Contact Us

1 (800) 723-1166 |

Security Labs

HomeSecurity Labs
HomeSecurity Labs

Forcepoint Security Labs™ brings together researchers, engineers and thought leaders from around the world to discover, investigate, report and – ultimately – protect our customers from sophisticated, evasive and evolving Web- and email-based threats.

Find out more about the work we do through our blogs, annual reports, conference presentations and podcasts.

Please note: Forcepoint Security Labs have now published an in-depth analysis of the EternalBlue propagation method used by the WannaCry campaign. This can be found here:

Yesterday, the world saw one of the most significant malware outbreaks for quite some time: our news feeds are full of the news of this cyber attack with institutions in many countries being impacted and reports of whole computer networks being shut down. The malware's ability to self-propagate was a significant change from what we have become used to in recent years,... Read more

Please note: this post is not related to the global WannaCry outbreak on Friday 12 May 2017. For ongoing up dates on WannaCry, please see our blog post at

Forcepoint Security Labs™ have observed today a major malicious email campaign from the Necurs botnet spreading a new ransomware which appears to call itself 'Jaff', peaking within our telemetry at nearly 5m emails per hour. 

The emails sent by this campaign may look spartan to the professional eye but, as ever, the human point of interaction with systems is... Read more

Forcepoint Security Labs have recently observed a malicious email campaign delivering what appears to be a new variant of the Geodo/Emotet banking malware, predominantly to .UK TLDs across a range of sectors including addresses at major business and government departments.

Several prior campaigns have been recorded with researchers noting a progressive evolution in the methods employed by the actors behind the malware: earlier versions were reported delivering the malware as an attachment to fake telephone bills. This then changed to embedding links to malicious files within the emails - the same approach as has been observed in... Read more

In a recent blog we talked about how the current ransomware pandemic continues to attract would-be cybercriminals to ransomware-as-a-service (RaaS) platforms. In this post we will look into a new piece of ransomware called "CradleCore" - a crimeware kit that is currently being offered to cybercriminals looking to own customisable ransomware source code.

CradleCore,  a.k.a. "Cradle Ransomware", is peculiar in the sense that it is being sold as source code. Typically, ransomware is monetized by developers using the RaaS business model. If that doesn't work, only then the will the developers consider selling the source code. 

... Read more

In the past year, the Healthcare sector was one of the biggest industries that were hit by ransomware attacks. Being inclined to paying ransom to recover patient data, the Healthcare sector became a low hanging fruit for seasoned ransomware operators looking to maximize profit, such as those behind the Locky ransomware. However, it appears that amateur cybercriminals have also started to shift towards this trend in the form of an off-the-shelf ransomware aimed at a healthcare organization in the United States.

In this attack, a shortened URL, which we believe was sent through a spear-phishing email, was used as a lure to infect a... Read more

For the past several weeks, Forcepoint Security Labs have been tracking a seemingly low-profile piece of malware which piqued our interest for a number of reasons: few samples appear to be available in the wild; there is no previous documentation referring to the C2 domains and IP addresses it uses (despite the domains appearing to be at least twelve months old); and, if its compilation timestamps are to be trusted, the campaign itself may have been active for at least six months before samples started to surface...

The primary samples examined appear in the wild with filenames mimicking that of Adobe's Content Management System [... Read more

Since January of this year, Forcepoint Security Labs™ have observed that the DragonOK campaign have started to target political parties in Cambodia. DragonOK is an active targeted attack that was first discovered in 2014. It is known to target organizations from Taiwan, Japan, Tibet and Russia with spear-phishing emails containing malicious attachments. 

The latest dropper they used is disguised as an Adobe Reader installer and installs yet another new custom remote access tool (RAT). We have named this RAT “KHRAT” based on one of the command and control servers used, kh[.]inter-ctrip[.]com, which pertained to Cambodia’s... Read more

In early March 2017 we saw a surge in malware samples with similar behaviours and low detection rates, often triggering only generic and/or heuristic antivirus signatures. Examining these revealed them to be samples of the venerable njRAT Trojan (also known as Bladabindi) and, unsurprisingly, shows their post-infection behaviour and capabilities to align with known njRAT patterns (keylogging, screen-capturing, etc.)

Two samples were examined in particular: both of these downloaded a sizeable 'blob' from Pastebin and communicated with C2s hosted on domains associated with dynamic DNS services - typical features of njRAT campaigns... Read more

Since late last year, multiple warnings have been issued to the public regarding tax-related fraud campaigns. Last month, a warning was issued to Northwich residents in the UK regarding a HM Revenue & Customs (HMRC) phishing scam, while the Internal Revenue Service (IRS) issued a similar warning to US tax payers.

Forcepoint Security Labs™ have observed a similar trend in our telemetry. Small to medium-sized tax-themed email campaigns have constantly appeared since the start of this year. For instance, just last week, our telemetry captured the following phishing email sent to some 700 recipients from the UK:

... Read more

Forcepoint™ Security Labs frequently identify new, unusual, or otherwise interesting pieces of malware. Sometimes these turn out to be elements of large, APT-driven campaigns (e.g. our report into the MONSOON campaign from August 2016:; other times these can be more 'niche', as is the case with this miniature Monero mining botnet.

Much as the California Gold Rush attracted amateurs lured by the promise of easy money (the original '49ers'), a low barrier-to-entry is tempting amateurs to take up cryptocurrency mining. Unfortunately, these 21st century... Read more