What You Need to Know About OpenSSH Vulnerability and New Vulnerable Scenario
Background on the new OpenSSH vulnerability and how Stairwell can help
Resources
A lot is happening, and we’re moving at a fast pace. Keep up with it all here.
Stairwell threat report: Black Basta overview and detection rules
Gain an understanding of the Black Basta ransomware-as-a-service, plus YARA rules for detection.
Stairwell threat report: Vulnerable PuTTY SSH libraries (CVE-2024-31497)
An overview of the CVE as well as a list of software not previously mentioned in the NIST advisory.
Threat report: xz backdoor
How Stairwell users have insight into xz backdoor in their organizations, pIus IOCs & YARA rules.
Proactive response: AnyDesk, any breach
Among rumors of an AnyDesk breach, we developed YARA rules and hunting methods to help customers.
Technical analysis: The silent torrent of VileRAT
A technical overview of VileRAT & the group thought to be behind it, as well as IoCs and more.
Signed, sealed, but not always secure: Rethinking trust in digitally-signed certificates
Research and an in-depth look at the double-edge swords that are digitally-signed certificates.
Kuiper ransomware analysis: Stairwell’s technical report
A detailed technical analysis of an obtained copy of Kuiper ransomware.
Stepping into the unknown: Uncovering espionage malware with Stairwell Variant Discovery
Using Stairwell's Variant Discovery tool to expand on threat research shared by ESET.
Security alert enrichment: ShadowPad variants
The Stairwell Threat Research team shares variants and queries for ShadowPad variant samples.
Akira: Pulling on the chains of ransomware
Stairwell researchers recovered a directory that had been publicly exposed. Here's what they found.
CVE-2023-3519: Stairwell identifies previously unseen attack methods
Details on previously unseen threats regarding Citrix CVE-2023-3519.
ChamelGang and ChamelDoH: A DNS-over-HTTPS implant
The first in a series detailing the capabilities of various tools in ChamelGang's arsenal.
Security alert enrichment: Terminator endpoint defense evasion tool
An alert enrichment to the report created by CrowdStrike on Terminator.
Jasper the unfriendly loader
The analysis of JasPer Loader, a trojanized Dynamic Link Library (DLL) file.
