September 17, 2025 It began with an unassuming executable named calendaromatic.exe. At first glance, it appeared to be a harmless desktop application wrapped in a friendly calendar UI.
August 27, 2025 A well-known red team tactic for blending Command-and-Control (C2) traffic in with legitimate network traffic involves utilizing Amazon Web Services (AWS) CloudFront redirectors to mas…
August 13, 2025 Where It All Started The Artificial Intelligence (AI) industry is approaching a peculiar anniversary.
August 5, 2025 Bottom-Line Up Front (BLUF): We have observed Akira affiliates exploiting two common drivers as part of a suspected AV/EDR evasion effort following initial access involving SonicWall ab…
June 27, 2025 Sometimes the best discoveries happen when you’re not even looking for them.
March 6, 2025 Key Takeaways During the period covered by the Black Basta leaked chat logs (18 September 2023 – 28 September 2024), we observed the following We observed at least 47 cryptocurrency wa…
January 15, 2025 In an incident response in Q4 of 2024, GuidePoint Security identified evidence of a threat actor utilizing a Python-based backdoor to maintain access to compromised endpoints.
Ivanti CSA Investigation/Detection Details October 9, 2024 Authors: Rui Ataide, Andrew Nelson, and Hermes Bojaxhi GuidePoint Security has recently been engaged on several incidents related to f…
June 20, 2024 TL;DR: Compromise of an SCCM administrator account can easily lead to compromise of every machine managed by SCCM.
March 8, 2024 Contributors: Justin Timothy, Threat Intelligence Consultant, Gabe Renfro, DFIR Advisory Consultant, Keven Murphy, DFIR Principal Consultant Introduction Ever since Avast released a decr…
August 3, 2023 Introduction Across the cybersecurity community, defenders are constantly finding threat actors using novel and innovative techniques to further their exploitation efforts against targe…
December 1, 2022 What if you could no longer trust the critical process values displayed on your HMI screen? Executive Summary When operating an Industrial Control System (ICS), the operator relies on…
