Incident Response
How Isolation Changes Incident Response
Large Groups of Isolated Users Shrink Your Exposure Surface Enterprises frequently acquire an isolation solution (with Menlo for remote browser isolation) for groups of users, such as VIPs, rather than their entire ...
Survey Finds Lag in Crisis Response Planning
A recent survey from security firm Immersive Labs found that many organizations don’t hold crisis simulations more than once a year, and the majority of organizations when holding such exercises only do ...
Drovorub: Russia Pushing Invisible Malware, say NSA and FBI
Fancy Bear is at it again. This time, it’s said to be infecting Linux machines with Drovorub—rootkit malware that’s very hard to detect ...
Intel Leak: 20GB of Secrets Just the Start, Says Perp
A large cache of confidential documents has been exfiltrated from Intel and leaked ...
How Cybersecurity Will Change Post-Pandemic
The business impact of COVID-19 has been felt in many different industries. Cybersecurity is one industry that has seen a huge impact, with the increase of hacks, malware and phishing attempts popping ...
Hunting injected processes by the modules they keep
A relatively recent post showed how Metasploit's Meterpreter module made some noise on endpoints when the migrate command was used to move the agent code into a legitimate process, spoolsv.exe in our ...
Garmin Pays Ransom to Evil Corp – Despite Russian Sanctions
It’s emerged that Garmin caved into pressure and paid several million dollars’ ransom to WastedLocker-wielding criminals ...
Avon Cosmetics Leaks 7GB of Personal and Technical Information from Unsecured Server
Last month, SafetyDetectives researchers discovered an unsecured database belonging to the popular Avon beauty company. The server, which lacked basic security measures, was easily accessible by investigators, who found a trove of ...
Reimagining the SOC for the Future of Work
Amy Blackshaw and Michael Adler talk with ITPSmagazine about ways to enable a successful virtual SOC and what organizations need to do to manage the growing threat of dynamic workforce risks ...
Analyzing an Instance of Meterpreter’s Shellcode
In my previous post on detecting and investigating Meterpreter's Migrate functionality, I went down a rabbit hole on the initial PowerShell attack spawned by and Excel macro. In that payload was a ...
