Interlock ransomware uses hybrid RSA-AES encryption, symlink abuse, and log clearing. See its TTPs and how to detect it in Defender XDR.
Wizard Cyber Blogs
UAC-0050 Targets European Financial Institution Using Trusted Services And Remote Administration Software
3 August 2026by Cyber Shield Intelligence (CSI) Team
UAC-0050 used phishing, layered archives, and Remote Manipulator System to breach a European bank supporting Ukraine reconstruction.
When Microsoft Teams Becomes The Initial Access Vector: Detecting RMM-Based Intrusions
31 July 2026by Detection Engineering Team
Learn how correlating Microsoft Teams chats with RMM activity detects social engineering attacks used to gain remote endpoint access.
Detecting Suspicious PowerShell Command Execution Using Behavioral Scoring
27 July 2026by Detection Engineering Team
See how behavioral scoring detects suspicious PowerShell commands, catching obfuscation and encoding that static indicators miss.
Detecting Malicious Traffic That Was Allowed Through The Firewall
22 July 2026by Detection Engineering Team
Learn how to detect malicious traffic allowed through your firewall despite being flagged, using Fortinet logs and Sentinel KQL.
Technique Profile: Cross-tenant Helpdesk Impersonation Leading To Data Exfiltration
21 July 2026by Threat Hunting Team
Learn how attackers abuse Microsoft Teams helpdesk impersonation to gain access, move laterally, and steal sensitive data.
CopyFail, Dirty Frag, And Fragnesia: Linux Page Cache Corruption Vulnerabilities Enabling LPE
15 July 2026by Cyber Shield Intelligence (CSI) Team
CopyFail, Dirty Frag, and Fragnesia are Linux kernel flaws enabling local root escalation via page cache corruption. Patch now.
How We Tracked The Dohdoor Backdoor’s Encrypted C2 Channel Using DNS-over-HTTPS Behavioral Analysis
1 July 2026by Threat Hunting Team
Learn how Wizard Cyber detected the Dohdoor backdoor by identifying DNS-over-HTTPS C2 traffic and KQL threat hunting.
Why Claude AI Is Being Abused In Modern Attack Campaigns
19 May 2026by Cyber Shield Intelligence (CSI) Team
Learn how attackers abuse Claude AI through fake installers, ads, and ClickFix lures to steal credentials and deploy malware.
Detecting Boot-Level Persistence In Windows: BCD Abuse And Startup Manipulation
19 May 2026by Detection Engineering Team
Learn how to detect boot-level persistence in Windows by identifying BCD abuse, bcdedit misuse, and early startup manipulation.
Cybercrime Actors Exploit VPN Trust Through SEO Poisoning To Steal Enterprise Credentials
13 May 2026by Cyber Shield Intelligence (CSI) Team
Threat actors exploit SEO poisoning to distribute fake VPN installers, steal credentials, and gain silent access to enterprises.
Learn how ClickFix and HijackLoader deliver DeerStealer via user execution, MSI abuse, and DLL sideloading on Windows.
Copyright by Wizard Cyber. All rights reserved.
Copyright by Wizard Cyber. All rights reserved.WIZARD CYBERHeadquarters
Providing enterprises with bespoke & powerful managed solutions to protect against all forms of cybercrimeOUR LOCATIONSWhere to find us?
WIZARD CYBERHeadquarters
Providing enterprises with bespoke & powerful managed solutions to protect against all forms of cybercrimeOUR LOCATIONSWhere to find us?
GET IN TOUCHLatest Updates
Stay up to date with the latest news from Wizard Cyber and the cybersecurity industry
