https://blog.fox-it.com/2025/09/01/three-lazarus-rats-coming-for-your-cheese/https://blog.fox-it.com/wp-content/uploads/2026/05/79ac5-telegram-pyongyang2.jpgtelegram-pyongyanghttps://blog.fox-it.com/wp-content/uploads/2026/05/909ce-telegram-pyongyang.jpgtelegram-pyongyanghttps://blog.fox-it.com/wp-content/uploads/2026/05/29d30-romeogolf_ida_screenshot.pngromeogolf_ida_screenshothttps://blog.fox-it.com/wp-content/uploads/2026/05/05b34-themeforest_ida_screenshot.pngthemeforest_ida_screenshothttps://blog.fox-it.com/wp-content/uploads/2026/05/66f90-sessionenv-perfhloader-overview.pngsessionenv-perfhloader-overviewhttps://blog.fox-it.com/wp-content/uploads/2026/05/c9ce6-attack-overview.pngattack-overviewhttps://blog.fox-it.com/wp-content/uploads/2026/05/b01c4-comparison-file-renaming.pngcomparison-file-renaminghttps://blog.fox-it.com/wp-content/uploads/2026/05/346ab-comparison-status-codes-c2.pngcomparison-status-codes-c2https://blog.fox-it.com/wp-content/uploads/2026/05/efead-comparison-bot-id-generation-2.pngcomparison-bot-id-generationhttps://blog.fox-it.com/wp-content/uploads/2026/05/df958-comparison-bot-id-generation-1.pngcomparison-bot-id-generation2026-05-21T19:29:43+00:00monthlyhttps://blog.fox-it.com/2024/09/25/red-teaming-in-the-age-of-edr-evasion-of-endpoint-detection-through-malware-virtualisation/2026-05-21T09:48:46+00:00monthlyhttps://blog.fox-it.com/2021/12/07/encryption-does-not-equal-invisibility-detecting-anomalous-tls-certificates-with-the-half-space-trees-algorithm/2026-05-07T17:59:15+00:00monthlyhttps://blog.fox-it.com/2024/12/11/decrypting-full-disk-encryption-with-dissect/2024-12-05T14:38:57+00:00monthlyhttps://blog.fox-it.com/2024/04/25/sifting-through-the-spines-identifying-potential-cactus-ransomware-victims/https://blog.fox-it.com/wp-content/uploads/2026/05/bea58-top-20-countries-compromised-qlik-sense.pngtop-20-countries-compromised-qlik-sensehttps://blog.fox-it.com/wp-content/uploads/2026/05/b9928-powershell-dir-listing-qle-fonts.pngpowershell-dir-listing-qle-fontshttps://blog.fox-it.com/wp-content/uploads/2026/05/eb337-top-20-countries-vulnerable-qlik-sense.pngtop-20-countries-vulnerable-qlik-sensehttps://blog.fox-it.com/wp-content/uploads/2026/05/91047-qlik-sense-vuln-status.pngqlik-sense-vuln-statushttps://blog.fox-it.com/wp-content/uploads/2026/05/7107e-image-1.pngimage-1https://blog.fox-it.com/wp-content/uploads/2026/05/b6a65-image.pngimage2024-04-25T04:56:48+00:00monthlyhttps://blog.fox-it.com/2024/03/28/android-malware-vultur-expands-its-wingspan/https://blog.fox-it.com/wp-content/uploads/2026/05/3740b-542e4746fdf58bc882731fa490a99ed1867a4a95_14.png542e4746fdf58bc882731fa490a99ed1867a4a95_14https://blog.fox-it.com/wp-content/uploads/2026/05/9340e-542e4746fdf58bc882731fa490a99ed1867a4a95_13.png542e4746fdf58bc882731fa490a99ed1867a4a95_13https://blog.fox-it.com/wp-content/uploads/2026/05/dc025-542e4746fdf58bc882731fa490a99ed1867a4a95_12.png542e4746fdf58bc882731fa490a99ed1867a4a95_12https://blog.fox-it.com/wp-content/uploads/2026/05/f081a-542e4746fdf58bc882731fa490a99ed1867a4a95_11.png542e4746fdf58bc882731fa490a99ed1867a4a95_11https://blog.fox-it.com/wp-content/uploads/2026/05/d0869-542e4746fdf58bc882731fa490a99ed1867a4a95_10-1.png542e4746fdf58bc882731fa490a99ed1867a4a95_10-1https://blog.fox-it.com/wp-content/uploads/2026/05/f8cd9-image-3.pngimage-3https://blog.fox-it.com/wp-content/uploads/2026/05/ceec2-542e4746fdf58bc882731fa490a99ed1867a4a95_10.png542e4746fdf58bc882731fa490a99ed1867a4a95_10https://blog.fox-it.com/wp-content/uploads/2026/05/fc82b-542e4746fdf58bc882731fa490a99ed1867a4a95_9.png542e4746fdf58bc882731fa490a99ed1867a4a95_9https://blog.fox-it.com/wp-content/uploads/2026/05/25249-542e4746fdf58bc882731fa490a99ed1867a4a95_8.png542e4746fdf58bc882731fa490a99ed1867a4a95_8https://blog.fox-it.com/wp-content/uploads/2026/05/b4628-542e4746fdf58bc882731fa490a99ed1867a4a95_7.png542e4746fdf58bc882731fa490a99ed1867a4a95_72024-03-28T10:00:15+00:00monthlyhttps://blog.fox-it.com/2024/01/25/memory-scanning-for-the-masses/https://blog.fox-it.com/wp-content/uploads/2026/05/be200-notepad_exe_attributes.pngnotepad_exe_attributes2024-01-26T11:21:55+00:00monthlyhttps://blog.fox-it.com/2023/12/14/reverse-reveal-recover-windows-defender-quarantine-forensics/https://blog.fox-it.com/wp-content/uploads/2026/05/ba168-upload_193c111d8639e63369484615023e25e8.pngupload_193c111d8639e63369484615023e25e82023-12-14T14:25:39+00:00monthlyhttps://blog.fox-it.com/2023/11/15/the-spelling-police-searching-for-malicious-http-servers-by-identifying-typos-in-http-responses/https://blog.fox-it.com/wp-content/uploads/2026/05/a7dd1-9_new_content_length.png9_new_CONTENT_LENGTHhttps://blog.fox-it.com/wp-content/uploads/2026/05/4745f-7_new_contenttyle.png7_new_contenttylehttps://blog.fox-it.com/wp-content/uploads/2026/05/ab277-6_new_apache64.png6_new_Apache64https://blog.fox-it.com/wp-content/uploads/2026/05/8f631-5_new_ngengx.png5_new_ngengxhttps://blog.fox-it.com/wp-content/uploads/2026/05/3c545-4_new_microsoftiis.png4_new_microsoftiishttps://blog.fox-it.com/wp-content/uploads/2026/05/e0054-new-rr.pngnew-rrhttps://blog.fox-it.com/wp-content/uploads/2026/05/de5c6-http-request-and-response-client-en-server-example.pngHTTP-request-and-response-client-en-server-examplehttps://blog.fox-it.com/wp-content/uploads/2026/05/c22ca-microsoft-iis-1.pngMicrosoft-IIS-1https://blog.fox-it.com/wp-content/uploads/2026/05/6d153-content_length.pngCONTENT_LENGTHhttps://blog.fox-it.com/wp-content/uploads/2026/05/e3b65-screenshot-content-tyle-landing-page.pngScreenshot-Content-Tyle-landing-page2023-11-15T14:00:08+00:00monthlyhttps://blog.fox-it.com/2023/11/01/popping-blisters-for-research-an-overview-of-past-payloads-and-exploring-recent-developments/https://blog.fox-it.com/wp-content/uploads/2026/05/7bebe-blister_samples_overview.pngblister_samples_overview2023-11-01T13:18:02+00:00monthlyhttps://blog.fox-it.com/2023/09/11/from-ermac-to-hook-investigating-the-technical-differences-between-two-android-malware-variants/https://blog.fox-it.com/wp-content/uploads/2026/05/6f5d0-image-36.pngimage-36https://blog.fox-it.com/wp-content/uploads/2026/05/0eed1-image-35.pngimage-35https://blog.fox-it.com/wp-content/uploads/2026/05/76311-image-34.pngimage-34https://blog.fox-it.com/wp-content/uploads/2026/05/4f99b-image-33.pngimage-33https://blog.fox-it.com/wp-content/uploads/2026/05/568cc-image-32.pngimage-32https://blog.fox-it.com/wp-content