Charlotte Hammond

Malware Reverse Engineer, IBM Security

Charlotte is a malware reverse engineer for IBM Security's X-Force IRIS team. She has been working in the security industry for more than 7 years with a focus on malware analysis, forensics, and incident response.

Threat Intelligence June 27, 2023

The Trickbot/Conti crypters: Where are they now?

23 min read - Despite its shutdown, operators from the Conti syndicate remain active and collaborative in new factions. IBM Security X-force shares the intel.

Threat Intelligence April 27, 2023

Ex-Conti and FIN7 actors collaborate with new backdoor

15 min read - Former Conti syndicate and FIN7 members have collaborated to use a new backdoor dubbed "Minodo" to deliver the Project Nemesis infostealer. Explore the intricate nature of cooperation among cybercriminal groups and their members with in-depth analysis from IBM Security X-Force…

Threat Intelligence November 22, 2022

RansomExx upgrades to rust

4 min read - IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language.

Malware August 18, 2022

From Ramnit to Bumblebee (via NeverQuest): Similarities and code overlap shed light on relationships between malware developers

26 min read - A comparative analysis performed by IBM Security X-Force uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is…

Threat Intelligence July 7, 2022

Unprecedented shift: The Trickbot group is systematically attacking Ukraine

13 min read - Following ongoing research our team, IBM Security X-Force has uncovered evidence indicating that the Russia-based cybercriminal syndicate “Trickbot group” has been systematically attacking Ukraine since the Russian invasion — an unprecedented shift as the group had not previously targeted Ukraine.…

Malware May 19, 2022

ITG23 crypters highlight cooperation between cyber criminal groups

25 min read - IBM Security X-Force researchers have continually analyzed the use of several crypters developed by the cybercriminal group ITG23, also known as Wizard Spider, DEV-0193, or simply the “Trickbot Group”. The results of this research, along with evidence gained from the…

Malware February 25, 2022

Trickbot group’s AnchorDNS backdoor upgrades to AnchorMail

6 min read - IBM Security X-Force researchers have discovered a revamped version of the Trickbot Group’s AnchorDNS backdoor being used in recent attacks ending with the deployment of Conti ransomware. The Trickbot Group, which X-Force tracks as ITG23, is a cybercriminal gang known…

Threat Intelligence December 15, 2021

Nation state threat group targets airline with Aclip backdoor

8 min read - IBM Security X-Force has observed a state-sponsored adversary using a new backdoor that utilizes Slack to attack airline organizations. The adversary leveraged free workspaces on Slack, a legitimate messaging and collaboration application likely to obfuscate operational communications, allowing malicious traffic,…

Advanced Threats October 13, 2021

Trickbot rising — Gang doubles down on infection efforts to amass network footholds

11 min read - IBM X-Force has been tracking the activity of ITG23, a prominent cybercrime gang also known as the TrickBot Gang and Wizard Spider. Researchers are seeing an aggressive expansion of the gang’s malware distribution channels, infecting enterprise users with Trickbot and…

Advanced Threats August 17, 2021

Analysis of Diavol ransomware reveals possible link to TrickBot gang

7 min read - Ransomware has become the number one cyber threat to organizations, making up nearly 25% of attacks IBM X-Force Incident Response remediated in 2020. Ransomware is making headlines on a regular basis due to the high impact of certain attacks on…

Government April 27, 2020

SBA Spoofed in COVID-19 Spam to Deliver Remcos RAT

5 min read - As the ongoing COVID-19 pandemic impacts small businesses in the U.S., cybercriminals are trusting that people will be more likely to open unsolicited emails purporting to come from relevant entities.

Failed to load data

Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats.

Cybersecurity News By Topic By Industry Exclusive Series Threat Research Podcast Events Contact About Us

Security Intelligence

{{title}}

{{title}}

{{title}}

{{title}}

Topics

Charlotte Hammond

The Trickbot/Conti crypters: Where are they now?

Ex-Conti and FIN7 actors collaborate with new backdoor

RansomExx upgrades to rust

From Ramnit to Bumblebee (via NeverQuest): Similarities and code overlap shed light on relationships between malware developers

Unprecedented shift: The Trickbot group is systematically attacking Ukraine

ITG23 crypters highlight cooperation between cyber criminal groups

Trickbot group’s AnchorDNS backdoor upgrades to AnchorMail

Nation state threat group targets airline with Aclip backdoor

Trickbot rising — Gang doubles down on infection efforts to amass network footholds

Analysis of Diavol ransomware reveals possible link to TrickBot gang

SBA Spoofed in COVID-19 Spam to Deliver Remcos RAT

{{{title}}}