Summary: A recent alert from Sophos X-Ops MDR highlights a surge in ransomware attacks exploiting the critical CVE-2024-40711 vulnerability in Veeam Backup & Replication software. Attackers have been leveraging this …
Tag: MDR
Short Summary
Read More
Trend Micro’s investigation into the Earth Simnavaz APT group reveals their advanced tactics targeting critical sectors in the UAE, utilizing sophisticated malware and exploiting vulnerabilities for espionage and …
Threat Actor: North Korean Hackers | North Korean Hackers Victim: iOS and Android Users | iOS and Android Users Price: Not disclosed Exfiltrated Data Type: Personal and financial information
Key …
Short Summary:
Trend Micro’s MDR team successfully mitigated a more_eggs infection, which was initiated through a spear-phishing email that tricked a recruitment officer into downloading a malicious file disguised as …
Short Summary:
Huntress analysts have identified various indicators and tactics used in Akira ransomware attacks, highlighting the importance of early detection and monitoring. The analysis reveals that threat actors often …
Victim: dowley.com Country : GB Actor: lockbit3 Source: http://lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion//post/OyYjaqJycFV9J9Bf66e6e324ca974 Discovered: 2024-09-15 17:13:47.247356 Published: 2024-09-15 13:37:00.000000 Description : Security Experts! Experience, Expertise & Knowledge The Dowley relationship cycle is a well …
Short Summary: In December 2023, an intrusion incident involving Zloader malware was investigated. The breach was potentially linked to Citrix exploitation, with various Cobalt Strike payloads deployed. Zloader, a variant…
Read More
Summary: The RansomHub ransomware gang has adopted new tactics by utilizing TDSSKiller to disable endpoint detection systems and LaZagne for credential harvesting, marking a significant shift in their attack methodology. …
Short Summary
Read More
Rapid7 has been recognized as a Leader in the IDC MarketScape: Worldwide SIEM for SMB 2024 Vendor Assessment. The company highlights the unique features of its InsightIDR product, …
Short Summary: Sophos X-Ops has identified a Chinese state-directed cyberespionage operation, termed Operation Crimson Palace, targeting a Southeast Asian government agency. The operation involves multiple threat activity clusters, with ongoing…
Read More
Short Summary:
The RansomHub ransomware gang has been identified using TDSSKiller and LaZagne in a new attack method to disable EDR systems and harvest credentials. This marks the first recorded …
Short Summary:
The article discusses the increasing prevalence of malware targeting macOS, particularly focusing on the Atomic macOS Stealer (AMOS), which is designed to steal sensitive data from infected machines. …
Summary: The Critical Start Cyber Research Unit’s analysis reveals a significant rise in cyberattacks across various industries in the first half of 2024, with manufacturing and healthcare being the most …
Summary: A recent Malwarebytes report reveals a significant rise in ransomware attacks, with evolving tactics that necessitate continuous monitoring and rapid response strategies for organizations. The report highlights alarming statistics …
Short Summary:
The article discusses the challenges faced by security professionals in managing unpredictability in the cyber world. It emphasizes the importance of focusing on controllable factors, conducting risk assessments, …
Short Summary:
The Trend Micro Managed Detection and Response (MDR) team successfully identified and contained a Play ransomware intrusion attempt using the Trend Micro Vision One platform. The attack involved …
Short Summary
Read More
eSentire’s Threat Response Unit (TRU) investigates the D3F@ck Loader malware, tracing its origins to a developer known as Sergei Panteleevich. The article details the loader’s capabilities, including its …
Short Summary:
Sophos MDR has identified a new threat activity cluster, STAC6451, targeting exposed Microsoft SQL Server databases in India. The attackers exploit vulnerabilities to gain unauthorized access, deploy ransomware, …
“`html Short Summary:
A new phishing campaign has been discovered that utilizes Discord’s Content Delivery Network (CDN) to deliver malicious executables. The campaign involves a phishing email containing a zip …
In a recent attack, Rhysida used a new variant of the Oyster backdoor, also known as Broomstick.