/uploads/2026/05/50b16-image-31.pngimage-31https://blog.fox-it.com/wp-content/uploads/2026/05/f18cd-image-30.pngimage-30https://blog.fox-it.com/wp-content/uploads/2026/05/77553-image-29.pngimage-29https://blog.fox-it.com/wp-content/uploads/2026/05/28542-image-28.pngimage-28https://blog.fox-it.com/wp-content/uploads/2026/05/4fedd-image-27.pngimage-272023-09-11T09:05:30+00:00monthlyhttps://blog.fox-it.com/2023/08/15/approximately-2000-citrix-netscalers-backdoored-in-mass-exploitation-campaign/https://blog.fox-it.com/wp-content/uploads/2026/05/fb8d3-vulnerable-netscalers-1.pngVulnerable-NetScalers-1https://blog.fox-it.com/wp-content/uploads/2026/05/1e2e2-known-backdoored-top-20-countries.pngknown-backdoored-top-20-countrieshttps://blog.fox-it.com/wp-content/uploads/2026/05/5204c-percentage-vuln-over-time-legend.pngpercentage-vuln-over-time-legendhttps://blog.fox-it.com/wp-content/uploads/2026/05/3db55-pie-chart-backdoor-on-patched-unpatched-systems.pngpie-chart-backdoor-on-patched-unpatched-systemshttps://blog.fox-it.com/wp-content/uploads/2026/05/555f2-compromised-netscalers.pngCompromised-NetScalershttps://blog.fox-it.com/wp-content/uploads/2026/05/5aee0-vulnerable-netscalers.pngVulnerable-NetScalers2023-08-15T16:06:20+00:00monthlyhttps://blog.fox-it.com/2023/02/15/threat-spotlight-hydra/https://blog.fox-it.com/wp-content/uploads/2026/05/bd2b6-c2_countries.pngc2_countrieshttps://blog.fox-it.com/wp-content/uploads/2026/05/c45a5-c2_api_mirrors.pngc2_api_mirrorshttps://blog.fox-it.com/wp-content/uploads/2026/05/4086c-tor_libs.pngtor_libshttps://blog.fox-it.com/wp-content/uploads/2026/05/81a7a-github_mirrors.pnggithub_mirrorshttps://blog.fox-it.com/wp-content/uploads/2026/05/eeb29-github_mirrors_code.pnggithub_mirrors_codehttps://blog.fox-it.com/wp-content/uploads/2026/05/d914d-decoded_mirrors_onion.pngdecoded_mirrors_onionhttps://blog.fox-it.com/wp-content/uploads/2026/05/3a0a0-send_stolen_credentials_and_cookies.pngsend_stolen_credentials_and_cookieshttps://blog.fox-it.com/wp-content/uploads/2026/05/9cd59-steal_cookies_targets_last.pngsteal_cookies_targets_lasthttps://blog.fox-it.com/wp-content/uploads/2026/05/dd9b4-steal_cookies_targets_june.pngsteal_cookies_targets_junehttps://blog.fox-it.com/wp-content/uploads/2026/05/ebd68-screencast_start_call.pngscreencast_start_call2023-03-09T08:48:33+00:00monthlyhttps://blog.fox-it.com/2023/02/22/from-backup-to-backdoor-exploitation-of-cve-2022-36537-in-r1soft-server-backup-manager/https://blog.fox-it.com/wp-content/uploads/2026/05/11ba6-r1soft-backdoor-totals-2023-03-03.pngr1soft-backdoor-totals-2023-03-03https://blog.fox-it.com/wp-content/uploads/2026/05/0baa9-picture2.pngPicture2https://blog.fox-it.com/wp-content/uploads/2026/05/a630b-picture1.pngPicture1https://blog.fox-it.com/wp-content/uploads/2026/05/f4e64-mysql-jar-ziplisting.pngmysql-jar-ziplistinghttps://blog.fox-it.com/wp-content/uploads/2026/05/60037-r1soft-backdoors-by-org.pngr1soft-backdoors-by-orghttps://blog.fox-it.com/wp-content/uploads/2026/05/c2e57-r1soft-backdoors-by-country.pnghttps://blog.fox-it.com/wp-content/uploads/2026/05/4017d-r1soft-total-backdoors.pngr1soft-total-backdoorshttps://blog.fox-it.com/wp-content/uploads/2026/05/84c06-image.pngimage2023-03-03T17:21:22+00:00monthlyhttps://blog.fox-it.com/2022/12/28/cve-2022-27510-cve-2022-27518-measuring-citrix-adc-gateway-version-adoption-on-the-internet/https://blog.fox-it.com/wp-content/uploads/2026/05/209ae-update-adoption-1.pngupdate-adoption-1https://blog.fox-it.com/wp-content/uploads/2026/05/39557-top-versions-1.pngtop-versions-1https://blog.fox-it.com/wp-content/uploads/2026/05/308dc-citrix-by-country-1.pngcitrix-by-country-1https://blog.fox-it.com/wp-content/uploads/2026/05/58633-version_hash-1.pngversion_hash-1https://blog.fox-it.com/wp-content/uploads/2026/05/94948-gist.pnggisthttps://blog.fox-it.com/wp-content/uploads/2026/05/850c2-target-fs.pngtarget-fshttps://blog.fox-it.com/wp-content/uploads/2026/05/01c5c-update-adoption.pngupdate-adoptionhttps://blog.fox-it.com/wp-content/uploads/2026/05/70014-citrix-by-country.pngcitrix-by-countryhttps://blog.fox-it.com/wp-content/uploads/2026/05/980bc-top-versions.pngtop-versionshttps://blog.fox-it.com/wp-content/uploads/2026/05/ce3d8-cloudshell.pngcloudshell2022-12-29T15:28:28+00:00monthlyhttps://blog.fox-it.com/2022/12/12/one-year-since-log4shell-lessons-learned-for-the-next-code-red/https://blog.fox-it.com/wp-content/uploads/2026/05/4c7d2-log4shell-timeline-1.pngLog4Shell-Timeline-1https://blog.fox-it.com/wp-content/uploads/2026/05/a28cd-log4shell-timeline.pngLog4Shell-Timelinehttps://blog.fox-it.com/wp-content/uploads/2026/05/16032-log4j7.pngLog4j72022-12-12T08:03:26+00:00monthlyhttps://blog.fox-it.com/2022/10/18/im-in-your-hypervisor-collecting-your-evidence/2022-11-29T15:28:17+00:00monthlyhttps://blog.fox-it.com/2022/09/02/sharkbot-is-back-in-google-play/https://blog.fox-it.com/wp-content/uploads/2026/05/1e581-ats_config_example.pngats_config_examplehttps://blog.fox-it.com/wp-content/uploads/2026/05/69867-grabber_config_example.pnggrabber_config_examplehttps://blog.fox-it.com/wp-content/uploads/2026/05/fcaf4-grabber_config_start.pnggrabber_config_starthttps://blog.fox-it.com/wp-content/uploads/2026/05/6a191-create_webview_logscookie.pngcreate_webview_logsCookiehttps://blog.fox-it.com/wp-content/uploads/2026/05/d5a80-get_webview_cookies-1.pngget_webview_cookies-1https://blog.fox-it.com/wp-content/uploads/2026/05/3fd63-onpagefinished_send_cookies.pngonPageFinished_send_cookieshttps://blog.fox-it.com/wp-content/uploads/2026/05/e76f5-get_webview_cookies.pngget_webview_cookieshttps://blog.fox-it.com/wp-content/uploads/2026/05/c9fe8-logscookie_command.pnglogsCookie_commandhttps://blog.fox-it.com/wp-content/uploads/2026/05/3ba17-dga_v1_v2.pngdga_v1_v2https://blog.fox-it.com/wp-content/uploads/2026/05/71271-ats_accept_permissions.pngats_accept_permissions2022-09-02T11:07:31+00:00monthlyhttps://blog.fox-it.com/2022/08/11/detecting-dns-implants-old-kitten-new-tricks-a-saitama-case-study/https://blog.fox-it.com/wp-content/uploads/2026/05/018ae-05_distribution.png05_distributionhttps://blog.fox-it.com/wp-content/uploads/2026/05/615f6-04_transmission.png04_transmissionhttps://blog.fox-it.com/wp-content/uploads/2026/05/9bdbf-03_sleeptimes.png03_sleeptimeshttps://blog.fox-it.com/wp-content/uploads/2026/05/49a81-02_determine_alphabet.png02_determine_alphabethttps://blog.fox-it.com/wp-content