What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2024-05-01 14:00:00 | Uncharmed: Untangling Iran\'s APT42 Operations (lien direct) | Written by: Ofir Rozmann, Asli Koksal, Adrian Hernandez, Sarah Bock, Jonathan Leathery
APT42, an Iranian state-sponsored cyber espionage actor, is using enhanced social engineering schemes to gain access to victim networks, including cloud environments. The actor is targeting Western and Middle Eastern NGOs, media organizations, academia, legal services and activists. Mandiant assesses APT42 operates on behalf of the Islamic Revolutionary Guard Corps Intelligence Organization (IRGC-IO). APT42 was observed posing as journalists and event organizers to build trust with their victims through ongoing correspondence, and to deliver invitations to conferences or legitimate documents. These social engineering schemes enabled APT42 to harvest credentials and use them to gain initial access to cloud environments. Subsequently, the threat actor covertly exfiltrated data of strategic interest to Iran, while relying on built-in features and open-source tools to avoid detection. In addition to cloud operations, we also outline recent malware-based APT42 operations using two custom backdoors: NICECURL and TAMECAT. These backdoors are delivered via spear phishing, providing the attackers with initial access that might be used as a command execution interface or as a jumping point to deploy additional malware. APT42 targeting and missions are consistent with its assessed affiliation with the IRGC-IO, which is a part of the Iranian intelligence apparatus that is responsible for monitoring and preventing foreign threats to the Islamic Republic and domestic unrest. APT42 activities overlap with the publicly reported actors CALANQUE (Google Threat Analysis Group), Charming Kitten (ClearSky and CERTFA), Mint Sandstorm/Phosphorus (Microsoft), TA453 (Proofpoint), Yellow Garuda (PwC), and ITG18 ( |
Malware Tool Threat Cloud | Yahoo APT 35 APT 42 | ★★ |
|
2024-04-29 14:00:00 | De l'assistant à l'analyste: la puissance de Gemini 1.5 Pro pour l'analyse des logiciels malveillants From Assistant to Analyst: The Power of Gemini 1.5 Pro for Malware Analysis (lien direct) |
Executive Summary A growing amount of malware has naturally increased workloads for defenders and particularly malware analysts, creating a need for improved automation and approaches to dealing with this classic threat. With the recent rise in generative AI tools, we decided to put our own Gemini 1.5 Pro to the test to see how it performed at analyzing malware. By providing code and using a simple prompt, we asked Gemini 1.5 Pro to determine if the file was malicious, and also to provide a list of activities and indicators of compromise. We did this for multiple malware files, testing with both decompiled and disassembled code, and Gemini 1.5 Pro was notably accurate each time, generating summary reports in human-readable language. Gemini 1.5 Pro was even able to make an accurate determination of code that - at the time - was receiving zero detections on VirusTotal. In our testing with other similar gen AI tools, we were required to divide the code into chunks, which led to vague and non-specific outcomes, and affected the overall analysis. Gemini 1.5 Pro, however, processed the entire code in a single pass, and often in about 30 to 40 seconds. Introduction The explosive growth of malware continues to challenge traditional, manual analysis methods, underscoring the urgent need for improved automation and innovative approaches. Generative AI models have become invaluable in some aspects of malware analysis, yet their effectiveness in handling large and complex malware samples has been limited. The introduction of Gemini 1.5 Pro, capable of processing up to 1 million tokens, marks a significant breakthrough. This advancement not only empowers AI to function as a powerful assistant in automating the malware analysis workflow but also significantly scales up the automation of code analysis. By substantially increasing the processing capacity, Gemini 1.5 Pro paves the way for a more adaptive and robust approach to cybersecurity, helping analysts manage the asymmetric volume of threats more effectively and efficiently. Traditional Techniques for Automated Malware Analysis The foundation of automated malware analysis is built on a combination of static and dynamic analysis techniques, both of which play crucial roles in dissecting and understanding malware behavior. Static analysis involves examining the malware without executing it, providing insights into its code structure and unobfuscated logic. Dynamic analysis, on the other hand, involves observing the execution of the malware in a controlled environment to monitor its behavior, regardless of obfuscation. Together, these techniques are leveraged to gain a comprehensive understanding of malware. Parallel to these techniques, AI and machine learning (ML) have increasingly been employed to classify and cluster malware based on behavioral patterns, signatures, and anomalies. These methodologies have ranged from supervised learning, where models are trained on labeled datasets, to unsupervised learning for clustering, which identifies patterns without predefined labels to group similar malware. | Malware Hack Tool Vulnerability Threat Studies Prediction Cloud Conference | Wannacry | ★★★ |
|
2024-04-25 10:00:00 | Pole Voûte: cyber-menaces aux élections mondiales Poll Vaulting: Cyber Threats to Global Elections (lien direct) |
Written by: Kelli Vanderlee, Jamie Collier
Executive Summary The election cybersecurity landscape globally is characterized by a diversity of targets, tactics, and threats. Elections attract threat activity from a variety of threat actors including: state-sponsored actors, cyber criminals, hacktivists, insiders, and information operations as-a-service entities. Mandiant assesses with high confidence that state-sponsored actors pose the most serious cybersecurity risk to elections. Operations targeting election-related infrastructure can combine cyber intrusion activity, disruptive and destructive capabilities, and information operations, which include elements of public-facing advertisement and amplification of threat activity claims. Successful targeting does not automatically translate to high impact. Many threat actors have struggled to influence or achieve significant effects, despite their best efforts. When we look across the globe we find that the attack surface of an election involves a wide variety of entities beyond voting machines and voter registries. In fact, our observations of past cycles indicate that cyber operations target the major players involved in campaigning, political parties, news and social media more frequently than actual election infrastructure. Securing elections requires a comprehensive understanding of many types of threats and tactics, from distributed denial of service (DDoS) to data theft to deepfakes, that are likely to impact elections in 2024. It is vital to understand the variety of relevant threat vectors and how they relate, and to ensure mitigation strategies are in place to address the full scope of potential activity. Election organizations should consider steps to harden infrastructure against common attacks, and utilize account security tools such as Google\'s Advanced Protection Program to protect high-risk accounts. Introduction The 2024 global election cybersecurity landscape is characterized by a diversity of targets, tactics, and threats. An expansive ecosystem of systems, administrators, campaign infrastructure, and public communications venues must be secured against a diverse array of operators and methods. Any election cybersecurity strategy should begin with a survey of the threat landscape to build a more proactive and tailored security posture. The cybersecurity community must keep pace as more than two billion voters are expected to head to the polls in 2024. With elections in more than an estimated 50 countries, there is an opportunity to dynamically track how threats to democracy evolve. Understanding how threats are targeting one country will enable us to better anticipate and prepare for upcoming elections globally. At the same time, we must also appreciate the unique context of different countries. Election threats to South Africa, India, and the United States will inevitably differ in some regard. In either case, there is an opportunity for us to prepare with the advantage of intelligence. |
Ransomware Malware Hack Tool Vulnerability Threat Legislation Cloud Technical | APT 40 APT 29 APT 28 APT 43 APT 31 APT 42 | ★★★ |
|
2024-04-23 12:00:00 | M-Trends 2024: Notre vue depuis les fronts M-Trends 2024: Our View from the Frontlines (lien direct) |
Attackers are taking greater strides to evade detection. This is one of the running themes in our latest release: M-Trends 2024. This edition of our annual report continues our tradition of providing relevant attacker and defender metrics, and insights into the latest attacker tactics, techniques and procedures, along with guidance and best practices on how organizations and defenders should be responding to threats.
