Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Every day more than 2 billion documents and emails are added to Microsoft 365, making this critical data a priority target for ransomware and other cyber attacks. After all, 61% of attacks affect SaaS applications, the most targeted platform / environment. This data can also often be unstructured, and rapidly processing and managing the content at enterprise scale is critical when it comes to both applying protection and performing restores.

What if a malicious attack deleted your Microsoft Entra ID (formerly Azure Active Directory) objects? Or what if hundreds of objects get deleted across your Microsoft OneDrive account from a rogue script? Think about it. If you’re a large enterprise customer, would you be prepared to rapidly recover from these scenarios at scale?

The City of Huber Heights is in east Ohio, north of Dayton. The suburban area has a population of around 50,000, but other populated areas are nearby. Sunday morning, November 12th, 2023, the City of Huber Heights was subject to a ransomware attack; the investigation is ongoing, as the attack disrupted many City divisions.

Rubrik has been assisting our customers with recovery from cyber attacks since 2018. We immediately took notice of these attacks, and early on, began developing processes and procedures to respond more effectively to better assist our customers. Our spirit of continuous improvement and execution of lessons learned from the field has led to a number of improvements to both our products and processes.

DCRat, also known as Dark Crystal Rat has been around since 2018. It operates as a modular remote access trojan (RAT) offered as a Malware-as-a-Service (MaaS) and has garnered attention due to its cost-effectiveness and adaptability. The malware is purpose-built to provide threat actors unauthorized access to systems by circumventing security measures.

CherryBlos is a rather interesting family of Android malware that can plunder your cryptocurrency accounts - with a little help from your photos.

Top tips is a weekly column where we highlight what’s trending in the tech world today and list out ways to explore these trends. This week we’re looking into how your organization can recover from a ransomware attack. It’s well known at this point that ransomware attacks are an inevitability. With around 493.33 million ransomware attempts in 2022 alone, it’s not a question of if you’ll fall victim to a ransomware attack, but rather it’s a question of when.

As ransom payments reach an all-time high, it’s time to look at attacks from a data perspective and find the greatest opportunities to stop these attacks. Every quarter, I’ve been covering the Quarterly Ransomware Reports from ransomware response company Coveware. In their latest report covering Q3 of this year, we get a greater sense of what trends their security researchers are seeing from the data: This last one is interesting.

CrowdStrike Counter Adversary Operations has been investigating a series of cyberattacks and strategic web compromise (SWC) operations targeting organizations in the transportation, logistics and technology sectors that occurred in October 2023. Based on a detailed examination of the malicious tooling used in these attacks, along with additional reporting and industry reports, CrowdStrike Intelligence attributes this activity to the IMPERIAL KITTEN adversary.