in September, as well as Japan in November. LACNIC-33 are... Continue Reading →

Detecting Cyber Recon Using Network Signals

Author: David Monnier What's the value of a packet? How about three packets? In this post I'll show how you can identify potential reconnaissance being conducted on a network, including identifying the potential target, by taking specific note of one type of ICMP packet being produced by your border device. ICMP, or Internet Control Message... Continue Reading →

Azorult – what we see using our own tools

The Value of Being Able to Perform Threat Analysis outside the Boundaries of Your Enterprise... Looking at Dmitry Bestuzhev’s piece about AZORult cryptominer spreading as a fake ProtonVPN installer[1],   I took a glance in Augury at what we have for the malware hashes he provided and many are still very low in terms of their detection... Continue Reading →

Cheers to the Pioneers

Author: James Shank View off San Francisco Pier 1 With NANOG78 just wrapping up in beautiful San Francisco, I am reflecting on my time here and the great conversations that I have had here at number 78 and past conferences. One particular aspect of my conversations stands out - the human narrative of the history... Continue Reading →

Do you fly anon?

Author: Steve Santorelli Like many InfoSec professionals, I see the inside of a lot of airplanes. (However, I was not on that ship last month.) I recently flew back from our company HQ in Orlando to my home in California: Now, to set the scene, I’m on auto-pilot (no pun intended) as I travel. I... Continue Reading →

Up ↑