Threat Command

Primary threat research from Elastic Security Labs Threat Command.

Filters
Malware Analysis

TCLBANKER: Brazilian Banking Trojan Spreading via WhatsApp and Outlook

REF3076 uses a trojanized Logitech installer to deploy TCLBANKER, a Brazilian banking trojan with environment-gated payloads, WPF fraud overlays, and self-propagating WhatsApp and Outlook worm modules.

Jia Yu Chan
Detection Engineering

CI/CD pipeline abuse: the problem no one is watching

How we built an open-source, drop-in CI template that uses signal extraction and LLM reasoning to catch CI/CD abuse in GitHub Actions, GitLab CI, and Azure DevOps pipelines.

Mika Ayenson
AI Security

The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation

Elastic Security Labs explores the ongoing arms race between LLM-driven reverse engineering and obfuscation.

Cyril François
Malware Analysis

Phantom in the vault: Obsidian abused to deliver PhantomPulse RAT

Elastic Security Labs uncovers a novel social engineering campaign that abuses the popular note-taking application, Obsidian's legitimate community plugin ecosystem. The campaign, which we track as REF6598, targets individuals in the financial and cryptocurrency sectors through elaborate social engineering on LinkedIn and Telegram.

Salim Bitam
Malware Analysis

Hooked on Linux: Rootkit Detection Engineering

In this second part of a two-part series, we explore Linux rootkit detection engineering, focusing on the limitations of static detection reliance, and the importance of rootkit behavioral detection.

Ruben Groenewoud
Threat Intelligence

How we caught the Axios supply chain attack

Joe Desimone shares the story of how he caught the Axios supply chain attack with a proof of concept tool built in an afternoon.

Joe Desimone
Malware Analysis

Inside the Axios supply chain compromise - one RAT to rule them all

Elastic Security Labs analyzes a supply chain compromise of the axios npm package delivering a unified cross-platform RAT

Ruben Groenewoud
Malware Analysis

Fake Installers to Monero: A Multi-Tool Mining Operation

Elastic Security Labs dissects a long-running operation deploying RATs, cryptominers, and CPA fraud through fake installer lures, tracking its evolution across campaigns and Monero payouts.

Jia Yu Chan
Threat Intelligence

Elastic Security Labs uncovers BRUSHWORM and BRUSHLOGGER

Elastic Security Labs observed two custom malware components targeting a South Asian financial institution: a modular backdoor with USB-based spreading and a DLL-side-loaded keylogger.

Salim Bitam
Malware Analysis

Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework

Elastic Security Labs analyzes VoidLink, a sophisticated Linux malware framework that combines traditional Loadable Kernel Modules with eBPF to maintain persistence.

Ruben Groenewoud
Malware Analysis

From Invitation to Infection: How SILENTCONNECT Delivers ScreenConnect

SILENTCONNECT is a multi-stage loader that leverages VBScript, in-memory PowerShell execution, and PEB masquerading to silently deploy the ScreenConnect RMM tool.

Daniel Stepanic
Malware Analysis

Hooked on Linux: Rootkit Taxonomy, Hooking Techniques and Tradecraft

In this first part of a two-part series, we explore Linux rootkit taxonomy, trace their evolution from userland shared object hijacking and kernel-space loadable kernel module hooking to modern eBPF- and io_uring-powered techniques.

Remco Sprooten