active adversary – Computer Security Articles

RD Web Access abuse: Fighting back

June 13, 2024 admin active adversary, active adversary report, Featured, Incident Response, RDP, security operations, sophos x-ops, threat research

Credit to Author: Angela Gunn| Date: Wed, 12 Jun 2024 18:59:54 +0000

Investigation insights and recommendations from a recent welter of incident-response cases

Security Sophos

It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024

April 15, 2024 admin active adversary, active adversary report, Case study, Featured, Incident Response, RDP, threat research

Credit to Author: Angela Gunn| Date: Wed, 03 Apr 2024 10:01:37 +0000

The latter half of 2023 found numerous fronts on which attackers failed to press ahead. Are defenders failing to take advantage?

Security Sophos

Remote Desktop Protocol: The Series

March 20, 2024 admin active adversary, Featured, Incident Response, incident response tools, mdr, RDP, security operations, sophos x-ops, threat research

Credit to Author: Angela Gunn| Date: Wed, 20 Mar 2024 16:18:21 +0000

What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary Special Report

Security Sophos

‘AuKill’ EDR killer malware abuses Process Explorer driver

April 19, 2023 admin active adversary, active adversary playbook, anti-edr, aukill, backstab, EDR, edr killer, Featured, malware, process explorer, procexp, sophos x-ops, Targeted Attacks, threat research

Credit to Author: Andrew Brandt| Date: Wed, 19 Apr 2023 10:00:43 +0000

Driver based attacks against security products are on the rise

Security Sophos

Defenders vs. Adversaries: The Two-Speed Cybersecurity 2023 Race

April 4, 2023 admin active adversary, EDR, Endpoint, Featured, mdr, Network, products & services, security operations, XDR

Credit to Author: Sally Adam| Date: Tue, 04 Apr 2023 09:45:12 +0000

Slowed by multiple headwinds, defenders are falling behind while adversaries continue to accelerate. Organizations need to speed up the defender flywheel to enable them to pull ahead.

Security Sophos

Cookie stealing: the new perimeter bypass

August 18, 2022 admin active adversary, cookie theft, Featured, information stealers, infostealer malware, sophos x-ops, threat research

Credit to Author: gallagherseanm| Date: Thu, 18 Aug 2022 11:00:50 +0000

As organizations move to cloud services and multifactor authentication, cookies tied to identity and authentication give attackers a new path to compromise.

Security Sophos

The Active Adversary Playbook 2022

June 7, 2022 admin active adversary, artifacts, attack tools, cobalt strike, cryptomining, cyberattacks, cyberthreats, dwell time, exploit, Featured, initial access broker, malware delivery system, MITRE, proxylogon, proxyshell, ransomware, Ransomware as a Service, security operations, sophos rapid response, Vulnerability

Credit to Author: Tilly Travers| Date: Tue, 07 Jun 2022 11:02:43 +0000

Cyberattacker behaviors, tactics and tools seen on the frontline of incident response during 2021

Security Sophos

The Ransomware Threat Intelligence Center

March 17, 2022 admin active adversary, astrolocker, atom silo, avaddon, avos locker, black kingdom, blackmatter, conti, cring, darkside, dearcry, dharma, egregor, entropy, epsilon red, Featured, gandcrab, karma, lockbit, lockfile, maze, memento, Midas, nefilim, netwalker, python, ragnar locker, ragnarok, ransomware, rEvil, robbinhood, ryuk, SamSam, security operations, snatch, sophos threat report, WannaCry, wastedlocker

Credit to Author: Tilly Travers| Date: Thu, 17 Mar 2022 09:13:50 +0000

A collection of Sophos threat research articles and security operations reports related to new or prevalent ransomware groups from 2018 to the present. The content will be updated as new research is published