Our in-depth analysis of what began as an unusual PowerShell script revealed intrusion sets associated with Gootkit loader. In the past, Gootkit used freeware installers to mask malicious files; now it uses legal documents to trick users into downloading these files. We uncovered this tactic through managed extended detection and response (MxDR) and by investigating…

In early April, 1912, many people believed that the Titanic was unsinkable. On April 15, 1912, the Titanic sank and by late April, 1912, as the news spread, people no longer believed that the Titanic was unsinkable. I think that the story of the Titanic and the mistaken belief that it was unsinkable can teach…

Teachers unable to get paychecks. Tax and customs systems paralyzed. Health officials unable to access medical records or track the spread of COVID-19. A country’s president declaring war against foreign hackers saying they want to overthrow the government. For two months now, Costa Rica has been reeling from unprecedented ransomware attacks disrupting everyday life in…

Snowflake this week launched a new Cybersecurity workload that helps cybersecurity teams to better protect their enterprises using its platform and an extensive ecosystem of partners delivering security capabilities with connected applications, cybersecurity teams can quickly gain visibility and automation at cloud-scale. “With Snowflake’s Data Cloud, cybersecurity teams can break down data silos to enable…

Our nation is facing some of the most daunting cybersecurity challenges in history. As the new Office of the National Cyber Director (ONCD) gets fully staffed and running, little is more important to the nation’s security than making sure the right people are in the right places to address these dynamic challenges. Bringing private industry…

Ransomware incidents are on the rise and this week proved no exception, with the discovery of a Linux-based ransomware family called Cheerscrypt targeting VMware ESXi servers and an attack on SpiceJet, India’s second largest airline. Meanwhile, an oddball “GoodWill” variant purports to help the needy. The Cheerscrypt ransomware variant was uncovered by Trend Micro and…

Companies face various cyber risks, ranging from ransomware to data theft. Cyber threat actors gain access to an organization’s systems in various ways. However, cybercriminals commonly take the path of least resistance, and organizations’ reliance on password-based authentication provides numerous avenues of attack. Passwords are known to be a weak form of authentication, and the…

Evidence that members of the defunct REvil group may be reviving the ransomware gang continues to accumulate, but cybersecurity experts question whether the group will have the same impact that it once did. On April 29, anti-malware firm Avast revealed that the company’s software had blocked a ransomware sample that appeared to be generated using…

Mandiant announced the findings of an annual report that provides timely data and insights based on frontline investigations and remediations of high-impact cyber attacks worldwide. The 2022 report––which tracks investigation metrics between October 1, 2020 and December 31, 2021—reveals that while significant progress has been made in threat detection and response, adversaries are still innovating…

Endpoint protection vendor Cybereason has launched a new incident response (IR) solution to streamline and automate IR investigations. Digital Forensics Incident Response incorporates nuanced forensics artifacts into threat hunting, reducing remediation time by enabling security analysts to contain cyberattacks in minutes, the firm stated in a press release. The release comes in the wake of…