This year\'s M-Trends report covers Mandiant Consulting investigations of targeted attack activity conducted between January 1, 2023 and December 31, 2023. During that time, many of our observations demonstrate a more concerted effort by attackers to evade detection, and remain undetected on systems for longer periods of time:
Increased targeting of edge devices, and platforms that traditionally lack endpoint detection and response solutions.
A more than 50% growth in zero-day usage over the same reporting period in 2022, both by espionage groups as well as financially-motivated attackers.
More “living off the land,” or use of legitimate, pre-installed tools and software within an environment.
Despite the increased focus on evasion by attackers, we are pleased to report that defenders are generally continuing to improve at detecting threats. Dwell time represents the period an attacker is on a system from compromise to detection, and in 2023 the global median dwell time is now 10 days, down from 16 days in 2022. While various factors (such as ransomware) help drive down dwell time, it\'s still a big win for defenders. We can\'t let up, however. Mandiant red teams need only five to seven days on average to achieve their objectives, so organizations must remain vigilant. Other M-Trends 2024 metrics include:
54% of organizations first learned of a compromise from an external source (down from 63% in 2022), while 46% first identified evidence of a compromise internally.
Our engagements most frequently occurred at financial services organizations (17.3%), business and professional services (13.3%), high tech (12.4%), retail and hospitality (8.6%), healthcare (8.1%), and government (8.1%).
The most common initial infection vectors were exploits (38%), phishing (17%), prior compromise (15%), and stolen credentials (10%).
Additional topics covered in detail in M-Trends 2024 include Chinese espionage operations targeting the visibility gap, the evolution of phishing amid shifting security controls, the use of adversary-in-the-middle to overcome multi-factor authentication, cloud intrusion trends, an |
Tool Vulnerability Threat Medical Cloud | ★★★★ | |
|
2024-04-22 14:00:00 | Niveaux FAKENET-NG: Présentation de la sortie interactive basée sur HTML FakeNet-NG Levels Up: Introducing Interactive HTML-Based Output (lien direct) |
Written by: Beleswar Prasad Padhi, Tina Johnson, Michael Bailey, Elliot Chernofsky, Blas Kojusner
FakeNet-NG is a dynamic network analysis tool that captures network requests and simulates network services to aid in malware research. The FLARE team is committed to maintaining and updating the tool to improve its capabilities and usability. FakeNet is compatible across platforms and extensively customizable; however, we recognized a need to present captured network data in a more intuitive and user-friendly way to help you quickly identify relevant Network-Based Indicators (NBIs). To address this challenge and further enhance the usability, we extended FakeNet-NG to generate HTML-based output that enables you to view, explore, and share captured network data. This feature was implemented by Beleswar Prasad Padhi as part of a Google Summer of Code (GSoC) project that the Mandiant FLARE team mentored in 2023. To learn more about the program and our open-source contributors, check out the introductory post. Interactive HTML-Based Output FakeNet-NG\'s new interactive output is backed by an HTML page coupled with inline CSS and Javascript. Figure 1 shows the new HTML-based output and Figure 2 shows FakeNet-NG\'s existing text-based output. 
Figure 1: FakeNet-NG\'s new HTML-based output
Figure 2: FakeNet-NG\'s text-based output
FakeNet-NG generates each report using a |
Malware Tool Cloud | ★★ | |
|
2024-04-17 10:00:00 | Unearthing APT44: Russia\'s Notorious Cyber Sabotage Unit Sandworm (lien direct) | Written by: Gabby Roncone, Dan Black, John Wolfram, Tyler McLellan, Nick Simonian, Ryan Hall, Anton Prokopenkov, Luke Jenkins, Dan Perez, Lexie Aytes, Alden Wahlstrom
With Russia\'s full-scale invasion in its third year, Sandworm (aka FROZENBARENTS) remains a formidable threat to Ukraine. The group\'s operations in support of Moscow\'s war aims have proven tactically and operationally adaptable, and as of today, appear to be better integrated with the activities of Russia\'s conventional forces than in any other previous phase of the conflict. To date, no other Russian government-backed cyber group has played a more central role in shaping and supporting Russia\'s military campaign. Yet the threat posed by Sandworm is far from limited to Ukraine. Mandiant continues to see operations from the group that are global in scope in key political, military, and economic hotspots for Russia. Additionally, with a record number of people participating in national elections in 2024, Sandworm\'s history of attempting to interfere in democratic processes further elevates the severity of the threat the group may pose in the near-term. Given the active and diffuse nature of the threat posed by Sandworm globally, Mandiant has decided to graduate the group into a named Advanced Persistent Threat: APT44. As part of this process, we are releasing a report, “APT44: Unearthing Sandworm”, that provides additional insights into the group\'s new operations, retrospective insights, and context on how the group is adjusting to support Moscow\'s war aims. Key Findings Sponsored by Russian military intelligence, APT44 is a dynamic and operationally mature threat actor that is actively engaged in the full spectrum of espionage, attack, and influence operations. While most state-backed threat groups tend to specialize in a specific mission such as collecting intelligence, sabotaging networks, or conducting information operations, APT44 stands apart in how it has honed each of these capabilities and sought to integrate them into a unified playbook over time. Each of these respective components, and APT44\'s efforts to blend them for combined effect, are foundational to Russia\'s guiding “information confrontation” concept for cyber warfare. 