On July 10, 2024, a prominent private school was struck by the Rhysida …
Introduction
Read More
In the beginning of 2024, eSentire’s Threat Response Unit (TRU) observed an increase in DarkGate malware infections. DarkGate is a commodity loader initially discovered in 2018 but has seen …
During the past few weeks, we’ve observed a number of malicious Google search ads targeting IT staff. These malvertising campaigns are nothing new, in fact they have been documented numerous …
THE THREAT
Read More
Beginning in May 2024, and carrying into early June, eSentire has identified an increase in observations of Matanbuchus malware. Matanbuchus is a loader type malware that was first …
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats …
In May 2023, in a threat hunt across Sophos Managed Detection and Response telemetry, Sophos MDR’s Mark Parsons uncovered a complex, long-running Chinese state-sponsored cyberespionage operation we have dubbed “Crimson …
Sophos Managed Detection and Response initiated a threat hunt across all customers after the detection of abuse of a vulnerable legitimate VMware executable (vmnat.exe) to perform dynamic link library (DLL) …
Summary
Read More
On May 2, 2024, Arctic Wolf Labs began monitoring deployment of a new ransomware variant referred to as Fog. The ransomware activity was observed in several Arctic Wolf Incident …
Summary: Managed Service Partners (MSPs) highlight cybersecurity as their top concern in staying competitive in the market, with challenges including staying on top of security technologies, employing more security analysts, …
Cybereason issues Threat Alerts to inform customers of emerging impacting threats, including critical vulnerabilities. Cybereason Threat Alerts summarize these threats and provide practical recommendations for protecting against them.…
In a recent investigation by Bitdefender Labs, a series of cyberattacks targeting high-level organizations in South China Sea countries revealed a previously unknown threat actor. We’ve designated this group “Unfading …
Introduction
Read More
Attackers always find creative ways to bypass defensive features and accomplish their goals. This can be done with packers, crypters, and code obfuscation. However, one of the best ways …
Summary: This content discusses the prevalence of data breaches in organizations and the factors that contribute to the identification or lack thereof of breaches within their environments.
Threat Actor: N/A …
Summary: This article discusses an ongoing social engineering campaign targeting multiple managed detection and response (MDR) customers, where a threat actor overwhelms a user’s email with junk and offers assistance …
Executive Summary
Read More
Rapid7 has observed an ongoing campaign to distribute trojanized installers for WinSCP and PuTTY via malicious ads on commonly used search engines, where clicking on the ad leads …
Last updated at Thu, 16 May 2024 17:30:35 GMT
Co-authored by Rapid7 analysts Tyler McGraw, Thomas Elkins, and Evan McCann
Executive SummaryRapid7 has identified an ongoing social engineering campaign …
Last updated at Thu, 16 May 2024 17:38:34 GMT
Executive SummaryRapid7 has observed an ongoing campaign to distribute trojanized installers for WinSCP and PuTTY via malicious ads on commonly …
Co-authored by Rapid7 analysts Tyler McGraw, Thomas Elkins, and Evan McCann
Executive SummaryRapid7 has identified an ongoing social engineering campaign that has been targeting multiple managed detection and response …
Summary: AT&T has completed the divestiture of its cybersecurity services group and formed a joint venture called LevelBlue, which will focus on managed cybersecurity services.
Threat Actor: N/A
Victim: N/A…
We are investigating a ransomware campaign that abuses legitimate Sophos executables and DLLs by modifying their original content, overwriting the entry-point code, and inserting the decrypted payload as a resource …
Summary: ThreatLocker, a global cybersecurity company, has raised $115M in Series D funding to enhance its Zero Trust endpoint security solution and expand its global presence.
Threat Actor: ThreatLocker | …
Organizations are increasingly turning to cloud computing for IT agility, resilience and scalability. Amazon Web Services (AWS) stands at the forefront of this digital transformation, offering a robust, flexible and …
At its core, threat hunting is the practice of proactively searching for signs of malicious activities or indicators of compromise (IOCs) before threat actors gain a deep foothold within your …
Rapid7’s Managed Detection and Response (MDR) team continuously monitors our customers’ environments, identifying emerging threats and developing new detections.
In August 2023, Rapid7 identified a new malware loader named the …
Last updated at Wed, 10 Apr 2024 14:32:16 GMT
Rapid7’s Managed Detection and Response (MDR) team continuously monitors our customers’ environments, identifying emerging threats and developing new detections.
In August …
This is part two in our series on building honeypots with Falco, vcluster, and other assorted open source tools. For the previous installment, see Building honeypots with vcluster and Falco: …
In the past couple of weeks, we have observed an ongoing campaign targeting system administrators with fraudulent ads for popular system utilities. The malicious ads are displayed as sponsored results …
Threat detection and response are critical components of a robust cybersecurity strategy. However, simply relying on automated detections is no longer enough to protect your organization from downtime.
To reduce …
This blog post discusses the IDAT Loader malware and its unique method of retrieving data from PNG files. It also explores the attack chain observed in two separate incidents involving …
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats …
THE THREAT
Read More
Beginning on March 24th, 2024, eSentire observed a significant increase in exploitation of CVE-2023-48788 (CVSS: 9.8). CVE-2023-48788 is a SQL injection flaw in FortiClientEMS software. Exploitation would allow …