Organizations need 24/7 Security Operations Centers (SOCs) to defend against off-hours cyberattacks, especially during holidays when staff are unavailable. Implementing AI automation and building a skilled, well-trained team are crucial for effective continuous monitoring and response. #RadiantAI #SOC #cyberattacks #offhours…
Tag: THREAT HUNTING
Cybercriminals are increasingly using trusted platforms like Google, Microsoft, and Slack to hide malicious activities, making detection more challenging. The webinar offers key insights into identifying and preventing these stealthy LOTS attacks to enhance organizational security. #LivingOffTrustedSites #ThreatHunting #CloudSecurity…
![Threat Research | Weekly Recap [16 Jun 2025]](https://www.hendryadrian.com/tweet/image/cybersecuritynews.png "Threat Research | Weekly Recap [16 Jun 2025]")
This weekly recap covers global ransomware trends, including notable incidents like Fog and Spectra, and exploits of vulnerabilities such as CVE-2024-57727. It highlights ongoing activities from threat groups like Arkana, LockBit, and MISSION2025, along with malware campaigns like DCRat and GrayAlpha’s diverse infection vectors. #Arkana #LockBit #MISSION2025 #DCRat #GrayAlpha
This article discusses effective strategies for prioritizing cybersecurity projects, emphasizing the importance of Quick Wins that deliver high value with low effort. It highlights the significance of scope management, use case development, and ranking methods to ensure continuous security improvement. #SecurityMonitoring #SIEM #ThreatHunting
Elastic enhances Windows endpoint security by leveraging call stacks to identify malicious activities with greater precision, distinguishing the actor behind behaviors rather than just the actions themselves. The approach enriches call stacks with contextual data to aid detection, triage, and hunting, while addressing challenges like spoofing and limitations of stack walking. #CallStacks #ElasticDefend #SilentMoonwalk
Ransomware actors are exploiting unpatched SimpleHelp RMM instances to target utility billing software customers, emphasizing the need for updates and threat mitigation. The attack pattern highlights ongoing vulnerabilities exploited by groups like DragonForce and others, with mitigation strategies recommended by CISA. #SimpleHelp #DragonForce…
Ransomware operators are exploiting a vulnerability in SimpleHelp remote monitoring software to target customers of a utility billing provider, as warned by CISA. Immediate patching and threat hunting are essential to prevent further compromises and disruptions. #CVE-2024-57727 #SimpleHelp #Ransomware #ThreatActors #KEV…
Ransomware actors have been exploiting a path traversal vulnerability (CVE-2024-57727) in SimpleHelp Remote Monitoring and Management (RMM) version 5.5.7 and earlier to target downstream customers, particularly in the utility billing sector. CISA urges immediate mitigation steps including software upgrades, system isolation, and threat hunting to prevent and respond to these attacks….
Today’s threat actors are increasingly sophisticated, necessitating proactive cybersecurity strategies like threat intelligence and threat hunting to defend against advanced adversaries. Operationalizing these practices within security operations enables organizations to detect unknown threats earlier and improve response times. #eSentire #ThreatHunting #ThreatIntelligence
The Cybersecurity and Infrastructure Security Agency (CISA), FBI, and Australian Cyber Security Centre (ACSC) released an updated advisory detailing the Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) related to the Play ransomware group, active since 2022 and responsible for widespread attacks. The advisory includes new behaviors such as…
Adversary-in-the-Middle (AitM) phishing attacks increasingly target Microsoft 365 and Google accounts, leveraging sophisticated phishing kits offered as Phishing-as-a-Service (PhaaS). These kits harvest session cookies to bypass multi-factor authentication, facilitating financial fraud and Business Email Compromise (BEC) attacks. #Tycoon2FA #Storm1167 #EvilProxy #SekoiaTDR
British startup Maze has secured $25 million to develop AI-driven software that automates vulnerability detection and fixing in cloud environments. The company’s innovative agents simulate attack paths and resolve weaknesses automatically, aiming to revolutionize cloud security management. #Maze #AIagents #cloudvulnerabilities…
The ransomware group Black Basta disbanded after internal chat leaks, but its tactics, especially mass email spam and Microsoft Teams phishing, continue to be used by former members and new groups. Emerging attack methods now include Python script execution with cURL for payload delivery, emphasizing the need for strong user education and vigilant defense strategies. #BlackBasta #MicrosoftTeamsPhishing #CactusRaaS
This article describes a hands-on blue team cybersecurity simulation hosted by Deloitte, focusing on detecting insider threats through log analysis and digital forensics. It highlights the importance of pattern recognition, threat hunting, and intrusion detection in defending critical systems. #Deloitte #CyberSimulation
CyberEye, also known as TelegramRAT, is a modular .NET-based Remote Access Trojan that uses Telegram Bot API for command and control, enabling stealthy surveillance and data theft without requiring attacker infrastructure. Its capabilities include credential harvesting, defense evasion by disabling Windows Defender, clipboard hijacking, and persistence via scheduled tasks, making it a significant threat for users and organizations. #CyberEye #TelegramRAT #TelegramBotAPI