Author Profile

ASERT Team

ATLAS Security Engineering & Response Team (ASERT) delivers world-class network security research and analysis for the benefit of today’s enterprise and network operators. ASERT engineers and researchers are part of an elite group of institutions that are referred to as ‘super remediators’ and represent the best in information security. ASERT has both visibility and remediation capabilities at nearly every tier one operator and a majority of service provider networks globally.

Air APT

September 12th, 2019

Executive Summary Airlines and the airport industry in general are highly lucrative targets for APT groups; they are rife with information that other countries would find useful. NETSCOUT data from 2019 shows airport and airline targeting remains strong and steady, with Russian, Chinese, and Iranian APT groups...

NETSCOUT Threat Intelligence Report

August 5th, 2019

"It’s hard to express the scale of today’s cyber threat landscape, let alone its global impact." - Hardik Modi, Senior Director of Threat Intelligence Executive Summary In the past six months, there were nearly four million DDoS attacks around the world and that attack frequency grew by 39 percent in the first half of...

Realtek SDK Exploits on the Rise from Egypt

Executive Summary ASERT’s IoT honeypot network continuously monitors known exploit vectors and we recently detected a spike in exploit attempts targeting the Realtek SDK miniigd SOAP vulnerability in consumer-based routers from the end of April 2019 until the first half of May 2019. The attacks originated from Egypt...

LUCKY ELEPHANT Campaign Masquerading

March 22nd, 2019

In early March 2019, ASERT Researchers uncovered a credential harvesting campaign targeting mostly South Asian governments. The actors behind this campaign we call LUCKY ELEPHANT use doppelganger webpages to mimic legitimate entities such as foreign governments, telecommunications, and military.

Introducing the NETSCOUT Threat Intelligence Report – Findings from Second Half 2018

February 27th, 2019

NETSCOUT Threat Intellgience Report - Security Findings from Second Half 2018. Special Report powered by ATLAS.

IoT Exploits: Around The World In 120 Days

February 7th, 2019

Internet of Things (IoT) botnets commonly propagate by exploiting vulnerabilities in IoT devices. Telemetry from our IoT honeypots show the number of exploit attempts originating from bots continues to increase.

LoJax: Fancy since 2016

January 16th, 2019

In May of last year, ASERT Researchers reported on LoJax, a double-agent leveraging legitimate software to phone home to malicious command and control (C2) servers. Since the publication of our research, we’ve monitored a number of new malware samples.

Danabot's Travels, A Global Perspective

December 19th, 2018

First discovered in May of 2018, Danabot is a Delphi written banking trojan that has been under active development throughout the year.

Fast & Furious IoT Botnets: Regifting Exploits

December 12th, 2018

Internet of Things (IoT) botnet authors are adapting to a shift in more secure IoT devices, which has diverted attacker’s focus to exploiting vulnerabilities in IoT devices, either to supplement brute-forcing factory default passwords or completely supplant it.

STOLEN PENCIL Campaign Targets Academia

December 5th, 2018

ASERT has learned of an APT campaign, possibly originating from DPRK, we are calling STOLEN PENCIL that is targeting academic institutions since at least May 2018.

Tunneling Under the Sands

September 14th, 2018

ASERT recently came across spear-phishing emails targeting the Office of the First Deputy Prime Minister of Bahrain.

Double the Infection, Double the Fun

August 30th, 2018

Executive Summary Cobalt Group (aka TEMP.Metastrike), active since at least late 2016, have been suspected in attacks across dozens of countries. The group primarily targets financial organizations, often with the use of ATM malware. Researchers also believe they are responsible for a series of attacks on the SWIFT...