Guardicore Labs

Guardicore Labs is a global research team, consisting of hackers, cybersecurity researchers and industry experts. We publish our cyber security research and provide analysis, insights and response methodologies to the latest cyber threats as well as lead and participate in academic research. We are also the core maintainers of the Infection Monkey, a popular open-source network resiliency test tool.

The Massive Propagation of the Smominru Botnet

Guardicore Labs uncovers the scope of the Smominru mining botnet. The attack campaign compromises Windows machines using an EternalBlue exploit and brute-force. With almost 100k infected machines per month, the attackers steal credentials and make millions of dollars from mining Monero cryptocurrency.

READ MORE

September 18, 2019

Nansh0u

The Nansh0u Campaign - Hackers Arsenal Grows Stronger

by Ophir Harpaz
6 Comments
/
Guardicore Labs provided assistance in a ransomware investigation. We analysed the decryption process of the IEncrypt ransomware and provided a safe-to-use version of the attackers’ decryptor.
Read more
Guardicore Labs Patch Tuesday

May 2019’s Patch Tuesday: Must-Knows for Every Data Center

by Daniel Goldberg
Guardicore Labs provided assistance in a ransomware investigation. We analysed the decryption process of the IEncrypt ransomware and provided a safe-to-use version of the attackers’ decryptor.
Read more

IResponse to IEncrypt

by Ophir Harpaz
3 Comments
/
Guardicore Labs provided assistance in a ransomware investigation. We analysed the decryption process of the IEncrypt ransomware and provided a safe-to-use version of the attackers’ decryptor.
Read more
Guardicore - Infection Monkey

TEST YOUR NETWORK WITH OUR OPEN SOURCE ATTACK SIMULATION TOOL

Assess the resiliency of your network to post-breach attacks and lateral movement

LEARN MORE
Guardicore - Introducing Guardicore Cyber Threat Intelligence

Introducing Guardicore Cyber Threat Intelligence

by Daniel Goldberg
1 Comment
/
Guardicore Labs is announcing the release of Cyber Threat Intelligence (CTI), a freely available resource to assist security teams in identifying and investigating malicious IP addresses and domains. Our Cyber Threat Intelligence is designed to allow security teams to keep track of potential threats that are specific to data center and cloud infrastructure.
Read more

Highlights of BlueHat Israel 2019

by Daniel Goldberg
BlueHat Israel covered many interesting talks, covering supply chain attacks, processor flaws and many more.
Read more

A vulnerability in Debian’s apt allows for easy lateral movement in data centers

by Daniel Goldberg
Guardicore Labs explains the recent vulnerability in the apt package management tool that allows attackers to exploit software installation process to attack Linux servers.
Read more

Bread and butter attacks

by Daniel Goldberg
2 Comments
/
Guardicore Labs has uncovered an SSH brute force attack that has stayed under the radar for years. The attack deploys a RAT with DDoS capabilities and a cryptocurrency miner. In this post, we describe the attack, payload and different preventive steps.
Read more
Guardicore - What's New in Infection Monkey Release 1.6

What's New in Infection Monkey Release 1.6

by Daniel Goldberg
We are proud to announce the release of a new version of the Infection Monkey, GuardiCore’s open-source Breach and Attack Simulation (BAS) tool. Release 1.6 introduces several new features and a few bug fixes.
Read more
Guardicore - With libSSH, Authentication is Optional

With libSSH, Authentication is Optional

by Daniel Goldberg
1 Comment
/
A critical vulnerability (CVE-2018-10933) was disclosed in libSSH, a library implementing the SSH2 protocol for clients and servers. The vulnerability allows an attacker to completely bypass the authentication step and connect to the server without providing any credentials, the worst possible flaw for a library implementing SSH.
Read more
Guardicore - Operation Prowli: Monetizing 40,000 Victim Machines

Operation Prowli: Monetizing 40,000 Victim Machines

by Daniel Goldberg
3 Comments
/
Guardicore Labs has uncovered a previously unknown operation named Prowli, focused on cryptocurrency mining and traffic hijacking. This operation showcases how attackers abuses insecure websites and their visitors by redirecting them to malicious domains.
Read more
Guardicore - Azure passwords are still at risk; Infection Monkey can help

Azure passwords are still at risk; Infection Monkey can help

by Ravit Greitser
As this security flaw still exists and puts Azure environments at risk, we believe it’s important to continuously verify whether your environment is vulnerable. To do that we integrated Azure password harvesting capabilities into the Infection Monkey.
Read more
Guardicore - Recovering Plaintext Passwords from Azure Virtual Machines like It’s the 1990s

Recovering Plaintext Passwords from Azure Virtual Machines like It’s the 1990s

by Daniel Goldberg
3 Comments
/
While researching the Azure Guest Agent, we’ve uncovered several security issues which have all been reported to Microsoft. This post will focus on a security design flaw in the VM Access plugin that may enable a cross platform attack impacting every machine type provided by Azure.
Read more
Guardicore - The Next Gen Infection Monkey is Here

The Next Gen Infection Monkey is Here

by Ravit Greitser
4 Comments
/
We are pleased to announce a new version of our Infection Monkey open source attack simulation tool with several significant enhancements. We first introduced the Infection Monkey in 2016 and have continuously developed and supported it. Part of what we did came from feedback we received from our community so thanks everyone for contributing!
Read more
Guardicore - Something is brewing: A CPU bug risks virtual memory segmentation

