Author Profile

ASERT Team

ATLAS Security Engineering & Response Team (ASERT) delivers world-class network security research and analysis for the benefit of today’s enterprise and network operators. ASERT engineers and researchers are part of an elite group of institutions that are referred to as ‘super remediators’ and represent the best in information security. ASERT has both visibility and remediation capabilities at nearly every tier one operator and a majority of service provider networks globally.

LUCKY ELEPHANT Campaign Masquerading

March 22nd, 2019

In early March 2019, ASERT Researchers uncovered a credential harvesting campaign targeting mostly South Asian governments. The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments, telecommunications, and military.

Introducing the NETSCOUT Threat Intelligence Report – Findings from Second Half 2018

February 27th, 2019

We have a few announcements to make: On Tuesday February 26th, we released our second threat intelligence report , titled ‘Dawn of the Terrorbit Era.’ The report furthers our findings around Internet Scale Threat, with analysis from the ATLAS Security Engineering and Response Team (ASERT) and powered by ATLAS, our...

IoT Exploits: Around The World In 120 Days

February 7th, 2019

Internet of Things (IoT) botnets commonly propagate by exploiting vulnerabilities in IoT devices. Telemetry from our IoT honeypots show the number of exploit attempts originating from bots continues to increase.

LoJax: Fancy since 2016

January 16th, 2019

In May of last year, ASERT Researchers reported on LoJax, a double-agent leveraging legitimate software to phone home to malicious command and control (C2) servers. Since the publication of our research, we’ve monitored a number of new malware samples.

Danabot's Travels, A Global Perspective

December 19th, 2018

First discovered in May of 2018, Danabot is a Delphi written banking trojan that has been under active development throughout the year.

Fast & Furious IoT Botnets: Regifting Exploits

December 12th, 2018

Internet of Things (IoT) botnet authors are adapting to a shift in more secure IoT devices, which has diverted attacker’s focus to exploiting vulnerabilities in IoT devices, either to supplement brute-forcing factory default passwords or completely supplant it.

STOLEN PENCIL Campaign Targets Academia

December 5th, 2018

ASERT has learned of an APT campaign, possibly originating from DPRK, we are calling STOLEN PENCIL that is targeting academic institutions since at least May 2018.

Tunneling Under the Sands

September 14th, 2018

ASERT recently came across spear-phishing emails targeting the Office of the First Deputy Prime Minister of Bahrain.

Double the Infection, Double the Fun

August 30th, 2018

Executive Summary Cobalt Group (aka TEMP.Metastrike), active since at least late 2016, have been suspected in attacks across dozens of countries. The group primarily targets financial organizations, often with the use of ATM malware. Researchers also believe they are responsible for a series of attacks on the SWIFT...