Identity Attack Watch: May 2022

June 2022 roundup: Conti breached 40+ organizations in one month; CISA urged Exchange Online users onto Modern Auth; BlackCat targets Exchange servers for AD recon; Vice Society hit Palermo; Black Basta paired with QBot.

April 2022 roundup: FBI warning on BlackCat/ALPHV (dozens of victims); leaked Conti tools used against Russian firms; Hive breach exposed 850,000 Partnership HealthPlan members' data; Conti claimed the Panasonic Canada attack.

March 2022 roundup: HermeticWiper deployed via default domain policy against Ukrainian orgs; Lapsus$ social-engineered Azure AD/Okta access; AvosLocker hit critical infrastructure; CISA renewed PrintNightmare and MFA warnings.

February 2022 roundup: wiper malware hit Ukrainian government and bank sites after attackers gained AD control; a U.S. audit faulted NOAA's AD management; Conti hired TrickBot talent; a Zoho flaw enabled the Red Cross breach.

September 2021 roundup: a CISA/FBI/NSA joint advisory warned of escalating Conti attacks (patch Zerologon); LockBit returned with a GPO-based AD deployment technique; BlackMatter hit Olympus and Iowa's New Cooperative.

May 2021 roundup: SolarWinds actors escalated via Constant Contact (~150 orgs' email); APTs hit a U.S. local government via Fortinet flaws; Colonial Pipeline targeted Windows; Conti used domain credentials against Ireland's Health Service.