Something is brewing: A CPU bug risks virtual memory segmentation

by Daniel Goldberg
0 Comments
/
At any given moment, attack and defense are in a cat and mouse game where each side gains a momentary advantage. What we’ve recently seen over the past few months is a situation where defense is playing catch-up with what appears to be a serious hardware bug.
Read more
Guardicore - Beware the Hex-Men

Beware the Hex-Men

by Daniel Goldberg
6 Comments
/
In the last few months GuardiCore Labs has been investigating multiple attack campaigns conducted by an established Chinese crime group that operates worldwide. The campaigns are launched from a large coordinated infrastructure and are mostly targeting servers running database services. By now we were able to identify three attack variants - Hex, Hanako and Taylor - targeting different SQL Servers, each with its own goals, scale and target services. This report covers the attackers’ infrastructure, attack variants and how the victims are used for both profit and further propagation.
Read more
Guardicore - Highlights from Black Hat & DEFCON

Highlights from Black Hat & DEFCON

by Daniel Goldberg
I spent the last week at the “Hacker Summer Camp” of Black Hat and DEFCON. Besides meeting people and enjoying the dual craziness of the DEFCON crowd and the Black Hat business hall, we also gave a well received lecture - Escalating Insider Threats using VMWare’s API. Ofri Ziv, Head of GuardiCore labs, presented a backdoor we discovered in VMware’s remote administration API, enabling vSphere users to quickly and easily take over guest machines without providing guest credentials
Read more
Guardicore - Escalating Insider Threats Using VMware's API

Escalating Insider Threats Using VMware's API

by Daniel Goldberg
2 Comments
/
VMware vSphere is the most widely used virtualization platform for on-premises data centers. Similarly to other virtualization platforms, it basically relies on host servers running guest machines. These hosts and guest machines can be managed using administration interfaces such as vSphere API and VIX API. The GuardiCore Labs team has discovered a vulnerability in the vSphere infrastructure that can be exploited using VMware’s Virtual Infrastructure eXtension (VIX) API. This vulnerability allows an attacker to remotely execute code on guest machines, bypassing the need for guest authentication.
Read more
Guardicore - SambaCry, the Seven Year Old Samba Vulnerability, is the Next Big Threat (for now)

SambaCry, the Seven Year Old Samba Vulnerability, is the Next Big Threat (for now)

by Daniel Goldberg
4 Comments
/
The Samba team released a patch on May 24 for a critical remote code execution vulnerability in Samba, the most popular file sharing service for all Linux systems. Samba is commonly included as a basic system service on other Unix-based operating systems as well. This vulnerability, indexed CVE-2017-7494, enables a malicious attacker with valid write access to a file share to upload and execute an arbitrary binary file which will run with Samba permissions.
Read more
Guardicore - The Bondnet Army: Questions & Answers

The Bondnet Army: Questions & Answers

by Ravit Greitser
1 Comment
/
Last week we announced the discovery of Bondnet, a new botnet that was uncovered by GuardiCore Labs. The originator of Bondnet had installed a cryptocurrency miner and backdoor in thousands of servers of varying power and conscripted them into a botnet - a group of computing devices that can be centrally controlled for malicious purposes.
Read more
Guardicore - The Bondnet Army: Questions & Answers

The Bondnet Army

by Daniel Goldberg
11 Comments
/
GuardiCore Labs has recently picked up Bondnet, a botnet of thousands of compromised servers of varying power. Managed and controlled remotely, the Bondnet is currently used to mine different cryptocurrencies and is ready to be weaponized immediately for other purposes such as mounting DDoS attacks as shown by the Mirai Botnet. Among the botnet’s victims are high profile global companies, universities, city councils and other public institutions.
Read more
Guardicore - 0.2 BTC Strikes Back, Now Attacking MySQL Databases

0.2 BTC Strikes Back, Now Attacking MySQL Databases

by Ofri Ziv
4 Comments
/
Last week we first tweeted that the GuardiCore Global Sensor Network (GGSN) has detected a wide ransomware attack targeting MySQL databases. The attacks look like an evolution of the MongoDB ransomware attacks first reported earlier this year by Victor Gevers. In this post we will describe in detail the attack flow and provide some recommendations on how to protect your databases from similar attacks along with attack IoCs.
Read more
Guardicore - The Oracle of Delphi Will Steal Your Credentials

The Oracle of Delphi Will Steal Your Credentials

by Daniel Goldberg
1 Comment
/
It was one of those warm summer nights, no clouds, just a bright full moon lighting the way. Someone had unknowingly stumbled upon our honeypot, completely unaware of the fact that her every move was recorded and fully analyzed. Thanks to our deception technology, we could easily reroute the attacker, making her believe she reached her real target.
Read more
Guardicore - Infection Monkey Is on the Loose!

Infection Monkey Is on the Loose!

by Daniel Goldberg
1 Comment
/
Today we are releasing the Infection Monkey, our inhouse tool for testing a data center's resiliency to perimeter breaches and internal server infection. The Infection Monkey is a new open source security testing tool that we’ve developed at GuardiCore to test the resiliency of modern data centers to attack. Being good sports, we are sharing it with the security community. Just pick a random machine, release the Infection Monkey and see where it ends up. Use our Monkey to test whether your security systems can detect, stop and contain real threats. The monkey is benign and does not pose any risk to your network.
Read more