Experienced a breach?
Contact us
Experienced a breach?
CONTACT US
Resource Type
Blog
Threat Reports and Advisories
Guides and tools
Datasheet
Webinars
Topics
Cloud
Incident Response
OT Security
Malware
Vulnerabilities
Attack Techniques
Detection
State Actors
Research
Forensics
Email
Cyber Crime
Ransomware
Mitigation and Response
Managed Detection and Response
Tabletop War Games
Threat Intelligence
Security Mitigation
VMware Security
Artificial intelligence (AI)
Threat Research
Webinars Forensics Incident Response
On-Demand Webinar – Inside a Malware Ecosystem: How North Korean IT Workers Operate Undetected
Join our webinar to explore a real-world APT case with Sygnia’s IR experts. See how attackers turned Zoom into a RAT, used ARP for covert command delivery, and executed stealthy HID-based actions.
On-Demand Webinar – Inside a Malware Ecosystem: How North Korean IT Workers Operate Undetected
10.08.2025
1 min
Blog Forensics Incident Response
What is Digital Forensics and Incident Response (DFIR)?
Learn what Digital Forensics and Incident Response (DFIR) is, and how Sygnia identifies, investigates, and stops cyber threats to keep your business secure.
Rena Stern
6.08.2025
16 min
Blog Forensics Incident Response
Unmasking a North Korean IT Farm: How North Korean IT Workers Stay Undetected
A North Korean operative, posing as a remote IT worker, used legitimate tools and obscure protocols to operate undetected in 2024. This blog details the covert techniques used to remain unnoticed and their implications for insider threat defense.
Luis Garcia
28.04.2025
10 min
Blog Forensics Incident Response Malware Ransomware
Ransomware Attacks in 2024: The Most Devastating Year Yet?
Discover how ransomware attacks in 2024 surged to record levels, exposing major vulnerabilities. Learn about the biggest threats, trends, and key incidents.
Sygnia Team
2.04.2025
10 min
Blog Forensics Incident Response
The Forensic Value of MFT Slack Space in Modern Windows Systems
Slack space within the MFT is a largely unexplored, hidden part of the NTFS file system, often overlooked by digital forensics software. However, it holds critical data for forensic investigations. This blog explores MFT slack space and provides practical information on how to leverage it in investigations.
Harel Segev, Incident Response Expert
30.03.2025
10 min
Threat Reports and Advisories Attack Techniques Cloud Forensics
Oracle Cloud Federated SSO Incident
A reported breach in Oracle Cloud’s authentication system may impact thousands of organizations. While Oracle disputes the claim, intelligence suggests potential exposure. This advisory outlines key actions to assess risk, secure identities, and mitigate threats.
Liran Farazis, Matan Naftali
24.03.2025
7 min
Blog Threat Reports and Advisories Attack Techniques Forensics Incident Response Ransomware Threat Research
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
Sygnia details Weaver Ant, a China-nexus threat actor infiltrating a major telecom provider. Using web shells and tunneling, the attackers maintained persistence and facilitated cyber espionage. This blog explores their tactics and provides key defense strategies against state-sponsored threats.
Weaver Ant, the Web Shell Whisperer: Tracking a Live China-nexus Operation
24.03.2025
18 min
Blog Detection Forensics Ransomware
The Anatomy of Abyss Locker Ransomware Attack
Abyss Locker ransomware targets critical network devices with swift, disruptive attacks. This blog breaks down its tactics and defense strategies.
Abigail See, Zhongyuan (Aaron) Hau, Ren Jie Yow, Yoav Mazor, Omer Kidron, Oren Biderman
4.02.2025
16 min
Blog Attack Techniques Detection Forensics Incident Response Malware Managed Detection and Response Research
A Surge in Identity-based Attacks: Cybersecurity trends from Sygnia’s new 2025 Threat Report
Explore key cybersecurity trends for 2025, including ransomware evolution, supply chain vulnerabilities, and identity-based threats. Discover actionable strategies and expert insights to strengthen your organization’s resilience.
Sygnia Team
2.02.2025
5 min
Blog Forensics Incident Response Ransomware
ESXi Ransomware Attacks: Stealthy Persistence through SSH Tunneling
ESXi ransomware attacks target virtualized infrastructures using SSH tunneling to remain undetected. Discover the techniques, forensic insights, and actionable defense strategies to protect your ESXi appliances from evolving threats.
Zhongyuan Hau (Aaron), Ren Jie Yow, Yoav Mazor
21.01.2025
7 min
Forensics Incident Response Ransomware Research
Sygnia’s Annual Field Report series 2024
Learn how to leverage your existing security estate and assets effectively, ensuring a powerful defense against cyber threats. Stay ahead of the curve and download the full report.
Sygnia’s Annual Field Report series 2024
3.06.2024
1 min
Blog Attack Techniques Cyber Crime Detection Forensics Incident Response Malware Ransomware Research
Chapter 3 – Reversing DoSvc C++ using Ghidra – Part 1
In this chapter, we’ll finally get started on my favorite part: the reversing phase. Reversing is like looking for a needle in a haystack, so prepare yourselves, because things are about to get technical.
Binyamin Levine, Oleg Lerner
6.05.2024
18 min
Solutions
Blog Attack Techniques Cyber Crime Detection Forensics Incident Response Malware Ransomware Research
Chapter 2 – Black Box Research
The intricacies of WUDO (Windows Update Delivery Optimization).
Binyamin Levine, Oleg Lerner
16.04.2024
23 min
Blog Attack Techniques Cyber Crime Detection Forensics Incident Response Malware Ransomware Research
Chapter 1 – Introduction
The intricacies of WUDO (Windows Update Delivery Optimization).
Binyamin Levine, Oleg Lerner
1.04.2024
6 min
Blog Attack Techniques Cyber Crime Detection Forensics Incident Response Malware Ransomware Research
The Anatomy of a BlackCat (ALPHV) Attack
Explore the thwarted cyber extortion attempt by the BlackCat ransomware group, unraveled by Sygnia's Incident Response team in 2023.
Oren Biderman, Amir Sadon
5.03.2024
28 min
Blog Guides and tools Attack Techniques Cloud Detection Forensics Research
Proof of Concept: Overcoming Google Cloud Incident Response Issues with ‘Mirage’
How the Mirage tool developed by Sygnia assists in evidence collection & investigation, while uncovering key log analysis & incident response strategies for Google Cloud.
Itay Angi
21.02.2024
22 min
Blog Guides and tools Attack Techniques Cloud Detection Forensics Research
Announcing ‘Mirage’ – New Opensource Tool to Combat Google Cloud Incident Response Challenges
New open-source tool streamlines incident response in Google Workspace & GCP. Overcome challenges, access data, & gain insights faster. Learn more about Mirage & Google Cloud forensics in our blog series.
Itay Angi
21.02.2024
13 min
Blog Detection Forensics Malware Research
Diving into the new windows 11 PCA artifact
Discover the new forensic artifact in Windows 11 (22H2) and explore its format and behavior. Learn how to leverage it in investigations with our comprehensive documentation for DFIR practitioners.
Harel Segev, Incident Response Expert
15.11.2023
10 min
subsctibe decor
Want to get in touch?
Contact us