Threat Research

Ransomware Prevention Panel: How to Address a Pervasive and Unrelenting Threat

Ransomware Prevention Panel: How to Address a Pervasive and Unrelenting Threat

Watch this on-demand webcast to dive deeper into the themes explored in the SANS white paper “How to Address a Pervasive and Unrelenting Threat,” written by SANS instructor Justin Henderson. Along with Justin, you’ll learn from a panel of cybersecurity experts about how to protect against infection vectors, the latest trends in ransomware attacks, and how defending against ransomware changes when considering remote workforces.

Read More

Anatomy of a Hacker Group: APT29 (AKA Cozy Bear)

Watch the on-demand webinar now to learn from members of LogRhythm Labs’ threat research team and Randy Franklin Smith of Ultimate Windows Security, who will do a deep-dive into the APT29 threat group, their activities, and how you can automate the detection and mitigation of threats either associated with the group or that use similar techniques.

Read More
Remote work

Insights and Included Content to Protect Your Organization During Times of Crisis

In times of crisis and uncertainty, nefarious threat actors have always preyed on the public and worked to exploit the situation for their benefit. The COVID-19 pandemic is no exception, as attackers have begun to masquerade and disguise common cyberattacks…

Read More
The zero-day “baseStriker” vulnerability

Examining the baseStriker Vulnerability

The zero-day “baseStriker” vulnerability is still widely in use, but do you know what to look out for if it finds its way into your organization? While 18 months have passed since Microsoft developed a fix for the vulnerability that…

Read More

NotPetya Anniversary — Is a Version 2 Coming?

Just over a year ago, the world saw two major ransomware outbreaks in short succession. The first being WannaCry, followed by NotPetya a few weeks later. Unlike WannaCry, NotPetya infected machines on a network by exploiting the devices that were…

Read More

Detecting Drupalgeddon 2.0

Despite a patch being released for the Drupal vulnerability known as Drupalgeddon 2.0, educational institutions and government entities globally are still feeling its impacts. Since its release on March 28, 2018, the bug has impacted about 1 million sites that…

Read More

Time to Reset Your Router? Understanding and Removing VPNFilter Malware

On May 23, 2018, Talos Group released its analysis of an ongoing malware attack it named “VPNFilter.” The Talos analysis indicates that this attack was first identified in 2016 and, as of June 2018, has compromised more than 500,000 endpoints.…

Read More
AI Engine Rule Configured to Use the CAT : Metadata Field : Command list

Catch the Next WannaCry or NotPetya Ransomware Attack Before Damage Occurs

Contributors to this blog include Nathaniel “Q” Quist and Sam Straka. On April 14, 2017, Shadow Brokers released a set of previously classified exploit tools developed by the National Security Agency. Within this cache of exploits, perhaps the most notorious…

Read More
PlugX Component Files

Take a Deep Dive into PlugX Malware

In June 2017, Palo Alto’s Unit 42 Threat Research team published an excellent blog post on a newly detected version of the PlugX malware family, also known as “Korplug.” Interested to find out more about this new variant, I started…

Read More
First AI Engine Rule Designed to Detect Memcached Attacks—CAT : Attack : Allowed Potential Memcached Reflection Attack

Detecting Memcached DDoS Attacks Targeting GitHub

Contributors to this blog include Nathaniel “Q” Quist and Dan Kaiser. On February 28 and March 5, 2018, Memcached DDoS attacks targeted GitHub. LogRhythm Labs performed an investigation into the cause, effect, and outcome of these attacks. The following will…

Read More