WithSecure™ Labs: With great research comes great responsibility

Research, development, updates and tooling you can use.

Latest Publication

Read all publications

September 30, 2022

DUCKTAIL returns: Underneath the ruffled feathers

In short, the operation consists of an information stealer malware that is delivered to targeted victims that primarily operate in the digital marketing and advertisement space.

September 30, 2022

Machine Learning accuracy forecast

Machine Learning in a Changing World

The only constant in the world nowadays is change. This is no different in machine learning, and the data that machine learning models are trained on. Therefore, developing a machine learning model does not stop once we have trained and deployed the model: we should also monitor the deployed model and data, to make sure that the model keeps performing as expected.

September 30, 2022

Hunting for timer-queue timers

This blog provides a full technical walkthrough for implementing a PoC memory scanner for enumerating timer-queue timers as used in Ekko Sleep Obfuscation (https://github.com/Cracked5pider/Ekko).

September 30, 2022

Prototype Pollution Primer for Pentesters and Programmers

Prototype pollution is a vulnerability that exploits inheritance behavior in JavaScript to create malicious instances of data types, which in the right conditions, can result in the execution of attacker-supplied code. Depending on the context, this can have impacts ranging from DOM-based Cross Site Scripting to even Remote Code Execution.

September 30, 2022

DUCKTAIL: An infostealer malware targeting Facebook Business accounts

WithSecure™ has discovered an ongoing operation (dubbed "DUCKTAIL") that targets individuals and organizations that operate on Facebook’s Business and Ads platform.

September 30, 2022

Spoofing Call Stacks To Confuse EDRs

Call stacks are an understated yet often important source of telemetry for EDR products.