Read expert perspectives and industry news.

The creators of DARKSIDE ransomware and their affiliates have launched a global crime spree affecting organizations in more than 15 countries and multiple industry verticals.

Over time people have had an on-again, off-again interest in  Event Tracing for Windows  (ETW). ETW, first introduced in Windows 2000, is a lightweight Kernel level tracing facility that was originally intended for debugging, diagnostics and performance. Gradually, however, defenders realized that ETW provided metrics and data content that was not otherwise available without custom development efforts. Even so, aside from a number of big players in the industry, people have been slow to adopt ETW as a data source for detection and research. The two primary problems with ETW are: the complexities involved in event collection, and the volume of data that is generated. The task of looking through a haystack to find the proverbial needle is not necessarily appealing from an engineering perspective (How do you store the data? How do you process the data? Is the data really valuable? What were we looking for again?).

Our latest white paper provides hardening and detection guidance to protect against a destructive attack within an environment.

Mandiant uncovered and publicly disclosed a widespread attacker campaign that is being tracked as UNC2452 . In some, but not all, of the intrusions associated with this campaign where Mandiant has visibility, the attacker used their access to on-premises networks to gain unauthorized access to the victim’s Microsoft 365 environment. Learn more about the techniques used by UNC2452, as well as an auditing script to check for indicators of some of these techniques.

Check out the second post in our four-part blog series on CARBANAK.

This blog covers the growing trend of cyber criminals using blockchain domains for malicious infrastructure.

This blog post discusses the various trends that we have been observing related to cryptojacking activity.

We kick off CARBANAK Week with the first post in our four-part blog series.