Claire Zaboeva

Senior Strategic Cyber Threat Analyst, IBM

Claire is a Senior Strategic Cyber Threat Analyst on the Threat Hunt & Discovery Team within IBM X-Force. Claire has over 10 years of analytic experience in the federal and commercial sector, and specializes in Strategic and Emerging Threats. Claire is a contributor to the World Economic Forum's studies on cyber resilience in the Aviation sector.

X-Force April 9, 2024

Hive0051 goes all in with a triple threat

13 min read - As of April 2024, IBM X-Force is tracking new waves of Russian state-sponsored Hive0051 (aka UAC-0010, Gamaredon) activity featuring new iterations of Gamma malware first observed in November 2023. These discoveries follow late October 2023 findings, detailing Hive0051’s use of…

X-Force March 11, 2024

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

13 min read - As of March 2024, X-Force is tracking multiple ongoing ITG05 phishing campaigns featuring lure documents crafted to imitate authentic documents of government and non-governmental organizations (NGOs) in Europe, the South Caucasus, Central Asia, and North and South America. The uncovered…

Threat Intelligence December 8, 2023

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

12 min read - As of December 2023, IBM X-Force has uncovered multiple lure documents that predominately feature the ongoing Israel-Hamas war to facilitate the delivery of the ITG05 exclusive Headlace backdoor. The newly discovered campaign is directed against targets based in at least…

Threat Intelligence October 30, 2023

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - Recent analysis of Hive0051 has identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware.

Threat Intelligence September 7, 2023

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

8 min read - IBM X-Force uncovered a new phishing campaign likely conducted by Hive0117 delivering the fileless malware DarkWatchman, directed at individuals associated with major energy, finance, transport, and software security industries based in Russia, Kazakhstan, Latvia, and Estonia. DarkWatchman malware is capable…

Threat Intelligence June 6, 2023

ITG10 likely targeting South Korean entities of interest to the Democratic People’s Republic of Korea (DPRK)

7 min read - In late April 2023, IBM Security X-Force uncovered documents that are most likely part of a phishing campaign mimicking credible senders, orchestrated by a group X-Force refers to as ITG10, and aimed at delivering RokRAT malware, similar to what has…

Malware April 26, 2022

Hive0117 continues fileless malware delivery in Eastern Europe

4 min read - Through continued research into the ongoing cyber activity throughout Eastern Europe, IBM Security X-Force identified a phishing email campaign by Hive0117, likely a financially motivated cybercriminal group, from February 2022, designed to deliver the fileless malware variant dubbed DarkWatchman. The…

Threat Intelligence December 15, 2021

Nation state threat group targets airline with Aclip backdoor

8 min read - IBM Security X-Force has observed a state-sponsored adversary using a new backdoor that utilizes Slack to attack airline organizations. The adversary leveraged free workspaces on Slack, a legitimate messaging and collaboration application likely to obfuscate operational communications, allowing malicious traffic,…

Advanced Threats July 12, 2021

RoboSki and global recovery: Automation to combat evolving obfuscation

12 min read - In a recent collaboration to investigate a rise in malware infections featuring a commercial remote access trojan (RAT), IBM Security X-Force and Cipher Tech Solutions (CT), a defense and intelligence security firm, investigated malicious activity that spiked in the first…

Threat Intelligence April 14, 2021

An update: The COVID-19 vaccine’s global cold chain continues to be a target

5 min read - In December 2020, IBM Security X-Force released a research blog disclosing that the COVID-19 cold chain — an integral part of delivering and storing COVID-19 vaccines at safe temperatures — was targeted by cyber adversaries. After that first report, we…

X-Force December 3, 2020

IBM Uncovers Global Phishing Campaign Targeting the COVID-19 Vaccine Cold Chain

6 min read - At the onset of the COVID-19 pandemic, IBM Security X-Force created a threat intelligence task force dedicated to tracking down COVID-19 cyber threats against organizations that are keeping the vaccine supply chain moving. As part of these efforts, our team recently…

Advanced Threats July 28, 2020

Aviation Can Anticipate an Increase in State-Sponsored Activity

4 min read - The combination of lockdown measures, travel restrictions and stalling demand brought on by COVID-19 has caused an unprecedented collapse in the global air transport industry. Facing a projected loss of $84.3 billion in revenue and 32 million aviation-related jobs worldwide,…

Failed to load data

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.

Subscribe today

Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats.

Cybersecurity News By Topic By Industry Exclusive Series X-Force Podcast Events Contact About Us

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Claire Zaboeva

Hive0051 goes all in with a triple threat

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

ITG05 operations leverage Israel-Hamas conflict lures to deliver Headlace malware

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

New Hive0117 phishing campaign imitates conscription summons to deliver DarkWatchman malware

ITG10 likely targeting South Korean entities of interest to the Democratic People’s Republic of Korea (DPRK)

Hive0117 continues fileless malware delivery in Eastern Europe

Nation state threat group targets airline with Aclip backdoor

RoboSki and global recovery: Automation to combat evolving obfuscation

An update: The COVID-19 vaccine’s global cold chain continues to be a target

IBM Uncovers Global Phishing Campaign Targeting the COVID-19 Vaccine Cold Chain

Aviation Can Anticipate an Increase in State-Sponsored Activity

{{{title}}}

Topic updates