VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus

On February 14, 2020 the U.S. Department of Homeland Security DHS released a Malware Analysis Report MAR-10271944-1.v1 which provided information about a trojan they referred to as HotCroissant. DHS attributed the trojan to a threat group based in North Korea, often referred to as Hidden Cobra...

VMware Carbon Black Threat Analysis: FTCODE Ransomware

FTCODE is a fully PowerShell-based ransomware. It is distributed via malicious document files that contain macros or using VBScript to download and launch the malicious PowerShell script. FTCODE ransomware will scan a specific list of file extensions and encrypt them with Rijndael algorithm. Othe...

How To Build a Better Bug Bounty Program

Editor’s Note: Sam Bocetta, a guest author on the Carbon Black blog, is a freelance journalist specializing in U.S. diplomacy and national security, with emphases on technology trends in cyber warfare, cyber defense, and cryptography. Every software company in the world, regardless of whether the...

With the Predictive Security Cloud (PSC) Leading the Way, Carbon Black is Named One the “Coolest 20 Vendors in Endpoint Security” by CRN

Editor’s Note: Victor Baez, Carbon Black’s VP of WW Channel and this blog’s author, was recently named a 2018 CRN Channel Chief. As part of CRN's annual Security 100 list, 20 endpoint companies have been named “Coolest Endpoint Security Vendors of 2018.” Carbon Black is among them. We are honored...

August 10, 2017 – Morning Cyber Coffee Headlines – “PGA Championship” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 10, 2017 - Headlines One easy thing your agency can do to attract more...

August 7, 2017 – Morning Cyber Coffee Headlines – “Teddy Roosevelt” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 5, 2017 - Headlines Ransomware can cost firms over $700,000; cloud...

July 17, 2017 – Morning Cyber Coffee Headlines – “Roger Federer” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 17, 2017 - Headlines Carbon Black in the News: Threat Hunting – Pursue You...

Congratulations to our Query of the Month Winner for June 2019!

Last month, we launched our Query of The Month competition, which recognizes the top community-shared query that provides value to other Osquery users. To determine the query of the month, our team selects the community-shared query that has the most engagement or helps solve an important problem...

Carbon Black’s Global Incident Response Threat Report: The Ominous Rise of “Island Hopping” & Counter Incident Response Continues

To stay abreast of the current attack landscape and to quantify the latest attack trends seen by leading IR firms, Carbon Black is publishing its third Global Incident Response Threat Report GIRTR since introducing it in July 2018. Aggregating qualitative and quantitative input from 40 Carbon Bla...

CB Threat Intelligence Notification: Vidar InfoStealer Trojan Aims to Steal Data Before Erasing Itself

Vidar is an info stealer trojan, which was sold under the name Vidar Pro stealer and can be distributed through different campaigns. This malware will perform multiple types of malicious behavior including stealing web browser cookies and history, digital wallets, two-factor authentication data,...

The 4 Core Pillars of Endpoint Security

Cb Connect is always an exciting time for me. At Cb Connect 2017, we unveiled our vision for the Cb Predictive Security Cloud PSC. Over the past year, this platform has expanded and grown to provide better prevention, detection and response for our global customers. Today, at CbConnect18, we...

Getting Better Together in Cybersecurity

As the wheels lift up on my latest flight I am left reflecting on another year in infosec. We are moving toward “something” and some days I can’t figure out if that something is disaster or safety. The tea leaves become hard to read with the cyber war that has been raging over into the mainstream...

Carbon Black’s Commitment to GDPR & Keeping Customer Data Safe

At Carbon Black, keeping our customers’ data safe is a top priority. The European Union’s General Data Protection Regulation “GDPR”, a comprehensive European privacy law that takes effect on May 25, 2018, has shined a light on the importance of securing personal data. The GDPR is designed to...

August 3, 2017 – Morning Cyber Coffee Headlines – “Tony Bennett” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 3, 2017 - Headlines Carbon Black in the News: 10 tips for effective thre...

“The 101” – Episode 4 – What are the Different Types of Malware?

We’re back with another episode of The 101! This weekly security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to cut through the noise and provide clear definitions. So far we’ve talked abou...

VMware Carbon Black TAU Threat Analysis: Shlayer (macOS)

Following our initial reporting of this threat, Carbon Black’s Threat Analysis Unit TAU has continued following the Shlayer family of malware and monitoring changes adopted by this campaign. Although detection by antivirus vendors has improved over the past year, the malware authors continue to...

Announcing New CB ThreatHunter App for Phantom

Today’s cybersecurity landscape is facing multiple challenges - and not just from cyber attackers. Security teams are understaffed and struggling to find the talent they need to complete their day-to-day tasks, with limited visibility across their security stack. To address these challenges, SOC...

