Telegram Abused as C2 Channel for New Golang Backdoor

As part of Netskope Threat Labs hunting activities, we came across an IoC being shared by other researchers and decided to take a closer look at it. During the analysis, we discovered that the payload was apparently still under development, but is already fully functional. The malware acts like a backdoor and uses Telegram as its command and control (C2) channel.

Mastering PowerShell Sleep for Script Management

The Start-Sleep cmdlet in PowerShell pauses the execution of a script and waits for a specified amount of time. Strategically using pauses can help ensure smooth functionality and prevent errors, especially in scripts that depend on external systems or events. Here are three of the top reasons you might need to use a PowerShell pause command.

Delivering Effective Customer Notifications

A few months ago I received a call from my Grandma. She was concerned about having received a notification that she had been part of a data breach and wasn’t sure what to do about it. She had many seemingly basic, but good questions; What’s PII? I use the app on my iPad, is it safe to log into other applications like my bank? Is it safe to use my account? How do I know when it’s safe?

Understand and detect MITRE Caldera with Zeek

MITRE’s Caldera is a cybersecurity platform developed to simulate adversarial tactics, techniques, and procedures (TTPs). Built upon the MITRE ATT&CK framework, Caldera is an open-source tool designed to help cybersecurity professionals and organizations assess their defenses, uncover vulnerabilities, and enhance their overall security posture. By emulating real-world cyber threats, Caldera enables blue teams to test detection and response mechanisms under realistic conditions.

New Research: Ransomware Data Extortion Skyrocketing

Data theft extortion attacks increased by 46% in the fourth quarter of 2024, according to a new report from Nuspire. These incidents have become a routine part of ransomware attacks, since the threat of a data breach puts additional pressure on victims to pay the ransom. Ransomware gangs published stolen data on leak sites more than 2,200 times during Q4 2024. The finance and insurance industry saw the sharpest rise in data theft extortion last quarter.