Blog

Finally Some Good News: NERC Proposes Deferment of 3 CIP standards
Blog

Finally Some Good News: NERC Proposes Deferment of 3 CIP standards

By Editorial Staff on Tue, 04/07/2020
Amidst all the pandemic doom and gloom, we finally have something positive come from the chaos: NERC filed a motion recently (April 6, 2020) to defer three Critical Infrastructure Protection (CIP) Reliability Standards (as well as 1 PER, and 3 PRC standards) for three months due to the national emergency declared on March 13th by President Trump. As...
Phorpiex Botnet Named "Most Wanted Malware" in November 2020
Blog

L4NC34 Ransomware's Encryption Routine Reversed by Researchers

By David Bisson on Tue, 04/07/2020
Security researchers reversed the encryption routine employed by L4NC34 ransomware by decrypting a file without paying the ransom. Sucuri Security first encountered L4NC34 ransomware when it began investigating an attack in which a malicious actor encrypted all website files and appended ".crypt" to their file names. The security firm dug a bit...
Tripwire Patch Priority Index for August 2022
Blog

Tripwire Patch Priority Index for March 2020

By Lane Thames on Mon, 04/06/2020
Tripwire's March 2020 Patch Priority Index (PPI) brings together important vulnerabilities from Microsoft and Adobe. Up first on the patch priority list this month are patches for Microsoft Browsers and Scripting Engine. These patches resolve information disclosure, remote code execution, and memory corruption vulnerabilities. Next on the list are...
PLEASE_READ_ME Ransomware Campaign Targeting MySQL Servers
Blog

Misconfigured Docker API Ports Targeted by Kinsing Malware

By David Bisson on Mon, 04/06/2020
Security researchers observed an attack campaign that targeted misconfigured Docker API ports with samples of Kinsing malware. According to Aqua Security, the campaign began when it capitalized on an unprotected Docker API port to run a Ubuntu container. The command used for creating the Ubuntu container included a shell script "d.sh." By means of...
COVID-19 Scam Roundup – April 6, 2020
Blog

COVID-19 Scam Roundup – April 6, 2020

By David Bisson on Mon, 04/06/2020
Digital fraudsters have seized upon coronavirus 2019 (COVID-19) as a lure for their new scams and attack campaigns. Together, these malicious operations constitute nothing short of a deluge. Barracuda revealed that it spotted 9,116 coronavirus-themed spear-phishing emails between March 1 and March 23, 2020—a 667% increase over the 1,188 attacks...
Results Speak Louder Than Words: A Guide to Evaluating ICS Security Tools
Blog

Results Speak Louder Than Words: A Guide to Evaluating ICS Security Tools

By Editorial Staff on Sun, 04/05/2020
Why leveraging live environment simulations and putting ICS tools to the test is the best way to evaluate their fitness. Track and field was one of my favorite sports growing up. I didn’t begin competitively participating until I was a teenager, but I was instantly hooked once I started. Why? Because the clock didn’t lie. The tape measure didn’t lie....
Industrial Control Systems
New Microsoft Spear-Phishing Attack Uses Exact Domain Spoofing Tactic
Blog

Nearly Half of Employees Don't Know What to Do When Ransomware Hits

By David Bisson on Thu, 04/02/2020
A survey revealed that approximately half of employees didn't know how to respond in the event their organization suffered a ransomware infection. In its survey of North American business employees, Kaspersky found that 45% of respondents overall did not know the proper steps they should take in response to a ransomware attack. Respondents whose...
Phorpiex Botnet Named "Most Wanted Malware" in November 2020
Blog

VelvetSweatshop Technique Used by Attack Campaign to Deliver LimeRAT

By David Bisson on Wed, 04/01/2020
An attack campaign leveraged the Excel VelvetSweatshop encryption technique to deliver samples of the LimeRAT malware family. According to Mimecast, those responsible for this attack campaign turned to VelvetSweatshop to enhance the efficacy of their efforts. Nefarious individuals have a history of using a password to encrypt malicious Excel...
The MITRE ATT&CK Framework: Execution
Blog

The MITRE ATT&CK Framework: Execution

By Tripwire Researcher on Tue, 03/31/2020
Of all the tactics that an adversary will take on in their campaign, none will be more widely abused than Execution (https://attack.mitre.org/wiki/Execution). When taking into consideration off-the-shelf malware, traditional ransomware, or state-of-the-art advanced persistent threat actors, all of them have execution in common. There’s a great quote...
Blog

Are You Ready for the Remote Work’s Toll on Corporate Security?

