Elastic Security Labs
@elasticseclabs
Followers
4K
Following
289
Media
86
Statuses
523
Elastic Security Labs is democratizing security by sharing knowledge and capabilities necessary to prepare for threats. Spiritually serving humanity since 2019.
Global
Joined November 2022
Really awesome new research from @k33b0i @soolidsnakee
#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant. Check it out at https://t.co/Df8JLO6w4d
0
5
21
#RONINGLOADER -> PPL abuse, the new hotness.
#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant. Check it out at https://t.co/Df8JLO6w4d
0
6
16
#ElasticSecurityLabs uncovers #RONINGLOADER, a multi-stage loader utilizing signed drivers, PPL abuse, CI Policies, and other evasion techniques to deliver #DragonBreath's gh0st RAT variant. Check it out at https://t.co/Df8JLO6w4d
0
28
103
It's not too often we get to work shoulder-to-shoulder with the practitioners and researchers on the front lines. #REF3927 is an intrusion set that deploys SEO cloaking capabilities, RATs, webshells, and RMMs - largely using a novel IIS module we named #TOLLBOOTH
#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys:
0
1
4
Fantastic work by the @harfanglab team describing and documenting indicators and detection logic for "RudePanda," described with complementary analysis by the @elasticseclabs team as "TOLLBOOTH." https://t.co/DS83PaxYi0
harfanglab.io
Identifier: TRR251001. Summary Late August and early September 2025, our security product detected the compromises of IIS servers with a previously undocumented malicious module which we call...
Late summer our stuff stopped an infection chain involving a driver, a previously undocumented malicious IIS module, and ASP .NET viewstate abuse.
0
4
11
#ElasticSecurityLabs releases nightMARE, a Python-based library for malware analysts that we use to build tools for acquiring intelligence. Read more about it here:
elastic.co
This article describes nightMARE, a python-based library for malware researchers that was developed by Elastic Security Labs to help scale analysis. It describes how we use nightMARE to develop...
0
11
45
@bluish_red_ @ValidinLLC Really great research from @bluish_red_ and the team at @elasticseclabs! Worth a read and if you're running IIS, should definitely check if you're impacted.
0
1
4
Amazing experience to work the great folks @elasticseclabs on this write up to showcase some interesting activity we discovered together! Excited to keep our collaboration going to give back what we can to the security community!
#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys:
1
2
9
@Cthulhu_Sec @elasticseclabs Your team and the customer squashing it from the get go was great! Love talking about good folks doin' the good work!
0
2
5
This was a cool project for a few reasons. First, some of us have been working with Texas A&M since Endgame and it’s a partnership with a ton of history! Also it is a blast for us to work with other experts to achieve successes!
#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys:
1
6
19
Thanks for being generous with your time and expertise on this @SreekarMad! Good stuff! @ValidinLLC
#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys:
2
5
12
#ElasticSecurityLabs joins forces with @tamusystem and discloses TOLLBOOTH, an IIS module used for SEO abuse that relies on publicly exposed ASP. NET machine keys:
elastic.co
REF3927 abuses publicly disclosed ASP.NET machine keys to compromise IIS servers and deploy TOLLBOOTH SEO cloaking modules globally.
0
20
43
@M_haggis @elasticseclabs Thank y'all for reading it, Michael!
0
1
3
@elasticseclabs Love some IIS modules on a Tuesday. Thank you all for sharing
1
1
3
In September, #ElasticSecurityLabs published 78 new rules! Take a look at the overview and learn how we manage these rulesets.
0
0
5
@elasticseclabs is currently researching a new family of IIS malware impacting a large number of organizations globally. With a US university-based MDR provider, we’ve observed a novel attack chain, RMMs, a Godzilla-forked framework, and a malicious driver. Details coming soon.
1
11
59
i'm gonna keep on dancing at the WARMCOOKIE string_bank
#ElasticSecurityLabs has kept tabs on #WARMCOOKIE, a backdoor we disclosed in June 2024 that used employment-related phishing lures to infect victims. Learn how this threat’s evolving:
2
6
35
Predictive indicator for WARMCOOKIE 🍪🍪🍪 infrastructure. @ValidinLLC
@500mk500
#ElasticSecurityLabs has kept tabs on #WARMCOOKIE, a backdoor we disclosed in June 2024 that used employment-related phishing lures to infect victims. Learn how this threat’s evolving:
1
6
15
#ElasticSecurityLabs has kept tabs on #WARMCOOKIE, a backdoor we disclosed in June 2024 that used employment-related phishing lures to infect victims. Learn how this threat’s evolving:
elastic.co
A year later: Elastic Security Labs re-examines the WARMCOOKIE backdoor.
0
10
44