Breaking News
Identity Attack Watch: AD Security News, April 2023
As cyberattacks targeting Active Directory continue to rise, AD security, identity, and IT teams face mounting pressure to monitor the evolving AD-focused threat landscape. To assist IT professionals in comprehending and preventing ...
AD Security Research: Breaking Trust Transitivity
While playing with Kerberos tickets, I discovered an issue that allowed me to authenticate to other domains within an Active Directory (AD) forest across external non-transitive trusts. This means that there is ...
New Attack Paths? AS Requested Service Tickets
While helping Andrew Schwartz with his Kerberos FAST post (which has more information about what FAST is and how it works, so have a read), I noticed something interesting. AS-REQs for machine ...
What It Means to be a Mission-Driven Company
On behalf of the entire team, I’m excited to share that Semperis has been named to Inc.’s 2022 list of Best Workplaces. This annual list honors workplaces that are ranked highly by ...
Combatting a BlackCat Ransomware Active Directory Attack
The FBI has released FBI Flash CU-000167-MW warning that BlackCat/ALPHV ransomware-as-a-service (RaaS) group has compromised at least 60 entities globally. As with the majority of cyberattacks, BlackCat/ALPHV’s end game is an Active ...
NotPetya Flashback: The Latest Supply-Chain Attack Puts Active Directory at Risk of Compromise
Last week, news broke that a sophisticated adversary penetrated FireEye’s network and stole the company’s Red Team assessment tools. The attack is reportedly linked to a larger supply-chain assault that struck government, consulting, technology, and ...
Mapping Out a Malware Distribution Network
More than a dozen US-based web servers were used to host 10 malware families, distributed through mass phishing campaigns. Malware families include Dridex, GandCrab, Neutrino, IcedID and others. Evidence suggests the existence ...
Tricks and COMfoolery: How Ursnif Evades Detection
Ursnif is one of the main threats that is effectively evading detection right now (at publication) The dropper uses a COM technique to hide its process parentage WMI is used to bypass ...
Cybercriminals Use Bitcoin as One Method of Laundering Money | Part 1
We are following the money to see what happens to the proceeds from cybercrime. This research shows cybercriminals are money laundering through both familiar and unfamiliar channels. Reserve your copy of the ...