Partner Perspectives: Siemplify & Carbon Black Create Competitive Solution for MSSPs

Meny Har is the VP of Product for Siemplify. Advanced threats and an ever-evolving competitive landscape have created an increased demand for managed security services. Organizations of all sizes are turning to managed security services providers MSSPs to help them to effectively manage their...

Excerpts from Modern Bank Heists – Data Gathering

Carbon Black recently published a report on how to gather data to improve the security posture of your enterprise. For more information about how Cb Defense, Carbon Black's NGAV + EDR solution, helps enterprises address their endpoint security challenges, check out our weekly Cb Defense Live Demo...

Making Carbon Black a “Top Place to Work” for a Fourth Consecutive Year

Carbon Black is proud to announce we’ve been recognized as a “Top Place to Work” by the Boston Globe for a fourth consecutive year. It’s an honor to receive this award and it’s all thanks to our people who have tirelessly contributed to building the most inspiring, transparent, and positive work...

August 23, 2017 – Morning Cyber Coffee Headlines – “Boston Celtics” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 23, 2017 - Headlines No U.S.-Russia Cyber Unit Without Trump Notifying...

Carbon Black Threat Research Technical Analysis: Petya / NotPetya Ransomware

On June 27, public announcements were made about a large-scale campaign of ransomware attacks across Europe. The ransomware impacted notable industries such as Maersk, the world’s largest container shipping company. The initial infection vector appears to be the exploitation of a Ukrainian tax...

Partner Perspectives: Notes from the Field: Extending Carbon Black Visibility to Undetected Malware

Daniel LaVoie is a Senior Solutions Specialist at ReversingLabs. On a recent customer visit, I asked the company’s Director of Security Operations how ReversingLabs came to be deployed as a part of their SOC tool set. The answer was quite interesting, and one that I wanted to share with our blog...

Partner Perspectives: Orchestrating Endpoint Security with CyberSponse and Carbon Black

Amit Jain is the Principal Technical Product Manager at CyberSponse. Today's network security infrastructures are complex beasts. Increasing mobile and cloud deployments have made managing endpoint security more challenging than ever before. The dynamic and ever-evolving nature of today’s...

Partner Perspectives: VMRay + Carbon Black Bridge the Gap Between Threat Hunting & Incident Response

In 2016, Carbon Black and VMRay introduced an out-of-the-box integration combining the capabilities of two industry-best platforms: Cb Response and the VMRay Analyzer. Leveraging the threat hunting and incident response capabilities of Cb Response, alongside the malware analysis and detection...

What Can Application Control Do For You?

In past blogs, we’ve taken a look at application control and the best practices for successful deployment. Today we’re going to shift gears slightly, and highlight the reasons some companies have chosen this practice. Whitelist With Flexibility It seems counterintuitive to put “whitelisting” and...

Carbon Black Report: China, Russia & North Korea Launching Sophisticated, Espionage-Focused Cyberattacks

Even as a steady drumbeat of headlines keeps the world’s attention focused on cybercrimes, such as ransomware and cryptojacking, in the dark corners of the internet, attackers are busy refining their craft. According to the world’s top incident response IR professionals, cyberattackers are honing...

What Is FIPS 140-2 & Why Does It Matter?

Editor's Note: Ray Potter, the blog's author, is the CEO and Co-founder of SafeLogic. Carbon Black has just announced the successful FIPS 140-2 validation of their Carbon Black Cryptographic Module and availability within their Cb Response and Cb Protection products. Our team at SafeLogic is...

September 19, 2017 – Morning Cyber Coffee Headlines – “Space Jam” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 19, 2017 - Headlines State, Federal Authorities Proposing New Rules o...

September 7, 2017 – Morning Cyber Coffee Headlines – “NFL Kickoff” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 7, 2017 - Headlines Carbon Black in the News: Milton Security Announc...

August 30, 2017 – Morning Cyber Coffee Headlines – “Eiffel Tower” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 30, 2017 - Headlines Carbon Black in the News: Carbon Black names Marco...

Attacking Critical Infrastructure: The Evolution Of Kinetic Warfare

I said earlier in 2017 I believed it was quite possible that during the year a major cyberattack will occur in either the United States, the United Kingdom, or another friendly country that will require a response equivalent to a kinetic attack. In other words, a cyberattack will occur that will ...

Avoid the Liability Associated with Running End-of-Life Operating Systems (EOL)

Recent attacks such as WannaCry and NotPetya have demonstrated hackers are more familiar with the vulnerabilities of unsupported systems than many organizations themselves. When new patches are released, attackers easily reverse-engineer the updates and quickly find all the weaknesses in...

vExpert Security 2020 Award Announcement

Thank you to everyone who applied for the vExpert Security sub-group and thank you to the vExpert PRO’s for doing their part in this process. We are pleased to announce the list of 2020 vExperts Security. Each of these vExperts have demonstrated significant contributions to the community and a...

