Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Semperis Identity Attack Watch: January 2021

semperis.com | incident | #active-directory | #ransomware | #sap | #revil | #news-roundup | #ghost-attacks

Summary

January 2021 roundup: an exploit for SAP's SolMan, the 'Active Directory of SAP'; Sophos-described ghost attacks where intruders added AD domain-admin accounts undetected; and REvil's Dairy Farm hit, using AD screenshots as extortion proof.
Published
Collected

original ↗

Related coverage

blog · semperis.com
Identity Attack Watch: October 2021
October 2021 roundup: Sinclair's corporate AD domain hit by ransomware; Microsoft warned on risky service-provider access; REvil infrastructure taken down; BlackMatter struck Olympus again; Exchange Autodiscover leaked 100,000 credentials.
blog · semperis.com
Identity Attack Watch: July 2021
July 2021 roundup: the MeteorExpress wiper abused AD Group Policy against Iran's rail system; Microsoft fixed PetitPotam and other flaws; CISA ordered PrintNightmare patches; SolarWinds fell to a Serv-U zero-day; REvil struck via Kaseya.
blog · semperis.com
Identity Attack Watch: June 2021
June 2021 roundup: Colonial Pipeline traced to a stolen inactive VPN account; FujiFilm shut down by Qbot/REvil; JBS paid $11M; REvil hit nuclear contractor Sol Oriens; and the UK's NCSC warned schools to harden defenses.
incident · semperis.com
Identity Attack Watch: AD Security News, January 2023
January 2023 roundup: Sandworm deployed SwiftSlicer wipers via AD Group Policy in Ukraine; Vice Society hit a German university and Fire Rescue Victoria; LockBit struck Royal Mail and Wabtec.
incident · semperis.com
Identity Attack Watch: November 2022
November 2022 roundup: Sandworm spread RansomBoggs via domain controllers in Ukraine; LockBit hit Southampton County and Continental; Vice Society struck Cincinnati College; Black Basta hit Sobeys.
incident · semperis.com
Identity Attack Watch: October 2022
October 2022 roundup: Microsoft warned of Prestige ransomware hitting Ukraine/Poland logistics via domain admin credentials; Hive attacked Tata Power; LockBit breached UK dealer Pendragon.
back