sophos x-ops – Page 10 – Computer Security Articles

Family Tree: Related DLL-Sideloading Cases Bear Strange Fruit

November 3, 2022 admin dll side-load, Featured, sophos x-ops, threat research, x-ops

Credit to Author: Gabor Szappanos| Date: Thu, 03 Nov 2022 12:03:13 +0000

A threat actor’s repeated use of DLL-hijack execution flow makes for interesting attack results, including omnivorous file ingestion; we break down five cases and find commonalities

Security Sophos

For Cybersecurity Awareness Month, how about better cybersecurity advice?

October 13, 2022 admin Advice, Cybersecurity Awareness Month, end user, security operations, sophos x-ops

Credit to Author: Chester Wisniewski| Date: Thu, 13 Oct 2022 11:00:07 +0000

Let us be frank: The same old warnings to users aren’t cutting it, and it’s the technologists’ fault. Chester Wisniewski lays out a wiser way.

Security Sophos

Are threat actors turning to archives and disk images as macro usage dwindles?

October 12, 2022 admin archives, bumblebee, Featured, macros, malspam, sophos x-ops, threat research

Credit to Author: Matt Wixey| Date: Wed, 12 Oct 2022 11:00:28 +0000

Following Microsoft’s announcement that macros from the internet will be disabled by default, threat actors are using alternative file types for malware delivery. This shift brings both challenges and opportunities for organizations.

Security Sophos

Remove All The Callbacks – BlackByte Ransomware Disables EDR Via RTCore64.sys Abuse

October 4, 2022 admin blackbyte, EDR, Featured, ransomware, sophos x-ops, threat research

Credit to Author: Angela Gunn| Date: Tue, 04 Oct 2022 11:00:33 +0000

A fresh exploration of the malware uncovers a new tactic for bypassing security products by abusing a known driver vulnerability

Security Sophos

Six months on: Looking back at the role of cyberattacks in the Ukraine War

September 14, 2022 admin Featured, geopolitics, Russia, security operations, sophos x-ops, Ukraine

Credit to Author: Chester Wisniewski| Date: Wed, 14 Sep 2022 13:00:39 +0000

When Russia invaded Ukraine on February 24th 2022, none of us knew what role cyberattacks might play in a full-scale invasion. Russia had been conducting cyberattacks against Ukraine since it had occupied Crimea back in 2014 and it seemed inevitable that these tools would play a role, especially after the attacks on Ukraine’s power grid […]

Security Sophos

A lighter Patch Tuesday, but one heavy with remote code execution bugs

September 13, 2022 admin microsoft, Patch Tuesday, sophos x-ops, threat research

Credit to Author: Matt Wixey| Date: Tue, 13 Sep 2022 18:38:14 +0000

There are fewer bugs in September’s update than in previous months, with RCE vulns making up the bulk of the addressed CVEs

Security Sophos

Cookie stealing: the new perimeter bypass

August 18, 2022 admin active adversary, cookie theft, Featured, information stealers, infostealer malware, sophos x-ops, threat research

Credit to Author: gallagherseanm| Date: Thu, 18 Aug 2022 11:00:50 +0000

As organizations move to cloud services and multifactor authentication, cookies tied to identity and authentication give attackers a new path to compromise.

Security Sophos

Lockbit, Hive, and BlackCat attack automotive supplier in triple ransomware attack

August 10, 2022 admin active adversary playbook, blackcat, Featured, hive, lockbit, ransomware, security operations, sophos x-ops

Credit to Author: Matt Wixey| Date: Wed, 10 Aug 2022 11:00:50 +0000

After gaining access via RDP, all three threat actors encrypted files, in an investigation complicated by event log clearing and backups. 3 attackers, 2 weeks – 1 entry point.