Identity Attack Watch: March 2021

May 2021 roundup: SolarWinds actors escalated via Constant Contact (~150 orgs' email); APTs hit a U.S. local government via Fortinet flaws; Colonial Pipeline targeted Windows; Conti used domain credentials against Ireland's Health Service.

February 2021 roundup: SolarWinds hearings spotlighted identity gaps—on-prem entry and escalation to Office 365; DarkSide hit Brazil's Copel via privileged access tooling; malware encrypted AD at a New York school district, forcing a week's closure.

Semperis argues that testing backups under ideal conditions creates only an illusion of resilience; real cyber resilience is about staying recoverable when the plan fails and the assumptions behind it collapse.

Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.

December 2022 roundup: LockBit hit the Port of Lisbon and California's Department of Finance; Hive hit Louisiana's Lake Charles Memorial (270,000 patients); BlackCat hit Colombian energy firm EPM.

August 2022 roundup: Bumblebee loader aided AD attacks; Nobelium's MagicWeb backdoored ADFS; an Iranian group exploited Log4j against Israel; CVE-2022-30216 threatened domain controllers.