CyberProof Acquires Interpres Security
A Gartner distinguished vendor in Continuous Threat Exposure Management (CTEM) and Automated Security Control Assessments (ASCA).
SecOps & Risk mitigation
CyberProof uses OSINT and threat intelligence feeds for visibility into threats.
CyberProof’s adaptable playbooks address continuously evolving threats with updated strategies.
Professionals manage sophisticated networks, leveraging experience to counter advanced threats.
Professionals manage sophisticated networks, leveraging experience to counter advanced threats.
24/7 global SOC support ensures incident response with guaranteed SLA.
24/7 global SOC support ensures incident response with guaranteed SLA.
CyberProof develops recovery plans, restoring capabilities after a cyber incident.
Classify and manage enterprise assets, understanding risks and data sensitivity.
Non-destructive tests uncover potential exploits in assets and applications.
Mitigate security issues early with CyberProof’s training and awareness programs.
Rigorous security assessment for on-premise and cloud applications to ensure protection.
IAM manages user access, monitors for anomalies, ensuring security.
Cloud First approach ensures compliance and security within cloud environments.
Managed service for SIEM, EDR, MXDR, and threat intelligence solutions.
Identify, assess, and mitigate security vulnerabilities through regular scanning.
Partners
“Today I have complete visibility into the entire environment, in real time”
Jamil Farshchi | Equifax CISO
CyberProof Acquires Interpres Security
By leveraging and integrating the Interpres Security CTEM solution into its security services portfolio, CyberProof is able to continuously identify, assess, and prioritize risk while adapting defense services, like MDR, Vulnerability management and Use case management to address ever evolving threats. Take proactive steps to fortify your security today!
Start the journey today
Book a meetingCase Studies
Retail Company Reduces Data Costs by 85% with SIEM Transformation
90% increase in visibility after deploying Microsoft XDR with CyberProof
Enterprise saves millions on data ingestion & storage following cloud migration.
SOC unification streamlines enterprise insurance company’s security & network monitoring operations.
Global medical devices company gains visibility and meets stringent compliance standards across global geos
Pharmaceutical organization significantly enhances threat detection and response times
Threat Alerts
KoiLoader Reloaded – New Variant Abuses LNK Files and PowerShell to Drop Stealer Payload
Researchers have identified a sophisticated malware campaign leveraging a new variant of KoiLoader to distribute information-stealing payloads. The attack begins with phishing emails impersonating financial institutions, tricking victims into opening malicious Windows shortcut (LNK) files. These files exploit a known Windows vulnerability (ZDI-CAN-25373), which allows attackers to conceal command-line arguments, enabling stealthy execution of PowerShell scripts and bypassing traditional security defenses.
This campaign employs multi-stage execution, utilizing obfuscated scripts, scheduled tasks, and encrypted command-and-control (C2) communications to evade detection. By abusing Living-off-the-Land Binaries (LOLBins) and script-based evasion techniques, KoiLoader delivers Koi Stealer, capable of extracting credentials, cryptocurrency wallets, and sensitive documents. To mitigate such threats, organizations should enforce strict script execution policies, monitor PowerShell activity, disable wscript.exe via AppLocker, and deploy behavior-based endpoint detection and response (EDR) solutions.
Gootloader Malware Exploits Google Search Ads to Distribute Malicious Documents
The notorious Gootloader malware has evolved its attack strategy, now using Google Search advertisements to target users. This sophisticated campaign presents a significant threat as it exploits users’ trust in sponsored search results, appearing legitimate while delivering malware through seemingly harmless document downloads.
The attack begins when users search for terms like “non disclosure agreement template” and click on sponsored ads that appear legitimate. After being directed to a website, victims are asked to provide their email address to receive the requested document. Instead of receiving a genuine file, users download a compressed JavaScript file disguised as a legal document. When executed, this malicious JavaScript creates a scheduled task in the system to maintain persistence across reboots. The script then runs PowerShell commands to establish connections with multiple WordPress blogs, some of which are genuinely compromised servers while others function as decoys to complicate analysis. This sophisticated infection chain demonstrates advanced social engineering techniques designed to evade detection and maintain a foothold in compromised systems.
Awards