Figure 1: APT44\'s spectrum of operations
APT44 has aggressively pursued a multi- |
Malware Tool Threat Mobile Cloud | NotPetya | ★★ |
|
2024-04-04 14:00:00 | Cutting avant, partie 4: Ivanti Connect Secure VPN Post-Exploitation Mouvement latéral Études de cas Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies (lien direct) |
Written by: Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Chew, Billy Wong, Tyler McLellan
Since the initial disclosure of CVE-2023-46805 and CVE-2024-21887 on Jan. 10, 2024, Mandiant has conducted multiple incident response engagements across a range of industry verticals and geographic regions. Mandiant\'s previous blog post, Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts, details zero-day exploitation of CVE-2024-21893 and CVE-2024-21887 by a suspected China-nexus espionage actor that Mandiant tracks as UNC5325. This blog post, as well as our previous reports detailing Ivanti exploitation, help to underscore the different types of activity that Mandiant has observed on vulnerable Ivanti Connect Secure appliances that were unpatched or did not have the appropriate mitigation applied. Mandiant has observed different types of post-exploitation activity across our incident response engagements, including lateral movement supported by the deployment of open-source tooling and custom malware families. In addition, we\'ve seen these suspected China-nexus actors evolve their understanding of Ivanti Connect Secure by abusing appliance-specific functionality to achieve their objectives. As of April 3, 2024, a patch is readily available for every supported version of Ivanti Connect Secure affected by the vulnerabilities. We recommend that customers follow Ivanti\'s latest patching guidance and instructions to prevent further exploitation activity. In addition, Ivanti released a new enhanced external integrity checker tool (ICT) to detect potential attempts of malware persistence across factory resets and system upgrades and other tactics, techniques, and procedures (TTPs) observed in the wild. We also released a remediation and hardening guide |
Malware Tool Vulnerability Threat Studies Mobile Cloud | Guam | ★★★ |
|
2024-03-26 22:00:00 | Tendances les jours zéro exploités dans le monde en 2023 Trends on Zero-Days Exploited In-the-Wild in 2023 (lien direct) |
Written by: Maddie Stone, Jared Semrau, James Sadowski
Combined data from Google\'s Threat Analysis Group (TAG) and Mandiant shows 97 zero-day vulnerabilities were exploited in 2023; a big increase over the 62 zero-day vulnerabilities identified in 2022, but still less than 2021\'s peak of 106 zero-days. This finding comes from the first-ever joint zero-day report by TAG and Mandiant. The report highlights 2023 zero-day trends, with focus on two main categories of vulnerabilities. The first is end user platforms and products such as mobile devices, operating systems, browsers, and other applications. The second is enterprise-focused technologies such as security software and appliances. Key zero-day findings from the report include: Vendors\' security investments are working, making certain attacks harder. Attacks increasingly target third-party components, affecting multiple products. Enterprise targeting is rising, with more focus on security software and appliances. Commercial surveillance vendors lead browser and mobile device exploits. People\'s Republic of China (PRC) remains the top state-backed exploiter of zero-days. Financially-motivated attacks proportionally decreased. Threat actors are increasingly leveraging zero-days, often for the purposes of evasion and persistence, and we don\'t expect this activity to decrease anytime soon. Progress is being made on all fronts, but zero-day vulnerabilities remain a major threat. A Look Back - 2023 Zero-Day Activity at a Glance Barracuda ESG: CVE-2023-2868 Barracuda disclosed in May 2023 that a zero-day vulnerability (CVE-2023-2868) in their Email Security Gateway (ESG) had been actively exploited since as early as October 2022. Mandiant investigated and determined that UNC4841, a suspected Chinese cyber espionage actor, was conducting attacks across multiple regions and sectors as part of an espionage campaign in support of the PRC. Mandiant released a blog post with findings from the initial investigation, a follow-up post with more details as the investigation continued |
Vulnerability Threat Mobile Cloud Technical | ★★ | |
|
2024-03-22 00:00:00 | APT29 Uses WINELOADER to Target German Political Parties (lien direct) | Written by: Luke Jenkins, Dan Black
Executive Summary In late February, APT29 used a new backdoor variant publicly tracked as WINELOADER to target German political parties with a CDU-themed lure. This is the first time we have seen this APT29 cluster target political parties, indicating a possible area of emerging operational focus beyond the typical targeting of diplomatic missions. Based on the SVR\'s responsibility to collect political intelligence and this APT29 cluster\'s historical targeting patterns, we judge this activity to present a broad threat to European and other Western political parties from across the political spectrum. Please see the Technical Annex for technical details and MITRE ATT&CK techniques, (T1543.003, T1012, T1082, T1134, T1057, T1007, T1027, T1070.004, T1055.003 and T1083) Threat Detail In late February 2024, Mandiant identified APT29 - a Russian Federation backed threat group linked by multiple governments to Russia\'s Foreign Intelligence Service (SVR) - conducting a phishing campaign targeting German political parties. Consistent with APT29 operations extending back to 2021, this operation leveraged APT29\'s mainstay first-stage payload ROOTSAW (aka EnvyScout) to deliver a new backdoor variant publicly tracked as WINELOADER. Notably, this activity represents a departure from this APT29 initial access cluster\'s typical remit of targeting governments, foreign embassies, and other diplomatic missions, and is the first time Mandiant has seen an operational interest in political parties from this APT29 subcluster. Additionally, while APT29 has previously used lure documents bearing the logo of German government organizations, this is the first instance where we have seen the group use German-language lure content - a possible artifact of the targeting differences (i.e. domestic vs. foreign) between the two operations. Phishing emails were sent to victims purporting to be an invite to a dinner reception on 01 March bearing a logo from the Christian Democratic Union (CDU), a major political party in Germany (see Figure 1). The German-language lure document contains a phishing link directing victims to a malicious ZIP file containing a ROOTSAW dropper hosted on an actor-controlled compromised website “https://waterforvoiceless[.]org/invite.php”. ROOTSAW delivered a second-stage CDU-themed lure document and a next stage WINELOADER payload retrieved from “waterforvoiceless[.]org/util.php”. WINELOADER was first observed in operational use in late January 2024 in an operation targeting likely diplomatic entities in Czechia, Germany, India, Italy, Latvia, and Peru. The backdoor contains several features and functions that overlap with several known APT29 malware families including BURNTBATTER, MUSKYBEAT and BEATDROP, indicating they are likely created by a common developer (see Technical Annex for additional details). |
Malware Threat Cloud Technical | APT 29 | ★★★ |
|
2024-03-21 00:00:00 | Bringing Access Back - Initial Access Brokers Exploit F5 BIG-IP (CVE-2023-46747) and ScreenConnect (lien direct) | Written by: Michael Raggi, Adam Aprahamian, Dan Kelly, Mathew Potaczek, Marcin Siedlarz, Austin Larsen
During the course of an intrusion investigation in late October 2023, Mandiant observed novel N-day exploitation of CVE-2023-46747 affecting F5 BIG-IP Traffic Management User Interface. Additionally, in February 2024, we observed exploitation of Connectwise ScreenConnect CVE-2024-1709 by the same actor. This mix of custom tooling and the SUPERSHELL framework leveraged in these incidents is assessed with moderate confidence to be unique to a People\'s Republic of China (PRC) threat actor, UNC5174. Mandiant assesses UNC5174 (believed to use the persona "Uteus") is a former member of Chinese hacktivist collectives that has since shown indications of acting as a contractor for China\'s Ministry of State Security (MSS) focused on executing access operations. UNC5174 has been observed attempting to sell access to U.S. defense contractor appliances, UK government entities, and institutions in Asia in late 2023 following CVE-2023-46747 exploitation. In February 2024, UNC5174 was observed exploiting ConnectWise ScreenConnect vulnerability (CVE-2024-1709) to compromise hundreds of institutions primarily in the U.S. and Canada. Targeting and Timeline UNC5174 has been linked to widespread aggressive targeting and intrusions of Southeast Asian and U.S. research and education institutions, Hong Kong businesses, charities and non-governmental organizations (NGOs), and U.S. and UK government organizations during October and November 2023, as well as in February 2024. The actor appears primarily focused on executing access operations. Mandiant observed UNC5174 exploiting various vulnerabilities during this time. ConnectWise ScreenConnect Vulnerability CVE-2024-1709 F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability CVE-2023-46747 Atlassian Confluence CVE-2023-22518 Linux Kernel Exploit CVE-2022-0185 Zyxel Firewall OS Command Injection Vulnerability CVE-2022-30525 Investigations revealed several instances of UNC5174 infrastructure, exposing the attackers\' bash command history. This history detailed artifacts of extensive reconnaissance, web application fuzzing, and aggressive scanning for vulnerabilities on internet-facing systems belonging to prominent universities in the U.S., Oceania, and Hong Kong regions. Additionally, key strategic targets like think tanks in the U.S. and Taiwan were identified; however, Mandiant does not have significant evidence to determine successful exploitation of these targets. 
