|
By Andres Ramos
Since December 16, 2024, Arctic Wolf has observed increased activity in a social engineering campaign associated with Black Basta ransomware. In this campaign, threat actors were observed using Microsoft Quick Assist and Teams to impersonate IT personnel and engage in malicious activities upon contacting victims. This is a continuation of the Black Basta campaign we reported on in a security bulletin sent in June 2024.
|
By Andres Ramos
On December 15, 2024, reports emerged that threat actors have begun attempting to exploit a recently disclosed critical vulnerability in Apache Struts (CVE-2024-53677) shortly after the publication of a Proof-of-Concept (PoC) exploit. Apache Struts is a widely used open-source web application framework for developing Java-based applications.
|
By Andres Ramos
Since early December 2024, Arctic Wolf has been monitoring threat activity involving the malicious use of management interfaces on FortiGate firewall devices on the public internet. While our investigation into this activity is ongoing and the scope is yet to be fully determined, organizations running these products should ensure that they are adhering to security best practices for management access of firewall devices.
|
By Arctic Wolf
On December 16, 2024, BeyondTrust published a security advisory outlining a vulnerability impacting their Remote Support (RS) and Privileged Remote Access (PRA) software. The flaw, CVE-2024-12356, is a critical severity command injection vulnerability. If successfully exploited it can allow an unauthenticated remote threat actor to execute underlying operating system commands within the context of the site user.
|
By Dan Schiappa
Arctic Wolf has taken a decisive step forward in our mission to end cyber risk by acquiring Cylance, a pioneer of AI-based endpoint protection. With this acquisition, Arctic Wolf ushers a new era of simplicity and automation to the endpoint security market that will deliver the security outcomes endpoint security customers have been struggling to achieve for years.
|
By Madeline Chantry
With the emergence of artificial intelligence (AI), there has been a flurry of new terms to describe an increasing variety of new problems. Some of those problems have been around for decades but are now more difficult to manage due to the versatility of AI-based tools and applications. One of those ongoing challenges is shadow IT with a new class of problems classified as shadow AI.
In December 2024, Arctic Wolf Labs observed a mass exploitation campaign involving Cleo Managed File Transfer (MFT) products for initial access. The execution chain involved an obfuscated PowerShell stager, a Java loader, and ultimately a Java-based backdoor, which we will refer to as Cleopatra. In this article we will provide insight into the execution chain in this campaign, obfuscated malicious payloads deployed, and surrounding threat intelligence context around these activities.
|
By Andres Ramos
On December 11, 2024, Cleo released patches addressing the zero-day vulnerability recently observed in attacks targeting Cleo Managed File Transfer (MFT) products. This vulnerability allowed unauthenticated threat actors to import and execute arbitrary shell commands on Windows and Linux on affected devices by exploiting default settings of the Autorun directory. The fix is included in version 5.8.0.24, and is now available for Cleo Harmony, VLTrader, and Lexicom.
|
By Steven Campbell
On December 10, 2024, Ivanti released updates for three critical-severity vulnerabilities impacting their Cloud Services Application. By chaining the vulnerabilities together, a threat actor could obtain administrative privileges via authentication bypass (CVE-2024-11639), which could then allow for remote code execution (CVE-2024-11172) and/or SQL injection (CVE-2024-11173).
|
By Andres Ramos
Update: Dec 11, 2024. Find the latest information in our follow-up security bulletin. On December 7, 2024, Arctic Wolf began observing a novel campaign exploiting Cleo Managed File Transfer (MFT) products across several customer environments. Initial indications of malicious activity in this campaign were identified as early as October 19, with a sharp increase in early December.
|
By Arctic Wolf
In this edition of Always Ahead, Arctic Wolf Chief Product and Services Officer Daniel Schiappa shares his predictions for the cybersecurity industry in 2025.
|
By Arctic Wolf
The Arctic Wolf analyst team is known for their 24x7 monitoring and concierge level service. In this video we'll explore a few of the response actions the SOC team has at their disposal to take action and mitigate impact during a cyber security incident.
|
By Arctic Wolf
In this demo, we will see how Arctic Wolf's unified portal reflects the status of Security Focuses and the availability of Security Reviews to help customers monitor and plan the advancement of their security journey.
|
By Arctic Wolf
Built on the Arctic Wolf Security Operations Cloud and Concierge Delivery Model, Arctic Wolf serves over 7,000 customers worldwide, helping organizations of all sizes and industries end cyber risk.
|
By Arctic Wolf
This video demonstrates how Arctic Wolf Threat Intelligence enables customers to defend against new and emerging threats through engaging content, actionable intelligence, and IoC quicklinks.
|
By Arctic Wolf
This month we sit down with Jeff Green, Senior Vice President of R&D, as he shares his experience helping open our brand-new India office, leadership advice he swears by, and more! Jeff is an industry veteran with over 30 years of experience in building world-class products and technologies for enterprises and consumers primarily focused in security. Currently as Senior Vice President of R&D, Jeff leads Arctic Wolf’s global research and engineering organization with a focus on delivering security outcomes for customers and ending cyber risk at high scale.
