A false-flag cyber operation in one in which a threat actor seeks to mislead its target into thinking it’s been attacked by a third party. The name false-flag operation comes from the World War I practice of British and German ships deceptively flying the flags of other countries. Threat actors…

The Common Vulnerability Scoring System (CVSS) rates vulnerabilities by severity, assigning a numeric score. There are 3 metric groups: Base, Temporal, and Environmental. Only the Base score is published in vulnerability databases; organizations are supposed to calculate their own Temporal and Environmental scores based on their own situations. However, many…

Red teams use legitimate software for penetration testing and adversarial simulation. This software is often used by threat actors for malicious purposes. Rather than using the tools to test network defenses in order to improve them, threat actors use them to exploit networks. It’s like a thief who steals a…

Malware loaders or droppers are Trojans that gain initial access, establish persistence to support additional intrusion activities, and deploy next-stage malware (including ransomware). They can deploy, and be deployed by, other malware, including each other. They’re usually scripts or small applications. Common loaders are Qakbot, IcedID, Emotet, Trickbot, and Bumblebee. …

Apple’s introduction of Advanced Data Protection, which offers more end-to-end encryption (E2EE) of data stored in your iCloud account, caused me to think more about what data Apple has about me. …

The Art of Cyberwarfare: An Investigator’s Guide to Espionage, Ransomware, and Organized Cybercrime by Jon DiMaggio is an instructive guide to nation-state, criminal, and advanced ransomware cyber threat actors. The first half gives an overview and history of advanced cyber ops, and the second half explains how to investigate, analyze…

Cyber threat intelligence feeds contain IoCs such as IP addresses, domains, and file hashes. They can also contain mutexes that identify malware. Mutex is a portmanteau of mutual exclusion, so named because it’s an object that prevents simultaneous access to a resource by multiple threads or processes. Mutexes are also…

One of my favorite ways to learn about cyber threat intelligence (CTI) is by watching talks from CTI summits. I haven’t yet been able to attend one in person, but that would add the benefit of in-person networking. …

Vice Society (aka DEV-0832) is a cybercriminal group that has hit hundreds of K-12 educational institutions with ransomware and extortion campaigns. It’s less technically sophisticated than many other threat groups, and relies on malware, exploits, and techniques developed by others. Who Vice Society was first observed in June 2021. It hit…