Tweet

@Sophos

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @SophosXOps

Sophos X-Ops

@SophosXOps

Aug 11

NEW: Excel 4.0 macros, also known as XLM 4.0 macros, have been around for a long time – 30 years! They’ve become very popular with threat actors as an alternative to VBA macros. 1/14

These macros are specific to Excel and are commonly used by organizations, but can easily be weaponized. Add in a wide variety of obfuscation techniques, and it’s no wonder that threat actors love them. 2/14

The Knotweed threat actor used Excel 4.0 macros in 2021 (microsoft.com/security/blog/…).

Ransomware actors are also heavy users.

As were Trickbot, Zloader, Qakbot, Dridex, and more. 3/14

Read 14 tweets

Sophos X-Ops

@SophosXOps

Aug 10

3 attackers, 2 weeks – 1 entry point...

Lockbit, Hive, and BlackCat attack an automotive supplier in this triple #ransomware attack.

After gaining access via RDP, all three threat actors encrypted files, in an investigation complicated by event log clearing and backups.

1/17

In May 2022, an automotive supplier was hit with three separate ransomware attacks. All three threat actors abused the same misconfiguration – a firewall rule exposing Remote Desktop Protocol (RDP) on a management server – but used different ransomware strains and tactics. 2/17

The first ransomware group, identified as Lockbit, exfiltrated data to the Mega cloud storage service, used Mimikatz to extract passwords, and distributed their ransomware binary using PsExec. 3/17

Read 17 tweets

Sophos X-Ops

@SophosXOps

Aug 9

NEW: Multiple attackers increase pressure on victims, complicate incident response

Sophos’ latest Active Adversary report explores the issue of organizations being hit multiple times by attackers...

1/17

@Sophos

There’s a well-worn industry phrase about the probability of a cyberattack: “It’s not a matter of if, but when.”

Some of the incidents @Sophos recently investigated may force the industry to consider changing this: The question is not if, or when – but how many times? 2/17

In an issue we highlighted in our Active Adversary Playbook 2022, we’re seeing organizations being hit by multiple attackers. 3/17

Read 17 tweets

Sophos X-Ops

@SophosXOps

Mar 30

NEW: Reconstructing PowerShell scripts from multiple Windows event logs

On the trail of malicious #PowerShell artifacts too large to be contained in a single log? Help is on the way.

1/19

Adversaries continue to abuse PowerShell to execute malicious commands and scripts. It's easy to understand its popularity among attackers: Not only is it present on all versions of Windows by default (and crucial to so many Windows applications that few disable it)... 2/19

... this powerful interactive CLI and scripting environment can execute code in-memory without malware ever touching the disk. This poses a problem for defenders and researchers alike. 3/19

Read 19 tweets

Sophos X-Ops

@SophosXOps

Mar 29

NEW on #Log4Shell...

Horde of miner bots and backdoors leveraged #Log4J to attack VMware Horizon servers

1/14

In the wake of December 2021 exposure of a remote code execution vulnerability (dubbed “Log4Shell”) in the ubiquitous Log4J Java logging library, we tracked widespread attempts to scan for and exploit the weakness—particularly among cryptocurrency mining bots. 2/14

The vulnerability affected hundreds of software products, making it difficult for some organizations to assess their exposure. 3/14

Read 14 tweets

Sophos X-Ops

@SophosXOps

Mar 3

NEW 🧵on Conti...

We published some news this week about Conti. In brief, a #Conti affiliate infiltrated the network of a healthcare provider that a different #ransomware threat actor had already penetrated.

The technical debt in healthcare is dangerous.

1/23

But Conti, in particular, attracts a particularly aggressive group of affiliates. And we have another, previously untold, Conti-adjacent story about one of their ransomware affiliates.

It serves as a cautionary tale that not all attackers are necessarily after a ransom. 2/23

This past January we were contacted by a customer in the Middle East to investigate a malware incident that began in mid-December, 2021. The target, in the financial services industry, discovered lateral movement and backdoors in their network the week before new year's day. 3/23

Read 23 tweets

Share this page!

Sophos X-Ops

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @SophosXOps

Sophos X-Ops

Sophos X-Ops

Sophos X-Ops

Sophos X-Ops

Sophos X-Ops

Sophos X-Ops

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?