Gabriel Cardoso
2 articles
-
BlogBlack Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
In this blog entry, we discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
March 3rd, 2025 12 minCatherine Loveria, Stephen Carbery, Jovit Samaniego, Adam O'Connor…
Read article -
BlogMalvertising Used as Entry Vector for BlackCat, Actors Also Leverage SpyBoy Terminator
We found that malicious actors used malvertising to distribute malware via cloned webpages of legitimate organizations. The distribution involved a webpage of the well-known application WinSCP, an open-source Windows application for file transfer. We were able to identify that this activity led to a BlackCat (aka ALPHV) infection, and actors also used SpyBoy, a terminator that tampers with protection provided by agents.
June 30th, 2023 9 minLucas Silva, RonJay Caragay, Arianne Dela Cruz, Gabriel Cardoso
Read article