Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identity Attack Watch: AD Security News, October 2023

semperis.com | incident | #active-directory | #ransomware | #alphv | #news-roundup | #octo-tempest | #rorschach | #lazarus

Summary

October 2023 roundup: Microsoft profiled Octo Tempest; Rorschach hit Chilean telecom GTD via DLL side-loading and GPO abuse; ALPHV/BlackCat struck Seiko and others; Lazarus targeted TeamCity.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Identity Attack Watch: December 2021
December 2021 roundup: Microsoft urged immediate patching of two AD flaws enabling domain takeover; Conti weaponized Log4j against Kronos payroll; FBI warned on Cuba ransomware; ALPHV BlackCat emerged with domain-credential features.
incident · semperis.com
Identity Attack Watch: November 2022
November 2022 roundup: Sandworm spread RansomBoggs via domain controllers in Ukraine; LockBit hit Southampton County and Continental; Vice Society struck Cincinnati College; Black Basta hit Sobeys.
incident · semperis.com
Identity Attack Watch: October 2022
October 2022 roundup: Microsoft warned of Prestige ransomware hitting Ukraine/Poland logistics via domain admin credentials; Hive attacked Tata Power; LockBit breached UK dealer Pendragon.
incident · semperis.com
Identity Attack Watch: September 2022
September 2022 roundup: the Bloody Ransomware Gang used a leaked LockBit builder; an SEO poisoning campaign led to AD compromise; Lapsus$ breached Uber; Hive struck New York and Canadian targets.
incident · semperis.com
Identity Attack Watch: July 2022
July 2022 roundup: LockBit claimed 100GB stolen from Italy's tax agency and hit small towns; Black Basta shut down manufacturer Knauf; BlackCat breached game publisher Bandai Namco.
incident · semperis.com
Combatting a BlackCat Ransomware Active Directory Attack
After FBI Flash CU-000167-MW warned BlackCat/ALPHV had hit 60+ entities, this post explains why the group's end game is an AD attack and lists FBI-recommended mitigations: hunt rogue accounts, audit permissions, plan AD recovery.
back