Figure 1: UNC5174 global targeting map
Initial Disclosure of CVE-2023-46747
On Oct. 25, 2023, Praetorian published an advisory and proof-of-concept (PoC) for a zero-day (0-day) vulnerabil |
Malware Tool Vulnerability Threat Cloud | ★★★ | |
|
2024-02-21 00:00:00 | Dévoiler l'évaluation de l'échéance du programme d'intelligence de cyber-menace de Maniant Unveiling Mandiant\\'s Cyber Threat Intelligence Program Maturity Assessment (lien direct) |
Dans le cadre de l'engagement continu de Google Cloud \\ à améliorer l'état global de cybersécurité pour la société, Mandiant publie aujourd'hui publiquement un Discovery des capacités d'intelligence basées sur les web (ICD) pour aider les organisations commerciales et gouvernementales à évaluerLa maturité de leur programme d'intelligence cyber-menace (CTI).La CIM est conçue pour fournir aux praticiens de la cybersécurité et aux dirigeants du renseignement des menaces une estimation de la façon dont le programme CTI \\ de l'organisation crée un impact organisationnel positif et réduit le risque pour l'entreprise.La CIM joue un critique
As part of Google Cloud\'s continuing commitment to improving the overall state of cybersecurity for society, today Mandiant is publicly releasing a web-based Intelligence Capability Discovery (ICD) to help commercial and governmental organizations evaluate the maturity of their cyber threat intelligence (CTI) program. The ICD is designed to provide cyber security practitioners and threat intelligence leaders with an estimate of how effectively and efficiently the organization\'s CTI program is creating a positive organizational impact and reducing risk for the business. The ICD plays a critical |
Threat Cloud Commercial | ★★★ | |
|
2024-01-30 20:30:00 | Évolution de UNC4990: Découvrir les profondeurs cachées de USB MALWARE \\ Evolution of UNC4990: Uncovering USB Malware\\'s Hidden Depths (lien direct) |
Défense gérée mandiante Suivi unc4990 , un acteur qui utilise fortement les périphériques USB pour l'infection initiale.UNC4990 cible principalement les utilisateurs basés en Italie et est probablement motivé par un gain financier.Nos recherches montrent que cette campagne est en cours depuis au moins 2020. malgré son apparition sur la tactique séculaire de l'armement USBDrives, UNC4990 continue d'évoluer leurs outils, tactiques et procédures (TTPS).L'acteur est passé de l'utilisation de fichiers texte codés apparemment bénins à l'hébergement de charges utiles sur des sites Web populaires tels que Ars Technica, Github, Gitlab et Vimeo. Les services légitimes abusés par
Mandiant Managed Defense has been tracking UNC4990, an actor who heavily uses USB devices for initial infection. UNC4990 primarily targets users based in Italy and is likely motivated by financial gain. Our research shows this campaign has been ongoing since at least 2020.Despite relying on the age-old tactic of weaponizing USB drives, UNC4990 continues to evolve their tools, tactics and procedures (TTPs). The actor has moved from using seemingly benign encoded text files to hosting payloads on popular websites such as Ars Technica, GitHub, GitLab, and Vimeo.The legitimate services abused by |
Malware Tool Cloud | ★★★★ | |
|
2024-01-10 22:00:00 | Des centaines de milliers de dollars d'actifs de crypto-monnaie Solana volés lors de récentes campagnes de draineur Clinksink Hundreds of Thousands of Dollars Worth of Solana Cryptocurrency Assets Stolen in Recent CLINKSINK Drainer Campaigns (lien direct) |
Le 3 janvier 2024, le compte de médias sociaux de Mandiant \\ a été repris et utilisé par la suite pour distribuer des liens vers une page de phishing de drainage de crypto-monnaie.En travaillant avec X, nous avons pu reprendre le contrôle du compte et, sur la base de notre enquête sur les jours suivants, nous n'avons trouvé aucune preuve d'activité malveillante ou de compromis de, tous les systèmes de cloud mandiant ou Google qui ont conduit au compromis de cettecompte.Le billet de blog suivant fournit un aperçu supplémentaire de Draineur Levé dans cette campagne, que nous avons surnommé Clinksink. De nombreux acteurs ont mené des campagnes depuis
On January 3, 2024, Mandiant\'s X social media account was taken over and subsequently used to distribute links to a cryptocurrency drainer phishing page. Working with X, we were able to regain control of the account and, based on our investigation over the following days, we found no evidence of malicious activity on, or compromise of, any Mandiant or Google Cloud systems that led to the compromise of this account. The following blog post provides additional insight into the drainer leveraged in this campaign, which we have dubbed CLINKSINK.Numerous actors have conducted campaigns since |
Cloud | ★★★ | |
|
2023-08-03 11:30:00 | Le rapport sur les horizons de menace d'août 2023 fournit des informations et des recommandations axées sur la cybersécurité axées August 2023 Threat Horizons Report Provides Cloud-Focused Cybersecurity Insights and Recommendations (lien direct) |
Le rapport Google Cloud Keners Horizons a été lancé pour la première fois en novembre 2021 dans le but ultime de fournir aux décideurs de sécurité des informations stratégiques sur les menaces pour les utilisateurs des entreprises dans le cloud, ainsi que les données, les métriques, les tendances et les recherches supplémentaires sur le cloud.Peut-être plus important encore, le rapport visait à fournir des recommandations des équipes de renseignement et de sécurité de Google \\ pour aider les défenseurs à protéger, à détecter et à répondre aux derniers cloud et autres menaces.
