Security-X
Forum Security-X => News => Discussion démarrée par: igor51 le septembre 30, 2021, 14:00:18
-
GhostEmperor: From ProxyLogon to kernel mode
While investigating a recent rise of attacks against Exchange servers, we noticed a recurring cluster of activity that appeared in several distinct compromised networks. With a long-standing operation, high profile victims, advanced toolset and no affinity to a known threat actor, we decided to dub the cluster GhostEmperor.
Source: GhostEmperor: From ProxyLogon to kernel mode (https://securelist.com/ghostemperor-from-proxylogon-to-kernel-mode/104407/)