Splunk recently sponsored the annual SANS 2022 SOC Survey.

The Splunk Threat Research Team (STRT) continues to monitor new relevant payloads to the ongoing conflict in Eastern Europe. One of these new payloads was found by the Ukranian CERT named “Industroyer2.” The name of this new payload references the original "Industroyer" malicious payload used against the country of Ukraine's power grid in 2016 and allegedly was able to affect a fifth of the power capacity of the city of Kyiv.

You’ve built an awesome business — it is booming and making money. You’ve streamlined all the processes and operations. Business is good. But, when you build something great, it attracts cyber criminals. Your business is valuable to you and cybercriminals can leverage it. That’s why security is important. You can use different security approaches to secure your application, infrastructure and network. In this post we’ll focus on one such approach: penetration testing.

Splunk SURGe recently released a whitepaper, blog, and video that outline the encryption speeds of 10 different ransomware families. Early in our research, during the literature review phase, we came across another group that conducted a similar study on ransomware encryption speeds. Who was this group you ask? Well, it was actually one of the ransomware crews themselves.

If you want just to see how to find evidence of the Atlassian vulnerability in your Confluence systems, skip down to the “detections” sections. Otherwise, read on for a quick breakdown of what happened, how to detect it, and MITRE ATT&CK mappings.