Explore our blog

By revealing the origins of software, the Genetic Analysis approach can detect in-memory threats designed by attackers to not generate noise.

Intezer Analyze now supports genetic analysis for files created with the Golang programming language. Users can detect and classify malware written in Go, within seconds!

ACBackdoor is a multiplatform backdoor with Linux and Windows variants. The malware lacks known connections to other threat groups, which may indicate the retooling of a known threat group or the formation of a new one.

Researchers at Intezer and IBM X-Force have identified a new, undetected ransomware threat being used in targeted attacks against enterprise production servers and databases.

In the spirit of Halloween we’re spotlighting three “spooky” threats detected by the Intezer Analyze community in October. And as a special treat, we’re giving away three code-based YARA signatures which can be used to hunt for additional variants of these threats!

SOCs from the same organization can leverage Intezer Analyze to automatically share classifications and remediation tactics on previous incidents.

Research conducted in a joint effort between Intezer and Check Point Research maps the Russian APT ecosystem on an unprecedented scale.

We can assess with high confidence that FullofDeep, a Russian cybercrime group specializing in ransomware operations, is behind both the original QNAPCrypt campaigns and the newly identified ransomware variant.

By applying a Genetic Malware Analysis approach, and adhering to the mitigation recommendations outlined in this blog, users of Linux-based systems—particularly organizations hosting their data on Linux cloud servers—can better protect themselves from the threats posed by this emerging landscape.

At BlackHat Arsenal 2019 Intezer’s researcher, Omri Ben-Bassat, revealed open-source tool called MoP (“Master of Puppets”) which is a framework for reverse engineers who wish to create and operate trackers for new malware found in the wild for research purposes.

In July, Intezer Analyze community users detected GonnaCry ransomware, the HawkEye malware kit, and BXAQ, the spyware the Chinese authorities have been installing onto foreign travelers’ Android devices.

Studying genetic connections between malware samples and families detected and classified by the Intezer Analyze community.

Researchers have discovered a new version of WatchBog, a cryptocurrency-mining botnet operational since November 2018. It is estimated that 4,500 Linux machines have been infected by this new malware campaign since June 2019.

EvilGnome, a rare type of malware with zero detections in VirusTotal, is spying on Linux desktop users by allowing the recording of audio conversations. The malware has infrastructure connections to Russian APT Gamaredon Group.

Researchers at Intezer have detected and temporarily DoS’d the operation of a ransomware targeting Linux-based file storage systems. It can be assessed with high confidence that this malware, named QNAPCrypt, was developed by the authors of Linux.Rex.