rapid response – PossibleThreat Articles

Rapid Response: The Squirrelwaffle Incident Guide

February 15, 2022 0 Comments featured, malware, mtr, proxylogon, proxyshell, rapid response, security operations, sophos xdr, squirrelwaffle

Credit to Author: Tilly Travers| Date: Tue, 15 Feb 2022 13:00:10 +0000

Squirrelwaffle is a malicious dropper or loader used to deliver other malware onto target systems. This guide shows Security Operations Centers (SOCs) and Incident Response Teams how to detect and respond to the presence of Squirrelwaffle on the network

Security Sophos

Windows services lay the groundwork for a Midas ransomware attack

February 2, 2022 0 Comments anydesk, dism, dismcore.dll, midas, PowerShell, Ransomware, rapid response, teamviewer, threat research

Credit to Author: Andrew Brandt| Date: Tue, 25 Jan 2022 12:30:13 +0000

Attackers took two months to craft and install PowerShell scripts as services before deploying the ransomware