Egregor Ransomware Attack on Kmart is a Reminder that Active Directory Needs to Be Protected and Recoverable

Standard forensics isn't enough once AD and Entra ID are compromised. This IFIR introduction covers hunting identity backdoors like ACL persistence and SYSVOL malware, and why recovery matters.

How Ryuk, Maze and SaveTheQueen weaponized Active Directory: human-operated campaigns chain TrickBot/Emotet loaders into Cobalt Strike, then use BloodHound/SharpHound and Mimikatz for AD recon and credential theft—against the Zerologon backdrop.

Wiz examines 'malware-less' database ransomware: exposed MySQL, PostgreSQL and MongoDB servers with weak auth are looted, wiped and ransomed via native commands — no malware to detect.

Learn about the evolving ransomware landscape, including how attackers operate, the roles within the ransomware economy, and actionable strategies to strengthen your defenses.

A Viettel Cyber Security analysis of the current trend of APT groups combining their operations with ransomware attacks.

An in-depth Viettel Cyber Security study examining the ransomware threat landscape and attack trends across Vietnam.