Matt Brooks

Articles

“内幕消息”:一起针对中文新闻媒体的入侵行动

加拿大多伦多大学公民实验室(Citizen Lab)研究人员发现了多个假冒中文新闻网站的域名和网站。这些中文新闻网站包括中国数字时代 明镜新闻 大纪元新闻 香港01 和 博闻社,它们经常报道被中国政府认为是禁忌或具有争议性的话题。

It’s Parliamentary: KeyBoy and the targeting of the Tibetan Community

In this report we track a malware operation targeting members of the Tibetan Parliament that used known and patched exploits to deliver a custom backdoor known as KeyBoy. We analyze multiple versions of KeyBoy revealing a development cycle focused on avoiding basic antivirus detection.

Group5: Syria and the Iranian Connection

This report describes a malware operation against the Syrian Opposition. We name the operator Group5, and suspect they have not been previously-reported. Group5 used “just enough” technical sophistication, combined with social engineering, to target computers and mobile phones with malware.

Between Hong Kong and Burma: Tracking UP007 and SLServer Espionage Campaigns

In this research note, we analyze a malware campaign targeting Hong Kong democracy activists. Two new malware families are used in the campaign that we name UP007 and SLServer. Previous reports have shown overlap in the tactics, tools, and procedures used in this campaign in other operations targeting groups in Burma, Hong Kong, and the Tibetan community.