/uploads/2026/05/ce2c1-01_int_to_string.png01_int_to_string2022-08-11T16:05:12+00:00monthlyhttps://blog.fox-it.com/2022/06/29/flubot-the-evolution-of-a-notorious-android-banking-malware/https://blog.fox-it.com/wp-content/uploads/2026/05/57953-fedex_web.pngfedex_webhttps://blog.fox-it.com/wp-content/uploads/2026/05/51536-section1.pngsection1https://blog.fox-it.com/wp-content/uploads/2026/05/27e45-56_mms_rate.png56_MMS_RATEhttps://blog.fox-it.com/wp-content/uploads/2026/05/90d09-56_get_mms.png56_GET_MMShttps://blog.fox-it.com/wp-content/uploads/2026/05/32db0-55_cookie_send.png55_cookie_sendhttps://blog.fox-it.com/wp-content/uploads/2026/05/db14e-55_cookie_stealing_gmail.png55_cookie_stealing_gmailhttps://blog.fox-it.com/wp-content/uploads/2026/05/90804-55_get_injects_list_new.png55_GET_INJECTS_LIST_newhttps://blog.fox-it.com/wp-content/uploads/2026/05/db1e8-54_get_notif_msg.png54_GET_NOTIF_MSGhttps://blog.fox-it.com/wp-content/uploads/2026/05/0a99b-54_directreply_code.png54_directreply_codehttps://blog.fox-it.com/wp-content/uploads/2026/05/f34a4-53_smishing_countries3.png53_smishing_countries32022-06-30T09:45:00+00:00monthlyhttps://blog.fox-it.com/2022/04/29/adventures-in-the-land-of-bumblebee/https://blog.fox-it.com/wp-content/uploads/2026/05/27a6b-bumblebee_tasks.pngBumblebee_tasks2022-04-29T11:14:10+00:00monthlyhttps://blog.fox-it.com/2022/03/03/sharkbot-a-new-generation-android-banking-trojan-being-distributed-on-google-play-store/https://blog.fox-it.com/wp-content/uploads/2026/05/4e540-image.pngimage2022-03-03T19:23:28+00:00monthlyhttps://blog.fox-it.com/2021/12/14/log4j-jndi-be-gone-a-simple-mitigation-for-cve-2021-44228/2021-12-16T12:36:06+00:00monthlyhttps://blog.fox-it.com/2021/12/12/log4shell-reconnaissance-and-post-exploitation-network-detection/2021-12-16T11:46:17+00:00monthlyhttps://blog.fox-it.com/2021/12/02/tracking-a-p2p-network-related-to-ta505/2021-12-02T09:34:06+00:00monthlyhttps://blog.fox-it.com/2021/11/08/ta505-exploits-solarwinds-serv-u-vulnerability-cve-2021-35211-for-initial-access/2021-11-09T14:39:12+00:00monthlyhttps://blog.fox-it.com/2021/10/12/reverse-engineering-and-decrypting-cyberark-vault-credential-files/https://blog.fox-it.com/wp-content/uploads/2026/05/1d0b3-image-4.pngimage-4https://blog.fox-it.com/wp-content/uploads/2026/05/0ac0f-image-3.pngimage-3https://blog.fox-it.com/wp-content/uploads/2026/05/278f6-image-2.pngimage-2https://blog.fox-it.com/wp-content/uploads/2026/05/85a7a-image.pngimage2021-10-12T07:42:06+00:00monthlyhttps://blog.fox-it.com/2021/10/11/snapmc-skips-ransomware-steals-data/2021-10-11T19:14:39+00:00monthlyhttps://blog.fox-it.com/2021/05/04/rm3-curiosities-of-the-wildest-banking-malware/https://blog.fox-it.com/wp-content/uploads/2026/05/30418-rm3_aes.pngRM3_AEShttps://blog.fox-it.com/wp-content/uploads/2026/05/fa770-rm3_hook_worker.pngRM3_Hook_Workerhttps://blog.fox-it.com/wp-content/uploads/2026/05/a1d89-rm3_msedge.pngRM3_Msedgehttps://blog.fox-it.com/wp-content/uploads/2026/05/154ad-rm3_serpent-1.pngRM3_Serpent-1https://blog.fox-it.com/wp-content/uploads/2026/05/833cd-rm3_serpent.pngRM3_Serpenthttps://blog.fox-it.com/wp-content/uploads/2026/05/b3f8a-rm3_aes_code.pngRM3_AES_Codehttps://blog.fox-it.com/wp-content/uploads/2026/05/41c41-rm3_loading_inject.pngRM3_Loading_Injecthttps://blog.fox-it.com/wp-content/uploads/2026/05/38924-rm3_inject_sample.pngRM3_Inject_Samplehttps://blog.fox-it.com/wp-content/uploads/2026/05/ab727-rm3_ssl_proxy.pngRM3_SSL_Proxyhttps://blog.fox-it.com/wp-content/uploads/2026/05/55ca6-rm3_sqlite3_build.pngRM3_SQLITE3_Build2021-05-04T18:14:08+00:00monthlyhttps://blog.fox-it.com/2020/11/16/ta505-a-brief-history-of-their-time/https://blog.fox-it.com/wp-content/uploads/2026/05/a4f95-getandgo-infection-chain.pngGetandGo-Infection-Chain2020-11-26T11:45:44+00:00monthlyhttps://blog.fox-it.com/2020/11/11/decrypting-openssh-sessions-for-fun-and-profit/https://blog.fox-it.com/wp-content/uploads/2020/11/ssh_frame.pngssh_frame2020-11-11T10:24:35+00:00monthlyhttps://blog.fox-it.com/2020/09/10/streamdivert-relaying-specific-network-connections/https://blog.fox-it.com/wp-content/uploads/2020/08/copy-of-streamdivert-4-1.pngCopy-of-streamdivert-42020-09-10T09:25:13+00:00monthlyhttps://blog.fox-it.com/2020/09/02/machine-learning-from-idea-to-reality-a-powershell-case-study/https://blog.fox-it.com/wp-content/uploads/2020/08/small.pngsmall2020-09-02T07:55:35+00:00monthlyhttps://blog.fox-it.com/2018/01/11/mitm6-compromising-ipv4-networks-via-ipv6/https://blog.fox-it.com/wp-content/uploads/2018/01/ntlmrelay_final.pngntlmrelay_finalhttps://blog.fox-it.com/wp-content/uploads/2018/01/auth-proxies_fixed.pngauth-proxies_fixedhttps://blog.fox-it.com/wp-content/uploads/2018/01/ipconfig_fixed.pngipconfig_fixedhttps://blog.fox-it.com/wp-content/uploads/2018/01/mitm6_cropped.pngmitm6_croppedhttps://blog.fox-it.com/wp-content/uploads/2018/01/dhcpv6_cropped.pngdhcpv6_cropped2020-08-12T14:21:05+00:00monthlyhttps://blog.fox-it.com/2020/07/01/a-second-look-at-cve-2019-19781-citrix-netscaler-adc/https://blog.fox-it.com/wp-content/uploads/2020/07/microsoftteams-image-3.jpgMicrosoftTeams-image (3)https://blog.fox-it.com/wp-content/uploads/2020/07/microsoftteams-image-2.jpgMicrosoftTeams-image (2)https://blog.fox-it.com/wp-content/uploads/2020/07/microsoftteams-image-1.jpgMicrosoftTeams-image (1)https://blog.fox-it.com/wp-content/uploads/2020/07/microsoftteams-image.jpgMicrosoftTeams-imagehttps://blog.fox-it.com/wp-content/uploads/2020/06/compromised-servers-patch-status-june.pngCompromised Servers - Patch Status - Junehttps://blog.fox-it.com/wp-content/uploads/2020/06/compromised-servers-patch-status-jan.pngCompromised Servers - Patch Status - Janhttps://blog.fox-it.com/wp-content/uploads/2020/06/compromised-servers-by-country-june.pngCompromised Servers by Country - Junehttps://blog.fox-it.com/wp-content/uploads/2020/06/compromised-servers-by-country-jan.pngCompromised Servers by Country - Janhttps://blog.fox-it.com/wp-content/uploads/2020/06/citrix-blog-images-25.pngcitrix-blog-images-25https://blog.fox-it.com/wp-content/uploads/2020/06/citrix-blog-images-24.pngcitrix-blog-images-242020-07-01T09:21:36+00:00monthlyhttps://blog.fox-it.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/2020-06-24T08:22:37+00:00monthlyhttps://blog.fox-it.