Identity Attack Watch: AD Security News, April 2023

July 2022 roundup: LockBit claimed 100GB stolen from Italy's tax agency and hit small towns; Black Basta shut down manufacturer Knauf; BlackCat breached game publisher Bandai Namco.

December 2022 roundup: LockBit hit the Port of Lisbon and California's Department of Finance; Hive hit Louisiana's Lake Charles Memorial (270,000 patients); BlackCat hit Colombian energy firm EPM.

June 2022 roundup: Conti breached 40+ organizations in one month; CISA urged Exchange Online users onto Modern Auth; BlackCat targets Exchange servers for AD recon; Vice Society hit Palermo; Black Basta paired with QBot.

April 2022 roundup: FBI warning on BlackCat/ALPHV (dozens of victims); leaked Conti tools used against Russian firms; Hive breach exposed 850,000 Partnership HealthPlan members' data; Conti claimed the Panasonic Canada attack.

November 2022 roundup: Sandworm spread RansomBoggs via domain controllers in Ukraine; LockBit hit Southampton County and Continental; Vice Society struck Cincinnati College; Black Basta hit Sobeys.

Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.