Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identity Attack Watch: October 2021

semperis.com | blog | #active-directory | #revil | #news-roundup | #autodiscover | #exchange-server | #sinclair

Summary

October 2021 roundup: Sinclair's corporate AD domain hit by ransomware; Microsoft warned on risky service-provider access; REvil infrastructure taken down; BlackMatter struck Olympus again; Exchange Autodiscover leaked 100,000 credentials.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Identity Attack Watch: June 2022
June 2022 roundup: Conti breached 40+ organizations in one month; CISA urged Exchange Online users onto Modern Auth; BlackCat targets Exchange servers for AD recon; Vice Society hit Palermo; Black Basta paired with QBot.
blog · semperis.com
Identity Attack Watch: July 2021
July 2021 roundup: the MeteorExpress wiper abused AD Group Policy against Iran's rail system; Microsoft fixed PetitPotam and other flaws; CISA ordered PrintNightmare patches; SolarWinds fell to a Serv-U zero-day; REvil struck via Kaseya.
blog · semperis.com
Identity Attack Watch: June 2021
June 2021 roundup: Colonial Pipeline traced to a stolen inactive VPN account; FujiFilm shut down by Qbot/REvil; JBS paid $11M; REvil hit nuclear contractor Sol Oriens; and the UK's NCSC warned schools to harden defenses.
incident · semperis.com
Semperis Identity Attack Watch: January 2021
January 2021 roundup: an exploit for SAP's SolMan, the 'Active Directory of SAP'; Sophos-described ghost attacks where intruders added AD domain-admin accounts undetected; and REvil's Dairy Farm hit, using AD screenshots as extortion proof.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
blog · semperis.com
Identity Attack Watch: December 2022
December 2022 roundup: LockBit hit the Port of Lisbon and California's Department of Finance; Hive hit Louisiana's Lake Charles Memorial (270,000 patients); BlackCat hit Colombian energy firm EPM.
back