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/https://blog.fox-it.com/wp-content/uploads/2020/06/figure6.pngfigure6https://blog.fox-it.com/wp-content/uploads/2020/06/figure5.pngfigure5https://blog.fox-it.com/wp-content/uploads/2020/06/figure4.pngfigure4https://blog.fox-it.com/wp-content/uploads/2020/06/figure3.pngfigure3https://blog.fox-it.com/wp-content/uploads/2020/06/figure2.pngfigure2https://blog.fox-it.com/wp-content/uploads/2020/06/figure1.pngfigure12020-06-02T14:30:01+00:00monthlyhttps://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/https://blog.fox-it.com/wp-content/uploads/2020/03/11.png11https://blog.fox-it.com/wp-content/uploads/2020/03/10.png10https://blog.fox-it.com/wp-content/uploads/2020/03/8.png8https://blog.fox-it.com/wp-content/uploads/2020/03/9.png9https://blog.fox-it.com/wp-content/uploads/2020/03/6.png6https://blog.fox-it.com/wp-content/uploads/2020/03/7.png7https://blog.fox-it.com/wp-content/uploads/2020/03/5.png5https://blog.fox-it.com/wp-content/uploads/2020/03/4.png4https://blog.fox-it.com/wp-content/uploads/2020/03/2.png2https://blog.fox-it.com/wp-content/uploads/2020/03/3.png32020-03-19T11:04:10+00:00monthlyhttps://blog.fox-it.com/2017/05/09/relaying-credentials-everywhere-with-ntlmrelayx/https://blog.fox-it.com/wp-content/uploads/2017/05/nbns_spoof.pngNBNS_spoofhttps://blog.fox-it.com/wp-content/uploads/2017/05/autologon.pngautologonhttps://blog.fox-it.com/wp-content/uploads/2017/05/relay_ntlm.pngrelay_ntlmhttps://blog.fox-it.com/wp-content/uploads/2017/05/ntlm_auth.pngntlm_authhttps://blog.fox-it.com/wp-content/uploads/2017/05/http_relay.pnghttp_relayhttps://blog.fox-it.com/wp-content/uploads/2017/05/imap_relay.pngimap_relayhttps://blog.fox-it.com/wp-content/uploads/2017/05/ldapdump.pngldapdumphttps://blog.fox-it.com/wp-content/uploads/2017/05/da_add.pngda_addhttps://blog.fox-it.com/wp-content/uploads/2017/05/ldd_by_group.pngldd_by_grouphttps://blog.fox-it.com/wp-content/uploads/2017/05/ldd_clean.pngldd_clean2020-03-09T13:15:15+00:00monthlyhttps://blog.fox-it.com/2020/01/15/hunting-for-beacons/https://blog.fox-it.com/wp-content/uploads/2020/01/blog-beaconing-img-2.pngblog beaconing img 2https://blog.fox-it.com/wp-content/uploads/2020/01/blog-beaconing-img-1.pngBlog beaconing img 12020-01-15T12:28:30+00:00monthlyhttps://blog.fox-it.com/2019/10/16/detecting-random-filenames-using-unsupervised-machine-learning/https://blog.fox-it.com/wp-content/uploads/2019/10/fox-it-blog-detecting-random-filenames-04.pngFox-IT-Blog detecting random filenames-04https://blog.fox-it.com/wp-content/uploads/2019/10/fox-it-blog-detecting-random-filenames-02.pngFox-IT-Blog detecting random filenames-02https://blog.fox-it.com/wp-content/uploads/2019/10/fox-it-blog-detecting-random-filenames-01.pngFox-IT-Blog detecting random filenames-012019-10-16T11:26:35+00:00monthlyhttps://blog.fox-it.com/2019/09/11/office-365-prone-to-security-breaches/https://blog.fox-it.com/wp-content/uploads/2019/08/blog-pic-2.pngblog pic 2https://blog.fox-it.com/wp-content/uploads/2019/08/blog-pic-1.pngblog pic 1https://blog.fox-it.com/wp-content/uploads/2019/08/blogpic2-groot.pngblogpic2-groothttps://blog.fox-it.com/wp-content/uploads/2019/08/blogpic2-e1565684727574.pngblogpic2https://blog.fox-it.com/wp-content/uploads/2019/08/blogpic1.pngblogpic12019-09-11T14:09:21+00:00monthlyhttps://blog.fox-it.com/2019/06/11/using-anomaly-detection-to-find-malicious-domains/https://blog.fox-it.com/wp-content/uploads/2019/06/blog-figure.pngblog figurehttps://blog.fox-it.com/wp-content/uploads/2019/06/ngram.pngngram2019-06-06T13:58:03+00:00monthlyhttps://blog.fox-it.com/2019/06/06/syncing-yourself-to-global-administrator-in-azure-active-directory/https://blog.fox-it.com/wp-content/uploads/2019/06/ceomailbox.pngceomailboxhttps://blog.fox-it.com/wp-content/uploads/2019/06/get-msolrolemember.pngget-msolrolememberhttps://blog.fox-it.com/wp-content/uploads/2019/06/get-msoluser.pngget-msoluserhttps://blog.fox-it.com/wp-content/uploads/2019/06/msolrole.pngmsolrolehttps://blog.fox-it.com/wp-content/uploads/2019/06/onpremise.pngonpremisehttps://blog.fox-it.com/wp-content/uploads/2019/06/syncednow.pngsyncednow2019-06-06T13:08:25+00:00monthlyhttps://blog.fox-it.com/2019/06/04/export-corrupts-windows-event-log-files/https://blog.fox-it.com/wp-content/uploads/2019/06/fox-it-forensics-4.pngFox-IT Forensics 4https://blog.fox-it.com/wp-content/uploads/2019/06/fox-it-forensics-3.pngFox-IT Forensics 3https://blog.fox-it.com/wp-content/uploads/2019/06/fox-it-forensics-2.pngFox-IT Forensics 2https://blog.fox-it.com/wp-content/uploads/2019/06/fox-it-forensics-1.pngFox-IT Forensics 1https://blog.fox-it.com/wp-content/uploads/2019/06/fox-it-blog-3.pngFox-IT blog 3https://blog.fox-it.com/wp-content/uploads/2019/06/fox-it-blog-2.pngFox-IT blog 2https://blog.fox-it.com/wp-content/uploads/2019/06/fox-it-blog-1.pngFox-IT blog 1Image 5: Original data: record content on the left, record headers on the right. 2019-06-04T12:29:42+00:00monthlyhttps://blog.fox-it.com/2019/04/25/getting-in-the-zone-dumping-active-directory-dns-using-adidnsdump/2019-04-25T16:32:38+00:00monthlyhttps://blog.fox-it.com/2019/03/28/mkyara-writing-yara-rules-for-the-lazy-analyst/https://blog.fox-it.com/wp-content/uploads/2019/03/mkyara5.gifmkyara5https://blog.fox-it.com/wp-content/uploads/2019/03/mkyara4.gifmkyara4https://blog.fox-it.com/wp-content/uploads/2019/03/mkyara.pngmkyarahttps://blog.fox-it.com/wp-content/uploads/2019/03/mkyara-image-1.pngmkYARA - image 12019-03-28T13:15:49+00:00monthlyhttps://blog.fox-it.com/2019/03/27/psixbot-the-evolution-of-a-modular-net-bot/https://blog.fox-it.com/wp-content/uploads/2019/03/login.pngloginhttps://blog.fox-it.com/wp-content/uploads/2019/03/versions.pngversions2019-03-27T19:28:37+00:00monthlyhttps://blog.fox-it.com/2019/02/26/identifying-cobalt-strike-team-servers-in-the-wild/https://blog.fox-it.com/wp-content/uploads/2019/02/space_video.pngspace_videohttps://blog.fox-it.com/wp-content/uploads/2019/02/teamservers_stats.pngteamservers_statshttps://blog.fox-it.com/wp-content/uploads/2019/02/space.pngspacehttps://blog.fox-it.com/wp-content/uploads/2019/02/changelog.pngchangelog2019-02-26T14:18:05+00:00monthlyhttps://blog.fox-it.com/2018/04/26/escalating-privileges-with-acls-in-active-directory/https://blog.fox-it.com/wp-content/uploads/2018/04/exploit.pngexploithttps://blog.fox-it.com/wp-content/uploads/2018/04/org_management1.pngorg_managementhttps://blog.fox-it.com/wp-content/uploads/2018/04/psexec-relay1.pngpsexec-relayhttps://blog.fox-it