Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Anand Ajjan
攻撃者の潜伏を阻止するメモリスキャン
** 本記事は、Memory scanning leaves attackers nowhere to hide の翻訳です。最新の情報は英語記事をご覧ください。** ソフォスのテクノロジーや研究の裏側を読者に詳しくお伝えする Technical Thought Leadership の新シリーズ第一弾として、ソフォスのメモリスキャン保護およびその仕組みについて、概要をご紹介します。 メモリスキャンとは、プロセスのメモリ内 (プロセスイメージや疑わしいモジュール、スレッド、ヒープ領域) で脅威を捜索することを指します。メモリスキャンは、セキュリティ製品によって、さまざまな方法、あるいはタイミングで実行されます。新しいプロセスが作成されたときに実行されることもあれば、システム上の全プロセスまたは一部のプロセスに対して定期的に実行されることもあります。たとえば、マルウェアがプロセスに注入された悪意のあるペイロードを実行しようとする際に CreateRemoteThread (またはその亜種) を呼び出すことや、VirtualAllocEx や WriteProcessMemory...
Memory scanning leaves attackers nowhere to hide
In the first of our new series of technical thought leadership papers, which aim to give readers an in-depth look under-the-hood at some of our technologies and research, we wanted to provide an overview of our memory scanning protection and how it works. Memory scanning – searching within a process’s memory (the process image, and/or suspicious modules, threads, and heap regions) for threats – can be achieved in a variety of ways by security products, and at a variety of times.
Independence Day: REvil uses supply chain exploit to attack hundreds of businesses
On July 2, while many businesses had staff either already off or preparing for a long holiday weekend, an affiliate of the REvil ransomware group launched a widespread crypto-extortion gambit. Using an exploit of Kaseya’s VSA remote management service, the REvil actors launched a malicious update package that targeted customers of managed service providers and enterprise users of the on-site version of Kaseya’s VSA remote monitoring and management platform.
Conti ransomware: Evasive by nature
Editor’s note: This is one of a series of articles focused on the Conti ransomware family, which include a detailed analysis of a Conti attack, A Conti Ransomware Attack Day-By-Day, and a guide for what IT administrators can expect when Conti ransomware hits. For the past several months, both SophosLabs and the Sophos Rapid Response team have been collaborating on detection and behavioral analysis of a ransomware that emerged last year and has undergone rapid growth.
WastedLocker’s techniques point to a familiar heritage
It’s a lot easier to change a ransomware’s appearance (or obfuscate its code) than to change its underlying goals or behavior. After all, ransomware must necessarily reveal its intent when it strikes. But there are behavioral traits that ransomware routinely exhibits that security software can use to decide whether the program is malicious. Some traits – such as the successive encryption of documents – are hard for attackers to change.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Anand
Contact Anand, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack