Name: July 2021 Threat Intelligence Observations
Start: 2021-07-26T21:12:00Z
End: 2021-07-26T21:50:59.000Z
Location: BrightTALK
Rating: 0

eSentire, Inc. is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events. Combining cutting-edge machine learning XDR technology, human expertise, and proven security operations leadership, eSentire mitigates business risk, and enables security at scale. The Team eSentire difference means enterprises are protected by the best in the business with a named Cyber Risk Advisor, 24/7 access to SOC Cyber Analysts and Elite Threat Hunters, and industry-leading threat intelligence research from eSentire’s Threat Response Unit (TRU). eSentire provides Managed Risk, Managed Detection and Response and Digital Forensic and Incident Response services. 

For more information, visit www.esentire.com and follow @eSentire.

Recent geopolitical climate has played an important role in how adversaries are targeting their victims. As geopolitical tensions rise, so do threats from state-sponsored adversaries. Battle lines have been redrawn and state-sponsored threat actors are adapting new tradecraft and targets to respond to global trends.

In this live webinar, join Ryan Westman, Sr. Manager, Threat Intelligence at eSentire, and Cameron Buriani, Sr. Solutions Architect, Team Lead at CrowdStrike, as they share their insights on how geopolitical tensions have impacted the evolution of cybercrime.

Key takeaways include:
- The key drivers of state-sponsored cyberattacks
- Notable trends in ransomware, as observed by eSentire’s Threat Response Unit (TRU) and CrowdStrike
- How geopolitical tensions are giving rise to the weaponization of zero-day vulnerabilities, wiper malware, and more
- Recommendations to protect your organization against state-sponsored attacks

The Impact of Geopolitical Tensions on the Evolution of Cybercrime

New Federal Trade Commission (FTC) Safeguards Rule requirements come into effect in June 2023. Under the new regulations, automotive dealerships are considered non-banking financial institutions and must comply with the updated requirements.

Given that dealerships are considered the retail operational fronts for the automotive industry, they are highly susceptible to cyberattacks that impact the financial, retail, and manufacturing industries.

Watch this webinar with Greg Crowley, CISO at eSentire to learn more about:
- How to achieve compliance with the FTC Safeguards Rule to protect customer information, including the 9 elements that auto dealerships must have in place as part of their information security program
- The two primary reasons that auto dealers are attractive targets for cyberattacks
- Potential GLBA penalties for non-compliance
- How eSentire can help you achieve compliance
- How eSentire Managed Detection and Response (MDR) addresses key automotive industry challenges, including the results the automotive cybersecurity leaders can expect

Are Automotive Dealerships Ready for the FTC Safeguards Rule Update?

With Microsoft offering a cost-effective and highly integrated security stack that covers endpoint, email, cloud, identity and more, many organizations are replacing their legacy tools with Microsoft’s advanced security stack and getting the most out of their Office 365 investment.
To fully unlock the power of E5, cybersecurity leaders need to take advantage of the threat detection and investigation capabilities 365 Defender and Sentinel offer. Unfortunately, most organizations struggle with the in-house expertise and resources needed to operationalize and manage these tools. That’s where the role of an MDR provider becomes indispensable.

Watch this webiar to learn more about:
- What companies get with E5 licensing
- The Defender 365 and Sentinel toolset capabilities
- The response and remediation capabilities MDR can offer for Microsoft 
- How eSentire’s 24/7 MDR service leverages your existing investment in the Microsoft ecosystem to shrink threat actor dwell time and reduce your risk of business disruption

Unlocking Your E5 Investment with MDR for Microsoft

Safeguarding your legal firm from cyberattacks and threats caused by user execution takes an understanding of the threats, a robust cybersecurity program, and the contribution of all team members. To help your team in these pursuits, eSentire’s Threat Response Unit (TRU) has correlated key findings and threat trends based on global threat hunts across our global legal customer base. 

In this masterclass, Spence Hutchinson, Principal Threat Researcher, will share original research from TRU and recommendations on how you can protect your legal firm from specific industry threats. 

