Surefire Cyber Inc.

Please give a warm welcome to Jennifer Walker! 🎉 Her passion and expertise are sure to make an impact here at Surefire Cyber Inc. We’re excited to see all she’ll accomplish with us! 🎉 #newhire #cybersecurity #DFIR

Tomorrow our #DFIR Director, Matthew Dowling, will join the Munich Re Specialty - North America team to discuss #publicentity risk. During this virtual symposium, Matt will break down the various stages of a #ransomware attack and provide the perspective of both the #threatactor and victim. 𝐑𝐞𝐠𝐢𝐬𝐭𝐞𝐫: https://lnkd.in/g_Qc9y9D #cybersecurity #cyber #cyberrisk

Researchers have observed changes to the #ransomware from #Qilin. We have also observed some of these tactics from Qilin, particularly on defense evasion and the destructive nature of their attacks.   𝐄𝐧𝐡𝐚𝐧𝐜𝐞𝐝 𝐄𝐧𝐜𝐫𝐲𝐩𝐭𝐢𝐨𝐧 - Implementation of AES-256-CTR #encryption for systems with AESNI capabilities - Advanced RSA-4096 encryption with OAEP padding - Virtually impossible to decrypt without the private key 𝐈𝐦𝐩𝐫𝐨𝐯𝐞𝐝 𝐄𝐯𝐚𝐬𝐢𝐨𝐧 𝐓𝐞𝐜𝐡𝐧𝐢𝐪𝐮𝐞𝐬 - Sophisticated obfuscation methods - Encrypted strings and modified function names - Designed to evade signature-based detection - Self-deletion after completing its mission 𝐁𝐚𝐜𝐤𝐮𝐩 𝐓𝐚𝐫𝐠𝐞𝐭𝐢𝐧𝐠 - Systematic deletion of backup-related services - Removal of volume shadow copies - Evasion of system reboots   𝐖𝐡𝐲 𝐢𝐬 𝐭𝐡𝐢𝐬 𝐢𝐦𝐩𝐨𝐫𝐭𝐚𝐧𝐭? The evolution of Qilin represents a broader trend in the ransomware landscape that should concern both #security professionals and business leaders. 1. 𝘏𝘦𝘢𝘭𝘵𝘩𝘤𝘢𝘳𝘦 𝘵𝘢𝘳𝘨𝘦𝘵𝘪𝘯𝘨: Qilin's focus on healthcare institutions puts patient lives at risk. When hospitals can't access their systems, critical care is delayed or compromised. 2. 𝘌𝘤𝘰𝘯𝘰𝘮𝘪𝘤 𝘪𝘮𝘱𝘢𝘤𝘵: With #ransom demands in the millions and generous affiliate payouts (up to 85% of the ransom), Qilin is attracting skilled #cybercriminals to its ransomware-as-a-service platform. 3. 𝘈𝘥𝘷𝘢𝘯𝘤𝘦𝘥 𝘦𝘷𝘢𝘴𝘪𝘰𝘯: The sophistication of Qilin's evasion techniques means traditional security measures may fail to detect it until it's too late.   𝐖𝐡𝐚𝐭 𝐬𝐡𝐨𝐮𝐥𝐝 𝐲𝐨𝐮? - Implement cross-platform security monitoring, including Linux and VMware ESXi systems - Ensure #security tools can effectively handle Rust-compiled code - Focus on behavioral detection systems rather than relying solely on signature-based detection - Maintain robust backup systems with offline copies #cybersecurity #ransomwareprotection

On day one of the Pwn2Own competition in Ireland, researchers delivered proof of exploits for 52 previously unknown #vulnerabilities. Researchers look for vulnerabilities in a range of devices such as Wi-Fi cameras and smartphones, competing for a prize pool of $1 million. Competitions such as these improve #security in new products and reward researchers for their efforts. They also tend to get a lot of attention in #cyber media. However, it is always important to distinguish between vulnerabilities that have been found and those which are seen being exploited in the wild. For example, Fortinet disclosed a vulnerability in their FortiManager product that is under active exploitation. FortiManager is often used by #MSPs which enhances the potential impact. The vulnerability could allow #threatactors to move between different companies if they are managed by the same MSP. 𝐖𝐡𝐚𝐭 𝐬𝐡𝐨𝐮𝐥𝐝 𝐲𝐨𝐮 𝐝𝐨? - Pay attention to the risk profile of a #CVE, not just its severity score. - Have a reliable source of CVE intelligence rather than relying on cyber news channels. - Update your FortiManager to the latest version. - If an update is not possible, create an allowed list of IP addresses for FortiGate devices that are allowed to connect. - If an update is not possible, utilize the set fgfm-deny-unknown enable command to prevent devices with unknown serial numbers from registering to the FortiManager. #cybersecurity #ransomwareprotection

