Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Splunk

Security Insights: Investigating Ivanti Connect Secure Auth Bypass and RCE

On January 10th, 2024, Volexity reported that there is active exploitation in the wild against Ivanti Connect Secure (ICS) VPN devices. Ivanti and Volexity worked together to review impacted devices, and Volexity identified two different zero days, which have been assigned the following CVEs IDs.

Cybersecurity Trends for 2024: What's In & What's Out

Dissecting the cybersecurity landscape isn’t easy. Organizations are perennially under-prepared. Seemingly every person in the world has been affected by some company’s data breach. Then, we layer in the biggest tech news of 2023: the widespread experimentation and use of generative AI. Today, no one is immune from the threat of an attacker. Each organization must be ready. Organizations of all sizes must understand the evolving cybersecurity landscape in order to defend themselves.

Hypothesis-Driven Cryptominer Hunting with PEAK

Hypothesis-driven hunting is probably the most well-known type of threat hunting, and it’s one of the three types defined in the PEAK threat hunting framework. In this article, we’ll walk through a sample hypothesis-driven hunt, step-by-step. For our data, we’ll be using the Boss of the SOC Version 3 (BOTSv3) dataset, which you can use to recreate the hunt and work through it on your own. Below is a diagram of the Hypothesis-Driven hunting process.

Enter The Gates: An Analysis of the DarkGate AutoIt Loader

AutoIt is a scripting language designed for automating the Windows GUI and general scripting. Over the years, it has been utilized for malicious purposes, including AutoIt-compiled malware, which dates back to as early as 2008. Malware creators have exploited the versatility of AutoIT in a variety of ways, such as using obfuscated scripts for payload decryption, utilizing legitimate tools like BaSupportVNC, and even creating worms capable of spreading through removable media and Windows shares.

Defining & Improving Your Security Posture

The security posture of any organization is the result of comprehensive security strategies, processes and practices, which enable organizations to be resilient against evolving security threats. This article describes what we mean by “security posture”, including why it matters, and what comprises it. Importantly, we’ll also understand how to assess and improve the security posture.

What Is Hacktivism?

Not every cybercrime is about, well, the crime. In fact, some attacks are designed to draw attention to a cause, not stolen data or paydays. Social activism has been around forever. Today, it can manifest in the physical world, of course, and increasingly we see social activism in the digital world, too, ranging from minor activist activities all the way to high-profile cybercrime incidents.

Ransomware & Extortionware in 2024: Stats & Trends

In the underground cybercrime circles of the Dark Web, ransomware attacks are a particularly lucrative enterprise. These attacks are on the rise. And they’re disrupting the stalwart IT industry. The average cost of a ransom attack in 2023 was $1.54 million, almost double the previous year’s average. And research we gathered for The CISO Report show that 83% of organizations hit by a ransomware attack paid their attackers. Curious which industry is most likely to pay the ransom? Retail.

Security Testing for Mobile Applications in 2024

Mobile devices at the workplace: this so-called trend is here to stay. In response, IT teams are recognizing their responsibility to develop a secure and high-performance operating environment for their mobile and remote workforce. Mobile-related security risks have increased to astronomical levels in the last year: All that to say: a true organizational security posture cannot ignore the mobile apps and devices that its employees and customers use.

The National Cyber Workforce & Education Strategy (NCWES) Explained

Imagine a world where every cyber threat gets a swift and skilled response. This is the vision of the National Cyber Workforce and Education Strategy (NCWES), a program aimed at creating a future-proof cybersecurity workforce. Why is future-proofing our cybersecurity workforce so important? Because the cyber challenges of today and tomorrow require a diverse, well-educated, and agile workforce.

Secure AI System Development

Scientific progress in AI and downstream innovation to solve concrete real-world problems is part of a greater movement toward inventing Artificial General Intelligence (AGI). Broadly speaking, AGI is defined as an intelligent agent that can emulate and surpass human intelligence. Today, we are already familiar with incomplete forms of AGI: Despite these promising innovations moving from the scientific domain to consumer marketplaces, we are still far from achieving AGI.