
Threat Hunting Case Study: FileFix
FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.

Many countries have retired checks as a financial instrument, but billions of checks are still written every year in the U.S. This has proved to be a boon to fraudsters. There is an entire underground industry dedicated to stealing and fabricating checks that is not slowing down and is tricky to combat. Often, images of stolen checks are posted on Telegram and offered for sale to other fraudsters. In this Studio 471, Eric Huber, who is Cybercrime Research Leader at TD Bank, discusses why check fraud is such a huge problem and how financial institutions can counter it. Huber is the curator of the Fraudster Glossary, which is an index of terms used on cybercrime forums. Intel 471 also recently published an in-depth blog on check fraud, which is available here.
Participants:
Eric Huber, Cybercrime Research Leader, TD Bank
Jeremy Kirk, Executive Editor, Cyber Threat Intelligence, Intel 471

FileFix bypasses Mark of the Web (MotW) protections by hijacking the Windows File Explorer address bar. Here is how to hunt for it.

Gentlemen ransomware uses credential abuse, defense evasion, and double extortion tactics to compromise enterprise environments and increase pressure on victims.

TeamPCP is exploiting trusted npm and PyPI packages to compromise developer environments, steal credentials, and extend attacks across software supply chains.
Stay informed with our weekly executive update, sending you the latest news and timely data on the threats, risks, and regulations affecting your organization.