Ole Villadsen

Cyber Threat Hunt Analyst, IBM Security

Ole Villadsen is an analyst on the Threat Hunt & Discovery Team within IBM X-Force Incident Response and Intelligence Services (IRIS), where he investigates, analyzes, and models cyber threat activity. He brings to this role over 25 years of experience in researching and analyzing information. Ole began his career as an intelligence officer in the U.S. Navy and later held positions in the U.S. government and academia before joining IBM. He also holds advanced degrees in National Security Studies and Information Science.

Threat Intelligence February 28, 2024

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

10 min read - The 2024 IBM X-Force Threat Intelligence Index revealed attackers continued to pivot to evade detection to deliver their malware in 2023. The good news? Security improvements, such as Microsoft blocking macro execution by default starting in 2022 and OneNote embedded…

Threat Intelligence November 21, 2023

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

14 min read - This article was made possible thanks to the hard work of writer Charlotte Hammond and contributions from Ole Villadsen and Kat Metrick. IBM X-Force researchers have been tracking developments to the WailingCrab malware family, in particular, those relating to its…

Threat Intelligence November 6, 2023

GootBot – Gootloader’s new approach to post-exploitation

8 min read - IBM X-Force discovered a new variant of Gootloader — the “GootBot” implant — which facilitates stealthy lateral movement and makes detection and blocking of Gootloader campaigns more difficult within enterprise environments. X-Force observed these campaigns leveraging SEO poisoning, wagering on…

Threat Intelligence September 12, 2023

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

11 min read - IBM X-Force has identified new capabilities in DBatLoader malware samples delivered in recent email campaigns, signaling a heightened risk of infection from commodity malware families associated with DBatLoader activity. Explore the analysis.

Threat Intelligence June 27, 2023

The Trickbot/Conti crypters: Where are they now?

23 min read - Despite its shutdown, operators from the Conti syndicate remain active and collaborative in new factions. IBM Security X-force shares the intel.

Threat Intelligence April 27, 2023

Ex-Conti and FIN7 actors collaborate with new backdoor

15 min read - Former Conti syndicate and FIN7 members have collaborated to use a new backdoor dubbed "Minodo" to deliver the Project Nemesis infostealer. Explore the intricate nature of cooperation among cybercriminal groups and their members with in-depth analysis from IBM Security X-Force…

Malware August 18, 2022

From Ramnit to Bumblebee (via NeverQuest): Similarities and code overlap shed light on relationships between malware developers

26 min read - A comparative analysis performed by IBM Security X-Force uncovered evidence that suggests Bumblebee malware, which first appeared in the wild last year, was likely developed directly from source code associated with the Ramnit banking trojan. This newly discovered connection is…

Threat Intelligence July 7, 2022

Unprecedented shift: The Trickbot group is systematically attacking Ukraine

13 min read - Following ongoing research our team, IBM Security X-Force has uncovered evidence indicating that the Russia-based cybercriminal syndicate “Trickbot group” has been systematically attacking Ukraine since the Russian invasion — an unprecedented shift as the group had not previously targeted Ukraine.…

Malware May 19, 2022

ITG23 crypters highlight cooperation between cyber criminal groups

25 min read - IBM Security X-Force researchers have continually analyzed the use of several crypters developed by the cybercriminal group ITG23, also known as Wizard Spider, DEV-0193, or simply the “Trickbot Group”. The results of this research, along with evidence gained from the…

Malware February 25, 2022

Trickbot group’s AnchorDNS backdoor upgrades to AnchorMail

6 min read - IBM Security X-Force researchers have discovered a revamped version of the Trickbot Group’s AnchorDNS backdoor being used in recent attacks ending with the deployment of Conti ransomware. The Trickbot Group, which X-Force tracks as ITG23, is a cybercriminal gang known…

Advanced Threats October 13, 2021

Trickbot rising — Gang doubles down on infection efforts to amass network footholds

11 min read - IBM X-Force has been tracking the activity of ITG23, a prominent cybercrime gang also known as the TrickBot Gang and Wizard Spider. Researchers are seeing an aggressive expansion of the gang’s malware distribution channels, infecting enterprise users with Trickbot and…

Advanced Threats September 28, 2020

Ransomware 2020: Attack Trends Affecting Organizations Worldwide

9 min read - October 30, 2020 Update The FBI, CISA and HHS recently released an advisory regarding an “imminent cybercrime threat to U.S. hospitals and healthcare providers.” Watch the webinar, “Protecting Healthcare Organizations from Recent Malware Attacks,” on demand to learn more…

Failed to load data

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.

Subscribe today

Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats.

Cybersecurity News By Topic By Industry Exclusive Series X-Force Podcast Events Contact About Us

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Ole Villadsen

X-Force data reveals top spam trends, campaigns and senior superlatives in 2023

Stealthy WailingCrab Malware misuses MQTT Messaging Protocol

GootBot – Gootloader’s new approach to post-exploitation

Email campaigns leverage updated DBatLoader to deliver RATs, stealers

The Trickbot/Conti crypters: Where are they now?

Ex-Conti and FIN7 actors collaborate with new backdoor

From Ramnit to Bumblebee (via NeverQuest): Similarities and code overlap shed light on relationships between malware developers

Unprecedented shift: The Trickbot group is systematically attacking Ukraine

ITG23 crypters highlight cooperation between cyber criminal groups

Trickbot group’s AnchorDNS backdoor upgrades to AnchorMail

Trickbot rising — Gang doubles down on infection efforts to amass network footholds

Ransomware 2020: Attack Trends Affecting Organizations Worldwide

{{{title}}}

Topic updates