You’ll learn more about:
- Web-borne cyber threats that leverage attack techniques like search engine optimization (SEO) poisoning, compromised websites, and malicious downloads to gain initial access into your environment (e.g., GootLoader, SocGholish, and SolarMarker)
- Top email-borne threats used to dominate the legal industry’s threat landscape (e.g., Emotet, Qakbot, and IcecID)
- Tactical and strategic recommendations on how your organization can minimize risk and build a strong cybersecurity foundation with a multi-signal Managed Detection and Response strategy

Securing Law Firms Against The Top Web and Email-Borne Cyber Threats

In this month’s TRU Intelligence Briefing, the Threat Response Unit reviewed:
- Threat Landscape: A review of recently observed malware by the SOC such as BumbleBee, FormBook, IcedID and notable vulnerabilities impacting Atlassian, VMware, and Fortinet
- A brief update on cyberattacks related to ongoing geo-political tensions
- Qakbot Fall Campaign: A deep dive into the Qakbot malware, including a recent fall campaign, eSentire’s observations of the threat, and associated Black Basta ransomware activity
- Tactical Threat Response (TTR) Offensive Security Tool Model: An overview from the TTR team on how eSentire develops detections for offensive security tools

December TRU Intelligence Briefing

When it comes to cloud migration, do you view security as a destination or a journey? Regardless of your answer, robust cloud security posture management means having visibility across your attack surface, the ability to identify and prioritize the most critical security violations and misconfigurations, and most of all, proactive response.

Join eSentire & Lacework for this fireside chat with two Bad SaaS Women talking all things cloud security. Tia Hopkins, Field CTO & Chief Cyber Risk Strategist at eSentire, will host a special edition of eSentire’s Cyber Talks series with Erin K. Banks, Senior Director of Product Marketing at Lacework, to share their unique perspectives on how cloud security and business strategy converge. This Cyber Talks session will also cover key considerations around Platform, Application and Infrastructure protection and focus on recommendations from eSentire & Lacework on how to best secure your cloud ambitions.

Key conversation topics will include:
- Are all cyber risks equal?
- The dynamic vocabulary of cloud security
- Matching cloud security models to business innovation strategies
- How to think about the detection and response of cloud based threats

Cyber Talks: Risk is Risk Is Cloud Security The Journey or The Destination?

In May 2022, Conti leaders shut down operations as a formal entity. Yet affiliate groups, Black Basta and BlackByte, have followed in Conti’s footsteps, carrying out destructive and damaging ransomware attacks against organisations globally.

41% of these victim organisations tracked on Black Basta and BlackByte leak sites are based in Europe, and the other 59% are primarily U.S.-based. Moreover, many of the Europe-based organisations targeted by Black Basta and BlackByte are part of critical infrastructure sectors including energy, transportation, pharmaceuticals, education, government, facilities, and food.

Join this webinar with Keegan Keplinger, Research and Reporting Lead at eSentire, as he walks through: 
- The background and history of the Conti ransomware group, how they have evolved, and the current state of their operations

- Notable Black Basta and BlackByte ransomware attacks on critical infrastructure sectors, and the subsequent damage to victim organisations 

- Recommendations from TRU on how to protect your organisation from this cyber threat 

Register now to reserve your spot and submit your related questions in advance for the live Q&A.

Keeping Up With Conti

With unparalleled access to valuable information across all facets of the public and private sectors, legal firms have been subject to cyberattacks leading to massive ransomware attack outages, public exposure, and crippling reputational damage.

To prevent your practice from becoming a victim of business disrupting cyberattacks, you need a robust cybersecurity strategy and the expertise to proactively detect and remediate these cyber threats. 

At eSentire, we work with law firms to protect over 14,000 attorneys in the ALM 100 and ALM 200. Our Managed Detection and Response (MDR) services hunt threats and suspicious activity to investigate in minutes and contain these attacks before they become business disrupting for you and your clients. 

In this product briefing, eSentire’s Senior Solution Architect, Nickolas Davie, will walk you through real case studies from CIOs at Hughes Hubbard & Reed and Quarles & Brady, and demonstrate how we combine cutting-edge machine learning XDR with 24/7 threat hunting expertise and security operations leadership to hunt and disrupt known & unknown threats with a 15-minute Mean Time to Contain (MTTC).

Making the Case for MDR at Your Law Firm

At most private equity firms, CIOs lack visibility into the security operations across all their portfolio companies. The fact is that portfolio companies have limited knowledge of their cyber risks and an equally limited cybersecurity budget.  

Unfortunately, cybercriminals understand this Private Equity/Portfolio Company dynamic well and many take advantage of limited visibility and budgets to execute targeted ransomware attacks that can disrupt business operations and damage brand reputation. 

Unless you’re prepared to defend against modern ransomware threats, your portfolio companies could be locked out of critical systems and applications for days. The resulting downtime can cost your firm $225K per day in downtime costs alone 

Join this exclusive Private Equity Threat Summit, to listen to: 

- Private Equity Threat Briefing
Presented by Ryan Westman, Senior Manager, Threat Intelligence, eSentire
Ryan will share our latest intelligence and research based on global threat hunts across eSentire’s global Private Equity customer base. 

