SpiderLabs Blog

Threat-Loaded: Malicious PDFs Never Go Out of Style

Introduction In the realm of cybersecurity, danger hides where we least expect it and threats ...

The Evolution of Persistent Threats: From Chernobyl to BlackLotus

In this blog post, we will explore how the computer security landscape has expanded to reach below ...

Think Before You Scan: The Rise of QR Codes in Phishing

QR Codes, the square images that contain coded information that can be scanned by a smartphone, are ...

Behind the Invite: The Rise of Google Group Fake Order Fraud Emails

As the world shifted into remote work and distant learning during the pandemic lockdown, e-commerce ...

BEC Trends: Payroll Diversion Dominates and Sneaky Multi-Persona Attacks Emerge

Business Email Compromise (BEC) remains a lucrative threat vector for attackers. The FBI’s IC3 ...

Gootloader: Why your Legal Document Search May End in Misery

Introduction Recently, we’ve seen a noticeable surge in malware cases linked to a malicious payload ...

WormGPT and FraudGPT – The Rise of Malicious LLMs

As technology continues to evolve, there is a growing concern about the potential for large ...

New Rilide Stealer Version Targets Banking Data and Works Around Google Chrome Manifest V3

Trustwave SpiderLabs discovered a new version of the Rilide Stealer extension targeting ...

Honeypot Recon: New Variant of SkidMap Targeting Redis

Intro Since Redis is becoming increasingly popular around the world, we decided to investigate ...

Healthcare Threat Landscape 2022-2023: Common TTPs Used by Top Ransomware Groups Targeting the Healthcare Sector

The healthcare sector has been under constant threat from cybercriminals due to the sensitive ...

ModSecurity v3: DoS Vulnerability in Four Transformations (CVE-2023-38285)

ModSecurity is an open-source Web Application Firewall (WAF) engine maintained by Trustwave. This ...

Cybersecurity in the Healthcare Industry: Trustwave SpiderLabs Report

In their latest report titled "Cybersecurity in the Healthcare Industry: Actionable Intelligence ...

It’s Raining Phish and Scams – How Cloudflare Pages.dev and Workers.dev Domains Get Abused

As they say, when it rains, it pours. Recently, we observed more than 3,000 phishing emails ...

Honeypot Recon: Enterprise Applications Honeypot - Unveiling Findings from Six Worldwide Locations

To obtain a better perspective of attacks worldwide, Trustwave has implemented a network of ...

SNAPPY: Detecting Rogue and Fake 802.11 Wireless Access Points Through Fingerprinting Beacon Management Frames

Honeypot Recon: MSSQL Server – Database Threat Overview '22/'23

Introduction In a constantly connected world, protecting sensitive data in what are often complex ...

Brute-forcing ButterflyMX Virtual Keys and Hacking Time Limits

Recently, I discovered two vulnerabilities in the ButterflyMX system which were responsibly ...

KillNet, Anonymous Sudan, and REvil Unveil Plans for Attacks on US and European Banking Systems

In a recent development, Russian hackers have declared their intention to launch cyberattacks on ...

Honeypot Recon: Global Database Threat Landscape

In today's digital era, the importance of securing databases cannot be overstated. As more and more ...

Trustwave Action Response: Zero Day Vulnerability in Barracuda Email Security Gateway Appliance (ESG) (CVE-2023-2868)

On May 19, 2023, Barracuda Networks identified a remote command injection vulnerability ...

From Admin to AdminPlusPlus: Breaking Out of Sandboxed Applications Through Recon, Being Brave and Abusing SSO Domain Account Mappings

I've been pentesting applications for nearly two decades now and throughout that time you get to ...

Trustwave Action Response: Zero Day Exploitation of MOVEit (CVE-2023-34362)

Update - June 16, 2023: The second vulnerability mentioned in the June 12 update now has an ...

Hunting For Password Reset Tokens By Spraying And Using HTTP Pipelining

As is tradition with my blog posts, let’s start off a definition of what HTTP pipelining is all ...

Analyzing the NTC Vulkan Leak: What it Says About Russia's Cyber Capabilities

Information disclosed in the leaked NTC Vulkan papers allows us to investigate the high probability ...

Microsoft Encrypted Restricted Permission Messages Deliver Phishing

Over the past few days, we have seen phishing attacks that use a combination of compromised ...

From Response To Request, Adding Your Own Variables Inside Of GraphQL Queries For Account Take Over

For those wondering what GraphQL is…

When User Impersonation Features In Applications Go Bad

A user impersonation feature typically allows a privileged user, such as an administrator, but ...

Abusing Time-Of-Check Time-Of-Use (TOCTOU) Race Condition Vulnerabilities in Games, Harry Potter Style

I feel I need to clarify, for legal reasons, that this is nothing to do with any Harry Potter game. ...