Qilin ransomware caught stealing credentials stored in Google Chrome
Credit to Author: Angela Gunn| Date: Thu, 22 Aug 2024 10:45:48 +0000
Familiar ransomware develops an appetite for passwords to third-party sites
Read moreIncident Response
Don’t get Mad, get wise
Credit to Author: Angela Gunn| Date: Tue, 13 Aug 2024 09:59:22 +0000
The “Mad Liberator” ransomware group leverages social-engineering moves to watch out for
Read moreRD Web Access abuse: Fighting back
Credit to Author: Angela Gunn| Date: Wed, 12 Jun 2024 18:59:54 +0000
Investigation insights and recommendations from a recent welter of incident-response cases
Read moreSophos Incident Response achieves NCSC Certified Incident Response (CIR) Level 2 status
Credit to Author: Sally Adam| Date: Tue, 14 May 2024 07:00:35 +0000
I am delighted to announce that the Sophos Incident Response service has been awarded U.K.’s National Cyber Security Centre (NCSC) Cyber Incident Response (CIR) Level 2 status by CREST. This assurance confirms that amid the sophisticated cybersecurity threat landscape, Sophos has the experience and capabilities to deal with incidents caused by financially motivated criminals, such […]
Read moreExtracting data from encrypted virtual disks: six methods
Credit to Author: Angela Gunn| Date: Mon, 13 May 2024 08:30:24 +0000
For incident responders, a variety of techniques for information retrieval from locked-up VMs
Read moreIt’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024
Credit to Author: Angela Gunn| Date: Wed, 03 Apr 2024 10:01:37 +0000
The latter half of 2023 found numerous fronts on which attackers failed to press ahead. Are defenders failing to take advantage?
Read moreRemote Desktop Protocol: The Series
Credit to Author: Angela Gunn| Date: Wed, 20 Mar 2024 16:18:21 +0000
What is RDP, why is it a very nearly ubiquitous finding in incident response, and how can investigators run it to ground it when it goes wrong? An Active Adversary Special Report
Read moreRemote Desktop Protocol: Exposed RDP (is dangerous)
Credit to Author: Angela Gunn| Date: Wed, 20 Mar 2024 16:16:34 +0000
Is it really that risky to expose an RDP port to the internet? What if you change the default port? What if it’s just for a little while? The data answers, loud and clear
Read moreRemote Desktop Protocol: Queries for Investigation
Credit to Author: Angela Gunn| Date: Wed, 20 Mar 2024 16:15:12 +0000
How can defenders begin to make sense of RDP issues on their networks? We present three powerful tools for investigators’ toolkits
Read moreRemote Desktop Protocol: How to Use Time Zone Bias
Credit to Author: Angela Gunn| Date: Wed, 20 Mar 2024 16:13:08 +0000
Where in the world is your attacker? Presenting a less-known but useful event to look for in your logs
Read more