There are a lot of hacktivist groups and known adversaries engaged in the cyber conflict around the
#IsraelPalestineConflict
.
@CrowdStrike
pulled together a graphic to highlight some of what we're seeing.
@CrowdStrike
has identified exploitation of
#log4j
vulnerability by threat actors that more closely resembles targeted intrusion consistent with advanced attackers, such as deploying web shells and conducting lateral movement.
I am very excited to publicly unveil our new
@CrowdStrike
Counter Adversary Operations! Consolidating our market leading Threat Intelligence and game changing OverWatch Threat Hunting teams into a new entity charged with raising the cost for adversaries!
@CrowdStrike
has identified a malicious Java class file hosted on infra associated with a nation state adversary. The Java code is used to download known instances of adversary specific tooling and is likely to be used in conjunction with the recently disclosed
#log4j
issue.
Does Scattered Spider seem to be everywhere? The scope of their intrusions since March 2022 from a
@CrowdStrike
perspective is pretty broad. They use social engineering, living off the land, and RMM tools before deploying ransomware or conducting extortion.
Very excited to release the
@CrowdStrike
2023 Global Threat Report today - get it here: See key insights into adversary behavior in 2022 and how the threat is evolving including data weaponization, cloud targeting, and more!
As we work with customers and partners to get systems fully restored, we are seeing threat actors try to take advantage of the situation. Here is intel on what we have seen related to the issues today:
Awesome work by
@CrowdStrike
Services and Intel teams breaking down how COZY BEAR conducts an operation and looks at their capabilities on linux too!
#ThreatIntel
#CyberSecurity
In addition to the blog we published () here is a timeline graphic we hope will be helpful in illustrating the years of offensive
#cyber
operations against
#Ukraine
by
#VoodooBear
Excited to announce the launch of the
@CrowdStrike
2024 Threat Hunting Report - it contains insights from the last year by our Overwatch team. Details the increase in targeting of Healthcare by ecriminals, exposes Famous Chollima, and more!
If you haven’t had a chance to read the
@CrowdStrike
Threat Hunting Report yet, I've got you covered! I will be providing a quick overview of the report along with a deep dive into an insider threat you may not have heard of we call famous chollima.
The CSRB findings from the summer 2023 breach of Microsoft are both alarming and confirm many of the concerns I've voiced about the risk of overreliance on their products.
@Microsoft
is a national security threat and it's time to take it seriously! 🧵
Detailed blog regarding kernel access and security architecture, hopefully this helps dispel some common misinterpretations about kernel access, specifically regarding the architecture of the Falcon sensor:
Setting the record straight regarding alleged vulnerabilities related to the channel file issue, bottom line: there is no mechanism to write to arbitrary memory addresses or control program execution, and we use cert pinning to mitigate MitM
The disruption of Snake malware, which CrowdStrike attributes to Russia-nexus adversary VENOMOUS BEAR, is a huge win for the U.S. & NATO against FSB’s Center 16. Operation MEDUSA highlights the importance of public/private collaboration to take down sophisticated adversaries.
In addition to the
@CrowdStrike
blog post today on Imperial Kitten - we have released a podcast detailing Iranian cyber operations going back over a decade - or where ever you enjoy podcasts.
#CyberSecurity
#threatintelligence
Awesome work from Nicolas Zilio, Ken Balint , and Marco Ortisi!
Discovering and Blocking a Zero-Day Exploit with
@CrowdStrike
Falcon Complete: The Case of CVE-2023-36874
@CrowdStrike
has a blog detailing yet another threat to global telecoms - this covers justforfun a/k/a bpfdoor similar to lightbasin this is tracked as DecisiveArchitect
While I am always happy to speak on what
@CrowdStrike
is seeing with regards to DPRK offensive cyber activity - this appears to be Velvet Chollima targeting folks. Stay safe out there!
"The Board concludes that Microsoft’s security culture was inadequate." This is a pattern - SunBurst (2020), Lap$us(2022), Storm-0558 (2023), and Cozy Bear (2024) - Microsoft is a national security risk, security is a team sport, when are we putting them on the bench?
"Microsoft acquired a company called Affirmed Networks" ... "Microsoft believes that prior to the acquisition, Storm-0558 targeted an engineer and compromised their device" - Onboarding risk is a huge issue - M&A needs to incorporate compromise assessments as part of DD
@CrowdStrike
is excited to be part of JCDC’s new ICS initiative to help empower security teams with actionable knowledge and insights to detect and deter cyberattacks across their operational technology
Ways to spot information ops on twitter:
1) look at tweet rate 2) look at account age 3) look at likes/retweets 4) look at description versus beliefs 5) look at operating times - if they say they are a retired cop and they resigned that day might be info op
SLEUTHCON is coming!!! Registration and CFP are now open for this year's SLEUTHCON! This year's keynote will be given by Bryan Vorndran, FBI's Assistant Director Cyber Division. We are virtual and in-person in Arlington, VA on May 24th! 1/x