Symantec Threat Intelligence Blog
symantec-enterprise-blogs.security.com · Company blog · on HN since 2021
Symantec's Threat Intelligence team publishes technical analyses of malware, ransomware, and state-linked hacking groups.
What HN saysHN commenters link it as a better source than news coverage, such as for the Daxin backdoor, and for its research on malware and risky TLDs.
15HN people shared it
5linked it in comments
10stories submitted
36story points
2 years agolast shared
2021people per year2026
Most-shared posts
- 1Daxin: Stealthy Backdoor Designed for Attacks Against Hardened Networks2 people · 19 points · first shared 2022 · discussion on HN
- 2Hackers Have Found an New Way to Backdoor into Microsoft Windows1 people · 3 points · first shared 2024 · 1 comments on HN
- 3Witchetty: Group Uses Updated Toolset in Attacks on Governments in Middle East1 people · 3 points · first shared 2022 · discussion on HN
- 4Raindrop: New Malware Discovered in SolarWinds Investigation1 people · 3 points · first shared 2021 · 1 comments on HN
- 53AM: New Ransomware Family Written in Rust1 people · 2 points · first shared 2023 · discussion on HN
- 6Noberus: Technical Analysis Shows Sophistication of New Rust-Based Ransomware1 people · 2 points · first shared 2022 · discussion on HN
- 7Apt Group Uses Updated Custom Tool in Attacks on Government and Telecoms Org1 people · 1 points · first shared 2023 · discussion on HN
- 8Mobile App Vulnerabilities Could Endanger Sensitive Business Information1 people · 1 points · first shared 2022 · discussion on HN
- 9Hackers use Microsoft-signed malware to target victims in Hong Kong1 people · 1 points · first shared 2023 · discussion on HN
- 10New Malware Abuses Microsoft IIS Feature to Establish Backdoor1 people · 1 points · first shared 2023 · discussion on HN
- 11Removing blind spots ssltls1 people · first shared 2023
- 12Fakebank intercepts calls banks1 people · first shared 2021
- 13Top 20 shady top level domains1 people · first shared 2021
- 14Palmerworm blacktech espionage apt1 people · first shared 2023
What HN people wrote when they linked it
2OEH8eoCRo0 · 2023-10-02
If you were actually interested in evidence you'd be able to find it, as I have, in a minute or two of following links. For example:
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-270a
https://attack.mitre.org/versions/v13/techniques/T1021/004/
> G0098 BlackTech BlackTech has used Putty for remote access.[2]
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligen…
> The Threat Hunter Team at Symantec, a division of Broadcom (NASDAQ: AVGO), has uncovered a new espionage campaign carried out by the Palmerworm group (aka BlackTech) involving a brand new suite of custom malware, targeting organizations in Japan, Taiwan, the U.S., and China.
commandersaki · 2023-08-12
Having worked for a large telco that ran an oppressive network that performed TLS inspection on all corporate traffic, I imagine there'd be demand to inspect TLS 1.3 traffic. Banks, Boring Enterprise, Governments, Intelligence Community, etc. are the types of customers that are interested in this.
Here is a vendor implementing TLS 1.3 inspection [1] - they probably don't call it ETS (since there's a CVE attached to it) but it probably implements that exact spec (since ETS only deviates from TLS 1.3 by using a static DH key instead of ephemeral).
[1]: https://symantec-enterprise-blogs.security.com/blogs/product-insights/…
Edit:
Here's another vendor that probably does it too: https://blog.gigamon.com/2020/04/15/how-do-you-run-cryptography-faster…
JacobThreeThree · 2022-02-28
That article focuses on the least interesting parts of the hack.
The Symantec blog post is much better: https://symantec-enterprise-blogs.security.com/blogs/threat-intelligen…
passivate · 2021-11-20
Apparently this is a thing..
https://symantec-enterprise-blogs.security.com/blogs/threat-intelligen…
r1ch · 2021-03-06
I wonder if the use of a .win domain had any influence. I've seen nothing but spam and malware / phishing from these $2 TLDs.
https://symantec-enterprise-blogs.security.com/blogs/feature-stories/t…