- A Fireside Chat with Alex Manea, CISO at Georgian
Hosted by Eldon Sprickerhoff, Founder and Advisor, eSentire
Eldon and Alex will discuss the main cybersecurity challenges and top concerns Private Equity CISOs face, and share experiences and insights security leaders can leverage to address these challenges.

- Customer Perspectives
Presented by Mark Benaquista, Managing Partner, Thomas H. Lee Partners
Mark will provide his security leadership perspective as a customer, discussing the value eSentire’s provides his firm in ensuring a consistent security posture across portfolio companies with 24/7 MDR that provides proactive detection, disruption, and remediation of cyber threats before they become business disrupting events.

Securing Your Portfolio Investments from the Risk of Costly Downtime

Ransomware has become a topic of discussion globally as cybersecurity leaders grapple with the magnitude and impact of cyber risk and the threat of downtime revenue disruption to their business. 

Unless you’re prepared to defend against ransomware, these attacks result in your firm being locked out of critical systems and applications for days and even weeks. In many cases, the resulting downtime can cost upwards of $225K per day in revenue disruption.

In this masterclass, eSentire’s Field CTO & Chief Cyber Risk Strategist, Tia Hopkins shares her insights and recommendations on how you can prevent downtime based on your specific industry threats. We also compare the cost of downtime revenue disruption vs the cost of a 24/7 in house SOC vs the value of investing in 24/7 MDR. 

You’ll learn more about: 
- The top malware threats observed in the legal industry that lead to ransomware 
- The cost of downtime based on an organization’s size
- The costs of building, staffing and operating a 24/7 SOC in-house 
- How organizations can experience >70% in cost-savings with (eSentire) MDR

Downtime Revenue Disruption—The Most Costly Aspect of a Ransomware Attack

In this month’s TRU Intelligence Briefing, the Threat Response Unit reviewed:
- Threat Landscape: A review of recently observed malware by the SOC such as SocGholish, LALALA Stealer, Raspberry Robin and notable vulnerabilities impacting OpenSSL (CVE-2022-3602), VMware (CVE-2021-39144), and Apache (CVE-2022-42889)
- A brief update on cyberattacks related to ongoing geo-political tensions
- Black Basta Ransomware: eSentire research on recent Black Basta ransomware activity and TTPs, and the association with Qakbot malware
- Tactical Threat Response: Detection information for Black Basta and associated threats

November TRU Intelligence Briefing

In this breakout session, presented at the National Association of Manufacturing (NAM) Leading Edge Cybersecurity Forum, Larry Gagnon, SVP Incident Response at eSentire shared:
 - The risks associated with relying on traditional Incident Response Plans or Tabletop Exercises and the importance of adopting pre-breach deployment response tools
- A case study on an auto parts manufacturer 
- Effective IR planning and preparation including why time to value is the most critical consideration in building your response
- Recommendations on how to build cyber resiliency and minimize downtime due to a cybersecurity breach

Downtime Revenue Disruption: The Most Costly Aspect of a Ransomware Attack

In this workshop, presented at the National Association of Manufacturing (NAM) Leading Edge Cybersecurity Forum, Eldon Sprickerhoff, Founder and Advisor at eSentire shared:
- Threat research from eSentire’s TRU team on the top techniques ransomware groups are leveraging, and new observations from recent Conti ransomware gang attacks
- The challenges organizations face and the consequences of supply chain attacks
- A case study on Log4j
- Recommendations on how organizations can minimize supply chain risk
- The importance of your people, process, and technology (PPT) in building cyber resilience 
- How to leverage the pragmatic security event management playbook to navigate common cybersecurity scenarios and enrich your current IR plan

Securing Your Manufacturing Organization Against Future Supply Chain Attacks

In this month’s TRU Intelligence Briefing, the Threat Response Unit reviewed:
- Threat landscape: A review of recently observed malware by the SOC such as Qakbot, Gootloader, BatLoader, and notable vulnerabilities impacting Microsoft (CVE-2022-41033 & CVE-2022-37968), and Fortinet (CVE-2022-40684)
- A brief update on cyberattacks related to ongoing geo-political tensions
- ProxyNotShell Vulnerabilities (CVE-2022-41040 and CVE-2022-41082): Background, details, and detections
- eSentire MDR for Log: Recent platform expansions

October TRU Intelligence Briefing

In this month’s TRU Intelligence Briefing, the Threat Response Unit reviewed:
- Threat landscape: A review of recently observed malware by the SOC such as Socgholish, GuLoader, IcedID and notable vulnerabilities impacting Microsoft (CVE-2022-37969), Zimbra (CVE-2022-37042), and Atlassian (CVE-2022-36804)
- A brief update on cyberattacks related to ongoing geo-political tensions
- eSentire research: Venom Spider - financially motivated threat actor group
- Tactical Threat Response: Detection information for Venom Spider

September TRU Intelligence Briefing

With unparalleled access to valuable information across all facets of the public and private sectors, legal firms have been subject to cyberattacks leading to massive ransomware attack outages, public exposure, and crippling reputational damage. As a longtime cybersecurity partner in the legal sector, eSentire is proud to protect over 14,000 attorneys in the ALM 100 and ALM 200.
When disaster strikes, you need an incident response partner that can react with industry-leading speed and efficacy.  Through a combination of best-in-class digital forensics technology and elite responders, we can suppress a cybersecurity incident, anywhere in the world, within 4 hours. 

