Executive Summary This report is an overview of live espionage and data exfiltration resulting from a previously unknown backdoor that flew under the radar for over 3 years. The weapon? Spear phishing with official-looking documents targeting government employees. The target? A Southeast Asian government. There is medium-to-high-confidence that the Chinese APT

Executive Summary This report is about a new malware campaign by a foreign adversarial nation-state threat actor recently being referred to as NOBELIUM. The threat actor has gained prominence for its involvement in the SolarWinds supply chain attack. This new campaign focuses on phishing using a sophisticated toolset. Tactics, Techniques, and

Overview Details: On May 25, 2021, VMware released a new critical security advisory, VMSA-2021-0010 (CVE-2021-21985 & CVE-2021-21986), affecting vCenter Server 6.5, 6.7, and 7.0. These vulnerabilities could allow a malicious actor to gain access to vCenter by exploiting the vSAN plugin, even if vSAN is not currently in use. VMware has also made improvements to

Overview of TIR-20210524 This report discusses the relationship between the time a new vulnerability is announced and the increase in observed attacks against the vulnerability until it can be patched. The public-facing internet attack surface of many businesses has expanded dramatically in recent years due to the decreasing cost of cloud-computing