Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Identity Attack Watch: July 2021

semperis.com | blog | #supply-chain | #zero-day | #active-directory | #printnightmare | #revil | #news-roundup | #wiper-attack

Summary

July 2021 roundup: the MeteorExpress wiper abused AD Group Policy against Iran's rail system; Microsoft fixed PetitPotam and other flaws; CISA ordered PrintNightmare patches; SolarWinds fell to a Serv-U zero-day; REvil struck via Kaseya.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Identity Attack Watch: October 2021
October 2021 roundup: Sinclair's corporate AD domain hit by ransomware; Microsoft warned on risky service-provider access; REvil infrastructure taken down; BlackMatter struck Olympus again; Exchange Autodiscover leaked 100,000 credentials.
blog · semperis.com
Identity Attack Watch: June 2021
June 2021 roundup: Colonial Pipeline traced to a stolen inactive VPN account; FujiFilm shut down by Qbot/REvil; JBS paid $11M; REvil hit nuclear contractor Sol Oriens; and the UK's NCSC warned schools to harden defenses.
incident · semperis.com
Semperis Identity Attack Watch: January 2021
January 2021 roundup: an exploit for SAP's SolMan, the 'Active Directory of SAP'; Sophos-described ghost attacks where intruders added AD domain-admin accounts undetected; and REvil's Dairy Farm hit, using AD screenshots as extortion proof.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
blog · semperis.com
Identity Attack Watch: December 2022
December 2022 roundup: LockBit hit the Port of Lisbon and California's Department of Finance; Hive hit Louisiana's Lake Charles Memorial (270,000 patients); BlackCat hit Colombian energy firm EPM.
blog · semperis.com
Identity Attack Watch: August 2022
August 2022 roundup: Bumblebee loader aided AD attacks; Nobelium's MagicWeb backdoored ADFS; an Iranian group exploited Log4j against Israel; CVE-2022-30216 threatened domain controllers.
back