What Can Application Control Do For You?

In past blogs, we’ve taken a look at application control and the best practices for successful deployment. Today we’re going to shift gears slightly, and highlight the reasons some companies have chosen this practice. Whitelist With Flexibility It seems counterintuitive to put “whitelisting” and...

Carbon Black Report: China, Russia & North Korea Launching Sophisticated, Espionage-Focused Cyberattacks

Even as a steady drumbeat of headlines keeps the world’s attention focused on cybercrimes, such as ransomware and cryptojacking, in the dark corners of the internet, attackers are busy refining their craft. According to the world’s top incident response IR professionals, cyberattackers are honing...

Suppressing the Adversary via Threat Hunt Teams

What a brave new world. Global cyber insurgencies continue unabated. Decreasing dwell time is imperative in 2018. In order to achieve this goal, we must embrace the hunt. Every organization should stand up a threat hunt team. The team must be multidisciplinary with experience in e-forensics and...

4 Predictions for the Cybersecurity Landscape in 2018

Targeted attacks are on the rise, and the dark web isn’t helping curb that trend. To compound this, the recent revelations on Shadow Brokers and CIA Vault 7, as well as burgeoning nation-state cyber capabilities aren’t helping either. It’s only a matter of time before more attack methods are...

September 19, 2017 – Morning Cyber Coffee Headlines – “Space Jam” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 19, 2017 - Headlines State, Federal Authorities Proposing New Rules o...

September 7, 2017 – Morning Cyber Coffee Headlines – “NFL Kickoff” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! September 7, 2017 - Headlines Carbon Black in the News: Milton Security Announc...

Attacking Critical Infrastructure: The Evolution Of Kinetic Warfare

I said earlier in 2017 I believed it was quite possible that during the year a major cyberattack will occur in either the United States, the United Kingdom, or another friendly country that will require a response equivalent to a kinetic attack. In other words, a cyberattack will occur that will ...

August 22, 2017 – Morning Cyber Coffee Headlines – “Hamilton” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 22, 2017 - Headlines The Intelligence Community’s Top 3 Cybersecurity...

Avoid the Liability Associated with Running End-of-Life Operating Systems (EOL)

Recent attacks such as WannaCry and NotPetya have demonstrated hackers are more familiar with the vulnerabilities of unsupported systems than many organizations themselves. When new patches are released, attackers easily reverse-engineer the updates and quickly find all the weaknesses in...

VMware Workspace Security: A Major Leap Towards Unified Endpoint Mobility & Security

The rate of change in the way people work, driven by the need to work remotely, has exacerbated IT and security concerns. And this change in the way we work is likely to be permanent as organizations see performance benefits resulting from the remote work environment. New work expectations have...

Ransomware Attacks Targeting Healthcare Surge: VMware Carbon Black experts Weigh in

Targeted, sophisticated, and costly – over the past month, several high-profile ransomware attacks have been reported with a specific focus on some of the largest healthcare providers across the world1. With the recent surge in telemedicine adoption due to the COVID-19 as well as the growth of...

TAU Threat Analysis: Bundlore (macOS) mm-install-macos

The mm-install-macos variant of the Bundlore family of macOS adware has been around for many years in many variations and delivery methods. Recently, a variant with a novel installation method was discovered. Although most of the installation details were the same or similar to the samples analyz...

TAU Technical Report: New Attack Combines TinyPOS With Living-off-the-Land Techniques for Scraping Credit Card Data

In April of 2020 VMware Carbon Black Threat Analysis Unit TAU researchers worked with an Incident Response IR partner on a piece of malware that was discovered during an ongoing PCI investigation. The combined analysis showed that attackers who previously leveraged a malware family called TinyPOS...

Threat Analysis Unit (TAU) Threat Intelligence Notification: CoronaVirus Ransomware

"CoronaVirus" Ransomware has been found distributed via a phishing website. The malicious website will distribute a trojan downloader which then leads to downloading additional malicious payloads: the Kpot InfoStealer and Coronavirus Ransomware. "CoronaVirus" Ransomware will perform the deletion ...

Taking Reputation to Scale: An Iterative Journey with an Agile Approach (Part 2)

In Part 1 of this blog, we shared with you the challenges we had in balancing latency, scalability, and cost for our reputation services. In this blog, we’ll give you some insights into each major iteration along that journey, from the beginning to where we are now. 100 requests per second. Befor...

Gray Day: My Undercover Mission To Expose America’s First Cyber Spy

Who is Eric O’Neill? Eric O’Neill serves as Carbon Black’s national security strategist where he is a thought leader on a wide range of issues including counterterrorism and national security matters. Prior to this, he was as an operative for the FBI, where he conducted national security field...

SANS Reviews the CB Predictive Security Cloud

Understanding The Landscape Day by day, it is becoming more challenging to keep endpoints secure. In the SANS “Endpoint Protection and Response” survey from 2018, 42% of respondents indicated at least one of their endpoints had been compromised, and another 20% didn’t know if any endpoints had be...