Tomorrow kicks off #Cybersecurity at Duke University “In the Age of #AI” Conference. Our CTO, Marc Bleicher will be participating in a discussion with Heather Osborne, Max Perkins and Jeffrey W. on how the #cyberinsurance market is evolving to manage the claims being made during #cyber breaches. 𝐕𝐢𝐞𝐰 𝐭𝐡𝐞 𝐬𝐜𝐡𝐞𝐝𝐮𝐥𝐞: https://lnkd.in/gYqEVTUf Duke Cybersec #CybersecDuke

🎉Exciting News! We’re thrilled to welcome Brittany Daly to Surefire Cyber Inc.! With her expertise in #DFIR, we’re ready to help more clients prepare, respond, and recover from #cyber incidents. Please join us in welcoming Brittany! #cybersecurity #incidentresponse #IR

Our Chief Product Officer, Karla Reffold, has been following three #ransomware stories this week. Watch her latest video to find out which ones and why. #cybersecurity #ransomwareprotection #DFIR

Sessions from NetDiligence®'s #CyberRiskSummit are now available on-demand. If you missed this panel with our #DFIR Director, Luke Emrich, you can watch online. 𝐕𝐢𝐞𝐰 𝐬𝐞𝐬𝐬𝐢𝐨𝐧: https://lnkd.in/eJK5fhcw #BEC #cyberinsurance #cybersecurity Thank you to the other panelists for a great session! Kamran Salour, Lewis Brisbois Jeffrey Hunter, Federal Bureau of Investigation (FBI) Theresa Le, Cowbell Jordan Morgan, CIPRIANI & WERNER PC

A security update has been released for the Jetpack WordPress plugin, which is currently used on 27 million websites. The #vulnerability could allow users to access forms submitted by other visitors, potentially exposing their personally identifiable information (#PII). The company has know about this vulnerability since 2016. The update fixes the issue in 101 different versions of the plugin. Although this vulnerability has existed for eight years, there is no evidence that it has ever been exploited. This is a compelling demonstration that not all #vulnerabilities require action and that companies should take a risk-based approach to vulnerability management. 𝐖𝐡𝐲 𝐢𝐬 𝐭𝐡𝐢𝐬 𝐢𝐦𝐩𝐨𝐫𝐭𝐚𝐧𝐭? - Now that the vulnerability has been publicly disclosed, there is an increased risk of exploitation. - While the impact is not comparable, the Jetpack plugin has almost 1000% more customers than CrowdStrike. We have not seen mass exploitation of WordPress plugins. but the potential for significant impact exists. 𝐖𝐡𝐚𝐭 𝐬𝐡𝐨𝐮𝐥𝐝 𝐲𝐨𝐮 𝐝𝐨? - Upgrade to the latest version to remedy this, and other disclosed issues. #cybersecurity #ransomwareprotection

#Ransomware groups #Akira and #Fog have been exploiting a vulnerability, CVE-2024-40711, in Veeam Software Backup & Replication servers. CVE-2024-40711 allows unauthenticated attackers to execute remote code. Sophos X-Ops observed attacks combining CVE-2024-40711 with previously compromised credentials to add malicious local admin accounts. 𝐀𝐭𝐭𝐚𝐜𝐤 𝐩𝐚𝐭𝐭𝐞𝐫𝐧𝐬 - Initial access via compromised #VPN gateways lacking multi-factor authentication (#MFA) - Some targeted VPNs were running outdated software - In one case, Fog ransomware was deployed to an unprotected Hyper-V server - #Dataexfiltration using rclone utility 𝐖𝐡𝐲 𝐢𝐬 𝐭𝐡𝐢𝐬 𝐢𝐦𝐩𝐨𝐫𝐭𝐚𝐧𝐭? - Veeam’s software is widely used and any CVE affecting Veeam can impact a large number of organizations - When backups are compromised, recovery takes longer and the likelihood of needing to pay a #ransom increases 𝐖𝐡𝐚𝐭 𝐬𝐡𝐨𝐮𝐥𝐝 𝐲𝐨𝐮 𝐝𝐨? - Patch the CVE immediately - Contact your third parties and if they are using Veeam, ask them to patch the CVE - Consider an additional backup method for additional protection #cybersecurity #ransomwareprotection