|
By Arctic Wolf
This month we sit down with Lane Roush, Chief Technical Customer Officer, as he shares his philosophy on owning the outcome, his approach to wellbeing, his love for Halloween costumes and much more! Lane Roush has led the Arctic Wolf Sales Engineering organization since 2016. Lane brings 20+ years of IT and security experience to the team and has been a driving force in our sales, enablement, product, channel and go to market strategy.
|
By Arctic Wolf
Join hosts Chelsea and Mary as they celebrate one year of The Howler Podcast! From sharing their meet-cute story to interviewing various pack members, this episode is full of both heartwarming & funny moments highlighting the people & programs that make Arctic Wolf so special! Interested in running with the pack? Explore careers at Arctic Wolf—one of the fastest-growing and exciting cybersecurity companies in the world, to learn about how you can join our Pack, create impact, and influence what’s next in security operations.
|
By Arctic Wolf
Brett Rogers, Vice President of Concierge Security at Arctic Wolf, joins Ticker News to share the importance of effective, timely incident response as part of a cyber environment.
|
By Arctic Wolf
Brett Rogers, Vice President of Concierge Security at Arctic Wolf, joins Ticker News to discuss the tactics and techniques that SMB’s can use to boost their cyber resiliency in an ever-changing threat landscape.
|
By Arctic Wolf
Financial institutions, particularly regional banks and credit unions, are facing challenges both in terms of safeguarding data of their customers and meeting data security compliance standards. Information technology (IT) teams in these institutions are stretched thin. They struggle with needing to meet compliance obligations while simultaneously combatting cyberthreats.
|
By Arctic Wolf
The Health Insurance Portability and Accountability Act (HIPAA) Security Rule focuses on the safeguarding of electronic protected health information (ePHI) through the implementation of administrative, physical, and technical safeguards.
|
By Arctic Wolf
Security information and event management (SIEM), security orchestration, automation, and response (SOAR), and the newer extended detection and response (XDR) solutions have become the top choices for organizations wanting a unified view of activity within their IT environments. By combining relevant data into single consoles, XDR, SIEM and SOAR technologies minimize the time analysts spend moving between platforms and make it easier to correlate the data and develop subsequent steps appropriately.
- December 2024 (16)
- November 2024 (11)
- October 2024 (14)
- September 2024 (22)
- August 2024 (14)
- July 2024 (23)
- June 2024 (22)
- May 2024 (15)
- April 2024 (19)
- March 2024 (12)
- February 2024 (20)
- January 2024 (19)
- December 2023 (15)
- November 2023 (15)
- October 2023 (13)
- September 2023 (14)
- August 2023 (18)
- July 2023 (24)
- June 2023 (19)
- May 2023 (17)
- April 2023 (17)
- March 2023 (22)
- February 2023 (23)
- January 2023 (14)
- December 2022 (19)
- November 2022 (16)
- October 2022 (23)
- September 2022 (22)
- August 2022 (14)
- July 2022 (9)
- June 2022 (11)
- May 2022 (12)
- April 2022 (17)
- March 2022 (13)
- February 2022 (9)
- January 2022 (10)
- December 2021 (13)
- November 2021 (16)
- October 2021 (6)
- September 2021 (8)
- May 2021 (2)
- November 2020 (2)
- August 2020 (1)
- November 2019 (1)
- August 2019 (1)
- March 2017 (2)
Cybersecurity is a field that requires 24x7 vigilance and constant adaptation. Arctic Wolf’s cloud native platform and Concierge Security® Team delivers uniquely effective solutions.
The cybersecurity industry has an effectiveness problem. New technologies, vendors, and solutions emerge every year—yet, we still see headlines filled with high-profile breaches. Many attacks occur – not because a product failed to raise an alert – they fail because the alert was missed or was not actioned on. To prevent these attacks, the industry needs to adopt a new approach by focusing on security operations. That’s where Arctic Wolf can help.
Arctic Wolf® Platform
Spanning thousands of installations, the Arctic Wolf® Platform processes over 200 billion security events daily. The platform collects and enriches endpoint, network, and cloud telemetry, and then analyzes it with multiple detection engines. Machine learning and custom detection rules then deliver personalized protection for your organization.
While other products have limited visibility, the vendor-neutral Arctic Wolf® Platform enables broad visibility and works seamlessly with existing technology stacks, making it easy to adopt while eliminating blind spots and vendor lock-in.
Concierge Security® Team
Arctic Wolf invented the concept of Concierge Security®. With this delivery model, we pair a team of our security operations experts directly with your IT or security staff. Your Concierge Security® Team gives you 24×7 eyes-on-glass coverage. We work with your team on an ongoing basis to learn your security needs so that they can tune solutions for maximum effectiveness and ensure that your security posture gets stronger over time.
The Concierge Security® Team combines deep security operations expertise with an understanding of your environment to deliver better outcomes. We take on tactical actions like threat hunting and alert prioritization, and strategic tasks like security posture reviews and risk management.