Fake Installer: Ultimately, ValleyRAT infection

In this Threat Analysis Report, Cybereason explores the fake installer, ValleyRAT

February 3, 2026 / 16 minute read

Identity & Beyond: 2026 Incident Response Predictions

DFIR expert Jamie Mamroe shares 2026 Incident Response Predictions around Identity and Cloud attacks

January 9, 2026 / 4 minute read

Cybereason Nails 100% Detection, Visibility, Accuracy and SOC Efficiency in the 2025 MITRE ATT&CK® Enterprise Evaluation

Cybereason achieves 100% detection, accuracy, and SOC efficiency in the 2025 MITRE ATT&CK Enterprise Evaluation.

December 16, 2025 / 3 minute read

CVE-2025-55182: Critical Vulnerability, React2Shell, Allows for Unauthenticated RCE

React2Shell vulnerability, tracked as CVE-2025-55182, recently discovered in React’s Server Components, could allow for pre-authentication remote code execution.

December 5, 2025 / 3 minute read

License to Encrypt: “The Gentlemen” Make Their Move

In this Threat Analysis Report, Cybereason explores the new ransomware group, "The Gentlemen", and their latest TTPs.

November 18, 2025 / 8 minute read

Tycoon 2FA Phishing Kit Analysis

In this Threat Alert, Cybereason analyzes Tycoon 2FA phishing kit, a sophisticated phishing-as-a-service platform designed to bypass two-factor authentication.

November 3, 2025 / 7 minute read

See All Posts

Malicious Life Series'

Research

Phorpiex - Downloader Delivering Ransomware

In this Threat Analysis report, Cybereason investigates the the Phorpiex botnet that delivers LockBit Black Ransomware (aka LockBit 3.0).

Read More

View All Research

Podcasts

Malicious Life Podcast: Operation Snow White, Part 2

Scientology spies were trained in all covert operations techniques: surveillance, recruiting agents, infiltrating enemy lines, and blackmail. However, a suspicious librarian and a determined FBI agent brought the largest single spy operation in US government history to an end.

Read More

View All Podcasts

Webinars

Webinar October 18th 2022: The True Cost of Ransomware - Evaluating Risk and How to Avoid Attacks

In this webinar, Cybereason CSO Sam Curry is joined by Cody Queen to dig into the data from the Ransomware: The True Cost to Business 2022 report and how to quantify the true cost to business of ransomware attacks and what cybersecurity leaders can do to mitigate against them...

Read More

View All Webinars

Resources

White Paper: Operation-Centric Security - Leveraging Indicators of Behavior for Early Detection

This paper details the Operation-Centric approach and how it can foster earlier detections based on Indicators of Behavior that empowers security operations to dynamically adapt and predictively respond more swiftly than attackers can modify their tactics to circumvent defenses...

Read More

View All Resources

Cybereason News

White Paper: Operation-Centric Security - Leveraging Indicators of Behavior for Early Detection

This paper details the Operation-Centric approach and how it can foster earlier detections based on Indicators of Behavior that empowers security operations to dynamically adapt and predictively respond more swiftly than attackers can modify their tactics to circumvent defenses...

Read More

View All Cybereason News
Cybereason vs. NetWalker Ransomware

The NetWalker ransomware has been targeting organizations in the US and Europe including several healthcare organizations, despite several known threat actors publicly claiming to abstain from targeting such organizations due to COVID-19.

March 24, 2021 / 4 minute read

Malicious Life Podcast: Inside the HAFNIUM Microsoft Exchange Attacks

The recent HAFNIUM attacks hit tens of thousands of organizations’ Microsoft Exchange servers. What happened, what were the vulnerabilities exploited in the attack, and what can we do to defend against such attacks in the future? In this episode, Host Ran Levi is joined by Israel Barack, Cybereason CISO

March 23, 2021 / 1 minute read

Sodinokibi/REvil Ransomware Gang Hit Acer with $50M Ransom Demand (Clone)

The Sodinokibi/REvil ransomware gang has reportedly attacked multinational corporation Acer and demanded a ransom of $50 million - ransomware today is not simply an evolution of traditional malware, but an element of increasingly complex and highly targeted operations.

