U.S. and U.K. cyber, law enforcement and intelligence agencies issued a joint advisory Friday offering detailed information on how to defend against the activities
Attackers have co-opted the Hancitor malware downloader and recently used it to deliver Cuba ransomware as part of an email spam campaign for data exfiltration and
US, UK Agencies Warn Russian Hackers Are Adapting Based on Government Advisories http://www.fotogestoeber.de/iStock.com
email May 7, 2021
The adversary is changing its tools to avoid detection while attacking the vulnerabilities governments issue warnings about.
The Russian hacker group behind the historic SolarWinds intrusion that affected nine federal agencies keeps adjusting their tactics based on government advisories, U.S. and U.K. cybersecurity-focused agencies warn.
A joint advisory issued Friday by the U.K.’s National Cyber Security Centre, the Cybersecurity and Infrastructure Security Agency, the National Security Agency and the FBI specifically said Russia’s Foreign Intelligence Service (SVR) changed its behavior after the release of a July 2020 advisory on the group, also known as APT29. The U.S. and U.K. attributed the SolarWinds campaign to the Russian threat actor in April. The July advisory warned they were also targeting C
“We’re seeing an extraordinarily high level of complex ransomware and other cybercrime, and the need for effective, comprehensive cybersecurity has never been more critical or urgent,” said Dan Schiappa, chief product officer at Sophos. “Sophos XDR is a game-changing new solution for proactively defending against the most sophisticated and evasive attacks, especially those that leverage multiple access points to gain entry, move laterally to evade detection, and do as much damage as possible as fast as possible.”
Attacks on Steroids
Advertisement
Sophos has published new research, “Intervention halts a ProxyLogon-enabled attack,” detailing an attack against a large organization that began when the adversaries compromised an Exchange server using the recent ProxyLogon exploit. The research shows how the attackers moved laterally through the network and, over a two-week period, stole account credentials; compromised domain controllers; secured a foothold on multiple