The cyber threat landscape is complex and includes many vectors of attack. Organizations face critical security challenges every day, such as stolen employee credentials, fake websites, and social media impersonation. Taking a binary point of view, those threats can be divided into two simplistic dimensions: external and internal. According to the 2023 Verizon DBIR, the external threats consume 83% of the total threats.

Indicators of Compromise, or IOCs, refer to artifacts or clues that may be identified on a network or system indicating a potential security breach. They can be Ips, domain names and more.

Amid the disruption of the Hive ransomware group by law enforcement agencies, Hunters International emerged onto the cyber scene in Q3 of 2023, displaying notable technical similarities with Hive, hinting at an evolutionary progression or branch-off from the dismantled group. This transition underscores the adaptive nature of cybercriminal networks, persisting in their illicit activities despite law enforcement actions.

Windows Installers (.msi files) are a known vector of malware distribution. Although not quite common, they have been used by threat actors to distribute malware of all sorts. During July 2024, the Cyberint Research Team noticed somewhat of an uptick in the usage of malicious.msi files. Among the various samples we noticed a specific variant of malicious installer being actively used in the wild, disguised as legitimate applications or update installers and targeting Korean and Chinese speakers.

NIST has long been an important acronym in the world of cybersecurity, where organizations have for years used the NIST Cybersecurity Framework to help guide their security investments. But the practices and controls associated with NIST have evolved recently, due to the release of NIST 2.0. If you’re stuck in the era of NIST 1.x, it’s time to adapt.

The ransomware group – RansomHub – has emerged as a significant player in the ransomware landscape, making bold claims and substantiating them with data leaks. It emerged after the Federal Bureau of Investigation (FBI) disrupted ALPHV’s ransomware operation on December 19, 2023. There are assumptions that RansomHub is the “spiritual successor” of ALPHV group that operates with the help of former ALPHV affiliates.