March 23, 2021 / 3 minute read

Webinar: Protecting Against IT Infrastructure Attacks from HAFNIUM to SolarWinds

Cyberattacks targeting IT infrastructure systems are highly-scalable, campaign-style efforts with a widespread impact. With their high degree of success in recent months, we can expect this trend to continue in the future. Now is the time to learn how to end these attacks. Join our webinars to learn more!

March 22, 2021 / 1 minute read

Cybereason Exposes Campaign Targeting US Taxpayers with NetWire and Remcos Malware

Cybereason researchers have discovered a new campaign targeting US taxpayers with documents that purport to contain tax-related content but ultimately deliver NetWire and Remcos malware - two prolific remote access trojans.

March 22, 2021 / 4 minute read

Malicious Life Podcast: Inside NotPetya, Part 2

Listen as we break down the chain of events from the moment NotPetya began to spread around the world to the moment it was stopped by Amit Serper who was on his way to friends when he decided to take a swipe at the malware. Catch the latest episode of the Malicious Life podcast with guest Cyber Analyst Amit Serper

March 22, 2021 / 12 minute read

HAFNIUM Response: Cybereason is Dedicated to Defending Our Customers

Cybereason continues to investigate the related threats to protect our customers against adversaries targeting still-vulnerable and patched but not fully remediated Microsoft Exchange servers...

March 18, 2021 / 2 minute read

HAFNIUM and SolarWinds Attacks Highlight Lack of Accountability (Clone)

Organizations are again scrambling to assess the impact of a recently disclosed attack attributed to the Chinese state-sponsored HAFNIUM APT group that targets vulnerabilities in Microsoft Exchange. Cybereason protected all of our customers from both the SolarWinds and HAFNIUM attacks.

March 10, 2021 / 3 minute read

International Women’s Day: UbU and Lead Like a Girl (Clone)

Getting ahead in business doesn’t mean suppressing my femininity, it means using the best of who I am and finding ways for that authentic me to continue to advance in business – without apologies...

March 10, 2021 / 3 minute read

Cybereason Resource Spotlight Post Sample Two

Across the centuries globular star cluster across the centuries rogue a very small stage in a vast cosmic arena rich in heavy atoms.

March 4, 2021 / 3 minute read

Defender Spotlight: Keith Barros, Seton Hall University

Top-tier defender Keith Barros of Seton Hall University discusses the successes achieved with a deployment of Cybereason solutions to secure endpoints and ramp-up students to Level1 Analyst level performance....

March 2, 2021 / 1 minute read

Cybereason Resource Spotlight Post Sample One

Across the centuries globular star cluster across the centuries rogue a very small stage in a vast cosmic arena rich in heavy atoms.

March 1, 2021 / 3 minute read

Ryuk Ransomware: Mitigation and Defense Action Items

Cybereason recommends activating their prevention stack to be set on “Prevent” mode (AV, NGAV, Powershell, AntiRW) to protect against Ryuk ransomware.

March 1, 2021 / 3 minute read

Answering the 10 Must-Ask Questions for Evaluating EDR Tools

Across the centuries globular star cluster across the centuries rogue a very small stage in a vast cosmic arena rich in heavy atoms.

February 8, 2021 / 3 minute read

Krebs, Curry and Cyber Security

This talk with investigative reporter Brian Krebs and Cybereason CSO Sam Curry will examine some of the more alarming trends in cybercrime today and offer some perspectives on how businesses, consumers and infosec pros can up their game in response.

February 2, 2021 /

Amazon Gift Card Offer Serves Up Dridex Banking Trojan (Clone)

Over the course of December, 2020, the Cybereason Nocturnus Team has been tracking down cyber crime campaigns related to the holiday season, and more specifically to online shopping. Download the Indicator's of Compromise to search for Dridex in your own environment.

December 24, 2020 / 6 minute read

Is XDR the Next Silver Bullet?

Join us for an hour-long panel on the intricacies of XDR and how it will affect the security industry. Learn what XDR is, specific use cases, and how security practitioners can easily integrate this new technology into their security stack.

December 4, 2020 / 1 minute read

Cybereason vs. MedusaLocker Ransomware

There have been reports of MedusaLocker attacks across multiple industries, especially the healthcare industry which suffered a great deal of ransomware attacks during the COVID-19 pandemic.

November 19, 2020 / 4 minute read