Get to know

Bryan Lee

Blogs by Bryan Lee

Sort By:

Unit 42

Dear Joohn: The Sofacy Group’s Global Campaign

As alluded to in our previous blog regarding the Cannon tool, the Sofacy group (AKA Fancy Bear, APT28, STRONTIUM, Pawn Storm, Sednit) has persistently attacked various government and private organizations …

Dec 12, 2018

By Bryan Lee and Robert Falcone

Unit 42

Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan

Unit 42's continued look into Sofacy reveals global attacks and wheels out new 'Cannon' trojan.

Nov 20, 2018

By Robert Falcone and Bryan Lee

Unit 42

New KONNI Malware attacking Eurasia and Southeast Asia

Unit 42 uncovers NOKKI, a type of malware with ties to the previously discovered KONNI malware family, used to attack Eurasia and Southeast Asia.

Sep 27, 2018

By Josh Grunzweig and Bryan Lee

Unit 42

OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to O...

The OilRig group maintains their persistent attacks against government entities in the Middle East region using previously identified tools and tactics. As observed in previous attack campaigns, the tools used are not …

Sep 04, 2018

By Robert Falcone, Bryan Lee and Riley Porter

Unit 42

New Threat Actor Group DarkHydrus Targets Middle East Government

Unit 42 uncovers DarkHydrus, a new threat actor group targeting Middle East government.

Jul 27, 2018

By Robert Falcone, Bryan Lee and Tom Lancaster

Blogs by Bryan Lee

Sort By:

Cybersecurity, Malware

Grid Security Is Top of Mind in 2016 – NERC CIP and the Ukrainian Grid Atta...

The discussions around electric grid cybersecurity in 2016 have already started off with a lot of buzz with two important industry developments in play. The first is around the NERC CIP regulation. …

Feb 05, 2016

By Del Rodillas and Bryan Lee

Malware, Threat Prevention, Unit 42

New Attacks Linked to C0d0so0 Group

While recently researching unknown malware and attack campaigns using the AutoFocus threat intelligence platform, Unit 42 discovered new activity that appears related to an adversary group previously called “C0d0so0” or “Codoso”. This …

Jan 22, 2016

By Josh Grunzweig and Bryan Lee

Threat Prevention, Unit 42

Fresh Baked HOMEKit-made Cookles – With a DarkHotel Overlap

Threat actors tend to reuse certain tools, a trend we observed during recent Unit 42 research published on MNKit. In this post, we will discuss a fresh toolkit, which on the surface, …

Aug 12, 2016

By Bryan Lee and Robert Falcone

Unit 42

New Sofacy Attacks Against US Government Agency

The Sofacy group, also known as APT28, is a well-known threat group that frequently conducts cyber espionage campaigns. Recently, Unit 42 identified a spear phishing e-mail from the Sofacy group that targeted …

Jun 14, 2016

By Robert Falcone and Bryan Lee

Financial Services, Malware, Threat Prevention, Unit 42

The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helmint...

In May 2016, Unit 42 observed targeted attacks primarily focused on financial institutions and technology organizations within Saudi Arabia. Artifacts identified within the malware samples related to these attacks also suggest the …

May 26, 2016

By Robert Falcone and Bryan Lee

Bryan Lee

Unit 42

Dear Joohn: The Sofacy Group’s Global Campaign

Unit 42

Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan

Unit 42

New KONNI Malware attacking Eurasia and Southeast Asia

Unit 42

OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to O...

Unit 42

New Threat Actor Group DarkHydrus Targets Middle East Government

Cybersecurity, Malware

Grid Security Is Top of Mind in 2016 – NERC CIP and the Ukrainian Grid Atta...

Malware, Threat Prevention, Unit 42

New Attacks Linked to C0d0so0 Group

Threat Prevention, Unit 42

Fresh Baked HOMEKit-made Cookles – With a DarkHotel Overlap

Unit 42

New Sofacy Attacks Against US Government Agency

Financial Services, Malware, Threat Prevention, Unit 42

The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helmint...

Get the latest news, invites to events, and threat alerts

Products and Services

Company

Popular Links