Resources Blog | Threat Intelligence Blog | Resources

Emotet rises from the dead, uses its old payload Trickbot to rebuild itself
North Korea state actors target security researchers with compromised analysis software
Research highlights the TLDs preferred by attackers for different types of malicious activity

Podcast

Threat Set Radio #143

This week’s Threat Intel news:

US charges 2 suspected major REvil ransomware operators
Conti ransomware gang make grovelling apology to Arab Royals over data leak
TeamTNT hackers target your poorly configured Docker server

Podcast

Threat Set Radio #142

This week’s Threat Intel news:

Darkside hit with a $10m bounty as fallout of Colonial Pipeline attack continues.
Critical Linux kernel vulnerability disclosed.
FBI releases advisory stating ransomware gangs specifically target victims in financially sensitive negotiations.

Podcast

Threat Set Radio #141

This week’s Threat Intel news:

Avoslocker reportedly hits Gigabyte, possibly obtains files enabling supply chain attacks.
Conti begins selling access to non compliant victims networks.
Rootkit discovered bearing a valid Microsoft signature after evading vetting process.

Podcast

Threat Set Radio #140

This week’s Threat Intel news:

Macaw Locker is Evilcorps latest ransomware strain rebrand to evade sanctions.
Trickbot uses new tricks for distribution.
FIN7 creates fake English cybersecurity firm to hire pen-testers to perform criminal attacks.

Podcast

Threat Set Radio #139

This week’s Threat Intel news:

New EU legislation could ban anonymous domain registration, in an effort to curb cyber crime
FINN12 becomes the first ransomware affiliate to be elevated to threat actor level, targets healthcare
SnapMC skips the traditionally most important part of ransomware, and just plain extorts victims

Podcast

Threat Set Radio #138

This week's Threat Intel news:

Ransomware operators arrested and ill gotten gains seized in Ukraine
Atom Silo ransomware strain targets Confluence servers and employs novel evasive measures
Apache Airflow vulnerability morphs into remote code execution as POC is released

Podcast

Threat Set Radio #137

This week's Threat Intel news:

Microsoft scrambles to register autodiscover domains exploited in flaw it was warned of years ago.
The Conti ransomware gang target new recruits with specific backup destruction experience.
FoggyWeb malware attributed to the group behind the infamous Solarwinds attack.

Podcast

Threat Set Radio #136

This week's Threat Intel news:

OS compatibility features abused to stealthily deliver malware
VMware notifies customers of particularly concerning vulnerability prior to disclosure
US government poised to sanction Crypto exchanges which have dealt with cyber criminals

Podcast

Threat Set Radio #135

This week's Threat Intel news in just 7 minutes:

The recent Apple hack
Dark web forum Marketo making a name for themselves
Update on recent ransomware activity

Podcast

Threat Set Radio #134

This week's Threat Intel news in just 6 minutes:

New malware technique observed using CLFS log files to evade detection.
REvil returns after 2 months of hiding, attacks UK based ITSP with DDoS attacks.
Babuk source code leaked by ransomware developer dying due to stage 4 lung cancer.

Podcast

Threat Set Radio #133

This week's Threat Intel news in just 7 minutes:

Lockfile ransomware uses intermittent file encryption to bypass protections.
Microsoft exchange flaw can enable remote theft of entire mailbox.
BazaLoader uses fake DMCA takedown and DDoS notices as lures to deliver malware.

Podcast

Threat Set Radio #132

This week's Threat Intel news in just 7 minutes:

Details emerge on Fin8’s newly developed backdoor
Razer products allow alarmingly easy local privilege escalation
Proxyshell attacks on the rise despite patch issued months ago

Report

Ransomware Perceptions Report, 2021

Blog

Is Cyber Insurance Driving the Ransomware Crisis? Key Roundtable Takea

Podcast

Threat Set Radio #131

Some showstoppers this week, get the low down on:

Blackbaud in court battle over downplaying the severity of its 2020 ransomware attack
Almost half of US hospitals have shut down networks due to ransomware, new report shows
Possible terrorist suspect and no fly list exposed on Elasticsearch cluster with no password

Webinars

Live Debate: Is Cyber Insurance Driving the Ransomware Crisis?

