security operations – Page 13 – PossibleThreat Articles

The Ransomware Threat Intelligence Center

March 17, 2022 0 Comments active adversary, astrolocker, atom silo, avaddon, avos locker, black kingdom, blackmatter, conti, cring, darkside, dearcry, dharma, egregor, entropy, epsilon red, featured, gandcrab, karma, lockbit, lockfile, maze, memento, midas, nefilim, netwalker, python, ragnar locker, ragnarok, Ransomware, revil, robbinhood, ryuk, SamSam, security operations, snatch, sophos threat report, WannaCry, wastedlocker

Credit to Author: Tilly Travers| Date: Thu, 17 Mar 2022 09:13:50 +0000

A collection of Sophos threat research articles and security operations reports related to new or prevalent ransomware groups from 2018 to the present. The content will be updated as new research is published

Security Sophos

Will Russia’s war on Ukraine result in less online crime?

March 15, 2022 0 Comments Cybercrime, cybersecurity, featured, russia, security operations

Credit to Author: Chester Wisniewski| Date: Tue, 15 Mar 2022 07:37:51 +0000

Digital disruption and economic sanctions could reduce or power up Russia’s contribution to global cybercrime

Security Sophos

Countermeasures and observability key to defending against attackers trying to buy security products

March 4, 2022 0 Comments conti, featured, Ransomware, security operations, sophos security

Credit to Author: Craig Jones| Date: Fri, 04 Mar 2022 17:42:45 +0000

The leak of Conti ransomware’s internal chat logs revealed the attackers tried to buy security software so they could figure out how to bypass it and avoid detection

Security Sophos

Secrets of a security analyst: Ensuring 24/7 cover

February 24, 2022 0 Comments analyst insights, human-led threat hunting, security operations, sophos mtr, sophos rapid response

Credit to Author: Alice Barford| Date: Thu, 24 Feb 2022 09:01:20 +0000

Tips to help you investigate incidents from experienced security analysts

Security Sophos

Cyberthreats during Russian-Ukrainian tensions: what can we learn from history to be prepared?

February 22, 2022 0 Comments APT, blackenergy, cyber conflict, DDoS, disinformation, featured, geopolitics, russia, security operations, ukraine

Credit to Author: Chester Wisniewski| Date: Wed, 23 Feb 2022 04:04:23 +0000

A review of 15 years of activity designed to distract, confuse, deny, destablize, and divide

Security Sophos

Vulnerable Exchange server hit by Squirrelwaffle and financial fraud

February 15, 2022 0 Comments email security, exchange vulnerability, featured, fraud, malspam, proxylogon, proxyshell, security operations, squirrelwaffle

Credit to Author: Tilly Travers| Date: Tue, 15 Feb 2022 13:00:59 +0000

While Squirrelwaffle leveraged Exchange to spread malspam through hijacked email threads, one thread was spirited away by attackers to trick the target into a money transfer

Security Sophos

Rapid Response: The Squirrelwaffle Incident Guide

February 15, 2022 0 Comments featured, malware, mtr, proxylogon, proxyshell, rapid response, security operations, sophos xdr, squirrelwaffle

Credit to Author: Tilly Travers| Date: Tue, 15 Feb 2022 13:00:10 +0000

Squirrelwaffle is a malicious dropper or loader used to deliver other malware onto target systems. This guide shows Security Operations Centers (SOCs) and Incident Response Teams how to detect and respond to the presence of Squirrelwaffle on the network

Security Sophos

Log4Shell: How the Attackers’ Faces Have Changed Over Time

February 2, 2022 0 Comments Exploit, featured, log4j, log4shell, security operations, threat research, vulnerability

Credit to Author: Chester Wisniewski| Date: Wed, 02 Feb 2022 09:34:16 +0000

Following an article on January 24, 2022 of Log4Shell scanning and attack detections since the bug was reported, Sophos addresses reader questions about who’s behind it all

Security Sophos

Log4Shell: No Mass Abuse, But No Respite, What Happened?

February 2, 2022 0 Comments Exploit, featured, log4j, log4shell, mtr, security operations, threat research, vulnerability

Credit to Author: Chester Wisniewski| Date: Mon, 24 Jan 2022 17:52:07 +0000

Sophos reviews the scanning and attack detections for Log4Shell to see what’s really going on