October 16, 2018 – Morning Cyber Coffee Headlines – “Yale” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! October 16, 2018 - Headlines U.K. Cyber Security Center Says Most Attacks Are...

Excerpts from Modern Bank Heists – Nation State Threats

Carbon Black recently published a report on the latest non-malware attack methods, and how to counteract them. For more information about how Cb Defense, Carbon Black's NGAV + EDR solution, helps enterprises address their endpoint security challenges, check out our weekly Cb Defense Live Demo,...

In the New “Wild West” Even “Small” Cryptocurrency Theft is Costing Billions

Over the weekend, another cryptocurrency exchange was breached. This time it was “only” $40 million” in cryptocurrency. However, as a result cryptocurrencies overall lost more than $40 billion in value following the attack. That’s not a typo - a $40 million heist cost the market more than $40...

Carbon Black Solutions Currently Compatible With Major OS Vendor Patches on Meltdown & Spectre

Recently, researchers have released details on two classes of vulnerabilities in modern CPU hardware. These vulnerabilities affect unprecedented numbers of systems and are some of the more difficult issues to address in recent history. These vulnerabilities, dubbed Meltdown and Spectre, may be...

Cb Defense October 2017 Release Speeds Up Your Response

During a response scenario, every minute counts. The faster you can complete your investigation, the faster you can start taking corrective action. That’s why this week we’re happy to announce the October 2017 update of Cb Defense, which improves search functionality within the Cb Defense console...

Ransomware Roundup: Alternative Techniques featuring CTB-Faker

Ransomware is innovating to spread faster, hit harder and increase its payout potential. New unknown variants pop up daily, and many leverage non-malware techniques to evade traditional defenses. CTB-Faker is a perfect example of how modern ransomware is leveraging these new techniques to easily...

August 30, 2017 – Morning Cyber Coffee Headlines – “Eiffel Tower” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 30, 2017 - Headlines Carbon Black in the News: Carbon Black names Marco...

“The 101” – Episode 6 – Why is Malware Still Successful?

We’re back with another episode of The 101! This weekly security series aims to define endpoint security one question at a time. Tune in each week as we tackle a new term, concept, or comparison in our ongoing effort to provide clear definitions. In the past few episodes we’ve spoken about the...

July 7, 2017 – Morning Cyber Coffee Headlines – “Spiderman” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 7, 2017 - Headlines Carbon Black in the News: Residents of these states ar...

Linux Distribution Coverage Extended Across the VMware Carbon Black Cloud

In 2020, a record 56 new Linux malware families were discovered. We are now seeing this trend continue into the new year with the latest discovery of RedXOR, believed to be formulated by Chinese nation-state actors targeting RedHat Enterprise Linux RHEL. With organizations hyper-accelerating thei...

Announcing the Release of Malware Prevention for Linux

The VMware Carbon Black team has a mission to keep your entire organization safe from cyber attacks. To deliver on this for today’s landscape, the Carbon Black Cloud platform has added malware prevention for Linux to bring the entire protection lifecycle to Windows, macOS, and Linux. With Linux n...

Threat Analysis Unit (TAU) Threat Intelligence Notification: SatanCryptor Ransomware

In early January 2020, a new ransomware named ‘SatanCryptor’ was discovered. After it performs file encryption, it will drop a ransom note named “ SATAN CRYPTOR .hta” and append ‘.satan’ as a file extension to the encrypted files. In addition, SatanCryptor will delete itself after the execution t...

Cybersecurity Awareness Month: Bridging the Cybersecurity Skills Gap

Pumpkins, football, and cooler weather are three big indicators that it’s officially October. But, the most near and dear benchmark to my heart is that it’s National Cybersecurity Awareness Month NCSAM 2018. In its 15th year, NCASM is as an annual initiative to raise awareness about the importanc...

Cb Customer Spotlight Series: How Purdue Federal Credit Union Achieves Critical System Lockdown

Featuring Dee Lucas, Sr. Network Administrator at Purdue Federal Credit Union Leading financial institution, Purdue Federal Credit Union, serves over 71,000 members nationwide. This makes security of the utmost importance for Sr. Network Administrator Dee Lucas who supports Purdue Federal’s SOC...

10 Endpoint Security Problems Solved by the Cloud – Slowing Down Endpoints

This week we will continue our investigation into the top 10 endpoint security problems the cloud solves. Our blog today moves on from the last dilemma we discussed, securing remote workers, and examines the issue of slowing down endpoints. Legacy AV Slows Down Endpoints Traditional AV is as...

10 Endpoint Security Problems Solved by the Cloud – Securing Remote Workers

In last week’s post, we talked about how the cloud solves the problem of managing multiple agents. In this week’s blog, we’re going to look at a security challenge that almost every company faces: Securing Remote Workers. Remote Workers Are A Security Risk Advances in technology are creating...

