featured – Page 24 – PossibleThreat Articles

Lockbit, Hive, and BlackCat attack automotive supplier in triple ransomware attack

August 10, 2022 0 Comments active adversary playbook, blackcat, featured, hive, lockbit, Ransomware, security operations, sophos x-ops

Credit to Author: Matt Wixey| Date: Wed, 10 Aug 2022 11:00:50 +0000

After gaining access via RDP, all three threat actors encrypted files, in an investigation complicated by event log clearing and backups. 3 attackers, 2 weeks – 1 entry point.

Security Sophos

Multiple attackers increase pressure on victims, complicate incident response

August 9, 2022 0 Comments active adversary playbook, blackcat, conti, cryptominers, featured, hive, iabs, karakurt, lockbit, Ransomware, security operations, sophos x-ops, threat research

Credit to Author: Matt Wixey| Date: Tue, 09 Aug 2022 11:00:04 +0000

Sophos’ latest Active Adversary report explores the issue of organizations being hit multiple times by attackers

Security Sophos

OODA: X-Ops Takes On Burgeoning SQL Server Attacks

July 20, 2022 0 Comments featured, managed threat response, mtr•rapid response, security operations, sophos rapid response, sophos x-ops, threat research

Credit to Author: Angela Gunn| Date: Wed, 20 Jul 2022 11:00:14 +0000

How do the pieces of Sophos X-Ops fit together? A combined effort makes tidy work of a threat actor’s big play

Security Sophos

BlackCat ransomware attacks not merely a byproduct of bad luck

July 14, 2022 0 Comments blackcat, citrix, esxi, featured, SophosLabs Uncut, threat research, vmware, vpn

Credit to Author: Andrew Brandt| Date: Thu, 14 Jul 2022 11:05:03 +0000

Older hardware and outdated operating systems contribute to attacks

Security Sophos

Sophos Managed Threat Response: 10,000 customers and counting!

July 11, 2022 0 Comments featured, Gartner, Managed Detection and Response, mdr, products & services, Ransomware, sophos mtr

Credit to Author: Sally Adam| Date: Mon, 11 Jul 2022 08:00:02 +0000

Organizations are rapidly switching to Sophos’ managed detection and response service to enjoy better cybersecurity outcomes

Security Sophos

Active Adversary Playbook 2022 Insights: Web Shells

June 22, 2022 0 Comments active adversary playbook, cve-2021-31207, cve-2021-34473, cve-2021-34523, featured, proxylogon, proxyshell, threat research, web shells

Credit to Author: gallagherseanm| Date: Wed, 22 Jun 2022 11:00:07 +0000

Public proofs-of-concept of web shell exploits coincide with major spikes in attacks.

Security Sophos

Confluence exploits used to drop ransomware on vulnerable servers

June 16, 2022 0 Comments atlassian, cerber, confluence, cryptoguard, cve-2022-26134, featured, Intercept X, PowerShell, Ransomware, security operations, sophos managed threat response (mtr), SophosLabs Uncut, threat research, tomcat, webshell

Credit to Author: Andrew Brandt| Date: Thu, 16 Jun 2022 11:00:03 +0000

Automated attacks are now widely exploiting the Atlassian vulnerability

Security Sophos

‘Follina’ Word doc taps previously unknown Microsoft Office vulnerability

June 8, 2022 0 Comments cve-2022-30190, featured, follina, Microsoft Office, ms-msdt, msdt, msdt.exe, SophosLabs Uncut, threat research, vulnerability, zero day

Credit to Author: Andrew Brandt| Date: Tue, 31 May 2022 00:41:42 +0000

MSDT.exe misuse in May makes for Memorial Day Monday mayhem

Security Sophos

The Active Adversary Playbook 2022

June 7, 2022 0 Comments active adversary, artifacts, attack tools, cobalt strike, Cryptomining, cyberattacks, cyberthreats, dwell time, Exploit, featured, initial access broker, malware delivery system, mitre, proxylogon, proxyshell, Ransomware, Ransomware as a Service, security operations, sophos rapid response, vulnerability

Credit to Author: Tilly Travers| Date: Tue, 07 Jun 2022 11:02:43 +0000

Cyberattacker behaviors, tactics and tools seen on the frontline of incident response during 2021