Aujourd'hui marque la sortie de la septième édition de notre publication trimestrielle, août 2023 Rapport des horizons de menace , Et notre
The Google Cloud Threat Horizons Report first launched in November 2021 with the ultimate goal of providing security decision-makers with strategic intelligence about threats to cloud enterprise users, along with data, metrics, trends, and additional cloud research. Perhaps most importantly, the report aimed to provide recommendations from Google\'s intelligence and security teams to help defenders protect against, detect, and respond to the latest cloud and other threats. Today marks the release of the seventh edition of our quarterly publication, August 2023 Threat Horizons Report, and our |
Threat Cloud | ★★★ | |
|
2023-05-16 09:00:00 | Échange de sim et abus de la console de série Microsoft Azure: la série fait partie d'une attaque bien équilibrée SIM Swapping and Abuse of the Microsoft Azure Serial Console: Serial Is Part of a Well Balanced Attack (lien direct) |
En 2022, l'activité d'attaquant a identifié Mandiant centré dans Microsoft Azure que mandiant a attribué à UNC3944.L'enquête de Mandiant \\ a révélé que l'attaquant utilisait une utilisation malveillante du Consoleserial sur Azure Virtual Machines (VM) pour installer un logiciel de gestion à distance tiers dans les environnements clients.Cette méthode d'attaque était unique en ce qu'elle a évité de nombreuses méthodes de détection traditionnelles utilisées dans Azure et a fourni à l'attaquant un accès administratif complet à la machine virtuelle.Malheureusement, les ressources cloud sont souvent mal comprises, conduisant à des erreurs de configuration qui
In 2022, Mandiant identified attacker activity centered in Microsoft Azure that Mandiant attributed to UNC3944. Mandiant\'s investigation revealed that the attacker employed malicious use of the Serial Console on Azure Virtual Machines (VM) to install third-party remote management software within client environments. This method of attack was unique in that it avoided many of the traditional detection methods employed within Azure and provided the attacker with full administrative access to the VM. Unfortunately, cloud resources are often poorly misunderstood, leading to misconfigurations that |
Cloud | ★★ | |
|
2023-05-12 08:30:00 | Partners de mission pour la sécurité multicloud Mission Partners for Multicloud Security (lien direct) |
Le gouvernement américain a fait de grands progrès pour reconnaître et accepter l'importance de la technologie cloud.Cet engagement et se concentrer sur les infrastructures cloud pour améliorer la sécurité nationale et accélérer la résilience des infrastructures critiques est démontrée dans les clés de la stratégie nationale de cybersécurité de l'administration Biden \\.Google, maintenant avec Mandiant, a et continuera d'être un partenaire clé du gouvernement américain pour l'innovation et le leadership cloud.En l'occurrence dans les domaines de la prévention de la violence aux infrastructures américaines, de la modernisation des systèmes fédéraux, de l'infrastructure critique
The U.S. government has made great strides to acknowledge and embrace the importance of cloud technology. This commitment to and focus on cloud infrastructure to enhance national security and accelerate critical infrastructure resilience is demonstrated in key pillars of The Biden Administration\'s National Cybersecurity Strategy. Google, now together with Mandiant, has and will continue to be a key partner to the U.S. government for cloud innovation and leadership. As focus in the areas of U.S. infrastructure abuse prevention, Federal systems modernization, critical infrastructure |
Cloud | ★★ | |
|
2023-05-04 09:30:00 | Nouvelles intégrations d'intelligence de menace mandiante pour MISP, Splunk Siem et Soar, et Cortex Xsoar par Palo Alto Networks New Mandiant Threat Intelligence Integrations for MISP, Splunk SIEM and SOAR, and Cortex XSOAR by Palo Alto Networks (lien direct) |
Les professionnels de la sécurité sont souvent submergés par le nombre de consoles de gestion ou de plates-formes dont ils ont besoin pour sauter un jour donné.L'automatisation et le partage d'informations sur les flux de travail existants peuvent décharger ces équipes en éliminant les tâches banales et en réduisant l'erreur humaine.
Les intégrations SaaS mandiant gagnent du temps et aident à rendre les équipes de sécurité plus proactives.L'API de renseignement Mandiant Threat permet aux équipes de sécurité d'intégrer Intelligence de menace mandiante Données directement dans leurs outils de sécurité et flux de travail existants.
dans le cadre de notre engagement en cours à aider les équipes de sécurité à travailler
Security professionals are often overwhelmed by the number of management consoles or platforms they need to jump between on any given day. Automating and sharing information into existing workflows can unburden these teams by eliminating mundane tasks and reducing human error. Mandiant SaaS integrations save time and help make security teams more proactive. The Mandiant Threat Intelligence API allows security teams to integrate Mandiant Threat Intelligence data directly into their existing security tools and workflows. As part of our ongoing commitment to helping security teams work |
Tool Threat Cloud | ★★ | |
|
2023-05-03 09:00:00 | Nuageux avec une chance de mauvais journaux: configurations de journaux de plate-forme cloud à considérer dans les enquêtes Cloudy with a Chance of Bad Logs: Cloud Platform Log Configurations to Consider in Investigations (lien direct) |
De plus en plus d'organisations utilisent la technologie cloud pour les applications, le stockage de fichiers, etc.Cependant, si un attaquant compromet un environnement cloud, les organisations peuvent ne pas savoir comment enquêter sur ces technologies, ou peut même ne pas enregistrer les preuves qui pourraient permettre à l'organisation d'identifier ce qu'un attaquant a fait.
Ce billet de blog décrit un scénario hypothétique d'un compromis de plate-forme cloud avec plusieurs composants qui nécessiteraient une enquête.Chaque composant est un exemple d'une véritable tactique d'intrusion que Mandiant a étudié sur diverses plates-formes cloud, parfois
More and more organizations utilize cloud technology for applications, file storage, and more. However, if an attacker compromises a cloud environment, organizations may not know how to investigate those technologies, or may not even be logging the evidence that could allow the organization to identify what an attacker did. This blog post describes a hypothetical scenario of a cloud platform compromise with multiple components that would require investigation. Each component is an example of a real intrusion tactic that Mandiant has investigated across various cloud platforms, sometimes |
Cloud | ★★★ | |
|
2023-02-28 16:30:00 | Perspectives mandiantes de la Munich Cyber Security Conference 2023 Mandiant Perspectives from the Munich Cyber Security Conference 2023 (lien direct) |
Les cyber-capacités sont un outil de plus en plus important de Statecraft avec les opérations d'aujourd'hui reflétant de plus en plus les ambitions stratégiques et géopolitiques des sponsors gouvernementaux.Il est essentiel de connecter les défenseurs et les décideurs du réseau.
La Conférence de cybersécurité de Munich (MCSC) fournit donc un échange de bienvenue pour discuter des défis naissants auxquels la communauté de la cybersécurité est confrontée.La vice-présidente de l'intelligence mandiante Sandra Joyce et Google Cloud Ciso Phil Venables ont pris la parole lors de l'événement de cette année.
Ce billet de blog décrit les plats à retenir de MCSC 2023 et comment mandiant, maintenant une pièce
Cyber capabilities are an increasingly important tool of statecraft with today\'s operations increasingly reflecting the strategic and geopolitical ambitions of government sponsors. This makes it essential to connect network defenders and policymakers. The Munich Cyber Security Conference (MCSC), therefore, provides a welcome exchange to discuss nascent challenges facing the cyber security community. Both Mandiant Intelligence VP Sandra Joyce, and Google Cloud CISO Phil Venables spoke at this year\'s event. This blog post outlines key takeaways from MCSC 2023 and how Mandiant, now a part |
Tool Cloud Conference | ★★ | |
|
2023-02-01 15:00:00 | Ajouter une visibilité du nuage à votre programme de gestion de surface d'attaque Add Cloud Visibility to Your Attack Surface Management Program (lien direct) |
La surface d'attaque externe se développe au-delà du DNS et des domaines pour inclure des ressources et des applications hébergées dans le nuage.Pour les organisations ayant des empreintes sur site et dans deux ou plusieurs environnements cloud, la réalisation d'une visibilité continue et centralisée de tous les actifs possédés est lourd, ce qui a conduit les équipes de sécurité à basculer entre les consoles pour bricoler ensemble une vue de la surface d'attaque.
