CB Customer Spotlight: Q&A with Ritter Insurance Marketing’s Dan McLellan

Dan McLellan is a Network Support Specialist at Ritter Insurance Marketing, and uses the Carbon Black community to increase his security knowledge and share information with his colleagues. Having access to insights from other security professionals has not only shortened the time he spends tryin...

TAU Threat Intelligence Notification: BlackRouter Ransomware

According to the article from BleepingComputer, BlackRouter Ransomware was being promoted as a Ransomware-as-a-Service on Telegram by an Iranian developer. BlackRouter Ransomware will append ‘.BlackRouter’ as file extension to the encrypted file. In addition, it will attempt to delete volume shad...

Partner Perspectives: Beyond SIEM: Carbon Black + JASK Connected

Oren Arar is the Head of Alliances for JASK. The real-time integration of JASK & Carbon Black provides high-value alerts and extended contextual investigation insights to our joint customers, all within a cloud-native environment. Background The JASK Autonomous Security Operations Center ASOC...

HEVD pool overflow analysis-vulnerability warning-the black bar safety net

Prepare the environment Win 10 64-bit host + win 7 32-bit virtual machine Windbg: a debugger VirtualKD-3.0: double-click the debug tool InstDrv: the drive is installed, run the tool HEVD: a Windows kernel vulnerability training project, which almost covers the kernel may exist, all vulnerability...

Carbon Black TAU & ThreatSight Analysis: GandCrab and Ursnif Campaign

Summary Analysis conducted by Andrew Costis, Cathy Cramer, Emily Miner and Jared Myers. The Carbon Black ThreatSight team observed an interesting campaign over the last month. ThreatSight worked with the Threat Analysis Unit TAU to research the campaign. This report is being released to help...

Razer Synapse 3 Windows client local to mention the right vulnerability analysis-vulnerability warning-the black bar safety net

A, vulnerability introduction Razer Synapse（Ray cloud software installed in the system a service Razer Synapse Service, the service to NT AUTHORITY\SYSTEM permissions to run 会加载C:\ProgramData\Razer\目录中的多个.NET assembly. C:\ProgramData\Razer\and its subdirectories/files in the permissions aspect is...

Partner Perspectives: The Speed of Prevention – eSentire + Carbon Black

Editor's Note: This blog originally appeared on eSentire.com. Let’s start with a brief history lesson. In September 2016, eSentire and Carbon Black™ announced a strategic partnership in conjunction with launching esENDPOINT built on CB Response to augment our market-leading Managed Detection and...

TAU Threat Intelligence Notification – MongoLock Ransomware

Summary The new variant of MongoLock Ransomware will delete users’ files immediately instead of encrypting them. Upon execution, MongoLock will scan specific locations such as Desktop, Documents, or Recycle Bin Folders, then delete files and format the local disk drives. The following is the list...

Fortnite Hacked Via Insecure Single Sign-On

Epic Games patched a bug that could have allowed hackers to break into millions of Fortnite accounts and steal virtual currency or resell virtual goods. The vulnerability is tied to an insecure Fortnite application program interface API used by players to log into their accounts using third-party...

Partner Perspectives: Awake Security and Carbon Black Deliver Comprehensive Threat Detection and Response

Rudolph Araujo is the Vice President of Awake Security. Even relatively unsophisticated attackers today use tools, tactics and techniques that make them difficult to uncover. For instance, the use of non-malware tools, such as PowerShell, psexec and Python, places a burden on security teams to...

The world’s southernmost security conference

When asked about his best race, Ayrton Senna replied that it was when he raced karting cars. For him it was the best because it was only for the sake of sports and free from commercial sponsoring and commercial interests. I have this same feeling about computer security conferences, because they...

Session becomes unresponsive and application window is totally black after starting published AutoDesk Revit

Once user launches the published AutoDesk Revit, the previously launched application windows will hang and become totally black. All applications are locked in taskbar...

TAU Threat Intelligence Notification: Djvuu Ransomware

Summary Djvuu ransomware is believed to be a newer variant of the “Stop” ransomware strain, which was seen circulating in the early part of 2018. There are also similarities to the Goren-B trojan originally reported by Sophos back in 2016. Djvuu is likely to be delivered through phishing e-mail...

Christmas Day was Quiet for Online Retailers But Picked Up Immediately on Boxing Day

Christmas Holiday Retail Sales In early November, eMarketer forecast that the 2018 U.S. online retail holiday sales would be $106 billion, a healthy increase of 16.6% over 2017. The Black Friday & Cyber Monday sales results confirmed that optimistic forecast with a combined total of nearly $14b i...

Cybersecurity Skills Gap: “There’s No Silver Bullet to Solving the Problem” & Other Takeaways From the Toronto Global Forum

Last week, I ventured up to the beautiful city of Toronto — and while I’d love to go back for pleasure, this trip was strictly business. The Toronto Global Forum is an international conference that brings together heads of states, central bank governors, ministers and global economic decision...

Untainted By Design: How Our MITRE ATT&CK Results Demonstrate the Resilience of Carbon Black

I started my career in cybersecurity 10 years ago as a Technical Operations Officer in the US Intelligence Community, where I had a first-hand view into the most sophisticated ongoing cyber operations in the world. One thing was always clear: attackers always found ways to stay a step ahead of th...

WordPress Targeted with Clever SEO Injection Malware

A clever malware built for SEO injection – where a black hat loads up a webpage with spammy links, redirects and ad keywords, unbeknownst to the site owner – has been seen evading detection with an innovative approach that involves appending itself in an unusual place in the back-end code of a...

Twitter Abuse Toward Women Is Rampant, Amnesty Report Says

Frustrated by Twitter's silence on abuse, Amnesty International crowdsources its own data and finds that the platform is especially toxic for black women...

Russia's IRA Targeted Black Americans, Exploiting Racial Tensions

A new report documents how the Internet Research Agency had a much more sustained, deliberate focus on black Americans...

Partner Perspectives: Insight on Turla PNG Dropper

Editor's Note: This blog originally appeared on NCC Group's website. This is a short blog post on the PNG Dropper malware that has been developed and used by the Turla Group 1. The PNG Dropper was first discovered back in August 2017 by Carbon Black researchers. Back in 2017 it was being used to...