.com/wp-content/uploads/2018/04/pwn1.pngpwnhttps://blog.fox-it.com/wp-content/uploads/2018/04/relayadduserdomainacl1.pngrelayadduserdomainaclhttps://blog.fox-it.com/wp-content/uploads/2018/04/sddl1.pngsddlhttps://blog.fox-it.com/wp-content/uploads/2018/04/secretsdump1.pngsecretsdumphttps://blog.fox-it.com/wp-content/uploads/2018/04/secretsdump-21.pngsecretsdump-2https://blog.fox-it.com/wp-content/uploads/2018/04/secretsdumppwn1.pngsecretsdumppwnhttps://blog.fox-it.com/wp-content/uploads/2018/04/domain_permission1.pngdomain_permission2019-01-20T16:49:38+00:00monthlyhttps://blog.fox-it.com/2018/12/18/your-trust-our-signature/https://blog.fox-it.com/wp-content/uploads/2018/12/twitter.pngtwitterhttps://blog.fox-it.com/wp-content/uploads/2018/12/gov.pnggovhttps://blog.fox-it.com/wp-content/uploads/2018/12/Ktn66H2-1.pngKtn66H2https://blog.fox-it.com/wp-content/uploads/2018/12/OxmuNkt.pngOxmuNkthttps://blog.fox-it.com/wp-content/uploads/2018/12/EHH4vBz.pngEHH4vBzhttps://blog.fox-it.com/wp-content/uploads/2018/12/iFPwV2x.pngiFPwV2xhttps://blog.fox-it.com/wp-content/uploads/2018/12/B8TQT4f.pngB8TQT4fhttps://blog.fox-it.com/wp-content/uploads/2018/12/CpRQtRz.pngCpRQtRzhttps://blog.fox-it.com/wp-content/uploads/2018/12/8nhvj29.png8nhvj29https://blog.fox-it.com/wp-content/uploads/2018/12/175MRhH.png175MRhH2018-12-18T16:10:45+00:00monthlyhttps://blog.fox-it.com/archive/2018-09-10T14:04:03+00:00weekly0.6https://blog.fox-it.com/2018/08/14/phishing-ask-and-ye-shall-receive/2018-08-14T13:53:15+00:00monthlyhttps://blog.fox-it.com/2018/08/09/bokbot-the-rebirth-of-a-banker/https://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_post_request.pngbokbot_post_requesthttps://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_target_format.pngbokbot_target_formathttps://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_event_timeline.pngbokbot_event_timelinehttps://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_attributions.pngbokbot_attributionshttps://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_zeus_sig.pngbokbot_zeus_sighttps://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_reporting_targets.pngbokbot_reporting_targetshttps://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_id_format.pngbokbot_id_formathttps://blog.fox-it.com/wp-content/uploads/2018/08/bokbot_neverquest_target_format.pngbokbot_neverquest_target_formathttps://blog.fox-it.com/wp-content/uploads/2018/08/76service_krebs.jpg76service_krebs2018-08-09T17:15:22+00:00monthlyhttps://blog.fox-it.com/2018/05/17/introducing-team-foundation-server-decryption-tool/https://blog.fox-it.com/wp-content/uploads/2018/05/msf_tfs.pngmsf_tfshttps://blog.fox-it.com/wp-content/uploads/2018/05/tfs_decrypted.pngtfs_decryptedhttps://blog.fox-it.com/wp-content/uploads/2018/05/tfs_variable.pngTFS_Variable2018-05-17T11:06:32+00:00monthlyhttps://blog.fox-it.com/2018/05/09/introducing-orchestrator-decryption-tool/https://blog.fox-it.com/wp-content/uploads/2018/05/orch_result_sql.pngorch_result_sqlhttps://blog.fox-it.com/wp-content/uploads/2018/05/msf_output.pngmsf_outputhttps://blog.fox-it.com/wp-content/uploads/2018/05/orch_tool_result.pngorch_tool_resulthttps://blog.fox-it.com/wp-content/uploads/2018/05/dialog.pngdialoghttps://blog.fox-it.com/wp-content/uploads/2018/05/msf_orch.pngmsf_orch2018-05-09T12:06:56+00:00monthlyhttps://blog.fox-it.com/2017/06/27/liveblog-huge-petya-ransomware-wave/2018-05-04T13:03:32+00:00monthlyhttps://blog.fox-it.com/2018/04/06/compromising-sharefile-on-premise-via-7-chained-vulnerabilities/https://blog.fox-it.com/wp-content/uploads/2018/04/uploadid-double.pnguploadid-doublehttps://blog.fox-it.com/wp-content/uploads/2018/04/xxe.pngxxehttps://blog.fox-it.com/wp-content/uploads/2018/04/validate_1.pngvalidate_1https://blog.fox-it.com/wp-content/uploads/2018/04/validate_2.pngvalidate_2https://blog.fox-it.com/wp-content/uploads/2018/04/upload_initresponse.pngupload_initresponsehttps://blog.fox-it.com/wp-content/uploads/2018/04/upload_unzip.pngupload_unziphttps://blog.fox-it.com/wp-content/uploads/2018/04/uploadid_traversal.pnguploadid_traversalhttps://blog.fox-it.com/wp-content/uploads/2018/04/uploadid_traversal_2.pnguploadid_traversal_2https://blog.fox-it.com/wp-content/uploads/2018/04/unzipfromdisk.pngunzipfromdiskhttps://blog.fox-it.com/wp-content/uploads/2018/04/upload-hmac.pngupload-hmac2018-04-09T09:46:38+00:00monthlyhttps://blog.fox-it.com/2017/12/14/lessons-learned-from-a-man-in-the-middle-attack/2018-01-01T18:05:56+00:00monthlyhttps://blog.fox-it.com/2013/04/05/security-advisory-unencrypted-storage-of-confidential-information-in-keeper-password-data-vault-v5-3-for-ios/https://blog.fox-it.com/wp-content/uploads/2013/04/mysqlitedb560.pngmysqlitedb560https://blog.fox-it.com/wp-content/uploads/2013/04/masterpasswordstatement.pngmasterpasswordstatementhttps://blog.fox-it.com/wp-content/uploads/2013/04/keeper-welcome.pngkeeper welcome2017-12-22T13:35:04+00:00monthlyhttps://blog.fox-it.com/2017/12/12/criminals-in-a-festive-mood/https://blog.fox-it.com/wp-content/uploads/2017/12/2-campagne.png2-campagneStatistics from hxxp://stegengaweb.nl/files/contactgegevens%2012_2017_10_00_.ziphttps://blog.fox-it.com/wp-content/uploads/2017/12/1-campagne.png1-campagneStatistics from: hxxp://partytimeevents.nl/contactgegevens%2012_2017_10_00_.ziphttps://blog.fox-it.com/wp-content/uploads/2017/12/zeus-panel.pngzeus-panelhttps://blog.fox-it.com/wp-content/uploads/2017/12/coolblue_main.pngcoolblue_mainZeus Panda Banker web injecthttps://blog.fox-it.com/wp-content/uploads/2017/12/amazon_main.pngamazon_mainhttps://blog.fox-it.com/wp-content/uploads/2017/12/2e-campagne.png2e-campagneStatistics from hxxp://stegengaweb.nl/files/contactgegevens%2012_2017_10_00_.ziphttps://blog.fox-it.com/wp-content/uploads/2017/12/1e-campagne.png1e-campagneStatistics from hxxp://partytimeevents.nl/contactgegevens%2012_2017_10_00_.zip2017-12-13T12:52:53+00:00monthlyhttps://blog.fox-it.com/2016/05/02/ransomware-deployments-after-brute-force-rdp-attack/https://blog.fox-it.com/wp-content/uploads/2016/05/indialocker.pngindialockerhttps://blog.fox-it.com/wp-content/uploads/2016/05/visio_blog.pngvisio_blog2017-12-13T07:47:28+00:00monthlyhttps://blog.fox-it.com/2017/12/08/detection-and-recovery-of-nsas-covered-up-tracks/https://blog.fox-it.com/wp-content/uploads/2017/12/dsz_evtx_in_use-e1512736524298.pngRecovering removed event recordsFigure 4: Recovering removed