Ajoutant au défi, l'accélération de l'adoption des nuages a donné un nombre croissant de applications entrant des instances de cloud avant que l'équipe de sécurité puisse les évaluer pour le risque . observations du monde réel indic
The external attack surface expands beyond DNS and domains to include resources and applications hosted in the cloud. For organizations with footprints on-prem and in two or more cloud environments, achieving continuous and centralized visibility of all owned assets is cumbersome, leading security teams to toggle between consoles to cobble together a view of the attack surface. Adding to the challenge, the acceleration of cloud adoption has yielded an increasing number of applications entering cloud instances before the security team can assess them for risk. Real-world observations indic |
Cloud | ★★★ | |
|
2023-01-12 18:00:00 | Donner un sens à la gestion externe de la surface des attaques: l'état actuel et futur de la catégorie Making Sense of External Attack Surface Management: The Current and Future State of the Category (lien direct) |
La catégorie externe de gestion de la surface d'attaque (EASM) a vu le jour alors que les fournisseurs de sécurité ont cherché à améliorer les lacunes de la visibilité des actifs et de l'énumération de la vulnérabilité créée par l'héritageDes outils qui n'ont pas réussi à s'adapter à l'évolution de la dynamique de l'informatique et à la croissance des écosystèmes numériques.Parmi les défis liés à la visibilité sur les actifs inconnus, les organisations sont confrontées au risque introduit par les actifs tiers, y compris les applications.Le Équipe d'action de cybersécurité Google (GCAT) prédit des actifs et des dépendances tiers dans le cloud nécessitera des mises à jour de la gestion des risques
The external attack surface management (EASM) category came into existence as security vendors sought to improve the gaps in asset visibility and vulnerability enumeration created by legacy tools that failed to adapt to the evolving dynamics of enterprise IT and the growth of digital ecosystems. Among challenges with gaining visibility into unknown assets, organizations are faced with risk introduced by third party assets, including applications. The Google Cybersecurity Action Team (GCAT) predicts third-party assets and dependencies within the cloud will necessitate updates to risk management |
Tool Vulnerability Cloud | ★★★ | |
|
2023-01-11 15:00:00 | Annonçant la menace prête avec mandiant Announcing Threat Ready with Mandiant (lien direct) |
Les experts mandiants utilisent des données et des idées glanées à partir de leurs expériences de réponse aux incidents de première ligne pour informer nos services et solutions.Ces expériences combinées à l'intelligence de menace de Mandiant \\ sont au cœur de menace prête avec mandiant , une nouvelle offre de Google Cloud . La menace prête avec Mandiant permet aux organisations de protéger ce qui compte le plus pour leur entreprise, et d'avoir également accès aux experts mandiants pour répondre aux violations et aider à durcir leur environnement contre les menaces actives.
menace prête avec mandiant est disponible pour les clients de Google Cloud et les clients fonctionnant sur
Mandiant experts use data and insights gleaned from their frontline incident response experiences to inform our services and solutions. Those experiences combined with Mandiant\'s threat intelligence are at the core of Threat Ready with Mandiant, a new offering from Google Cloud. Threat Ready with Mandiant allows organizations to protect what matters most to their business, and also have access to Mandiant experts to respond to breaches and to help harden their environments against active threats. Threat Ready with Mandiant is available to both Google Cloud customers and customers running on |
Threat Cloud | ★★★ | |
|
2022-11-16 19:00:00 | Plus intelligent, pas plus difficile: comment hiérarchiser intelligemment le risque de surface d'attaque Smarter, Not Harder: How to Intelligently Prioritize Attack Surface Risk (lien direct) |
Il y a un dicton commun dans la cybersécurité: «Vous ne pouvez pas protéger ce que vous ne savez pas», et cela s'applique parfaitement à la surface d'attaque d'une organisation donnée.
De nombreuses organisations ont des risques cachés tout au long de leur infrastructure informatique et de sécurité étendue.Que le risque soit introduit par la croissance du nuage organique, l'adoption de dispositifs IoT ou par des fusions et acquisitions, le risque caché est dormant.En conséquence, les équipes informatiques et de sécurité n'ont pas toujours une image à jour de l'écosystème étendu qu'ils doivent défendre.Les outils hérités ont souvent des listes statiques de l'inventaire des actifs \\ 'connu
There\'s a common saying in cyber security, “you can\'t protect what you don\'t know,” and this applies perfectly to the attack surface of any given organization. Many organizations have hidden risks throughout their extended IT and security infrastructure. Whether the risk is introduced by organic cloud growth, adoption of IoT devices, or through mergers and acquisitions, the hidden risk lies dormant. As a result, IT and security teams do not always have an up-to-date picture of the extended ecosystem they need to defend. Legacy tools often have static lists of the \'known\' asset inventory |
Tool Cloud | ★★★★ | |
|
2022-10-11 08:00:00 | Protection des risques numériques mandialiants pour les clients Splunk Enterprise Mandiant Digital Risk Protection for Splunk Enterprise Customers (lien direct) |
Une surface d'attaque d'une organisation \\ est en constante évolution à mesure que les empreintes numériques et l'adoption du cloud se développent, de nouvelles relations commerciales sont conçues et que les employés travaillent de n'importe où.En conséquence, chaque appareil, application, service réseau, fournisseur ou employé peut désormais être une cible pour le compromis initial dans le grand schéma d'une campagne d'acteur de menace.
Pour atténuer les risques, les équipes de sécurité ont besoin d'une visibilité sur la surface d'attaque mondiale et le Web profond et sombre.La visibilité requise comprend l'établissement et la surveillance d'un inventaire complet d'actifs (connu et inconnu), comment leur marque est discutée sur
An organization\'s attack surface is ever-changing as digital footprints and cloud adoption grow, new business relationships are conceived, and employees work from anywhere. As a result, every device, application, network service, supplier, or employee can now be a target for initial compromise in the grand scheme of a threat actor campaign. To mitigate risk, security teams need visibility into the global attack surface and deep and dark web. The required visibility includes establishing and monitoring a complete inventory of assets (known and unknown), how their brand is being discussed on |
Threat Cloud | ★★★ | |
|
2022-09-12 08:00:00 | Déplacer la mission vers l'avant: Mandiant rejoint Google Cloud Moving the Mission Forward: Mandiant Joins Google Cloud (lien direct) |
google \\ 's acquisition of Mandiant est désormais complet , marquant un grand moment pour notre équipe et pour la communauté de sécurité que nous servons.
