Contact Us
Anatomy of an Attack
Cl0p Ransomware Group and the PTC Windchill Campaign
September 22, 2026
Explore how Cl0p targeted PTC Windchill with a custom web shell for data theft, and how ExtraHop RevealX detects C2 and exfiltration across encrypted sessions.
Detecting the Behavior of Medusa Ransomware Operations
August 31, 2026
Medusa ransomware operators follow a predictable "exfiltrate first, encrypt second" pattern. Learn how security teams can detect these behavioral trails on the network even when endpoint defenses are impaired.
Iranian-Affiliated Actors Target U.S. Critical Infrastructure Through PLCs
August 10, 2026
Explore the anatomy of Iranian-linked cyberattacks targeting U.S. critical infrastructure. Learn how to detect and stop unauthorized PLC manipulation using ExtraHop RevealX network detection and response.
VECT 2.0 Ransomware
July 21, 2026
VECT 2.0 is a data wiper, not ransomware. Discover how this destructive malware irreversibly deletes files and learn critical network-based strategies to defend against it.
UNC6692 and the SNOW Malware Ecosystem
July 7, 2026
UNC6692 uses Microsoft Teams and email-bombing to deploy the modular SNOW malware ecosystem, stealthily bypassing common defenses to compromise domain controllers and exfiltrate data.
VIPERTUNNEL
June 30, 2026
Examine how VIPERTUNNEL uses Python execution, file-type masquerading, and SOCKS5 tunneling to support ransomware-linked intrusions, and how ExtraHop RevealX helps detect the activity.
Inside Interlock Ransomware Operations
June 16, 2026
Examine how the Interlock ransomware group leverages living off the land techniques and cloud exfiltration, and how ExtraHop RevealX detects the intrusion.
The DINDOOR Backdoor
May 12, 2026
Iranian APT MuddyWater (Seedworm) is targeting organizations with a new, undocumented backdoor called DINDOOR. Discover how this campaign exploits the Deno runtime and Rclone for cloud exfiltration to bypass EDR, and learn how network detection and response (NDR) can help provide the visibility needed to stop these stealthy threats.
The Copy Fail: Linux Kernel Local Privilege Escalation
May 4, 2026
Uncover the "Copy Fail" logic flaw (CVE-2026-31431) that enables instant root access on nearly all major Linux distributions. Learn how this vulnerability bypasses file integrity monitoring and why network-based behavioral analysis is critical for securing containerized and cloud environments.
The MIMICRAT CLICKFIX Campaign
April 28, 2026
Expose how the MIMICRAT campaign weaponizes compromised financial sites and ClickFix lures to deploy fileless malware. See how ExtraHop RevealX provides the network-level ground truth to detect telemetry suppression and stealthy C2 patterns that bypass EDR.
Explore Topics
Showing results for:
