GuardiCore labs is a global research team focused on critical cyber security analysis and investigation. Our mission is to benefit the community through publications and timely disclosure of new advanced threats, targeting data centers and clouds. Our team delivers cutting-edge breach detection and response methodologies to protect critical business applications and infrastructure.

Read our latest posts:

SambaCry, the Seven Year Old Samba Vulnerability, is the Next Big Threat (for now)
May 26, 2017
The Samba team released a patch on May 24 for a critical remote code execution vulnerability in Samba, the most popular file sharing service for all Linux systems. Samba is commonly included as a basic system service on other Unix-based operating systems as well. This vulnerability, indexed CVE-2017-7494, enables a malicious attacker with valid
Get the detection script>>


The Bondnet Army- Q&A
May 11, 2017
Recently GuardiCore uncovered Bondnet, a new botnet. The originator of Bondnet had installed a cryptocurrency miner and backdoor in thousands of servers of varying power and conscripted them into a botnet – a group of computing devices that can be centrally controlled for malicious purposes
Learn more and download the detection & cleanup tool>>


The Bondnet Army
May 4, 2017
GuardiCore Labs picked up a botnet of thousands of compromised servers of varying power. Managed and controlled remotely, the botnet is ready to be weaponized and is currently used to mine different cryptocurrencies.
Learn more and download the detection & cleanup tool>>


0.2 BTC Strikes Back, Now Attacking MySQL Databases
February 24, 2017
GuardiCore Global Sensor Network (GGSN) has detected a wide ransomware attack targeting MySQL databases. The attacks look like an evolution of the MongoDB ransomware attacks first reported earlier this year by Victor Gevers. Similarly to the MongoDB attacks, owners are instructed to pay a 0.2 Bitcoin ransom (approx. $200)

Read more >>


The Oracle of Delphi Will Steal Your Credentials
October 3, 2016
It was one of those warm summer nights, no clouds, just a bright full moon lighting the way. Someone had unknowingly stumbled upon our honeypot, completely unaware of the fact that her every move was recorded and fully analyzed. Thanks to our deception technology, we could easily reroute the attacker, making her believe she reached her real target

Read more >>


Infection Monkey Is on the Loose!
July 27, 2016
Today we are releasing the Infection Monkey, our inhouse tool for testing a data center’s resiliency to perimeter breaches and internal server infection. The Infection Monkey is a new open source security testing tool that we’ve developed at GuardiCore to test the resiliency of modern data centers to attack. Being good sports, we are sharing it with the security community.

Read more >>


The PhotoMiner Campaign
June 14, 2016
Over the past few months, we’ve been following a new type of worm we named PhotoMiner. PhotoMiner features a unique infection mechanism, reaching endpoints by infecting websites hosted on FTP servers while making money by mining Monero.

Read more >>