In this webinar, eSentire’s Senior Vice President of Incident Response, Larry Gagnon, will showcase how our On-Demand 24/7 Incident Response service is unmatched in the industry: 
• Our SLA: We’re the only IR provider that guarantees a 4-Hr Threat Suppression, meaning we fully contain the threat and it’s done. 
• Our Technology: In addition to enabling the 4-Hr threat suppression, our Atlas XDR Investigator software has automated forensic triage capabilities that enable our team to complete an end-to-end IR engagement in a matter of days.
• Our Expertise: Our team of elite responders consists mainly of 20+ year industry veterans with backgrounds in multiple law enforcement, Federal Investigation and US Military.
• Time to Value: No other provider in the market can match our time to value. If a breach happens our remote incident response begins immediately, and the breach is suppressed in 4 hours.

Securing the Legal Industry with the World’s Fastest 4-Hr Incident Response SLA

For the past 16 months, eSentire’s security research team, the Threat Response Unit (TRU), has been tracking one of the most capable and stealthy malware suites—Golden Chickens. This malware is the “cyber weapon of choice” for two of Russia’s top cybercrime groups: FIN6 and Cobalt Group. 
 
TRU not only detected a new Golden Chickens threat campaign targeting e-commerce organizations but has also discovered the identity of the threat actors behind it. With this intelligence we deciphered the threat actor’s Tactics, Techniques and Procedures (TTPs), as well as the origins of the Golden Chickens Malware-As-A-Service (MaaS) and its ongoing operations. 
 
In this webinar on September 13, 2022 at 1:00 p.m. Eastern/10:00 a.m. Pacific eSentire and (ISC)² walk you through the Golden Chickens malware suite and the reconnaissance to unmask the identity of the VENOM SPIDER. 
 
Learn more about: 

• A detailed account of the investigation and subsequent identification of the Golden Chickens MaaS operator  
• An analysis of the Golden Chickens malware and the current cyberattack campaign  
• Insights and threat detection recommendations on how to defend your organization from the Golden Chickens threat 
• An overview of the FIN6 and Cobalt Group cybercrime organizations

Unmasking VENOM SPIDER— the Hacker Behind Golden Chickens Malware

In this month’s TRU Intelligence Briefing, the Threat Response Unit reviewed:
- Threat Landscape: A review of recently observed malware and notable vulnerabilities by the SOC such as: Raspberry Robin, Vidar Stealer, BumbleBee, CVE-2022-34713, CVE-2022-31656, and CVE-2022-37042
- A brief update on cyberattacks related to ongoing geo-political tensions
- Information Stealers: Cyber trends and tactics
- Tactical Threat Response view: Detection details and mitigation recommendations relating to information stealers

August TRU Intelligence Briefing

Join eSentire's Threat Intelligence (TI) team as they discuss the latest attacks observed by our Security Operations Center (SOC). Download this webinar today to learn more about:

- REvil ransomware campaign against Kaseya VSA Servers
- PrintNightmare Windows principal vulnerability
- The ongoing FIN7 campaign and recent incidents

This webinar will also include a Q&A session

Speakers:
Spence Hutchinson, Manager of Threat Intelligence Team, eSentire
Paul Aitken, Cyber Threat Intelligence Analyst, eSentire

July 2021 Threat Intelligence Observations

Managed Detection and Response

Threat Intelligence

Threat Analysis

Cyber Risk Management

Cyber Defence

Cyber Security

Ransomware

REvil

Kaseya

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Get powerful emerging technology insights from influential experts. Connect with thought leaders and colleagues to get the most up-to-date knowledge on technologies like 3D printing, pervasive robotics, natural interfaces, connected everything and cognitive systems.

Emerging Technologies

The research and development community on BrightTALK brings together leading professionals in healthcare, technology and manufacturing to present on current topics in their fields. From big data in healthcare to online forensics training and medical research practices, the community is an exceptional resource for those looking to expand their knowledge. Be part of the conversation by joining the community and participating in interactive live webinars.

July 2021 Threat Intelligence Observations

Presented by

About this talk

More from this channel