5 Reasons Why AV Can’t Protect Your Data Center

Why are so many organizations lagging behind in performing security assessments of virtual assets in their datacenter? One contributing factor is the impact of virtualization on the datacenter has happened so quickly and organically, that products and processes haven’t kept up. Even now, there is...

Essays from 7 Experts on Moving to a Cloud-Based Endpoint Security Platform

Carbon Black recently published a series of essays about the experiences of experts in the field on information security as they moved their endpoint security program to the cloud; this is one of those essays. To read the full series check out 7 Experts on Moving to a Cloud-Based Endpoint Securit...

The Perfect Storm:  Cyberspace Requires Defense in the Cloud

Cyberspace is a free-fire zone. Corporations are regularly under siege from multiple threat actors. The cyber-arms bazaar that flourishes around the world has allowed criminals and nations to wage long-term campaigns against corporations and government agencies. These attackers stalk businesses a...

VIDEO: Unfiltered Endpoint Data – Building Better Detection

BUILDING BETTER DETECTION In our previous post, Carbon Black’s Founder and CTO Mike Viscuso talked about how we can tilt the advantage back to the defenders with a “surveillance camera” for endpoints. By collecting endpoint activity and continuously storing it in a centralized location — without...

January 31, 2018 – Morning Cyber Coffee Headlines – “Explorer 1” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! January 31, 2018 - Headlines Carbon Black in the News: Beyond 100 Days - BBC...

Australia’s “Essential Eight” is Critical to Meet 2018 Cybersecurity Mandates & Privacy Laws

Christopher Strand, Carbon Black’s security risk and compliance officer recently wrote a blog discussing how the new mandatory data breach notification rule in the Privacy Amendment Notifiable Data Breaches Bill 2016, helps bring attention to cybersecurity solutions and focus on the practices...

August 2, 2017 – Morning Cyber Coffee Headlines – “Declaration of Independence” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! August 2, 2017 - Headlines Carbon Black in the News: Carbon Black Hires Former...

July 6, 2017 – Morning Cyber Coffee Headlines – “Dalai Lama” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 6, 2017 - Headlines UN finds cybersecurity is a struggle worldwide - CNET...

July 5, 2017 – Morning Cyber Coffee Headlines – “Isaac Newton” Edition

Good morning! Sit with Carbon Black this morning over a cup of coffee or tea and browse a few industry headlines to get the day started. We’ve got just enough information below to get you through that first cup…enjoy! July 5, 2017 - Headlines Carbon Black in the News: Carbon Black’s Cb Defense...

Women in Security Part 4: Meet Jan Lawford, Senior Director of EMEA Security Sales

This post is part of our Women’s History Month series - follow along with us on Twitter @VMwareCarbonBlack As we continue to celebrate Women’s History Month, we are honored to share the stories of women in our VMware Security Business Unit, including members of our team and customers alike. By...

VMware Carbon Black Announces Splunk Integration to Streamline and Modernize SOC Workflows

Introducing Unified VMware Carbon Black Cloud App for Splunk At VMware Carbon Black, our ecosystem of integration and alliance partners has been a core part of our vision and strategy. Today, with thousands of customers adopting the VMware Carbon Black Cloud to secure their endpoints and workload...

TAU Threat Analysis: Medusa Locker Ransomware

In recent weeks Carbon Black’s Threat Analysis Unit TAU has seen an increase in the number of infections attributed to the Medusa Locker ransomware family. There were notable traits exhibited by Medusa Locker in these attacks that warranted further investigation to determine behavioral tactics th...

Invoke-APT29: Adversarial Threat Emulation

MITRE recently conducted its second ATT&CK exercise in their ongoing annual series of Endpoint Security Efficacy testing and evaluation. This test focuses on assessing the behavioral capabilities of multiple endpoint security vendors against a simulated adversary, based closely around...

Our Communication Strategy to Help Development Make the Switch to Kubernetes

VMware Carbon Black has acquired a lot of technology as it has grown. That means we have a lot of different tooling in play that is both costly and complex to manage. Our VP of Engineering recognized this and created a new team specifically tasked with creating a unified system infrastructure and...

Partner Perspectives: Collaborate and Consolidate with King & Union and Carbon Black

Peter Prizio Jr. is the Senior Product Manager for King & Union. One of the biggest challenges facing security organizations today is dealing with the overwhelming number of alerts received each and every day. A staggering 27 percent of IT professionals report receiving more than one million aler...

ATT&CK +osquery = Love

I had the ability to live-stream MITRE's ATT&CKcon, a two-day event where organizations came together as a community to share their best practices with leveraging the ATT&CK framework. At this conference, Scott Lundgren, Chief Architect at Carbon Black ,presented “ATT&CK + osquery = Love,” where ...

10 Endpoint Security Problems Solved by the Cloud – Responding Quickly To Threats

In this week’s installment of 10 endpoint security problems solved by the cloud, we’re going to step away from last week’s topic, identifying problems, and examine how the cloud helps organizations respond quickly to threats. Speed is Critical Attackers move quickly, and your ability to respond...