By David Henderson on Mon, 03/30/2020
Given the situation that many companies, organizations and government agencies have been forced into working remotely due to COVID-19, it is imperative to give some thought about corporate security. Using a VPN for New Stay-at-Home Workers Millions of employees are now working from the confines of their own homes in an effort to keep businesses running smoothly. In most situations, employees are...
COVID-19 Scam Roundup – March 30, 2020
Blog

COVID-19 Scam Roundup – March 30, 2020

By David Bisson on Mon, 03/30/2020
Many in the digital security community are coming together to combat malicious actors during the coronavirus disease 2019 (COVID-19) global outbreak. One of the most visible of these new efforts is the COVID-19 CTI League. Made up of approximately 400 volunteers living in approximately 40 countries, the COVID-19 CTI League is working to block...
Mr and Mrs CISO: Security in the Age of the Lockdown
Blog

Mr and Mrs CISO: Security in the Age of the Lockdown

By Editorial Staff on Mon, 03/30/2020
With so many of us frantically learning to juggle our roles as parents, workers and most recently teachers; is it just my wife and I who feel it necessary to monitor the online activity of our teenagers during this lockdown? Sure, there’s rich educational content out there, but it sits amongst social networks, streaming services, gaming consoles and...
Now Is the Time to Get up to Speed with CMMC and SP 800-171 Rev 2
Blog

Now Is the Time to Get up to Speed with CMMC and SP 800-171 Rev 2

By David Bisson on Sun, 03/29/2020
At the beginning of March 2020, Fifth Domain reported that Colorado-based aerospace, automotive and industrial parts manufacturer Visser Precision LLC had suffered a DoppelPaymer ransomware infection. Those behind this attack ultimately published information stolen from some of Visser’s customers. Those organizations included defense contractors...
PLEASE_READ_ME Ransomware Campaign Targeting MySQL Servers
Blog

Tupperware Website Compromised with Credit Card Skimmer

By David Bisson on Fri, 03/27/2020
Digital attackers compromised the website of kitchen and household products manufacturer Tupperware with a credit card skimmer. On March 20, researchers at Malwarebytes observed that attackers had compromised tupperware[.]com by hiding malicious code within an image file. This code activated when a user attempted to check out and complete their...
Third-party data breach exposes GE employees' personal information
Blog

Third-party data breach exposes GE employees' personal information

By Graham Cluley on Thu, 03/26/2020
Past and present employees of General Electric (GE) are learning that their sensitive information has been exposed by a data breach at a third-party service provider. Fortune 500 company GE says it was recently informed of a security breach at one of its partners, Canon Business Process Services. According to GE, between approximately February 3 -...
The Future is Hybrid: Practicing Security in the Hybrid Cloud
Blog

The Future is Hybrid: Practicing Security in the Hybrid Cloud

By Lamar Bailey on Thu, 03/26/2020
By now, many organizations have adopted the cloud in some way. We saw organizations moving whole servers over to the cloud at the beginning, but now we see small parts of a system being moved to the cloud and new cloud native offerings. We’ll use the analogies of Lincoln Logs and Legos to describe these deployment models. Infrastructure-as-a...
Free Cyber Safety Resources during COVID-19
Blog

Free Cyber Safety Resources during COVID-19

By Tripwire Guest Authors on Tue, 03/24/2020
Whether you are reading this from somewhere in the United States or overseas, chances are you are doing it from the comfort of your home. Not because you chose to but because you were asked to do so in order to prevent Coronavirus disease 2019 (COVID-19) from spreading any further. If you are a parent, working remotely with your kids at home, you...
COVID-19 Scam Roundup – Week of 3/16/20
Blog

COVID-19 Scam Roundup – Week of 3/16/20

By David Bisson on Mon, 03/23/2020
Malicious actors are increasingly leveraging COVID-19 as a theme for new digital fraud attacks. In February 2020, for instance, Action Fraud received 21 reports of fraud relating to the coronavirus. This number of reports more than doubled to 46 between March 1 and March 13, 2020. Between March 14 and March 18, 2020, the United Kingdom's national...
The MITRE ATT&CK Framework: Initial Access
Blog

The MITRE ATT&CK Framework: Initial Access

By Tripwire Researcher on Mon, 03/23/2020
Although ATT&CK is not laid out in any linear order, Initial Access will be the point at which an attacker gains a foothold in your environment. This tactic is a nice transition point from PRE-ATT&CK to ATT&CK for Enterprise. What is different about the techniques within Initial Access is that they are more high-level than some of the other techniques...