Resources

Blog

Decryption Keys Released by Developer of HildaCrypt Ransomware

The developer of HildaCrypt has released the master decryption keys that would allow potential victims of the ransomware to recover their data for free. On October 4, a security researcher who goes by the name "GrujaRS" posted about the discovery of a new variant of STOP, a well-known ransomware family. https://twitter.com/GrujaRS/status...
Blog

NCSAM: It’s Everyone’s Job to Ensure Online Safety at Work

October is National Cyber Security Awareness Month (NCSAM). NCSAM is a great initiative to help educate and inform our friends and family on the importance of taking your digital security seriously. To help continue to support this initiative, we asked a range of industry experts to share some of their tips to help us stay safe online. Angus...
Blog

Secure Configuration in Cloud - IaaS, PaaS and SaaS Explained

If I asked you what security products you had in place to manage your risk within your IT organisation 10 years ago, you’d probably have been able to list a half dozen different tools and confidently note that most of your infrastructure was covered by a common set of key products such as antivirus, DLP, firewalls, etc. But in a world with IaaS,...
Blog

Automating Secure Configuration Management in the Cloud

For many organizations moving to the cloud, Infrastructure as a Service (IaaS) like AWS EC2, Azure Virtual Machines or Google Compute Engine often forms the backbone of their cloud architecture. These services allow you to create instances of pretty much any operating system almost instantly. Unfortunately, moving your IT infrastructure to the cloud...
Blog

Tripwire Patch Priority Index for September 2019

Tripwire's September 2019 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft and Adobe. Exploit Framework Alert A Metasploit Exploit module that targets Windows Remote Desktop Services has been recently released. This exploit module targets CVE-2019-0708 for the so-called “BlueKeep” vulnerability. This...
Blog

Discovery of Geost Botnet Made Possible by Attacker OpSec Fails

A series of operational security (OpSec) failures on the part of attackers enabled researchers to discover the Geost botnet. In mid-2018, Virus Bulletin researchers Sebastian Garcia, María José Erquiaga and Anna Shirokova discovered Geost, one of the largest Android banking botnets known today, while...
Blog

Attackers Targeting U.S. Petroleum Companies with Adwind RAT

Digital criminals have launched a new attack campaign that they're using to target U.S. petroleum companies with the Adwind RAT. Netskope discovered the operation in the beginning of September and found that it was distributing the Adwind RAT from “members[.]westnet[.]com[.]au/~joeven/.” With this URL in mind, it's likely that the individual...
Blog

How Will the CMMC Impact My Business and How Can We Prepare? Part 3 of 3

Combining Cyber Standards – Is ‘Unified’ Always A Good Approach? The CMMC enforcement model will require a significant adjustment to the way contractors conduct government business – from procurement to execution. In Part 2 of this series, I discussed the possible impacts of having your company’s security rating made public. In Part 3, I would like...
Blog

Cyber Threats to Medical Imaging Systems and How to Address Them

Healthcare continues to see staggering growth in breaches to patient health information. In the first half of 2019 alone, 32 million health records were breached, compared to 15 million records in the entire year of 2018. However, this trend of growing cyber breaches in healthcare is likely to persist due to the following characteristics of the...
Blog

eGobbler Malvertiser Bypassed Browser Protections Using Obscure Bugs

A malvertising actor known as "eGobbler" used obscure browser bugs to bypass built-in browser protections and expand the scope of its attacks. Confiant observed eGobbler exploiting the first vulnerability back on April 11, 2019. In that particular attack, the threat actor leveraged a Chrome exploit to circumvent the browser's pop-up blocker built...
Blog

SecTor 2019 Hack Lab Sneak Peek

Fall is officially here, and that can only mean that SecTor is right around the corner! All summer long, I’ve been planning and prepping new ideas for this year’s IoT Hack Lab and training session. With just a few weeks to go until the conference kicks off, I’m more than a little excited about the new hacks we’ll be demonstrating, dissecting and...
Blog

Ideas and Innovations at DEFCON 2019

Every year when I go to Black Hat USA and DEFCON, I am reminded of the constant battle between light and dark…wait…that’s Return of the Jedi…. I mean of the constant battle between infosec and the big bad hacker. And it’s not just the uber sophisticated hacks that involve fuzzing and SQL Injections (Am I showing my age there?) or any of the other...
Blog

Divergent Malware Using NodeJS, WinDivert in Fileless Attacks

Samples of a new malware family called "Divergent" are using both NodeJS and WinDivert in a series of fileless attack campaigns. Cisco Talos didn't identify the exact delivery method for Divergent. Even so, its researchers observed that the samples they analyzed staged and stored configuration date on the registry like other fileless malware. They...
Blog

Why Cybersecurity Pros Need to Be Good Storytellers

Like storytelling, data visualization can be used to provide a narrative about your organization’s cybersecurity posture. Cybersecurity is never a single thing; it is an amalgamation of an often growing list of issues that never seem to end. So in order to make some sense of what it means for the health of your organization, I am combining several...
Blog

WordPress sites hacked through defunct Rich Reviews plugin

An estimated 16,000 websites are believed to be running a vulnerable and no-longer-maintained WordPress plugin that can be exploited to display pop-up ads and redirect visitors to webpages containing porn, scams, and--worst of all--malware designed to infect users' computers. Researchers at WordFence went public about how hackers are exploiting a...
Blog

Percentage-Based URL Encoding Used by Phishers to Evade Detection

Digital criminals used percentage-based URL encoding to help their phishing campaign evade detection by secure email gateways. In mid-September, the Cofense Phishing Defense Center came across a phishing email that originated from a compromised email account for a recognizable American brand. The message informed recipients that they had a new...