Russia Fails to Stop Alleged Hacker From Facing US Charges

The repercussions over custody and extradition of Aleksei Burkov have set off a geopolitical maelstrom...

NSA on the Future of National Cybersecurity

Glenn Gerstell, the General Counsel of the NSA, wrote a long and interesting op-ed for the New York Times where he outlined a long list of cyber risks facing the US. There are four key implications of this revolution that policymakers in the national security sector will need to address: The firs...

Let's Destroy Democracy

Election security through an adversary's eyes By Matt Olney. Executive summary Over the past few years, Cisco Talos has increasingly been involved in election security research and support, most recently supporting the Security Service of Ukraine in their efforts to secure the two Ukrainian...

Hard Pass: Declining APT34’s Invite to Join Their Professional Network

Background With increasing geopolitical tensions in the Middle East, we expect Iran to significantly increase the volume and scope of its cyber espionage campaigns. Iran has a critical need for strategic intelligence and is likely to fill this gap by conducting espionage against decision makers a...

Evil TeamViewer Attacks Under the Guise of the U.S. State Department

UPDATE A targeted, email-borne attack against embassy officials and government finance authorities globally is making use of a malicious attachment disguised as a top-secret U.S. document. It weaponizes TeamViewer, the popular remote-access and desktop-sharing software, to gain full control of th...

The APT Name Game: How Grim Threat Actors Get Goofy Monikers

What’s in a name? When it comes to advanced persistent threat groups, it is often quite a bit. While their monikers’ may seem whimsical – Fancy Bear, Nomadic Octopus, Ocean Lotus and Darkhotel – the reality is these are not arbitrary names. In fact, many are similar to schoolyard nicknames or a...

Carbon Black Global Threat Report: ‘The Year of the Next-Gen Cyberattack’

In 2016, fileless attacks such as PowerWare and the alleged hack against the Democratic National Committee DNC stole sensitive information and global headlines. In 2017, WannaCry, NotPetya and BadRabbit demonstrated ransomware’s global ubiquity. Then, as we kicked off 2018, the Spectre and Meltdo...

BLITZ! Like a Great Middle Linebacker, An Agile & Strong EDR Solution Can Quickly Respond to an Offensive Attack

As we near the close of 2018, we should appreciate that cyberspace has become an increasingly hostile landscape. Geoplitical tensions are manifesting in cyberspace and cyber criminals have become increasingly punitive this year. We at Carbon Black have observed some interesting trends: Vapor Worm...

Shamoon Attackers Employ New Tool Kit to Wipe Infected Systems

ARCHIVED STORY Shamoon Attackers Employ New Tool Kit to Wipe Infected Systems By Thomas Roccia · December 19, 2018 Last week the McAfee Advanced Threat Research team posted an analysis of a new wave of Shamoon “wiper” malware attacks that struck several companies in the Middle East and Europe. In...

Shamoon Attackers Employ New Tool Kit to Wipe Infected Systems

ARCHIVED STORY Shamoon Attackers Employ New Tool Kit to Wipe Infected Systems By Thomas Roccia · December 19, 2018 Last week the McAfee Advanced Threat Research team posted an analysis of a new wave of Shamoon “wiper” malware attacks that struck several companies in the Middle East and Europe. In...

NRCC Email Hack Highlights Lack of Visibility & Proactive Threat Hunting at Political Organizations

Earlier this week, Politico reported that the National Republican Congressional Committee NRCC suffered a major attack prior to the 2018 U.S. midterm elections, with thousands of sensitive emails from four senior aides exposed to an outside intruder. While the impact of this breach is still...

Carbon Black Report: Destructive Cyberattacks Increase Ahead of 2018 Midterm Elections

A trade war with China. A fragile agreement with North Korea. A growing fear of Russian hackers. Ahead of the 2018 U.S. midterm congressional elections, geopolitical conflict continues to play out in cyberspace. According to the world’s top incident response IR professionals, politically motivate...

Creating a Cyber Panic Room to Fight Off Invasions

Genghis Khan was a mastermind. A terrifyingly brilliant military strategist who altered the course of world history. He used fear to paralyze his enemies. “In one apocryphal account circulated to create anxiety among the enemy, the Mongols supposedly promised to retreat from a besieged city if th...

Carbon Black Report: 46% of Incident Response Professionals Experience Counter Incident Response

Quarterly Incident Response Threat Report Executive Summary/Highlights Proactive Incident Response Even as a steady drumbeat of headlines keeps the world’s attention focused on cybercrimes such as ransomware and cryptojacking, in the dark corners of the internet, attackers are busy refining their...

Carbon Black Report: China, Russia & North Korea Launching Sophisticated, Espionage-Focused Cyberattacks

Even as a steady drumbeat of headlines keeps the world’s attention focused on cybercrimes, such as ransomware and cryptojacking, in the dark corners of the internet, attackers are busy refining their craft. According to the world’s top incident response IR professionals, cyberattackers are honing...

Excerpts from Modern Bank Heists – Nation State Threats

Carbon Black recently published a report on the latest non-malware attack methods, and how to counteract them. For more information about how Cb Defense, Carbon Black's NGAV + EDR solution, helps enterprises address their endpoint security challenges, check out our weekly Cb Defense Live Demo,...

Zero-Day Flash Exploit Targeting Middle East

A zero-day vulnerability is being exploited in the wild in targeted attacks against Windows users in the Middle East, researchers warned Thursday. The Flash Player vulnerability CVE-2018-5002, a stack-based buffer overflow bug that could enable arbitrary code execution, was patched earlier today ...

SANNY Malware Delivery Method Updated in Recently Observed Attacks

Introduction In the third week of March 2018, through FireEye’s Dynamic Threat Intelligence, FireEye discovered malicious macro-based Microsoft Word documents distributing SANNY malware to multiple governments worldwide. Each malicious document lure was crafted in regard to relevant regional...

Iran-Linked Group ‘TEMP.Zagros’ Updates Tactics, Techniques In Latest Campaign

Researchers say a massive phishing campaign targeting Asia and Middle East regions is linked to an Iranian-based threat actor TEMP.Zagros, also known as MuddyWater. This latest attack illustrates an evolution by the threat actor, which has now adopted new tactics, techniques and procedures. “We...

Vermont Grid 'Hack' Latest Tumble Down Attribution Rabbit Hole

A Vermont utility was for a brief moment last week at the center of a geopolitical scandal in which the Russian government was implicated in an attack against a U.S. electric grid. As it turns out, a laptop at Burlington Electric Department was infected with the Neutrino Exploit Kit. There was no...