Explore our blog

Intezer has discovered a new, sophisticated malware named HiddenWasp, targeting Linux systems. Unlike common Linux malware, HiddenWasp is not focused on crypto-mining or DDoS activity, but rather it is a trojan purely used for targeted remote control.

The Pacha Group is disabling previously installed cryptominers from other threat groups on the cloud, most notably Rocke Group, in order to obtain the largest foothold of computing power on the cloud for conducting malicious crypto-mining activities.

The Pacha Group is disabling previously installed cryptominers from other threat groups on the cloud, most notably the Rocke Group, in order to obtain the largest foothold of computing power on the cloud for conducting malicious crypto-mining activities.

Get to know Intezer Analyze community manager Shaul Holtzman. Shaul is a former cybersecurity analyst helping organizations detect and classify advanced cyber threats.

Memory forensics are crucial for detecting fileless malware. The new Intezer endpoint analysis solution analyzes code in memory to detect advanced threats.

A technical analysis of Linux.Greedy.Antd, a cryptominer employed by Pacha Group to compromise third party Linux servers. The malware was undetected by all leading engines, demonstrating the sophistication of this threat.

Announcing the release of an API for the Intezer Analyze community edition. Members of the free community can now create automation scripts to analyze files without manual intervention. Highlighted in this blog are some of the ways in which community users can utilize the API.

Software is evolutionary. Intezer has introduced a new innovative approach to automate malware analysis and provide clear insights into any suspicious file. The company's Genetic Malware Analysis technology empowers security teams to improve and accelerate all stages of their incident response, from the initial alert to the final step of remediation.

Distributed denial-of-service (DDoS) attacks were on the rise in 2018. Chinese threat actors in particular have predominantly deployed DDoS attacks in their cyber campaigns, and China has emerged has having one of the highest rates of DDoS attacks. This blog provides a technical analysis highlighting connections between ChinaZ and other notable Chinese threat actor groups in the current DDoS landscape.

The Muhstik botnet was first exposed by Netlab360 researchers in May 2018. This botnet targeted mainly GPON routers. At Intezer we found that Muhstik is extending its spectrum of compromised devices by targeting web servers hosting phpMyAdmin.

As seen by security researchers across the world and proven in a joint research by McAfee and Intezer, Lazarus, one of the groups operating from North Korea, has consistently reused code in their malware toolset.

Researchers at Palo Alto Networks recently published a report regarding the NOKKI malware, which has shared code with KONNI and, although not in the report by Palo Alto, KimJongRAT (discovered by Paul Rascagnères of Cisco Talos in 2013), and another report on how there is evidence of the NOKKI malware connecting...

We would like to proudly announce that Intezer Analyze™ now supports genetic malware analysis for ELF binaries! You may now upload ELF files to our system and find code reuse. We have already indexed the genes of millions of different files into our ELF genome database, classified into both malicious, trusted, and...

Foudre is a remote access tool and has the ability to remotely execute commands, steal information about the infected target (such as keystrokes, process information, etc), and auto-update itself. Most of the code and functionality from the previous versions of Foudre and Infy was reused and can be read about in the reports by Palo Alto linked above, so we are only going to focus on the new, unique, interesting features and the linkage of code reuse from previous versions.

Our technology is based on genetic analysis of files. So far, we’ve focused mainly on detection of code reuse, as part of the genetic malware analysis process.