Dans le cadre de Google Cloud, Mandiant a désormais une capacité beaucoup plus grande pour combler l'écart de sécurité créé parun nombre croissant d'adversaires.Au cours de mes 29 ans en première ligne de la sécurisation des réseaux, j'ai vu des criminels, des États-nations et de mauvais acteurs à faire nuire aux bonnes personnes.En combinant notre expertise et notre intelligence avec l'échelle et les ressources de Google Cloud, nous pouvons faire une grande différence dans la prévention et la lutte contre les cyberattaques, tout en pincement
Google\'s acquisition of Mandiant is now complete, marking a great moment for our team and for the security community we serve. As part of Google Cloud, Mandiant now has a far greater capability to close the security gap created by a growing number of adversaries. In my 29 years on the front lines of securing networks, I have seen criminals, nation states, and plain bad actors bring harm to good people. By combining our expertise and intelligence with the scale and resources of Google Cloud, we can make a far greater difference in preventing and countering cyber attacks, while pinpointing |
Cloud | ★★★ | |
|
2022-05-04 09:00:00 | Anciennes services, nouvelles astuces: abus de métadonnées du cloud par UNC2903 Old Services, New Tricks: Cloud Metadata Abuse by UNC2903 (lien direct) |
Depuis juillet 2021, Mandiant a identifié l'exploitation des applications Web accessibles au public par UNC2903 pour récolter et abuser des informations d'identification à l'aide du service d'instance d'Amazon \\ (IMD).Mandiant Tracked Access Tumps by UNC2903 pour accéder à des seaux S3 et des ressources cloud supplémentaires à l'aide des informations d'identification volées.Cet article de blog couvre comment UNC2903 a effectué l'exploitation et les abus IMD, ainsi que les meilleures pratiques connexes sur les techniques de durcissement du cloud.
Bien que les environnements de services Web Amazon Web ciblés UNC2903 (AWS), de nombreuses autres plates-formes cloud proposent des services de métadonnées similaires qui pourraient être à risque de
Since July 2021, Mandiant identified exploitation of public-facing web applications by UNC2903 to harvest and abuse credentials using Amazon\'s Instance Metadata Service (IMDS). Mandiant tracked access attempts by UNC2903 to access S3 buckets and additional cloud resources using the stolen credentials. This blog post covers how UNC2903 performed exploitation and IMDS abuse, as well as related best practices on cloud hardening techniques. Although UNC2903 targeted Amazon Web Services (AWS) environments, many other cloud platforms offer similar metadata services that could be at risk of |
Cloud | ★★★ | |
|
2022-03-09 18:00:00 | FedRamp Ready: La dernière désignation de Mandiant \\ prend en charge les clients du secteur public FedRAMP Ready: Mandiant\\'s Latest Designation Supports Public Sector Customers (lien direct) |
Dans une autre étape importante dans sa mission pour que chaque organisation soit sécurisée des cyber-menaces, Mandiant a récemment annoncé qu'il avait obtenu la désignation FedRamp Ready pour sa première solution évaluée, Mandiant Advantage Défense automatisée .Atteignant la préparation à Le niveau d'impact élevé, la défense automatisée est désormais disponible dans le FedRamp Marketplace En tant qu'offre de services cloud (CSO), permettant aux agences fédérales de profiter de ses capacités de détection, de priorisation et de réponse accélérées.
Qu'est-ce que FedRamp?
Fedramp est un Programme du gouvernement qui favorise l'adoption de
In yet another major milestone in its mission to make every organization secure from cyber threats, Mandiant recently announced that it achieved FedRAMP Ready designation for its first evaluated solution, Mandiant Advantage Automated Defense. Achieving readiness at the High impact level, Automated Defense is now available in the FedRAMP Marketplace as a Cloud Service Offering (CSO), allowing federal agencies to take advantage of its accelerated threat detection, prioritization and response capabilities. What is FedRAMP? FedRAMP is a government-wide program that promotes the adoption of |
Threat Cloud | ★★★ | |
|
2022-02-02 13:00:00 | Annonçant la gestion de la surface d'attaque mandiante avantage Announcing Mandiant Advantage Attack Surface Management (lien direct) |
Vous voulez sauter maintenant?Commencez avec Mandiant Advantage Attack Surface Management En créant votre Free Account aujourd'hui!
Alors que les organisations continuent de numériser leur entreprise et que les employés sont autorisés à tirer parti de ces capacités, il n'est pas étonnant que les équipes de sécurité aient du mal à garder une trace des infrastructures, des applications, des services cloud et du saasSeul s'assurer que les politiques de sécurité sont respectées dans ces environnements.La surface d'attaque est considérablement et largement en expansion, et sans l'automatisation appropriée, il est peu probable que les équipes de sécurité aient la visibilité, le contrôle et
Want to jump in now? Get started with Mandiant Advantage Attack Surface Management by creating your free account today! As organizations continue to digitize their business and employees are empowered to leverage these capabilities, it\'s no wonder security teams struggle to keep track of infrastructure, applications, cloud services and SaaS usage-let alone ensure security policies are adhered to across these environments. The attack surface is dramatically and vastly expanding, and without the proper automation, it is unlikely that security teams will have the visibility, control, and |
Cloud | ★★ | |
|
2021-12-14 16:00:00 | Azure Run Command pour les nuls Azure Run Command for Dummies (lien direct) |
Dans le récent article de blog de Mandiant \\, nous avons détaillé Activité d'intrusion russe présumée qui cible les fournisseurs de services gérés (MSP) pour accéder à leurs clients CLUSIDE \\ '.D'autres sociétés, comme Microsoft, ont observé Activité ciblée de manière similaire contre les clients de plusieurs Cloud et fournisseurs de services gérés . Une technique notable de ces intrusions est l'utilisation de commandes Azure Run pour passer latéralement des hyperviseurs gérés aux clients MSP \\ 'sous-jacent sous-jacentmachines virtuelles.
Ce dernier article de blog est une annexe supplémentaire pour mettre en surbrillance les commandes Azure Run et fournir
In Mandiant\'s recent blog post, we detailed suspected Russian intrusion activity that targeted managed services providers (MSP) to gain access to their customers\' cloud environments. Other companies, such as Microsoft, have observed similarly targeted activity against customers of several cloud and managed service providers. One notable technique from these intrusions is the use of Azure Run Commands to move laterally from managed hypervisors to the MSP customers\' underlying virtual machines. This latest blog post comes as a supplementary annex to highlight Azure Run Commands and provide |
Cloud | ★★ | |
|
2021-11-02 08:01:01 | Mandiant Data Science présente la dernière recherche sur l'apprentissage de la machine de sécurité à Camlis \\ '21 Mandiant Data Science Showcases Latest Security Machine Learning Research at CAMLIS \\'21 (lien direct) |
La mission de l'équipe de science des données mandialiants (MDS) est de développer des solutions d'apprentissage automatique innovantes qui appliquent l'expertise unique et l'intelligence des menaces de Maniant \\ à l'échelle pour nos clients.MDS est impliqué dans de nombreux projets divers dispensés dans le cadre de la Mandiant Advantage SaaS Platform, mais nous présentons égalementet publier des recherches de pointe à l'intersection de la sécurité et de l'apprentissage automatique lors des principales conférences de l'industrie et des universitaires.Nous sommes fiers d'annoncer que notre équipe a récemment eu quatre conférences acceptées au Conférence sur l'apprentissage appliqué en matière de sécurité de l'information (CAMLIS)
The Mandiant Data Science (MDS) team\'s mission is to develop innovative machine learning solutions that apply Mandiant\'s unique expertise and threat intelligence at scale for our customers. MDS is involved in many diverse projects delivered as part of the Mandiant Advantage SaaS platform, but we also present and publish cutting-edge research at the intersection of security and machine learning at leading industry and academic conferences. We are proud to announce that our team recently had four talks accepted at the Conference on Applied Machine Learning in Information Security (CAMLIS) |
Threat Cloud | ★★★ | |
|
2021-08-10 03:38:14 | Une mise à jour intrigante de l'avantage mandiant An Intriguing Update to Mandiant Advantage (lien direct) |
Aujourd'hui, Mandiant a fait une annonce significative dans la promotion des capacités de la plate-forme SaaS de mandiant avantage avec l'acquisition d'unEmerging Attack Surface Management (ASM) Leader, intrigue.Avec cette acquisition, nous nous réjouissons également de Jonathan Cran et de l'équipe d'intrigue auprès de la famille Mandiant.Nous sommes très heureux que Jonathan, un visionnaire et entrepreneur connu de l'industrie, se joigne à Maniant alors que nous continuons à développer nos capacités d'avantage.
