Identity Attack Watch: November 2022

January 2023 roundup: Sandworm deployed SwiftSlicer wipers via AD Group Policy in Ukraine; Vice Society hit a German university and Fire Rescue Victoria; LockBit struck Royal Mail and Wabtec.

July 2022 roundup: LockBit claimed 100GB stolen from Italy's tax agency and hit small towns; Black Basta shut down manufacturer Knauf; BlackCat breached game publisher Bandai Namco.

October 2022 roundup: Microsoft warned of Prestige ransomware hitting Ukraine/Poland logistics via domain admin credentials; Hive attacked Tata Power; LockBit breached UK dealer Pendragon.

January 2022 roundup: phishing enrolled attacker devices into Azure AD tenants lacking enforced MFA; LockBit hit the French Ministry of Justice and European firms via GPO-based deployment; noPac can compromise DCs in seconds.

May 2023 roundup: Black Basta hit ABB's Active Directory and Rheinmetall, LockBit claimed MCNA Dental (nearly 9 million patients), and ALPHV/BlackCat compromised Constellation Software.

December 2022 roundup: LockBit hit the Port of Lisbon and California's Department of Finance; Hive hit Louisiana's Lake Charles Memorial (270,000 patients); BlackCat hit Colombian energy firm EPM.