Lucas Silva
6 articles
-
BlogCVE-2025-55182: Análise React2Shell, Caos de Prova de Conceito e Exploração em Ambiente Real
CVE-2025-55182 é um RCE de pré-autenticação com CVSS 10.0 que afeta os Componentes de Servidor React. Em meio à enxurrada de explorações de prova de conceito falsas, scanners, explorações e equívocos generalizados, esta análise técnica pretende cortar o ruído.
December 10th, 2025 21 minPeter Girnus, Deep Patel, Jack Walsh, Lucas Silva…
Read article -
BlogSocGholish’s Intrusion Techniques Facilitate Distribution of RansomHub Ransomware
Trend Research analyzed SocGholish’s MaaS framework and its role in deploying RansomHub ransomware through compromised websites, using highly obfuscated JavaScript loaders to evade detection and execute various malicious tasks.
March 14th, 2025 16 minAdam O'Connor, Ian Kenefick, Jack Walsh, Lucas Silva…
Read article -
BlogBlack Basta and Cactus Ransomware Groups Add BackConnect Malware to Their Arsenal
In this blog entry, we discuss how the Black Basta and Cactus ransomware groups utilized the BackConnect malware to maintain persistent control and exfiltrate sensitive data from compromised machines.
March 3rd, 2025 12 minCatherine Loveria, Stephen Carbery, Jovit Samaniego, Adam O'Connor…
Read article -
BlogMalvertising Used as Entry Vector for BlackCat, Actors Also Leverage SpyBoy Terminator
We found that malicious actors used malvertising to distribute malware via cloned webpages of legitimate organizations. The distribution involved a webpage of the well-known application WinSCP, an open-source Windows application for file transfer. We were able to identify that this activity led to a BlackCat (aka ALPHV) infection, and actors also used SpyBoy, a terminator that tampers with protection provided by agents.
June 30th, 2023 9 minLucas Silva, RonJay Caragay, Arianne Dela Cruz, Gabriel Cardoso
Read article -
BlogBlack Basta Ransomware Gang Infiltrates Networks via QAKBOT, Brute Ratel, and Cobalt Strike
We analyzed a QAKBOT-related case leading to a Brute Ratel C4 and Cobalt Strike payload that can be attributed to the threat actors behind the Black Basta ransomware.
October 12th, 2022 8 minIan Kenefick, Lucas Silva, Nicole Hernandez
Read article -
BlogPlay Ransomware's Attack Playbook Similar to that of Hive, Nokoyawa
Play is a new ransomware that takes a page out of Hive and Nokoyawa's playbook. The many similarities among them indicate that Play, like Nokoyawa, are operated by the same people.
September 6th, 2022 8 minDon Ovid Ladores, Lucas Silva, Scott Burden, Janus Agcaoili…
Read article