Summary Bullets:
• For enterprising hackers, using legitimate credentials is the fastest path into the enterprise. IBM X-Force’s 2024 Threat Intelligence Index reported that bad actors commandeered valid credentials in 30% of all incidents the research arm responded to last year, the most common access method of any used in 2023.
• IBM saw an 11.5% decrease in ransomware demands, which the company attributed to increasing resistance from targeted companies to pay.

Today’s cyber threat environment remains toxic, virulent, and challenging for enterprises on the defensive. The 2024 IBM X-Force Threat Intelligence Index, sourced from the research team’s insights gained from tracking over 150 billion security threats each day, uncovered some changes in the processes and methodologies threat actors are using to mine enterprise resources for profit. Noting that hackers prefer an access path into the enterprise of one of least resistance, IBM reported a 71% jump in 2023 from the prior year in threat actors using legitimate credentials to breach a targeted enterprise. During incident response engagements, X-Force found a 100% rise in “Kerberroasting,” a tactic that uses Kerberos authorization tickets to steal Microsoft Active Directory credentials.

Continue reading “IBM X-Force Research Finds Identity Has Become the Entry Point into the Enterprise for Cybercriminals” →

Summary Bullets:

• Cybersecurity vendor Proofpoint flagged a hacking operation in November in which cybercriminals are employing phishing bait inside shared Office 365 documents to steal credentials.

• Hackers have targeted end users in a spectrum of corporate roles in multiple organizations with titles ranging from account managers and sales directors to CFOs and CEOs.

The Cloud Security Response team at security vendor Proofpoint issued an alert this week about an ongoing phishing campaign involving Office 365 apps that the organization first uncovered in November. Hackers have been threading together credential phishing and account takeover tactics to gain access to enterprise resources. So far, dozens of organizations and hundreds of users have been hit. One method these bad actors are using is to insert links that direct targeted users to click on to view a document. The links then route the users a harmful phishing web page. Continue reading “Hackers Take Aim at Microsoft 365 Users with Targeted Phishing Campaign” →

Summary Bullets:

• In late January 2024, Verizon began alerting more than 63,000 employees impacted by the breach of a file in September 2023 containing personal information that could encompass social security numbers, addresses, union affiliation, and compensation.

• Verizon took nearly three months to detect the incident, which the carrier blamed on “insider wrong doing.” Verizon doesn’t believe the data was shared with external entities.

Verizon joined the long list of companies facing the aftermath of a 2023 security incident. Nearly three months after an employee gained unauthorized access to a document containing sensitive data on more than 63,000 staff members, Verizon finally became aware of the breach. In January, Verizon sent letters to the employees impacted by the breach. In the letter, the carrier says the file could include name, address, social security number or other national identifier, gender, union affiliation, date of birth, and compensation data. Verizon says there is no indication the information has been misused or shared outside of Verizon. The carrier is providing affected staff with identity protection and credit monitoring services for two years.