Navigating the Looming Threat of Nation-State Attacks

Nation-state attacks are sophisticated cyberthreats from adversaries working directly or indirectly for their own government. Their objectives might be to steal sensitive information, disrupt enemy capabilities, grow financial power through cryptocurrency, or even sway the international balance o...

Taking Reputation to Scale: The Delicate Balance of Latency, Scale, and Cost (Part 1)

When it comes to serving reputation, even a millisecond of latency could create havoc, resulting in the unwanted spread of malware and causing costly consequences that no security company or customer wants. And that’s why we, as engineers here at Carbon Black, are constantly working towards...

Partner Perspectives: Accelerated Alert Handling from Syncurity and Carbon Black

JP Bourget is the Founder and CSO of Syncurity. One of the key Security Orchestration, Automation and Response SOAR use cases I see every day is alert handling. As more and more organizations adopt EDR solutions, like those offered by Carbon Black, Syncurity IR-Flow is able to speed up the alert...

Using the L.U.R.E. Method to Swim Free of Phishing Attacks

baitfish noun bait·​fish | \ˈbāt-ˌfish \ Definition of baitfish : a small fish such as a golden shiner or menhaden that attracts and is a food source for a larger game fish also : a fish used for bait Think about being in a school of fish for a second. Schools behave the way they do for a reason...

Iron Mind: Defending Against Propaganda & Counter Victimization

Thomas Jefferson had it right. Propaganda is the greatest threat to any democracy. Or did you just believe a quote that I made up with a picture of him to add credence to this blog? Iron Palm or Iron Hand is a body of training techniques in various martial arts. It is originally one of the 72 art...

Excerpts From “Why Companies Are Replacing AV with Advanced Endpoint Security”

Is legacy antivirus failing to keep your endpoints secure? In Carbon Black's recent webinar, Fulcanelli Chavez, Sr. Security Operations Analyst at D.A. Davidson, shared how switching from McAfee to Cb Defense has improved protection and simplified operations for his team. Below are excerpts from...

Carbon Black Report: 46% of Incident Response Professionals Experience Counter Incident Response

Quarterly Incident Response Threat Report Executive Summary/Highlights Proactive Incident Response Even as a steady drumbeat of headlines keeps the world’s attention focused on cybercrimes such as ransomware and cryptojacking, in the dark corners of the internet, attackers are busy refining their...

10 Endpoint Security Problems Solved by the Cloud – Securing Remote Workers

In last week’s post, we talked about how the cloud solves the problem of managing multiple agents. In this week’s blog, we’re going to look at a security challenge that almost every company faces: Securing Remote Workers. Remote Workers Are A Security Risk Advances in technology are creating...

The Perfect Storm:  Cyberspace Requires Defense in the Cloud

Cyberspace is a free-fire zone. Corporations are regularly under siege from multiple threat actors. The cyber-arms bazaar that flourishes around the world has allowed criminals and nations to wage long-term campaigns against corporations and government agencies. These attackers stalk businesses a...

VIDEO: Unfiltered Endpoint Data – Building Better Detection

BUILDING BETTER DETECTION In our previous post, Carbon Black’s Founder and CTO Mike Viscuso talked about how we can tilt the advantage back to the defenders with a “surveillance camera” for endpoints. By collecting endpoint activity and continuously storing it in a centralized location — without...

4 Predictions for the Cybersecurity Landscape in 2018

Targeted attacks are on the rise, and the dark web isn’t helping curb that trend. To compound this, the recent revelations on Shadow Brokers and CIA Vault 7, as well as burgeoning nation-state cyber capabilities aren’t helping either. It’s only a matter of time before more attack methods are...

Australia’s “Essential Eight” is Critical to Meet 2018 Cybersecurity Mandates & Privacy Laws

Christopher Strand, Carbon Black’s security risk and compliance officer recently wrote a blog discussing how the new mandatory data breach notification rule in the Privacy Amendment Notifiable Data Breaches Bill 2016, helps bring attention to cybersecurity solutions and focus on the practices...

“The 101” – Episode 6 – Why is Malware Still Successful?

We’re back with another episode of The 101! This weekly security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. In the past few episodes we’ve spoken about the...

August 14, 2017 – Morning Cyber Coffee Headlines – “Creamsicle” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 14, 2017 - Headlines Carbon Black in the News: NSA tools used to hack...

Women in Security Part 3: Meet Marina Liang, Threat Researcher

This post is part of our Women’s History Month series - follow along with us on Twitter @VMwareCarbonBlack In celebration of Women’s History Month, we’re excited to share the next blog in our six-part Women in Security series where we highlight outstanding women on the VMware Security Business Un...

Securing Containers and Kubernetes-Orchestrated Environments

In a recent Black Hat webcast, “Securing Containers and Kubernetes-Orchestrated Environments,” sponsored by VMware Carbon Black, guest speakers Sheila A. Berta, Offensive Security Specialist, Dreamlab Technologies and Haim Helman, CTO, VMware Carbon Black App Security, VMware Security Business...