Proactive downgrade protection: Keeping your systems protected from hidden vulnerabilities
Prevent hidden threats with Stairwell’s Downdate downgrade protection system.
Resources
A lot is happening, and we’re moving at a fast pace. Keep up with it all here.
What You Need to Know About OpenSSH Vulnerability and New Vulnerable Scenario
Background on the new OpenSSH vulnerability and how Stairwell can help
Stairwell threat report: Black Basta overview and detection rules
Gain an understanding of the Black Basta ransomware-as-a-service, plus YARA rules for detection.
Stairwell threat report: Vulnerable PuTTY SSH libraries (CVE-2024-31497)
An overview of the CVE as well as a list of software not previously mentioned in the NIST advisory.
Threat report: xz backdoor
How Stairwell users have insight into xz backdoor in their organizations, pIus IOCs & YARA rules.
Proactive response: AnyDesk, any breach
Among rumors of an AnyDesk breach, we developed YARA rules and hunting methods to help customers.
Technical analysis: The silent torrent of VileRAT
A technical overview of VileRAT & the group thought to be behind it, as well as IoCs and more.
Signed, sealed, but not always secure: Rethinking trust in digitally-signed certificates
Research and an in-depth look at the double-edge swords that are digitally-signed certificates.
Kuiper ransomware analysis: Stairwell’s technical report
A detailed technical analysis of an obtained copy of Kuiper ransomware.
Stepping into the unknown: Uncovering espionage malware with Stairwell Variant Discovery
Using Stairwell's Variant Discovery tool to expand on threat research shared by ESET.
Security alert enrichment: ShadowPad variants
The Stairwell Threat Research team shares variants and queries for ShadowPad variant samples.
Akira: Pulling on the chains of ransomware
Stairwell researchers recovered a directory that had been publicly exposed. Here's what they found.
CVE-2023-3519: Stairwell identifies previously unseen attack methods
Details on previously unseen threats regarding Citrix CVE-2023-3519.
ChamelGang and ChamelDoH: A DNS-over-HTTPS implant
The first in a series detailing the capabilities of various tools in ChamelGang's arsenal.
Security alert enrichment: Terminator endpoint defense evasion tool
An alert enrichment to the report created by CrowdStrike on Terminator.
