Incident Response @Mandiant. Former MITRE ATT&CKer.
Joined October 2017
- Tweets449
- Following352
- Followers1.7K
- Likes1.5K
Sarah Yoder retweeted
New reporting from CrowdStrike: WARP PANDA - This newly designated China-nexus adversary is deploying BRICKSTORM malware against vCenter servers and demonstrating deep familiarity with virtualized and cloud environments.
crowdstrike.com/en-us/blog/w…
Sarah Yoder retweeted
🚨 PRC state-sponsored APT actors are using BRICKSTORM malware, a sophisticated backdoor, to target govt & #CriticalInfrastructure. Our 🆕 Malware Analysis Report, derived from an #IncidentResponse engagement, details IOCs & mitigation steps. Act now! cisa.gov/news-events/analysi…
ALT Digital image featuring a red and black background with binary code and subtle red circuit patterns. At the top is the Cybersecurity and Infrastructure Security Agency (CISA) logo. The foreground text states 'MALWARE ANALYSIS REPORT: BRICKSTORM Backdoor.'
Even more BRICKSTORM details provided by @CISAgov, with great details around ESXi specific samples
xitter.cf/cisagov/status/1996606…
Earlier this year, I worked one the most interesting and complex IRs of my career. The malware and techniques from that case turned out to be key TTPs observed in multiple subsequent UNC5221 cases!
cloud.google.com/blog/topics…
Earlier this year, I worked one the most interesting and complex IRs of my career. The malware and techniques from that case turned out to be key TTPs observed in multiple subsequent UNC5221 cases!
cloud.google.com/blog/topics…
Sarah Yoder retweeted
🔥new blog detailing 0day exploitation of Ivanti appliances as well as newly observed malware families tracked as PHASEJAM and DRYHOOK. We also detail activity related to the previously observed SPAWN malware ecosystem tied to China nexus cluster UNC5337.
cloud.google.com/blog/topics…
Sarah Yoder retweeted
Today, @Mandiant published #MTrends2024, the 15th edition of the report. This report has everything - Frontline Intel Metrics, Hot Zero-Day Summer, Attackers Living on the Edge, insights into☁Threats, evolution of 🎣...
Get your copy here: cloud.google.com/security/re…
Sarah Yoder retweeted
it's always dns and/or caching until you're behind a corporate ssl inspection appliance. then it's always ssl certificates.
Check out @Mandiant’s latest hardening and remediation guide for orgs impacted by the recent ConnectWise #ScreenConnect vulns (CVE-2024-1708 and CVE-2024-1709)
mandiant.com/resources/blog/…
Sarah Yoder retweeted
LockBit ransomware gang disrupted by global operation dlvr.it/T2zG6G
Sarah Yoder retweeted
🔥new @Mandiant blog off the press digging further into our findings from Ivanti CS exploitation. Part 2 covers some new malware families, more on ZIPLINE, updates to attribution, and a bit on mitigation bypassing and new post-ex TTPs. mandiant.com/resources/blog/…
Sarah Yoder retweeted
UNC4990 - The first malicious threat actor Mandiant has tracked that's based out of Italy - employs some tactics we haven't seen before.
mandiant.com/resources/blog/…
Sarah Yoder retweeted
.@Volexity shares new observations on cont'd widespread exploitation of Ivanti Connect Secure VPN vulnerabilities. Now, 2100+ compromised devices & UTA0178 observed modifying built-in Integrity Checker Tool to evade detection. Details: volexity.com/blog/2024/01/18…
#dfir #threatintel
Sarah Yoder retweeted
The financially motivated threat actor tracked by Microsoft as Octo Tempest, whose evolving campaigns leverage tradecraft not seen in typical threat models, represents a growing concern for organizations. Get TTPs and protection info: msft.it/60129Lhkw
Sarah Yoder retweeted
🚨 NetScaler vulnerability CVE-2023-4966 is being actively exploited. It can lead to VDI session hijacking, including MFA bypass. There are no logs on the appliance to monitor for exploitation. Upgrade now and investigate your environment!
mandiant.com/resources/blog/…
#DFIR
Sarah Yoder retweeted
Our blog on UNC3944, a threat actor involved in several recent attacks on the hospitality sector and other industries. Includes actor methods and mitigations. mandiant.com/resources/blog/…
Sarah Yoder retweeted
🎯#Qakbot Botnet Takedown in Operation Duck Hunt!
💻 700,000 Victim Computers
💰 $8.6m in cryptocurrency seized by DOJ
💰 Qakbot has earned $58m in ransoms
🔒 Qakbot used by Conti, ProLock, Egregor, REvil, MegaCortex, and Black Basta ransomware groups
justice.gov/usao-cdca/pr/qak…
Sarah Yoder retweeted
Today we launched a 🔎 scanning tool for orgs to search their Citrix netscalers for evidence of CVE-2023-3519 post-exploration. You can run this direct on the ADC or against a forensic image. With public POCs out there expect more exploitation!
mandiant.com/resources/blog/…
#DFIR