The LogRhythm Labs team provides analysis on Mamba—a strain of ransomware identified in 2016—after its recent resurgence. This goal of this in-depth analysis is to ensure users are prepared to protect their systems and to help prevent future infection of this malware variant.
In a perfect world, you’d have a 24x7 SOC. But the reality is that you may have only one or two full-time employees faced with the daunting task of identifying possible signs of intrusion and compromise. But there is a solution: Build a SOC that automates as much work as possible so your staff can focus on what's important.
Hackers are constantly looking for ways to bypass traditional network defenses, and exploiting the Internet Control Message Protocol (ICMP) as a covert channel for a reverse shell is a commonly used method for attack. However, you can use LogRhythm’s Network Monitor to identify PowerShell tunneling through an ICMP.
In response to the recent WannaCry and Petya/NotPetya cyberattacks, see how LogRhythm can help you implement or validate your prevention strategy.
Although initially labeled as ransomware due to the ransom message that is displayed after infection, it appears now that NotPetya functions more as a destructive wiper-like tool than actual ransomware. This post reviews an in-depth technical analysis of NotPetya, including recommended security measures.