Drawing on extensive proprietary research, Trustwave SpiderLabs believes the threat actors behind the Facebook malvertising infostealer SYS01 are the same group that developed the previously reported Rilide malware. Facebook Malvertising Epidemic – Unraveling a Persistent Threat: SYS01 – Part 2 lays out evidence tying the latest Rilide (V4) version to SYS01. The report noted the code from the two malware types overlaps in too many areas to be a simple coincidence.

Drawing on extensive proprietary research, Trustwave SpiderLabs believes the threat actors behind the Facebook malvertising infostealer SYS01 are the same group that developed the previously reported Rilide malware. Facebook Malvertising Epidemic – Unraveling a Persistent Threat: SYS01 – Part 2 lays out evidence tying the latest Rilide (V4) version to SYS01. The report noted the code from the two malware types overlaps in too many areas to be a simple coincidence.

Trustwave SpiderLabs uncovered multiple stored cross-site scripting (XSS) vulnerabilities (CVE-2024-37394, CVE-2024-37395, and CVE-2024-37396) in REDCap (Research Electronic Data Capture), a widely used web application for building and managing online surveys and databases in research environments. These vulnerabilities, if exploited, could allow attackers to execute malicious JavaScript code in victims' browsers, potentially compromising sensitive data.

Most homeowners know that a lock is a good idea as a basic defense against invaders, and leaving the front door unlocked is simply unwise. Unfortunately, when it comes to creating a strong cyber defense it’s not that simple. Attackers have been evolving their intrusion techniques over decades, focused on one goal, relentlessly probing for weaknesses to enter your domain.

The decision on whether to implement the Microsoft Security offerings available with the Microsoft 365 E5 license certainly involves deep security discussions, but it's also a business decision. In that respect, this process allows security leaders to engage with their CFO and other business leaders to elevate conversations.

The cybersecurity threat landscape is constantly evolving, requiring organizations to regularly evaluate their security stack to ensure it not only offers the highest level of protection, but is operated by a firm with a long track record of developing, implementing, and properly maintaining the highest quality security tools.

For the second week in a row, Trustwave proudly announces recognition from the industry analyst firm Gartner. Today, Trustwave is proud to reveal that Gartner has named us as a Representative Vendor in the 2024 Gartner Market Guide for Digital Forensics and Incident Response (DFIR) Retainer Services. This news follows Trustwave's announcement last week stating we were named a Representative Vendor in the 2024 Gartner Market Guide for Managed Detection and Response.

Few repositories of cybersecurity knowledge are as broad, deep, and widely respected as Trustwave Security Colony. The industry analyst firm IDC has praised Security Colony, which sees clients and others interested in learning more about their cybersecurity posture download thousands of resources every month, much of which is available for free. IDC deemed this information so important that, in a recent report, it named Security Colony a "differentiator" from others in the field.

With all the issues happening in cybersecurity technology lately, such as CrowdStrike’s software update that caused massive outages worldwide last week, it behooves all organizations to take a serious look at their security stack with an eye toward paring it down to help reduce your threat landscape.

For many enterprises, cloud resources are becoming the data center's core. As these resources grow, it can be difficult for IT staff to keep up with daily administrative tasks, let alone learn the skills to provide security protections. So, how does one protect a variety of workloads in the cloud without having to worry about security misconfigurations?

Trustwave SpiderLabs issued a warning that threat actors may attempt to take advantage of CrowdStrike’s software update that caused widespread outages by using the news as the center of a social engineering scheme to convince people to open malicious phishing emails or fall for other types of attacks. Using this news cycle is nothing new.

For the second consecutive year, Trustwave has been named a Representative Vendor in the 2024 Gartner Market Guide for Managed Detection and Response. "We are honored Gartner has yet again named Trustwave a Representative Vendor for MDR," said Trustwave CEO Eric Harmon. "It is well understood that organizations today face a wide variety of threats that are best combatted by a world-class team of analysts and researchers like Trustwave SpiderLabs.

Too many consumers have awoken one morning to find messages from a retailer or their bank detailing purchases made through their account of which they were unaware. While the realization that they have been hacked will cause some well-deserved panic for the account holder, it usually only takes a few phone calls to cancel purchases, change a password, and cancel a credit card to put a stop to the problem.

The world is just beginning to understand how the intersection of artificial intelligence (AI) and data privacy will impact organizations, their employees, and those who use their services. As of June 2024, there are simply too many unknowns.

When working with Amazon Web Services (AWS), we often find that various AWS services need to store and manage secrets. AWS Secrets Manager is the go-to solution for this. It's a centralized service designed to help manage sensitive information securely, significantly reduce the risk of credential compromise, and facilitate your credential management process. However, there's more to it than just storing secrets.

Building an effective Security Operations framework that provides the right balance of people, processes, and technologies can take years. Here we’ll discuss some foundational topics that can be used to grow an effective SOC Operation.

AT&T reported on July 12 that an internal investigation had revealed that the telecommunication provider had been victimized by a third-party breach,resulting in the compromise of records of calls and texts of nearly all of AT&T’s cellular customers. An AT&T spokesperson confirmed to a news source that the breach resulted from of the data stolen from cloud storage firm Snowflake.

The Trustwave SpiderLabs Threat Intelligence team's ongoing study into how threat actors use Facebook for malicious activity has uncovered a new version of the SYS01 stealer. This stealer is designed to take over Facebook accounts, steal credential information from affected users' browsers, and then leverage legitimate accounts to further the spread of the malware.

DynamoDB is a fully managed NoSQL database service offered by Amazon Web Services (AWS). It is renowned for its scalability, dependability, and easy connection with other AWS services. Notwithstanding its manifold advantages, organizations continue to place a high premium on guaranteeing the security of data stored in DynamoDB. By default, DynamoDB can be accessed over the public network using HTTPS, ensuring secure communication with SSL/TLS encryption.

As organizations consider their journey to establishing a strong Zero Trust culture, they must adopt a data-centric approach, and this begins with ensuring database security. Data, or more specifically, knowing your data, is at the heart of Zero Trust. This means databases must be considered critical assets with the appropriate security considerations applied.

Trustwave SpiderLabs has put together nine vertical threat reports over the past 12 months, but in its most recent effort, the 2024 Professional Services Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies report, our team of elite researchers delve into one of the broadest and most complicated vertical sectors yet covered.

Threat Intelligence, or just TI, is sometimes criticized for possibly being inaccurate or outdated. However, there are compelling reasons to incorporate it into your cybersecurity defense strategy. Let’s present some ways to use TI effectively as part of your security operations lifecycle.

Cybersecurity is no longer solely an IT department’s concern; it's a company-wide responsibility. But with busy schedules and overflowing inboxes, getting employees to truly pay attention to cybersecurity training can feel like an uphill battle. Let’s start off with why too many staffers are apt to mentally tap out when taking an awareness course. Now, let’s look at how to design a cybersecurity awareness program that will keep employees engaged and informed.

As companies look to realize the full value of Microsoft Security products, they may find a managed security service provider can play a key role in helping them maximize the value of their investment. For many companies, the Microsoft 365 E5 license makes good business sense. In addition to the Office suite of productivity applications, E5 includes expanded capabilities for Microsoft cybersecurity solutions for endpoint detection and response (EDR), identity and access management (IAM), and more.

It’s impractical to operate security operations alone, using manual human processes. Finding opportunities to automate SecOps is an underlying foundation of Zero Trust and an essential architecture component for enterprise-scale SOCs. Let’s discuss what SOAR is, its common uses, and the future of SOAR with AI.