Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identity Attack Watch: March 2022

semperis.com | blog | #cloud | #active-directory | #cisa | #ransomware | #news-roundup | #lapsus | #hermeticwiper

Summary

March 2022 roundup: HermeticWiper deployed via default domain policy against Ukrainian orgs; Lapsus$ social-engineered Azure AD/Okta access; AvosLocker hit critical infrastructure; CISA renewed PrintNightmare and MFA warnings.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Identity Attack Watch: May 2022
May 2022 roundup: CISA warned against May Windows updates on domain controllers due to Kerberos/AD DS auth issues; Costa Rica declared emergency over Conti attacks; Verizon DBIR tied ~50% of breaches to stolen credentials.
blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
incident · semperis.com
Identity Attack Watch: September 2022
September 2022 roundup: the Bloody Ransomware Gang used a leaked LockBit builder; an SEO poisoning campaign led to AD compromise; Lapsus$ breached Uber; Hive struck New York and Canadian targets.
blog · semperis.com
Backup Testing Is Not Cyber Resilience: Lessons Learned Robbing a Bank
Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
blog · semperis.com
NSA Top Ten Cybersecurity Misconfigurations: An Active Directory Perspective (Part 3)
Final part of the CISA/NSA top-ten misconfigurations series from an AD perspective: misconfigured ACLs on shares, poor credential hygiene, and unrestricted code execution, with IOEs and IOCs.
back