WithSecure™ Labs: With great research comes great responsibility

This comprehensive analysis uncovers the business mechanics of ransomware groups, their ecosystems, and how they interact. The report not only provides a clear picture of the current ransomware situation but also reveals some unexpected trends.

In our latest research paper, Tim West, W/Intelligence’s Director of Threat Intelligence and Outreach, has looked into the cyber threats facing the Paris 2024 Olympics. As one of the world’s greatest events, there is always going to be unwanted interest, but how much should we worry and who are the main antagonists?

This report will explore the trend of mass exploitation of Edge Services and Infrastructure and will put forward several theories as to why they have been so heavily and successfully targeted by attackers.

We demonstrate how Google’s Gemini Advanced can be coerced into performing a social engineering attack. By sending a malicious email, attackers can manipulate Gemini's responses when analyzing the user's mailbox, causing it to display convincing messages that trick the user into revealing confidential information from other emails. 

We look at how hackers are using generative AI to enhance their offensive capabilities, then how we can protect ourselves from these attacks. Consideration is given to both the technical and the human elements.

This report provides an in-depth technical analysis of the backdoor and its capabilities, and analyzes the connection between Kapeka and Sandworm group. The purpose of this report is to raise awareness amongst businesses, governments, and the broader security community. WithSecure has engaged governments and select customers with advanced copies of this report. In addition to the report, we are releasing several artifacts developed as a result of our research, including a registry-based & hardcoded configuration extractor, a script to decrypt and emulate the backdoor’s network communication, and as might be expected, a list of indicators of compromise, YARA rules, and MITRE ATT&CK mapping