Blog

  February 2021 remained active by threat actors, launching cyberattacks and new malware strains. We saw that organizations working on COVID-19 vaccines remained popular targets. During the month, threat actors attacked an Oxford University lab, which is researching and producing COVID-19 vaccines. They were able to gain access to its internal systems, including machines used to prepare biochemical samples. In addition to Oxford University, due to the COVID-19 pandemic, overworked hospitals.

It is not uncommon for organisations to hear the term “Lateral Movement” after an audit or to be told they have a problem with it after a penetration test. But in most cases, there is no insight into what this means for them; and how they can begin to tackle it.  In this post we are going to attempt to make Lateral Movement relatable, and highlight how Cymulate can make it achievable, to understand what Lateral Movement looks like in your environment.  Lateral Movement refers to the techniques.

Ransomware is a constant threat to both businesses and individuals.  The potential for all critical data necessary to run an organization or a family to be locked is terrifying; and the global malware situation doesn't show any signs of slowing down in the future. Added to the threat of data loss to encryption is the recent surge in so-called "double-extortion attacks" where the data is not only encrypted but also stolen.  Let's take a look at the anatomy of these types of ransomware attacks.  

 In January 2021, cybercrime kept thriving, also exploiting the current COVID-19 pandemic for personal gain with hackers leaking stolen Pfizer COVID-19 vaccine data online.   Stolen Data from Pfizer/BioNTech Servers The threat actors breached the European Medicines Agency (EMA) and stole part of its Pfizer/BioNTech COVID-19 vaccine data from its servers. The stolen data included email screenshots, EMA peer review comments, Word documents, PDFs, and PowerPoint presentations. Some of the stolen.

How to Optimize your SOC If you’re here, you are looking for the “3 step magic process” that will instantly optimize your Security Operations Center (SOC) to be a premier Cybersecurity SOC right? Ok let us do that together. Though to do that let us make sure we all are on the same page about what the SOC should be doing vs what the SOC is doing to protect your organization from today’s cybersecurity threats. For that we have to turn to Lebron James. He is the best basketball player in the.

Threat actors were active as ever during December 2020, ending an already difficult year with a major ramification. TA542 Back with a Vengence  Let’s start with the threat group TA542 (aka Mummy Spider, ATK 104, and Mealybug) that came back after a month and a half break. The group relaunched its Emotet botnet, delivering documents with malicious macros that once enabled, connected to seven malicious domains to download the Emotet payload. Some of the victims included Lithuania's National.

A few days before Christmas, the domain registrar and hosting service GoDaddy came under fire in the press and social media for phish-testing their users with a fake email which made it look like they were getting a US$650 bonus for the holidays.  While the methodology used can and does need to be done better in future, the test itself raises some serious questions for corporate cybersecurity professionals and regular users alike.   Here's What Happened: GoDaddy's cybersecurity team sent an.

Update as of December 17, 2020 A consortium of industry vendors including Microsoft and Google have actively been working to circumvent the ability of SUNBURST to successfully activate and attack. Microsoft was able to gain possession and control over a key domain - avsvmcloud[.]com - which the SUNBURST attack binaries use to get Command and Control (C&C) information. Without this C&C connectivity, the SUNBURST system remains in an inactive state if it has not yet become active within an.

Is It Time For CEOs To Be Personally Liable For Cyber-Physical Security Incidents? In a recent Gartner press release written in an article September 1st Gartner predicts 75% of CEOs will be personally liable for cyber-physical security incidents by 2024. The famous last words “I wasn’t aware” or “ Oh that’s our CISO, they handle this” can no longer be handed that hall pass. What’s that old saying about ignorance of the law? While ignorance is bliss said Cypher in the movie Matrix, we can no.

Threat actors keep stepping up their game in November 2020 PyXie (aka GOLDEN DUPONT) PyXie has conducted successful ransomware campaigns since 2018, counts healthcare, educational, government, and technology organizations and companies among its favorite targets. In its attacks, the group used the Vatet loader which was created by combining and altering the original application of various open-source tools, turning into a highly-effective attack tool. The loader executes payloads such as Cobalt.