Blog Articles 2020–2022

2022 45

• [Research Summary]:Pandora Ransomware Technical Analysis Report Pandora ransomware targets corporate networks and uses double extortion. Learn its .pandora file extension, ransom note name and how to reduce the risk.
• [Research Summary]: AvosLocker Ransomware AvosLocker ransomware is a RaaS operation first detected in 2021. See how its affiliates extort victims, which countries and sectors it targets.
• Most Common Attack Vectors & Ransomware Threat Relation Learn the most common attack vectors, from phishing to brute force, and the top 10 MITRE ATT&CK techniques ransomware operators use, with detection tips.
• [Research Summary]: SandWorm APT Group Intelligence Report Sandworm Team, also known as Unit 74455, is a Russian cyber espionage group that has been operating since 2009. They mainly target Ukrainian organizations.
• YES! Ransom Gangs Retarget Same Companies, Learn Why! Ransom gangs often retarget the same companies. Learn why ransomware victims are hit again, how attacks start and what to do to cut the risk.
• How Ransomware Groups Evolve in Time and What to Expect in the Future Ransomware, in which an attacker steals or freezes an organization's computer systems or data and demands a ransom payment to restore access to them.
• The Most Affected Products by Vulnerabilities Which products are hit hardest by vulnerabilities? See the most exploited CVEs and CWEs, how ransomware groups use them, and how to reduce the risk.
• European Focused Threat Actors – Who Actively Continue Their Strategies The main motivation of individual threat actors who carry out European-focused attacks is to earn financial gain.
• European Focused Threat Actors – APT Groups It has been observed that the main motivation of individual threat actors who carry out European-focused attacks is to earn financial gain.
• [Research Summary]: Zebrocy Malware Zebrocy malware is a Trojan used by APT28 (Sofacy) since 2015 for espionage. See its components, targets, collected file types and how it works.
• European Focused Threat Actors – Ransomware Groups Threat actors, some ransomware groups, that governments support usually organize longer-term operations in the interests of the state they are affiliated with.
• What Should You Know About Ransomware Ransomware is an easy way to profit since attackers directly demand ransom. They do not have to infiltrate sensitive data and sell them to others.
• Why Organizations Need Extensive Dark Web Coverage? This article aims to enlighten you about the dark web, what it is to monitor the dark web and how it is beneficial for a company.
• Initial Access Methods: How Malicious Actors Do Infiltrate Companies? Initial access explained: the five MITRE ATT&CK techniques attackers use to get into a network, how to detect each one, and how to reduce the risk.
• Learn How to Avoid Hackers with 3 Easy Steps Hackers are constantly operating in the dark web network. They share among themselves the evil deeds they do to do business or to gain a reputation.
• Equation APT Group Equation Group profile: operations since 2001, zero-day exploits, hard drive firmware persistence, self-destructing malware and links to Stuxnet and Flame.
• LockBit 3.0 Technical Analysis Report LockBit 3.0, also called LockBit Black, followed LockBit 2.0 with Zcash payments, a leak site search and a bug bounty program. See what changed.
• APT Groups Actively Involved During the Russia-Ukraine Cyber War Which APT groups took part in the Russia-Ukraine cyber war? See the groups named, what they hit in Ukraine, and why firewalls and antivirus fall short.
• Detecting Phishing Emails How to spot a phishing email: check the sender domain, links, spelling, urgency, attachments and signature, then report it. A short guide to digital risks.
• Lazarus APT Group (APT38) Lazarus APT is a North Korean state-sponsored group active since at least 2009. See its aliases, targets, history, tools and how to defend against it.
• Mythic Leopard APT Group Mythic Leopard, also called APT36 and Transparent Tribe, is a suspected Pakistan-based group. See aliases, targets, timeline, tools and defenses.
• Dynamite Panda APT Group Dynamite Panda is the name used for APT18, a threat group active since at least 2009. See its targets, malware, techniques and how to defend against it.
• El Machete APT Group El Machete (APT-C-43) is a suspected Spanish-speaking espionage group active since 2010. See its targets, spearphishing tactics and how to defend.
• Top Open Source Intelligence (OSINT) Tools for Dark Web OSINT, or Open Source Intelligence, can scan to Decipher and find connections between criminals and other actors around them.
• Top Deep Web Websites for Threat Intelligence The deep web and dark web hide sites from standard search. See which forums, markets, leak sites, IRC and Telegram channels give useful threat data.
• Credit Card Information Safety How to keep your credit card safe when you shop online, how Magecart and BIN attacks steal card data, and what to do if someone uses your card.
• Top Ransomware Groups and Monitoring Techniques Conti, LockBit, Cl0p, Stormous and Lapsus$ in 2022 and where they stand now, plus free tools to identify ransomware and track leak sites.
• Dark Web Monitoring Tools: What to Use and When Compare dark web monitoring tools by type: free open-source scripts, breach checkers and enterprise platforms, plus how to choose one.
• Phishing Campaign for Turkish Energy Sector Ransom emails told staff in the energy sector in Turkey a RAT had infected their PC. Headers show bulk sending via an SMTP relay, not a hack. See the fix.
• Detecting Phishing Emails? Learn how to detect phishing emails: check the sender domain, greeting, links, attachments and urgency, and know what to do with a suspicious message.
• Deep Web Intelligence Trends for Security Operation Centers (SOCs) How SOC teams use deep web intelligence to track ransomware leak sites, credential markets, botnets and identity fraud, and why each source needs checking.
• Dark Web Sites and Search Engines: Onion Sites, Torch and the Hidden Wiki (2026) Dark web search engines in 2026: Excavator, Torch, Ahmia and Haystak. How they differ, what is risky and how teams research safely.
• Darknet Markets and Dark Web Marketplaces in 2026: Seized, Closed or Gone Darknet markets in 2026: which dark web marketplaces were seized, closed or exit-scammed, with dates. Is a black market website legit? No addresses given.
• Why Monitor for Phishing Sites Before Anyone Clicks? Learn why companies watch the internet for lookalike domains and fake phishing sites, how this differs from email filtering, and why takedown matters.
• Why is protecting C-Level (VIP) from Cyberattacks Important? Why are C-level executives a top target for cyberattacks? Learn the key defences: access control, encryption, multifactor authentication and training.
• What is the Attack Surface Management? An attack surface is every point where an attacker could enter a system or extract data. Learn how attack surface management works and how to reduce it.
• How to Triage a Vulnerability Alert Learn how to triage a vulnerability alert using affected versions, exposure, exploitation evidence and severity scores.
• Top 3 Stealer Malware Activity Research Stealer malware explained: how Raccoon, RedLine and Vidar are sold, how they spread, which data they steal and the steps that limit the damage.
• What is the Brand Protection? Brand protection is the process of ensuring that a company's trademark, name, and reputation are not being used without permission by others.
• Analysis of Hybrid Warfare Through Russia-Ukraine Cyber War Hybrid warfare mixes military and non-military means, including cyber attacks. See how it played out in the Russia-Ukraine cyber war between 2013 and 2022.
• Top 5 Security Threats to Be Careful Learn about common security threats: ransomware, insider threats, phishing, cloud attacks and malvertising, with plain steps to reduce each risk.
• Threat Hunting for Phishing Pages Phishing pages copy trusted sites. Learn how to find them with daily new domain lists, look-alike domain searches, and favicon and image hash matching.
• What is the Digital Fraud? Digital fraud explained: online scams, phishing and data theft, why it is hard to detect and prosecute across borders, and its consequences for businesses.
• How to Protect Your Business from Digital Risks? In this blog post, we will discuss some of the most common digital risks to businesses and how you can protect yourself from them.
• Three Types of Cyber Threat Intelligence Compare strategic, tactical and operational threat intelligence, who uses each and how the three views support decisions.