Podcast

Threat Set Radio #130

This week we're discussing:

Gigabyte, and American Megatrends GIT breached by RansomEXX
Accenture hit by Lockbit RaaS operation in the wake of REvil and Darkside winding down
Vulnerability disclosed in Arcadyan router firmware present for over a decade

Podcast

Threat Set Radio #129

This week we're discussing:

Darkside returns, rebranding as Blackmatter following the Colonial Pipeline attack
Disgruntled Conti ransomware affiliate leaks the groups playbook and training materials
ENISA concludes current protections will fold to supply chain based attacks based on recent examples

Podcast

Threat Set Radio #128

This week we're discussing:

Doppelpaymer looks to be performing a fairy obvious rebrand.
The Babuk groups new ransomware forum ironically held to ransom.
The no more ransom initiative saves over a billion in payments after 5 years in operation.

Podcast

Threat Set Radio #127

This week we're discussing:

Kaseya obtains decryption master key, but is remaining quiet about its origin
Printer vulnerability nearly old enough to drive affects millions of machines
Windows zero day privilege escalation vulnerability affects even unreleased Windows 11

Report

Hybrid SOC: Cure Your Cyber Security Headaches

Webinars

The Threat of Ransomware to UK Businesses and How to Mitigate it

Blog

A Ransomware Briefing for UK Businesses: Key Roundtable Takeaways

Podcast

Threat Set Radio #126

This week we're discussing:

New Solarwinds vulnerability under active exploitation
REvil disappears from the face of the earth following Kaseya attack fallout
Trickbot resurgence with new capabilities

Podcast

Threat Set Radio #125

Kaseya made headings this week with a supply chain attack claiming approximately 1500 victims, and the largest ever ransom demand of $70m. Also, After OOB patch addressing PrintNightmare released by Microsoft, researchers discover a complete bypass.

Podcast

Threat Set Radio #124

In this week's bulletin we're discussing:

Criminal VPN service taken down by law enforcement, who claim to have seized customer logs.
Code to exploit windows print spooler service accidentally released, disable ASAP.
Babuk ransomware building tool leaked to VT and immediately used by copycats.

Podcast

Threat Set Radio #123

Ransomware continues to dominate the headlines this week, we'll be discussing:

Clop ransomware chugs onward despite arrests of multiple members and equipment seizures.
700GB of ADATA files publicly released following refusal to pay ransom.
Data leak marketplace attempts to entice competitors into buying rivals compromised data.

Blog

Join the #RansomAware Movement

Blog

Security in the Cloud

Podcast

Threat Set Radio #122

In this week's episode we're discussing:

Avaddon, responsible for almost a quarter of all ransomware attacks in 2021, calls it quits.
EA reportedly breached via slack channel used to obtain MFA login token.
SITA, IT provider for 90% of the airline industry, hit by longform supply chain attack.

Podcast

Threat Set Radio #121

In this week's episode we're discussing:

Evilcorp attempts to imitate other criminal group to evade sanctions
Attackers are actively looking to leverage new VMware vulnerability with working PoC code
Colonial ransomware incident attributed to old VPN password found in previous breaches
Largest stolen credentials market taken down by joint operation

Podcast

Threat Set Radio #120

In this week's episode we discuss:

HaveIBeenPwned partners with the FBI
Worlds largest meat producer hit by REvil ransomware attack
Group responsible for the Solarwinds nightmare begins new campaign
Babuk group moves away from encryption, toward data extortion model instead

Podcast

Threat Set Radio #119

This week we report on, The SolarWinds attacker's NOBELIUM's latest campaign, 8 individuals arrested in connection with Royal Mail smishing campaign & a cheese loving drug dealer sentenced to 13 years

Podcast

Threat Set Radio #118

This week we report on New Zealand hospitals infected by ransomware, cancels surgeries, Colonial Pipeline CEO confirms $4.4 million payment & Qlocker ransomware shuts down after extorting hundreds of QNAP users.

Podcast

Threat Set Radio #117

This week we're focusing on the Colonial pipeline ransomware attack, the aftermath, and the potential long term consequences.