ASM émerge rapidement, conduisant la valeur grâce à la visibilité des actifs et de l'exposition dans la surface d'attaque destinée à Internet.Il comble une lacune entre l'actif
Today Mandiant made a significant announcement in furthering the capabilities of the Mandiant Advantage SaaS platform with the acquisition of an emerging Attack Surface Management (ASM) leader, Intrigue. With this acquisition we also welcome Jonathan Cran and the Intrigue team to the Mandiant family. We are very excited to have Jonathan, a known industry visionary and entrepreneur, join Mandiant as we continue to build out our Advantage capabilities. ASM is quickly emerging, driving value through asset and exposure visibility in internet-facing attack surface. It fills a gap between asset |
Cloud | ★★★★ | |
|
2021-06-02 10:00:00 | Un nouvel avenir pour Fireeye et Mandiant: Accélération des opportunités A New Future for FireEye and Mandiant: Accelerating Opportunities (lien direct) |
avec ANNONCE D'AUJOURD'HUI De la vente de l'entreprise FireEye Products To Symphony Technology Group (STG), nous avons fait un pas en avant important pour nous aider à mieux servir nos clients et accélérer les stratégies qui sontDéfinir l'avenir de la cybersécurité.
La transaction séparera les produits de sécurité de Fireeye \\, des e-mails, des points de terminaison et des produits de sécurité cloud, ainsi que la plate-forme de gestion et d'orchestration de la sécurité connexe à partir de logiciels et services d'agnostiques mandiant solutions \\ '.Le résultat: les deux organisations seront en mesure d'accélérer les investissements en croissance, de poursuivre de nouvelles voies de mise sur le marché et
With today\'s announcement of the sale of the FireEye Products business to Symphony Technology Group (STG), we have taken an important step forward to help us better serve our customers and accelerate strategies that are defining the future of cyber security. The transaction will separate FireEye\'s network, email, endpoint, and cloud security products, and related security management and orchestration platform from Mandiant Solutions\' controls-agnostic software and services. The result: both organizations will be able to accelerate growth investments, pursue new go-to-market pathways, and |
Cloud | ★★★ | |
|
2020-07-30 14:00:00 | Obscurci par les nuages: aperçu des attaques du bureau 365 et comment la défense gérée mandiante enquête Obscured by Clouds: Insights into Office 365 Attacks and How Mandiant Managed Defense Investigates (lien direct) |
Avec les compromis par e-mail commerciaux (BECS) ne montrant aucun signe de ralentissement Comprendre les violations du bureau 365 (O365) et comment les enquêter correctement.Ce billet de blog est destiné à ceux qui n'ont pas encore plongé les orteils dans les eaux d'un O365 BEC, fournissant un cours intensif sur la suite de productivité cloud de Microsoft et son assortiment de journaux et de sources de données utiles aux enquêteurs.Nous allons également passer en revue les tactiques d'attaquant courantes que nous avons observées en répondant aux BEC et fournissant un aperçu de la façon dont les analystes de défense gérés mandiants abordent ces
With Business Email Compromises (BECs) showing no signs of slowing down, it is becoming increasingly important for security analysts to understand Office 365 (O365) breaches and how to properly investigate them. This blog post is for those who have yet to dip their toes into the waters of an O365 BEC, providing a crash course on Microsoft\'s cloud productivity suite and its assortment of logs and data sources useful to investigators. We\'ll also go over common attacker tactics we\'ve observed while responding to BECs and provide insight into how Mandiant Managed Defense analysts approach these |
Cloud | ★★★★ | |
|
2015-12-01 13:00:00 | Le groupe de cyber-menaces basé en Chine utilise Dropbox pour les communications de logiciels malveillants et cible les médias de Hong Kong China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets (lien direct) |
Fireeye Intelligence Centerfireeye Threat Intelligence Analysts a identifié une campagne de phishing de lance réalisée en août 2015 en ciblant les organisations de médias basées à Hong Kong.Un groupe de cyber-menaces basé en Chine, que Fireeye suit en tant que groupe de menaces persistantes avancé (APT) non classé et d'autres chercheurs appellent «admin @ 338», peut avoir mené l'activité. [1] Les e-mails contenaient des documents malveillants avec une charge utile malveillante appelée lowball.Lowball abuse du service de stockage cloud Dropbox pour la commande et le contrôle (CNC).Nous avons collaboré avec Dropbox pour enquêter sur la menace, et
FireEye Intelligence CenterFireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations. A China-based cyber threat group, which FireEye tracks as an uncategorized advanced persistent threat (APT) group and other researchers refer to as “admin@338,” may have conducted the activity.[1] The email messages contained malicious documents with a malware payload called LOWBALL. LOWBALL abuses the Dropbox cloud storage service for command and control (CnC). We collaborated with Dropbox to investigate the threat, and |
Malware Threat Cloud Technical | ★★★★ | |
|
2015-04-18 11:10:00 | Opération Russiandoll: Adobe & Windows Exploits zéro-day Probablement exploités par APT28 de Russie dans une attaque très ciblée Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia\\'s APT28 in Highly-Targeted Attack (lien direct) |
Fireeye Labs a récemment détecté une campagne APT limitée exploitant les vulnérabilités zéro-jours dans Adobe Flash et une toute nouvelle à Microsoft Windows.En utilisant le Dynamic Keen Intelligence Cloud (DTI) , les chercheurs de Fireeye ont détecté un modèle d'attaques commençant le 13 avril Th , 2015. Adobe a indépendamment corrigé la vulnérabilité (CVE-2015-3043) dans APSB15-06 .Grâce à la corrélation des indicateurs techniques et des infrastructures de commandement et de contrôle, FireEye évalue que l'APT28 est probablement responsable de cette activité.
Microsoft est conscient de la vulnérabilité d'escalade locale exceptionnelle dans Windows
FireEye Labs recently detected a limited APT campaign exploiting zero-day vulnerabilities in Adobe Flash and a brand-new one in Microsoft Windows. Using the Dynamic Threat Intelligence Cloud (DTI), FireEye researchers detected a pattern of attacks beginning on April 13th, 2015. Adobe independently patched the vulnerability (CVE-2015-3043) in APSB15-06. Through correlation of technical indicators and command and control infrastructure, FireEye assess that APT28 is probably responsible for this activity. Microsoft is aware of the outstanding local privilege escalation vulnerability in Windows |
Vulnerability Threat Cloud | APT 28 APT 28 | ★★★★ |
1
We have: 35 articles.
We have: 35 articles.
To see everything:
Our RSS (filtrered)
