Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Arctic Wolf

Initial Access Brokers: What They Are, How They Gain Access, and Who Uses Their Services

Imagine a burglar. They’ve spent large amounts of time researching their target — your house. They’ve perfected their infiltration techniques, found your weak points, learned your schedule, and know the best time to strike. They’ve shown up when you least expect it and jimmied open the lock on the back door. And now, rather than head inside and steal your valuables, they hold the door open for someone else.

Lorenz Ransomware Intrusion: Understanding Your Risk

The Arctic Wolf Labs team recently investigated a Lorenz ransomware intrusion, which leveraged a Mitel MiVoice VOIP appliance vulnerability (CVE-2022-29499) for initial access and Microsoft’s BitLocker Drive Encryption for data encryption. Lorenz is a ransomware group that has been active since at least February 2021 and like many ransomware groups, performs double-extortion by exfiltrating data before encrypting systems. Over the last quarter, the group has primarily targeted small and medium businesses (SMBs) located in the United States, with outliers in China and Mexico.

Chiseling In: Lorenz Ransomware Group Cracks MiVoice And Calls Back For Free

The Arctic Wolf Labs team recently investigated a Lorenz ransomware intrusion, which leveraged a Mitel MiVoice VoIP appliance vulnerability (CVE-2022-29499) for initial access and Microsoft’s BitLocker Drive Encryption for data encryption. Lorenz is a ransomware group that has been active since at least February 2021 and like many ransomware groups, performs double-extortion by exfiltrating data before encrypting systems.

A Security Leader's Guide to Leveraging MDR

Each organization has its own unique attack surface, operating model, and risk tolerance. The challenge for CISOs (Chief Information Security Officers) and IT teams is how to keep business running smoothly, without interruption, while at the same time securing and protecting data. And, since every organization is different, no single strategy will work for everyone.

Car Dealerships: Dealers Must Bolster Data Security Under New FTC Rule

The Federal Trade Commission has recently updated the 2003 Gramm-Leach-Bliley Act ‘Safeguards Rule’ to create new standards and procedures that will apply to auto dealerships and go into effect in December 2022. The Safeguards Rule outlines the standards required for the protection of consumer data. The new updates create stricter criteria and procedures that car dealers will need to implement, both to reduce the risk of a data breach and to better protect customer data.

The Top Cyber Attacks of August 2022

Ransomware dominated the cybersecurity sphere yet again in August, with victims ranging from wealthy European nations to humble libraries to one of the most storied franchises in American sports. Also, people who send disgusting pranks via mail got some of their business put out on the street. What can we say, it was a weird month. Here are some of the breaches, hacks, and attacks that captured our attention in August 2022.

vxIntel Joins Arctic Wolf to Boost Detection and Threat Intelligence

I’m excited to announce that vxIntel, a leading provider of cyber threat intelligence has joined Arctic Wolf. vxIntel’s Malware Intelligence Platform currently analyzes over 500,000 files each day and over 10 terabytes of data each month from over 100 global data sources.

Challenge Accepted Podcast - Finding Your First Job in Cybersecurity

Security is a journey, not a destination. Every organization — no matter their size or age — should be constantly working to level up their cybersecurity. It’s the kind of process that can be continually reworked, reevaluated, and honed as organizations grow and evolve, and as the cyber threat landscape changes. The question, of course, is where to start?

Recent Phishing Attack Highlights How Hacks Are Changing

Hackers are getting smarter, and phishing is becoming more sophisticated. Most employees know that when an email comes in from a random address, rife with misspellings, and credentials or other private data demands, it’s absolutely a phishing scam. But what if, as an employee, you got a text to update your Okta credentials? What if the link took you to a domain that looked just like your Okta login?