Blog

Context On June 1, 2022, the United States Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigations (FBI), the Treasury Department, and the Financial Crimes Enforcement Network released a joint advisory with technical details and indicators of compromise for the Karakurt data extortion group. Karakurt is an advanced persistent threat (APT) group focused…

Context Microsoft has shared mitigation measures, which are included below, to block attacks exploiting the flaw, designated CVE-2022-30190, while a patch is being developed. Microsoft‘s entry for CVE-2022-30190 indicates it affects MSDT on all versions of Windows and Windows Server and has detected exploitation in the wild. The remote code execution vulnerability exists when Microsoft Support Diagnostic Tool (MSDT) is called using the…

Identity and access management (IAM) is a strategy for protecting critical information within your organization by limiting who is able to access privileged resources. With the rise of remote work and adoption of cloud-based work environments, identity can no longer be assumed based on location or device but must be verified by other authentication factors….

Context On May 25, 2022, multiple flights in India were grounded for several hours after the airline confirmed a ransomware attack on their internal systems that also disrupted their website functionality. On May 26, 2022, a small airline cancelled all flights leaving Gatwick in the United Kingdom from 1 to 3 p.m. BST due to…

A zero-trust approach to security, as the name implies, means that no user or application is inherently trusted. All access must be verified before permission is granted. A zero-trust approach relies on the principle of least privilege and microsegmentation of resources to limit access to just what is needed for the work being done. Behavior…

The cloud provides increased flexibility for businesses in today’s digital world, but the transition to cloud services has changed the nature of security. Old rules based on trusted on-premises perimeters are no longer relevant, and security teams must apply new standards to ensure compliance with data regulations and security best practices. This is where cloud…

Summary The notable ransomware gang known as Conti has, according to security firm Advanced Intel (AdvIntel), taken its infrastructure offline and shut down its ransomware operations. While public-facing ‘Conti News’ data leak and the ransom negotiation sites are still online, the Tor admin panels used by Conti members to perform negotiations, publish news, and generate…

Context On May 19, 2022, security researchers at Sentinel Labs released technical details of a campaign targeting the Rust development community with a supply-chain attack by leveraging a malicious crate. The Rust Security Response Working Group released an advisory regarding the malicious crate on May 10, 2022. The malicious crate was named “rustdecimal,” likely intended…

You want to take advantage of the benefits of a public cloud environment, including cost savings and increased flexibility, but you’re not quite ready to relinquish complete control of your most sensitive data. A hybrid cloud strategy is the solution for organizations that want the best of both worlds. A hybrid environment allows companies to…

Context On May 12, 2022, Apache released an advisory regarding a high severity vulnerability in Apache Tomcat. The vulnerability, designated CVE-2022-25762, affects Tomcat versions 9.0.0.M1 to 9.0.2o and 8.5.0 to 8.5.75. Apache advises users to upgrade to 9.0.21 or later or 8.5.76 or later to mitigate the vulnerability. A May 16, 2022 advisory from CISA…