event recordshttps://blog.fox-it.com/wp-content/uploads/2017/12/eventviewer_pre_post.pngBefore (back) and after (front) eventlogeditFigure 2: Before (back) and after (front) eventlogedithttps://blog.fox-it.com/wp-content/uploads/2017/12/03_eventlogedit-e1512735666674.pngDanderSpritz with eventlogedit in actionFigure 1: DanderSpritz with _eventlogedit_ in actionhttps://blog.fox-it.com/wp-content/uploads/2017/12/eventrecords.pngUntouched event records (left) and deleted event record (right)Figure 3: Untouched event records (left) and deleted event record (right). Note: not all field are displayed here.2017-12-08T15:20:57+00:00monthlyhttps://blog.fox-it.com/2017/11/28/further-abusing-the-badpwdcount-attribute/https://blog.fox-it.com/wp-content/uploads/2017/11/bruted.pngbrutedhttps://blog.fox-it.com/wp-content/uploads/2017/11/spray_check.pngspray_checkhttps://blog.fox-it.com/wp-content/uploads/2017/11/ps_test.pngps_test2017-11-28T16:22:34+00:00monthlyhttps://blog.fox-it.com/2017/09/13/fox-it-debunks-report-on-bylock-app-that-landed-75000-people-in-jail-in-turkey/https://blog.fox-it.com/wp-content/uploads/2017/09/expert_witness_report_bylock.pngexpert_witness_report_bylock2017-09-13T17:28:17+00:00monthlyhttps://blog.fox-it.com/2017/06/28/faq-about-petya-outbreak/2017-06-29T16:10:53+00:00monthlyhttps://blog.fox-it.com/2017/05/12/massive-outbreak-of-ransomware-variant-infects-large-amounts-of-computers-around-the-world/https://blog.fox-it.com/wp-content/uploads/2017/05/ransomware.jpgransomware2017-05-21T20:29:58+00:00monthlyhttps://blog.fox-it.com/2017/05/13/faq-on-the-wanacry-ransomware-outbreak/2017-05-16T15:56:39+00:00monthlyhttps://blog.fox-it.com/2017/05/03/snake-coming-soon-in-mac-os-x-flavour/2017-05-07T13:34:20+00:00monthlyhttps://blog.fox-it.com/2017/04/14/a-mole-exposing-itself-to-sunlight/https://blog.fox-it.com/wp-content/uploads/2017/04/5.png5https://blog.fox-it.com/wp-content/uploads/2017/04/4.png4https://blog.fox-it.com/wp-content/uploads/2017/04/3.png3https://blog.fox-it.com/wp-content/uploads/2017/04/2.png2https://blog.fox-it.com/wp-content/uploads/2017/04/website.pngwebsite2017-04-14T14:55:28+00:00monthlyhttps://blog.fox-it.com/2017/03/23/turkish-hacktivists-targeting-the-netherlands-high-noise-low-impact/https://blog.fox-it.com/wp-content/uploads/2017/03/turkhackteam_hollandaoperasyonu.jpgHollanda Operasyonuhttps://blog.fox-it.com/wp-content/uploads/2017/03/defaced_website.pngDefaced Dutch websitehttps://blog.fox-it.com/wp-content/uploads/2017/03/ddos_targets.pngDutch DDoS targets2017-03-23T12:36:39+00:00monthlyhttps://blog.fox-it.com/2017/02/13/detecting-ticketbleed-cve-2016-9244/https://blog.fox-it.com/wp-content/uploads/2017/02/ticketbleed_wireshark.pngticketbleed_wireshark2017-02-13T16:56:35+00:00monthlyhttps://blog.fox-it.com/2016/11/28/recent-vulnerability-in-eir-d1000-router-used-to-spread-updated-version-of-mirai-ddos-bot/https://blog.fox-it.com/wp-content/uploads/2016/11/mirai-hf.pngmirai-hf2016-11-28T22:06:21+00:00monthlyhttps://blog.fox-it.com/2016/10/20/ziggo-ransomware-phishing-campaign-still-increasing-in-size/https://blog.fox-it.com/wp-content/uploads/2016/10/lock.pngTorrentLocker lock screenhttps://blog.fox-it.com/wp-content/uploads/2016/10/1475825302447.pngZiggo phishing e-mail2016-10-20T12:10:10+00:00monthlyhttps://blog.fox-it.com/2016/06/15/mofang-a-politically-motivated-information-stealing-adversary/https://blog.fox-it.com/wp-content/uploads/2016/06/mofang_targetedcountries_image.pngmofang_targetedcountries_imagehttps://blog.fox-it.com/wp-content/uploads/2016/06/mofang_cover_image.pngmofang_cover_image2016-06-15T01:02:52+00:00monthlyhttps://blog.fox-it.com/2016/06/07/linkedin-information-used-to-spread-banking-malware-in-the-netherlands/https://blog.fox-it.com/wp-content/uploads/2016/06/screenshot-phishing-campagin.pngScreenshot phishing campagin2016-06-07T17:52:45+00:00monthlyhttps://blog.fox-it.com/2016/04/11/large-malvertising-campaign-hits-popular-dutch-websites/https://blog.fox-it.com/wp-content/uploads/2016/04/protact-fox-it-com-angler-malvertising.pngprotact-fox-it-com-angler-malvertising2016-04-11T10:42:41+00:00monthlyhttps://blog.fox-it.com/2016/03/21/financial-crisis-exercise-at-rsa-2016/https://blog.fox-it.com/wp-content/uploads/2016/03/rsa_3.jpgRSA_3https://blog.fox-it.com/wp-content/uploads/2016/03/rsa_2.jpgRSA_2https://blog.fox-it.com/wp-content/uploads/2016/03/rsa_1.jpgRSA_12016-04-01T07:42:05+00:00monthlyhttps://blog.fox-it.com/2016/03/11/rsa-2016-security-heeft-nog-een-lange-weg-te-gaan/https://blog.fox-it.com/wp-content/uploads/2016/03/jeremy_butcher2.jpgJeremy_Butcher22016-03-31T08:47:08+00:00monthlyhttps://blog.fox-it.com/2016/03/11/rsa-2016-a-long-road-ahead-for-security/2016-03-31T08:46:54+00:00monthlyhttps://blog.fox-it.com/2016/03/24/website-of-security-certification-provider-spreading-ransomware/https://blog.fox-it.com/wp-content/uploads/2016/03/teslacrypt_4-0.pngTeslaCrypt 4.0 ransom noteshttps://blog.fox-it.com/wp-content/uploads/2016/03/teslacrypt_screen.pngTeslaCrypt ransom noteshttps://blog.fox-it.com/wp-content/uploads/2016/03/iclass-eccouncil-org_anglerredirect.pngEC-COUNCIL iClass Angler exploit kit injected script2016-03-29T08:15:57+00:00monthlyhttps://blog.fox-it.com/2015/12/02/ponmocup-a-giant-hiding-in-the-shadows/https://blog.fox-it.com/wp-content/uploads/2015/12/ponmocup_cover_page.pngPonmocup threat report cover pagehttps://blog.fox-it.com/wp-content/uploads/2015/12/fox-it_infographic_fig-2.pngPonmocup botnet global infections2015-12-02T11:16:31+00:00monthlyhttps://blog.fox-it.com/2015/09/07/how-a-research-project-at-fox-it-enhances-your-security-career/https://blog.fox-it.com/wp-content/uploads/2015/09/image401461.jpgimage401461https://blog.fox-it.com/wp-content/uploads/2015/09/foxer_barry2.jpgFoxer_Barry22015-09-09T08:33:34+00:00monthlyhttps://blog.fox-it.com/2015/09/07/the-state-of-ransomware-in-2015/https://blog.fox-it.com/wp-content/uploads/2015/09/torrentlocker_warning.pngTorrentLocker lock screenhttps://blog.fox-it.com/wp-content/uploads/2015/09/ctb_lockscreen.pngCTB Lock screenhttps://blog.fox-it.com/wp-content/uploads/2015/09/ctb_lock_background.pngCTB background lock screenhttps://blog.fox-it.com/wp-content/uploads/2015/09/help_decrypt.pngCryptoWall ransom