Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

During a web shell attack, a cybercriminal injects a malicious file into a target web server's directory and then executes that file from their web browser. After launching a successful web shell attack, cybercriminals could gain access to sensitive resources, recruit the target system into a botnet, or create pathways for malware or ransomware injections. If you haven't implemented defense strategies against this cyber threat, your systems are at a high risk of exploitation.

In cybersecurity, an attack vector is a method of gaining unauthorized access to a private network. These pathways are either unintentional, such as vulnerabilities in third-party software, or intentionally designed by hackers, such as malicious software (malware). Cybercriminals primarily exploit attack vectors to advance extorsion tactics, the most popular being the deployment of ransomware.

Data breaches have reached a fever pitch over the last few years. The rapid frequency of successful attacks coupled with the rising costs to businesses has raised attention at the highest levels of global governments. In the past, breaches were relatively “localized,” that is, they affected the targeted company only. However, the newer attacks have disrupted entire supply chains.

Cyberattack is one of the common threats that modern businesses are facing today. Despite the growing threat landscape of cybersecurity attacks, many small and medium companies that experience data breaches and threats do not have adequate preparations. This includes prevention measures before the attack and incident response plans during/after the attack.

APTs (Advanced Persistent Threat) have more serious consequences than conventional cyberattacks. The explanation for this lies in the fact that, on the one hand, the perpetrators spend much more time and effort (often promoted by government organizations), and on the other, the victims are also more high profile.

The Splunk Threat Research Team recently evaluated ways to generate security content using native Windows event logging regarding PowerShell Script Block Logging to assist enterprise defenders in finding malicious PowerShell scripts. This method provides greater depth of visibility as it provides the raw (entire) PowerShell script output. There are three sources that may enhance any defender's perspective: module, script block and transcript logging.

In April 2021, I discovered an attack vector that could allow a malicious Pull Request to a Github repository to gain access to our production environment. Open source companies like us, or anyone else who accepts external contributions, are especially vulnerable to this. For the eager, the attack works by pivoting from a Kubernetes worker pod to the node itself, and from there exfiltrating credentials from the CI/CD system.

On February 9, 2021, Alex Birsan disclosed his aptly named security research, dependency confusion. In his disclosure, he describes how a novel supply chain attack that exploits misconfiguration by developers, as well as design flaws of numerous package managers in the open source language-based software ecosystems, allowed him to gain access and exfiltrate data from companies such as Yelp, Tesla, Apple, Microsoft, and others.

On July 2, 2021, the cybersecurity world woke up to yet another ransomware attack—this time, the victim was Kaseya, a software enterprise that provides IT management solutions predominantly to managed service providers (MSPs). The attack made a huge impact, affecting several MSPs and thousands of their customers. So, what exactly transpired in what most cybersecurity experts are calling the largest criminal ransomware attack on record?

Cyber attacks come in many forms, but they almost always share one trait in common: they are carried out over the network. Although there are exceptions, the network is usually the entry point that attackers use to launch whichever exploits, data thefts, or other intrusions they aim to impose upon a business.