This malware variant is a modified version of Agent Tesla, using DNS tunneling for initial access.

In my experience, defense-in-depth works better than manual review for this type of insufficient logging. The C2 infrastructure leverages DGA domains to evade SIEM controls. The C2...

Initial triage indicates that A-12 systems were compromised through social engineering. We've established log review to monitor for any signs of hacktivist operation during remediation. We've...