Identity Attack Watch: June 2021

October 2021 roundup: Sinclair's corporate AD domain hit by ransomware; Microsoft warned on risky service-provider access; REvil infrastructure taken down; BlackMatter struck Olympus again; Exchange Autodiscover leaked 100,000 credentials.

July 2021 roundup: the MeteorExpress wiper abused AD Group Policy against Iran's rail system; Microsoft fixed PetitPotam and other flaws; CISA ordered PrintNightmare patches; SolarWinds fell to a Serv-U zero-day; REvil struck via Kaseya.

May 2021 roundup: SolarWinds actors escalated via Constant Contact (~150 orgs' email); APTs hit a U.S. local government via Fortinet flaws; Colonial Pipeline targeted Windows; Conti used domain credentials against Ireland's Health Service.

January 2021 roundup: an exploit for SAP's SolMan, the 'Active Directory of SAP'; Sophos-described ghost attacks where intruders added AD domain-admin accounts undetected; and REvil's Dairy Farm hit, using AD screenshots as extortion proof.

One year after JBS paid an 11 million dollar ransom to ransomware actors, this piece urges critical infrastructure operators to patch proactively and validate security controls continuously.

A ransomware attack attributed to an Eastern European group forced Colonial Pipeline, supplier of nearly half the US East Coast's fuel, to shut down its entire system and triggered a federal response.