2021 3

• Post Exploitation with KOADIC Explore Koadic’s Windows Script Host techniques, historical mshta and persistence use, and defenses to investigate suspicious activity.
• OSINT with gOSINT gOSINT is an open source intelligence gathering tool developed in Go programming language. It is a fairly new OSINT (Open Source Intelligence) gathering tool.
• OSINT with Recon-ng Recon-ng 5.1.2 guide: install it from source, create workspaces, add modules from the marketplace and API keys, and run a first host search.

2020 1

• Using Bettercap in Penetration Testing Bettercap is MITM attack tool developed to for users who are likely to be penetration testers to test and improve the security of networks.

Browse by Category 7

The category pages below collect related articles, newest first.

• Blog: Digital Risk Protection Digital risk protection articles on brand impersonation, phishing, fake domains, data leaks and fraud, and how to detect and remove them early.
• Blog: Fraud Articles on online fraud: phishing, fake websites and apps, stolen card data and account takeover, with advice on spotting and stopping it.
• Blog: Ransomware Ransomware research: active groups, leak-site activity, attack methods and trends, and practical steps to cut your exposure and plan a response.
• Blog: Dark Web Dark web research: leaked credentials, data sales, underground forums and cybercrime markets, and what each one means for your organization.
• Blog: APT Groups Profiles of APT groups and state-linked threat actors: who they target, the tools and techniques they use, and how to defend against them.
• Blog: Sector Analysis Sector-by-sector analysis of cyber threats: how attackers target finance, healthcare, retail, energy and other industries, and what teams can do.
• Blog: VIP Security VIP and executive protection: impersonation, doxxing, leaked personal data and fake profiles, and how to monitor and reduce risk for key people.