Analysis of Malware from Tracking Exploit Writers
released on 2020-10-02 @ 02:53:27 PM
In the past months, Checkpoint Vulnerability and Malware Research teams joined efforts to focus on the exploits inside malware and specifically, on the exploit writers themselves. Starting from a single Incident Response case, we built a profile of one of the most active exploit developers for Windows, known as “Volodya” or “BuggiCorp”. Up until now, we managed to track down more than 10 (!) of their Windows Kernel Local Privilege Escalation (LPE) exploits, many of which were zero-days at the time of development.