Operations | Monitoring | ITSM | DevOps | Cloud

Ryuk and Splunk Detections

Several weeks ago, my good friend Katie Nickels (Director of Intelligence at Red Canary extraordinaire) and I were chatting about Ransomware. She was super interested and passionate about some new uses of a ransomware variant named “Ryuk” (first detected in 2018 and named after a manga/anime character) [1]. I was, to be honest, much less interested. It turns out, as usual, Katie was right; this was a big deal (although as you will see, I’m right too… still dull stuff!).

Detecting & Preventing Ransomware Through Log Management

As companies responded to the COVID-19 pandemic with remote work, cybercriminals increased their social engineering and ransomware attack methodologies. Ransomware, malicious code that automatically downloads to a user’s device and locks it from further use, has been rampant since the beginning of March 2020. According to a 2020 report by Bitdefender, ransomware attacks increased by seven times when compared year-over-year to 2019.

How to Prevent, Detect, and Remove Spyware

Spyware is a type of malware that hides deep inside your computer. Unlike more visible types of malware, spyware lets you go about your tasks while secretly recording information—especially passwords and other sensitive credentials. Since spyware is difficult to notice, both home users and system administrators need to prioritize its prevention and detection. Thankfully, even if you have spyware, it’s easy to get rid of with the right tools.

Ransomware: 11 Steps You Should Take to Protect Against Disaster

The frequency and volume of ransomware attacks have increased dramatically in the past few years. Few people in the tech industry will forget the 2017 WannaCry attack, which infected over 200,000 computers in 150 countries worldwide and brought down part of the U.K.’s National Health Service, or the 2019 RobbinHood attack, which brought the Baltimore government to a standstill for nearly two weeks.

7 Tips to Prevent Ransomware

Ransomware is a malicious type of software that’s used to extort money from victims. It almost always promises to restore the data it encrypts or the operating system it locks, in exchange for a large sum of money. Networks seem to face threats from all directions, but there are ways to prevent malware attacks. Specialized software can protect your assets. In addition, there are other steps you can take to strengthen your ransomware prevention best practices.

How to protect your IT infrastructure from a Maze ransomware attack

Pitney Bowes, a global package delivery giant, has been hit by a second ransomware attack in less than seven months, according to ZDNet. Those responsible for the attack have released screenshots portraying directory listings from inside the company’s network. What is Maze ransomware and what makes it so special?

The Path of an Outlaw, a Shellbot Campaign

The ability of an actor to remain undiscovered or obfuscating its doings when driving a malicious campaign usually affects the gains of such campaigns. These gains can be measured in different items such as time to allow completion of operations (exfiltration, movement of compromised data), ability to remain operative before take down notices are issued, or ability to obtain gains based on for-profit driven crimeware (DDoS for hire, Crypto mining).

Detecting Malware and Watering Hole Attacks with Splunk UBA

You may be surprised to learn that a particular malware is responsible for data theft in over 20% of financial institutions and other verticals in 2019. Watering hole attacks involve a web server that hosts files or applications where the website or files on the site become weaponized with malware. While recent news cycles have shined a spotlight on ransomware and crimeware, malware is not a new concept.

Early Ransomware Detection and Response

The inability to access critical digital assets can be catastrophic to your operations. Ransomware is therefore one the scariest, but also most common online assaults. Join this webinar and learn how Flowmon, a leading network detection and response tool, helps to cover visibility gaps, detect ransomware and respond even prior to locking down digital assets. We will go through Flowmon's features via live demo and show you how to trace attackers’ footprints across the system.