Podcast

Threat Set Radio #116

In this week's episode we're discussing:

Dell kernel bugs have the potential to be used against an install base of hundreds of millions
New spectre flaw surfaces, bypasses all current protections
A student delivers Ryuk onto research institute estate after downloading cracked software

Podcast

Threat Set Radio #115

In this week's episode - Another supply chain style attack, this time breaches an enterprise password manager, Babuk gets uncomfortably close to the plot of a bond film, threatening to expose informants if ransom goes unpaid and the “most reliable” UK rail network hit by ransomware as directors mail account hijacked.

Webinars

Mapping risk and understanding your threat coverage

Podcast

Threat Set Radio #114

This week we cover:

Codecov compromised in another large supply chain attack
Ryuk updates its techniques to include novel evasion methods
The Bazarloader campaign uses collaboration platforms to increase infection rate

Podcast

Threat Set Radio #113

This week we cover FBI accesses exchange servers still affected by proxylogon without consent, Zoom RCE vulnerability requiring no user interaction debuted at Pwn2Own and US Government finally formally charges APT29 with Solarwinds breach.

Podcast

Threat Set Radio #112

In this week's episode we'll be discussing:

LinkedIn job offer phishing delivers more_eggs
VMWare suffers another critical vulnerability, this time in security platform
SAP issues advisory on how quickly attackers reverse engineer their own patches

Podcast

Threat Set Radio #111

In this episode we'll be discussing:

Insurance Giant CNA hit by new ransomware strain tied to Evilcorp
Official PHP Git server appears to have been compromised, and a supply chain attack attempted
Ransomware group pledges to return payments, after pocketing a tidy profit due to Bitcoin inflation

Podcast

Threat Set Radio #110

In this week's episode we're discussing:

Multiple high profile hackers charged, after targeting multiple companies including Tesla.
Acer hit by ransomware demanding largest known ransom demand to date, 50 million USD
Evil corp reportedly creates Wastedlocker spinoff to evade sanctions on ransom payment.

Podcast

Threat Set Radio #109

In this week's episode we discuss:

6 Distinct APTs leveraged the exchange 0-day prior to patch, indicating previously unseen co-operation.
Ransomware joins the list of post exchange exploit activity with the new strain “Dearcry”
Trickbot takes the crown once held by Emotet prior to its takedown.

Webinars

Hybrid SOC: Improving Security Outcomes Through Collaboration & T

Podcast

Threat Set Radio #108

This week we report on:

the Hafnium hack, posing a new long-term threat for already overtaxed cyber workers,
operators of REvil ransomware threatening DDoS attacks and increase intimidation techniques by threatening Journalists and Business Partners over the phone,
and the breach of 150,000 Verkada surveillance camera feeds for the NHS, Tesla and numerous other large organisations.

Podcast

Threat Set Radio #107

In this week's episode we give you the lowdown on:

Ryuk develops self propagation capabilities, possibly due to Emotet takedown.
Four exchange vulnerabilities cause Microsoft to fear a repeat of the past.
Maza, infamous and exclusive Russian cybercriminal forum, suffers breach.

Podcast

Threat Set Radio #106

In this week's episode we discuss:

Critical VMware vulnerability discovered, present in the default install of the majority of enterprise data centers.
Tool previously believed to be made by Chinese APT group appears to be cloned stolen NSA tool.
New details emerge regarding browser zero day used to target security researchers.

Podcast

Threat Set Radio #103

In this weeks episode we discuss the following news stories:

Google patches the Chrome zero day suspected of use in targeted attacks against security researchers
Windows installer vulnerability is now exploitable for a 6th time as yet another bypass method is released
Trickbot continues to evolve and adapt following takedown attempt, this time adding a MassScan module

Podcast

Threat Set Radio #105

In this episode we discuss the following news items:

Jones Day law firm files released after the company refuses to pay ransom
Accelion product responsible for data breach is retired after decades of operation
Kia Motors America fall afoul of a Doppelpaymer ransomware attack
Microsoft claims the Solarwinds Orion compromise was the work of over 1000 engineers

Podcast

Threat Set Radio #104

This week we report on remote Desktop Protocol Attacks surging by 768%, hacker modifying drinking water chemical levels in Florida and Cyperpunk 2077 creator CD Projekt Red hit with a ransomware attack.