Hamburglars

Episode 1 – The Trigger The investigation, dubbed "Hamburglars", originated from an incident response activity and a targeted deep-dive conducted by the Cyber Threat Intelligence Team. An Italian company operating in the food service sector had reported anomalies in its systems: an ongoing brute-force attack targeting its customer area. At first, the case appeared to be a typical cyberattack. However, further analysis quickly...

Red Teaming & Jazz: Creativity as a Service

Red Teaming & Jazz: Creativity as a Service Foreword I had been missing on this blog for a bit and I told myself it was time to go back to writing something. If in the previous article (here is the link) I wanted to make a sort of small professional contribution to the sector, in this case it is a further customization...

Elons (Proxima/Black Shadow related) ransomware attack via Oracle DBS External Jobs

Premise As Yarix’s Incident Response Team, our responsibilities are to manage critical issues related to cyber-attacks carried out by cybercriminals, intervening promptly in order to guarantee security to victim companies and to minimize latent risks, analyzing the systems within their infrastructures and indicating precise remediation actions capable of re-establishing a state of security sufficient for normal operational recovery. In the course of...

Doppelganger: An Advanced LSASS Dumper with Process Cloning

Github Repo: https://github.com/vari-sh/RedTeamGrimoire/tree/main/Doppelganger What is LSASS? The Local Security Authority Subsystem Service (LSASS) is a core component of the Windows operating system, responsible for enforcing the security policy on the system. LSASS is a process that runs as lsass.exe and plays a fundamental role in: User authentication: It verifies users logging into the system, interacting with authentication protocols such as NTLM and Kerberos. Credential management: It handles...