note2015-09-07T11:59:05+00:00monthlyhttps://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/https://blog.fox-it.com/wp-content/uploads/2015/04/quantum_follow_stream3.pngquantum_follow_stream3https://blog.fox-it.com/wp-content/uploads/2015/04/quantum_insert_wireshark.pngquantum_insert_wiresharkhttps://blog.fox-it.com/wp-content/uploads/2015/04/detect_qi.pngDetect QUANTUMINSERT CSEC2015-09-07T10:23:31+00:00monthlyhttps://blog.fox-it.com/2015/08/24/finding-the-hidden-attacker-in-your-network/2015-09-02T07:40:15+00:00monthlyhttps://blog.fox-it.com/2015/08/13/do-you-have-a-clue/2015-09-02T07:40:01+00:00monthlyhttps://blog.fox-it.com/2015/07/15/how-to-become-cyber-resilient-quickly-and-remain-in-full-control/2015-07-15T13:29:02+00:00monthlyhttps://blog.fox-it.com/2015/06/15/large-malvertising-campaign-targeting-the-netherlands/2015-06-16T10:39:20+00:00monthlyhttps://blog.fox-it.com/2015/04/07/liveblog-malvertising-from-google-advertisements-via-possibly-compromised-reseller/https://blog.fox-it.com/wp-content/uploads/2015/04/malvertising_google_reseller_ru.pngMalvertising via Doubleclick2015-04-10T12:02:10+00:00monthlyhttps://blog.fox-it.com/about/2014-12-17T08:33:32+00:00weekly0.6https://blog.fox-it.com/2014/11/26/cryptophp-a-week-later-more-than-23-000-sites-affected/https://blog.fox-it.com/wp-content/uploads/2014/11/cryptophp_sinkhole_infection_statistics_2.pngCryptoPHP Sinkhole Infection_Statisticshttps://blog.fox-it.com/wp-content/uploads/2014/11/cryptophp_sinkhole_infection_statistics.pngCryptoPHP Sinkhole Infection Statistics2014-12-30T22:33:26+00:00monthlyhttps://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-inside-popular-content-management-systems/https://blog.fox-it.com/wp-content/uploads/2014/11/cryptophp_cover_300pdi.pngCryptoPHP2015-02-02T07:14:45+00:00monthlyhttps://blog.fox-it.com/2014/11/06/cryptolocker-variant-torrentlocker-making-new-victims-in-nl/https://blog.fox-it.com/wp-content/uploads/2014/11/word-macros.pngword macroshttps://blog.fox-it.com/wp-content/uploads/2014/11/incasso-mail.pngincasso mailhttps://blog.fox-it.com/wp-content/uploads/2014/11/warning-tl.pngwarning-tl2015-01-12T15:41:00+00:00monthlyhttps://blog.fox-it.com/2014/10/15/torrentlocker-spreading-in-the-netherlands/https://blog.fox-it.com/wp-content/uploads/2014/10/payment.pngpaymenthttps://blog.fox-it.com/wp-content/uploads/2014/10/warning.pngwarninghttps://blog.fox-it.com/wp-content/uploads/2014/10/torrentlocker.pngTorrentLockerhttps://blog.fox-it.com/wp-content/uploads/2014/10/tracktrace2.pngtracktrace2https://blog.fox-it.com/wp-content/uploads/2014/10/tracktrace.pngtracktracehttps://blog.fox-it.com/wp-content/uploads/2014/10/postnl-phishing.pngpostnl phishing2014-10-31T08:30:19+00:00monthlyhttps://blog.fox-it.com/2014/10/21/update-on-the-torrentlocker-ransomware/https://blog.fox-it.com/wp-content/uploads/2014/10/harvested-torrentlocker-addresses.pngharvested-torrentlocker-addresses2014-10-24T20:35:38+00:00monthlyhttps://blog.fox-it.com/2014/10/15/poodle/2014-10-15T11:20:14+00:00monthlyhttps://blog.fox-it.com/2014/09/04/update-on-decryptcryptolocker/https://blog.fox-it.com/wp-content/uploads/2014/09/cryptolocker_stats-top10_filetypes_rounded.pngCryptolocker_stats-top10_filetypes_roundedhttps://blog.fox-it.com/wp-content/uploads/2014/09/cryptolocker_stats-requests.pngCryptolocker_stats-requestshttps://blog.fox-it.com/wp-content/uploads/2014/09/cryptolocker_stats-top20_request.pngCryptolocker_stats-top20_requesthttps://blog.fox-it.com/wp-content/uploads/2014/09/cryptolocker_stats-infection.pngCryptolocker_stats-infection2015-01-21T18:00:24+00:00monthlyhttps://blog.fox-it.com/2014/08/27/malvertising-not-all-java-from-java-com-is-legitimate/https://blog.fox-it.com/wp-content/uploads/2014/08/fireeye_asprox_tracking.pngFireEye Asprox trackinghttps://blog.fox-it.com/wp-content/uploads/2014/08/malvertising.pngMalvertising2014-08-30T01:25:45+00:00monthlyhttps://blog.fox-it.com/2014/08/06/cryptolocker-ransomware-intelligence-report/https://blog.fox-it.com/wp-content/uploads/2014/08/payments-cryptolocker.pngPayments-Cryptolockerhttps://blog.fox-it.com/wp-content/uploads/2014/08/infections-per-month.pnginfections-per-monthhttps://blog.fox-it.com/wp-content/uploads/2014/08/global-infection-rate-cryptolocker.pngGlobal-Infection-Rate-Cryptolockerhttps://blog.fox-it.com/wp-content/uploads/2014/08/cryptolocker-warning.jpgCryptoLocker warning2014-10-28T14:23:50+00:00monthlyhttps://blog.fox-it.com/2014/04/08/openssl-heartbleed-bug-live-blog/https://blog.fox-it.com/wp-content/uploads/2014/04/heartbleed-example.pngheartbleed examplehttps://blog.fox-it.com/wp-content/uploads/2014/04/heartbleed.pngheartbleed2014-07-09T09:36:44+00:00monthlyhttps://blog.fox-it.com/2014/03/07/building-bowser-a-password-cracking-story/https://blog.fox-it.com/wp-content/uploads/2014/03/image018.jpgimage018https://blog.fox-it.com/wp-content/uploads/2014/03/image016.jpgimage016https://blog.fox-it.com/wp-content/uploads/2014/03/image056.jpgimage056https://blog.fox-it.com/wp-content/uploads/2014/03/image054.jpgimage054https://blog.fox-it.com/wp-content/uploads/2014/03/image058.jpgimage058https://blog.fox-it.com/wp-content/uploads/2014/03/image066.jpgimage066https://blog.fox-it.com/wp-content/uploads/2014/03/image064.jpgimage064https://blog.fox-it.com/wp-content/uploads/2014/03/image062.pngimage062https://blog.fox-it.com/wp-content/uploads/2014/03/image061.pngimage061https://blog.fox-it.com/wp-content/uploads/2014/03/image059.pngimage0592014-03-14T00:31:02+00:00monthlyhttps://blog.fox-it.com/2014/02/25/tilonspyeye2-intelligence-report/https://blog.fox-it.com/wp-content/uploads/2014/02/spyeye2-infrastructure.pngSpyEye2 infrastructure2014-02-25T10:56:53+00:00monthlyhttps://blog.fox-it.com/2014/01/03/malicious-advertisements-served-via-yahoo/https://blog.fox-it.com/wp-content/uploads/2014/01/yahoo-ads-malware1.jpgyahoo ads malwarehttps://blog.fox-it.com/wp-content/uploads/2014/01/yahoo-ad-distribution.jpgyahoo ad distributionhttps://blog.fox-it.com/wp-content/uploads/2014/01/yahoo-ads-malware.jpgyahoo ads malwarehttps://blog.fox-it.com/wp-content/uploads/2014/01/distribution-infections.jpgdistribution infectionshttps://blog.fox-it.com/wp-content/uploads/2014/01/distribution-infections.pngdistribution infectionshttps://blog.fox-it.com/wp-content/uploads/2014/01/yahoo-ads-malware.pngyahoo ads