Peeling Back the Onion on Threat Hunting

Do you have questions about what threat hunting is? Have you wondered when threat hunting should be used and how it can help your organization detect security threats more quickly? If so, this is the podcast you’ve been waiting for.

Listen in for great threat hunting insights from Bob Stasio, program director of cyber threat hunting and analysis at IBM Security, and special guest Dr. Eric Cole, founder of Secure Anchor Consulting. You’ll learn when and why organizations should turn to threat hunting, what indicators threat hunters look for and why it’s often recommended to outsource your threat hunting services.

Listen to the podcast

Learn more: Read Eric Cole’s 3-part Blog Series on Proactive Threat Hunting

Security Intelligence Staff

Ermac malware: The other side of the code

6 min read - When the Cerberus code was leaked in late 2020, IBM Trusteer researchers projected that a new Cerberus mutation was just a matter of time. Multiple actors used the leaked Cerberus code but without significant changes to the malware. However, the MalwareHunterTeam discovered a new variant of Cerberus — known as Ermac (also known as Hook) — in late September of 2022.To better understand the new version of Cerberus, we can attempt to shed light on the behind-the-scenes operations of the…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

12 min read - For the last year and a half, IBM X-Force has actively monitored the evolution of Hive0051’s malware capabilities. This Russian threat actor has accelerated its development efforts to support expanding operations since the onset of the Ukraine conflict. Recent analysis identified three key changes to capabilities: an improved multi-channel approach to DNS fluxing, obfuscated multi-stage scripts, and the use of fileless PowerShell variants of the Gamma malware. As of October 2023, IBM X-Force has also observed a significant increase in…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from Threat Hunting

Ermac malware: The other side of the code

Web injections are back on the rise: 40+ banks affected by new malware campaign

Hive0051’s large scale malicious operations enabled by synchronized multi-channel DNS fluxing

Topic updates