Daxin special: How this advanced malware was discovered

Update: 2022-03-10

Description

In this special edition of the podcast, Dick O’Brien is joined by Symantec threat researchers and analysts Piotr Krysiuk and Vikram Thakur to discuss the Symantec Threat Hunter team’s discovery of Daxin, which is the most advanced piece of malware we have seen from China-linked actors. We published a blog about the discovery of Daxin last week, as well as two in-depth technical blogs with more information on the tool this week. Piotr discusses his work analyzing the malware, and when he realized the significance of this discovery, while Vikram talks about liaising with customers impacted by the malware as well as working with the Cyber Security and Infrastructure Security Agency (CISA) to engage with multiple foreign governments targeted with Daxin to assist with detection and remediation.

Comments

In Channel

New Billbug campaign, Prestige ransomware, and multiple arrests of alleged cyber-crime gang members

2022-11-1725:38

Exbyte exfiltration tool, Cranefly uses new tools and novel technique, and OpenSSL bug is downgraded

2022-11-0320:42

Budworm espionage activity, Spyder Loader malware, and Ransom Cartel links to Sodinokibi

2022-10-2018:14

Witchetty espionage group activity, Microsoft Exchange Server zero days, and U.S. defense sector targeted by APT groups

2022-10-0627:50

Espionage activity targeting Asian governments, Webworm develops customized tools, and latest Noberus TTPs

2022-09-2225:24

Mobile app security, Russian invasion of Ukraine cyber impact continues, and Evil Corp switches focus

2022-09-0831:07

Bumblebee loader analysis, Raccoon Stealer returns, and LockBit launches a new version

2022-06-3023:17

BlackCat ransomware, Follina vuln used by Russian actors, and a new version of Metasploit

2022-06-1628:10

The Follina Microsoft Office vulnerability, Conti break-up, and more ransomware activity

2022-06-0226:10

Chinese cyber-espionage activity, Conti gang threatens Costa Rica government, and U.S. warns about North Korean citizens seeking jobs in IT

2022-05-1925:45

North Korea’s Stonefly, commodity malware, and the potential return of the REvil ransomware

2022-05-0531:58

Shuckworm targets Ukraine, Lazarus Dream Job campaign continues, and two dark marketplaces get taken down

2022-04-2127:42

Spring4Shell, Cicada campaign, new Verblecon malware, and Ukraine invasion cyber activity update

2022-04-0723:38

What you need to know about hacking group Lapsus$, cyber impacts of Ukraine invasion, and BazarBackdoor deploys new tactics

2022-03-2430:54

Daxin special: How this advanced malware was discovered

2022-03-1030:14

Hive and BlackByte ransomware, the money made by cyber criminals, and BEC scammers’ new tactics

2022-02-2423:33

FBI seizes $3.6 billion in cryptocurrency, cyber attacks against Ukraine continue, and financial organizations in Taiwan targeted

2022-02-1019:27

Ukraine cyber attacks, law enforcement activity, and a Noberus ransomware attack

2022-01-2727:23

BadUSB attacks, a new backdoor, and how one APT group managed to infect itself with malware

2022-01-1321:58

Log4j vulnerabilities, likely Iran-backed attacks on telecoms companies, and new Rust-based Noberus ransomware

2021-12-1628:17

00:00

1.0x

Daxin special: How this advanced malware was discovered

#box-pro-ellipsis-176465747696021{-webkit-line-clamp:2;}Daxin special: How this advanced malware was discovered

Daxin special: How this advanced malware was discovered

Daxin special: How this advanced malware was discovered