malware2014-02-28T16:30:39+00:00monthlyhttps://blog.fox-it.com/2013/12/19/not-quite-the-average-exploit-kit-zuponcic/https://blog.fox-it.com/wp-content/uploads/2013/12/zuponcic_attack_flow1.pngzuponcic_attack_flowhttps://blog.fox-it.com/wp-content/uploads/2013/12/htaccess_fake_redirects.pnghtaccess_fake_redirectshttps://blog.fox-it.com/wp-content/uploads/2013/12/zuponcic_redirect_flow.pngzuponcic_redirect_flowhttps://blog.fox-it.com/wp-content/uploads/2013/12/path-to-trojan1.pngPath-to-trojanhttps://blog.fox-it.com/wp-content/uploads/2013/12/path-to-trojan.pngPath-to-trojanhttps://blog.fox-it.com/wp-content/uploads/2013/12/zuponcic_zip_bing_keyword.pngzuponcic_zip_bing_keywordhttps://blog.fox-it.com/wp-content/uploads/2013/12/kurz-instruments-inc-certificate.pngKurz Instruments Inc Certificatehttps://blog.fox-it.com/wp-content/uploads/2013/12/ie10_jar.pngIE10_jarhttps://blog.fox-it.com/wp-content/uploads/2013/12/htaccess_referer_check.pnghtaccess_referer_check2013-12-20T09:59:20+00:00monthlyhttps://blog.fox-it.com/2013/09/05/large-botnet-cause-of-recent-tor-network-overload/https://blog.fox-it.com/wp-content/uploads/2013/09/tor_metrics1.pngTor Metricshttps://blog.fox-it.com/wp-content/uploads/2013/09/tor_module_analysis.pngTor Module Analysishttps://blog.fox-it.com/wp-content/uploads/2013/09/tor_metrics.pngTor Statisticshttps://blog.fox-it.com/wp-content/uploads/2013/09/sbc_panel.pngSBC Panel2013-09-14T04:26:26+00:00monthlyhttps://blog.fox-it.com/2013/08/05/dns-takeover-redirects-thousands-of-websites-to-malware/https://blog.fox-it.com/wp-content/uploads/2013/08/conrad_iframe.pngMalicious iframe2013-08-07T19:17:35+00:00monthlyhttps://blog.fox-it.com/2013/08/01/analysis-of-malicious-advertisements-on-telegraaf-nl/https://blog.fox-it.com/wp-content/uploads/2013/08/vm_cleanup.pngvm_cleanuphttps://blog.fox-it.com/wp-content/uploads/2013/08/telegraaf-nl_winlocker_ano.pngtelegraaf.nl_winlocker_ano2013-08-02T08:46:09+00:00monthlyhttps://blog.fox-it.com/2013/07/25/analysis-of-the-kins-malware/https://blog.fox-it.com/wp-content/uploads/2013/07/kins-ida.jpgkins-idahttps://blog.fox-it.com/wp-content/uploads/2013/07/kins-ida-600.pngkins-ida 600https://blog.fox-it.com/wp-content/uploads/2013/07/kins-ida-640.pngkins-ida 640https://blog.fox-it.com/wp-content/uploads/2013/07/kins-ida.pngkins-idahttps://blog.fox-it.com/wp-content/uploads/2013/07/kins.pngkins2014-03-25T18:12:32+00:00monthlyhttps://blog.fox-it.com/2013/06/06/geinfecteerde-advertenties-op-nu-nl/2014-04-11T06:57:55+00:00monthlyhttps://blog.fox-it.com/2013/03/06/seen-in-the-wild-updated-exploit-kits/https://blog.fox-it.com/wp-content/uploads/2013/03/sweetorange_landingpage_deobfuscated.pngsweetorange_landingpage_deobfuscatedhttps://blog.fox-it.com/wp-content/uploads/2013/03/sweetorange_landingpage_obfuscated.pngsweetorange_landingpage_obfuscatedhttps://blog.fox-it.com/wp-content/uploads/2013/03/nicepack_found.pngnicepack_foundhttps://blog.fox-it.com/wp-content/uploads/2013/03/nice_landingpage_deobfuscated.pngnice_landingpage_deobfuscatedhttps://blog.fox-it.com/wp-content/uploads/2013/03/nice_landingpage_obfuscated.pngnice_landingpage_obfuscatedhttps://blog.fox-it.com/wp-content/uploads/2013/03/registrant.pngregistrant2013-03-28T15:54:56+00:00monthlyhttps://blog.fox-it.com/2013/02/21/writeup-on-nbc-com-distributing-citadel-malware/2013-02-22T21:12:57+00:00monthlyhttps://blog.fox-it.com/2013/02/12/oracle-getting-serious-about-java/https://blog.fox-it.com/wp-content/uploads/2013/02/javaone.jpgJavaOnehttps://blog.fox-it.com/wp-content/uploads/2013/02/javatwo.jpgJavaTwohttps://blog.fox-it.com/wp-content/uploads/2013/02/blackhole_2-0-1_succesful_exploitation_distribution.pngBlackhole_2.0.1_succesful_exploitation_distributionhttps://blog.fox-it.com/wp-content/uploads/2013/02/java-sec-information.jpgjava sec informationhttps://blog.fox-it.com/wp-content/uploads/2013/02/java-update-needed.jpgjava update needed2013-02-13T11:47:42+00:00monthlyhttps://blog.fox-it.com/2013/01/11/demystifying-pobelka/2013-09-08T21:25:15+00:00monthlyhttps://blog.fox-it.com/2012/11/28/cyber-security-in-nederland-op-de-agenda/2012-12-07T13:17:49+00:00monthlyhttps://blog.fox-it.com/2012/10/18/fox-it-discovers-security-bugs-in-oracle-software/2012-10-18T15:17:51+00:00monthlyhttps://blog.fox-it.com/2012/10/15/mogen-we-terugslaan/2012-10-15T23:16:37+00:00monthlyhttps://blog.fox-it.com/2012/08/30/observations-on-the-recent-java-0-day-exploits-in-the-wild/https://blog.fox-it.com/wp-content/uploads/2012/08/exe.jpgExehttps://blog.fox-it.com/wp-content/uploads/2012/08/jar.jpgJarhttps://blog.fox-it.com/wp-content/uploads/2012/08/1_7.png1_72012-10-10T12:01:05+00:00monthlyhttps://blog.fox-it.com/2012/08/09/xdoccryptdorifel-document-encrypting-and-network-spreading-virus/https://blog.fox-it.com/wp-content/uploads/2012/08/rc41.pngrc4https://blog.fox-it.com/wp-content/uploads/2012/08/xdoccrypt_loader1.pngXDocCrypt_loaderhttps://blog.fox-it.com/wp-content/uploads/2012/08/xdoccrypt_loader.pngXDocCrypt_loaderhttps://blog.fox-it.com/wp-content/uploads/2012/08/recover_and_load_original.pngrecover_and_load_originalhttps://blog.fox-it.com/wp-content/uploads/2012/08/rc4.pngrc42012-08-31T14:37:44+00:00monthlyhttps://blog.fox-it.com/2012/06/21/how-to-find-malcious-communcation-leaving-your-network/2012-06-21T17:02:03+00:00monthlyhttps://blog.fox-it.com/2012/05/08/mime-sniffing-feature-or-vulnerability/https://blog.fox-it.com/wp-content/uploads/2012/05/xss-zip-file.pngxss zip file2014-10-22T17:34:35+00:00monthlyhttps://blog.fox-it.com/2012/04/12/critical-analysis-of-microsoft-operation-b71/2012-05-10T02:07:10+00:00monthlyhttps://blog.fox-it.com/2012/03/16/post-mortem-report-on-the-sinowallnu-nl-incident/https://blog.fox-it.com/wp-content/uploads/2012/03/smoke-loader.jpgsmoke loaderhttps://blog.fox-it.com/wp-content/uploads/2012/03/nuclear-pack.jpgnuclear pack2012-04-04T18:52:04+00:00monthlyhttps://blog.fox-it.com/2011/11/21/rsa-512-certificates-abused-in-the-wild/2012-01-04T23:37:07+00:00monthlyhttps://blog.fox-it.com/2011/11/15/onze-visie-op-de-eigen-slagkracht-van-de-overheid/2011-11-15T08:32:53+00:00monthlyhttps://blog.fox-it.com/2011/11/09/presentatie-fox-it-op-infosecurity-nl-2011/2011-11-09T12:57:18+00:00monthlyhttps://blog.fox-it.com/2011/06/02/over-het-cda-en-het-bestraffen-van-gebruik-van-crypto/2012-11-28T09:22:46+00:00monthlyhttps://blog.fox-it.com/2011/05/13/dpi-laten-we-het-doen-zoals-in-chili/2011-06-02T11:02:21+00:00monthlyhttps://blog.fox-it.com/2010/05/31/forbes-bert-hubert-explains-the-dns-issue-with-china/2010-05-31T16:12:16+00:00monthlyhttps://blog.fox-it.comdaily1.02026-05-21T19:29:43+00:00