The Cluster25 Blog
Cyberwarfare targeting the energy sector. Is Europe under threat?
May 27, 2022The energy sector is a pivotal one for the whole contemporary economy. A disrupt of its functions could cause huge probl...
Cozy Smuggled Into the Box: APT29 Abusing Legitimate Software for Targeted Operations in Europe
May 13, 2022Cozy Bear (aka Nobelium, APT29, The Dukes) is a well-resourced, highly dedicated and organized cyberespionage group that...
The strange link between a destructive malware and a ransomware-gang linked custom loader: IsaacWiper vs Vatet
May 3, 2022NOTICE: After additional reviews, the team at Cluster25 has determined that the code commonality identified in the two a...
The Lotus Panda is Awake Again: Analysis of the Last Strike
April 29, 2022NAIKON is the name of an APT (Advanced Persistent Threat) which is believed to originate from China. The Naikon hacker g...
DPRK-NEXUS Adversary Targets South Korean Individuals in a New Chapter of Kitty Phishing Operations
April 11, 2022The research team at Cluster25 traced a recent activity that started in the first days of April 2022 from a DPRK-nexus t...
Ghostwriter / UNC1151 Adopts Microbackdoor Variants in Cyber Operations Against Ukraine
March 8, 2022For a few months Cluster25 collected and analyzed several malicious activities which then were internally linked with th...
RuRAT used in spear-phishing attacks against media organisations in United States
March 3, 2022INTRODUCTION On 23.02.2022 one of our partners received a very specific targeted spear-phishing email message which lead...
Conti's Source Code: Deep Dive
March 2, 2022INTRODUCTION On 25.02.2022 cybercrime group Conti published the following statement on their shame blog: The post was re...
Ukraine: Analysis of the new disk-wiping malware (HermeticWiper)
February 24, 2022Very recently a new type of destructive malware named by the security community “HermeticWiper” was used to attack organ...
2021 Ransomware Bulletin: Recent, Past and Near Future of Cyber Extortion
January 12, 2022This past year 2021 was characterized by an increase in ransomware incidents, not only in regards to occurrence but also...