Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identity Attack Watch: September 2021

semperis.com | blog | #active-directory | #news-roundup | #lockbit | #zerologon | #conti | #blackmatter

Summary

September 2021 roundup: a CISA/FBI/NSA joint advisory warned of escalating Conti attacks (patch Zerologon); LockBit returned with a GPO-based AD deployment technique; BlackMatter hit Olympus and Iowa's New Cooperative.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Identity Attack Watch: December 2022
December 2022 roundup: LockBit hit the Port of Lisbon and California's Department of Finance; Hive hit Louisiana's Lake Charles Memorial (270,000 patients); BlackCat hit Colombian energy firm EPM.
blog · semperis.com
Identity Attack Watch: June 2022
June 2022 roundup: Conti breached 40+ organizations in one month; CISA urged Exchange Online users onto Modern Auth; BlackCat targets Exchange servers for AD recon; Vice Society hit Palermo; Black Basta paired with QBot.
blog · semperis.com
Identity Attack Watch: May 2022
May 2022 roundup: CISA warned against May Windows updates on domain controllers due to Kerberos/AD DS auth issues; Costa Rica declared emergency over Conti attacks; Verizon DBIR tied ~50% of breaches to stolen credentials.
blog · semperis.com
Identity Attack Watch: April 2022
April 2022 roundup: FBI warning on BlackCat/ALPHV (dozens of victims); leaked Conti tools used against Russian firms; Hive breach exposed 850,000 Partnership HealthPlan members' data; Conti claimed the Panasonic Canada attack.
blog · semperis.com
Identity Attack Watch: February 2022
February 2022 roundup: wiper malware hit Ukrainian government and bank sites after attackers gained AD control; a U.S. audit faulted NOAA's AD management; Conti hired TrickBot talent; a Zoho flaw enabled the Red Cross breach.
blog · semperis.com
Identity Attack Watch: August 2021
August 2021 roundup: LockFile exploited ProxyShell and PetitPotam to reach AD; LockBit 2.0 attacks surged (including Accenture); FBI issued a Hive alert after Memorial Health; Nokia's SAC Wireless hit by Conti.
back