Lead Analysts: Karthikeyan D, Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Lead Analysts: Lucy Gee and Emily Hanlon

As millions of shoppers prepare their wishlists and await discounts for Amazon’s Prime Big Deal Days starting October 6, cybercriminals are gearing up for their own payday.

Lead Analysts: Shikhar Dalela, Maddhav Grandy and Jeewan Singh Jalal

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal

Lead Analysts: Prabhakaran Ravichandhiran, Jeewan Singh Jalal, Karthikeyan Dharmaraj and Sripathi Kumar

Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal

By Shikhar Dalela and Jeewan Singh Jalal

The operators named the kit themselves.

Buried inside compromised legitimate websites, the hidden staging directory is sometimes literally called “/.bulletproof”, and the PHP session cookie the kit sets on every visitor is named “bp_redir_sess.” The “bp” stands for bulletproof, which is an unusual degree of candor from a threat actor whose entire design philosophy is concealment.

Lead Analysts: Prabhakaran Ravichandhiran and Jeewan Singh Jalal

Most phishing attacks pick a target and commit to a tactic. This one picks the tactic based on the target, which happens dynamically, per device, in milliseconds, without the victim ever knowing a decision was made.

Ransomware and phishing have always been linked, but the old model was blunt: a phishing email carried the payload, the recipient opened it, encryption followed within hours.