The technology could remove certain barriers to entry and open up the industry to a wider mix of people

Mandiant exec thinks AI could boost diversity in cybersecurity | ITPro

Google Cloud enhances cybersecurity with Mandiant integration, threat intelligence sharing, updated framework - SiliconANGLE

Multiple threat actors are exploiting CVE-2023-4966, aka Citrix Bleed, a critical vulnerability in NetScaler ADC and Gateway.

Mass Exploitation of ‘Citrix Bleed’ Vulnerability Underway

Citrix Bleed, the critical information-disclosure bug that affects NetScaler ADC and NetScaler Gateway, is now under "mass exploitation," as thousands of Citrix NetScaler instances remain vulnerable, according to security teams.

'Mass exploitation' of Citrix Bleed underway as ransomware crews pile in

Earlier this month another vulnerability was found in Citrix Systems Inc.’s NetScaler and NetGateway product lines. This time around, the Citrix Bleed exploit is a lot more dangerous and harder to snuff out.

New Citrix Bleed vulnerability of NetScaler network devices

North Korea’s evolving and flexible hacking structure encompasses a wide range of malicious activity beyond stealing from cryptocurrency exchanges, fueled by a small but nimble cyber workforce.

North Korea’s state hacking program is varied, fluid, and nimble

U.S. critical infrastructure organizations have been urged by Mandiant Intelligence Chief Analyst John Hultquist to accelerate efforts to discover and mitigate threats by Chinese state-sponsored threat operation Volt Typhoon,

Significant Volt Typhoon threat requires immediate US critical infrastructure action

Google’s AI strategy in Google Cloud, project Gemini, Vertex AI, and GenAI into security products boosts sales and innovation, said Sundar Pichai in Q3 2023 earnings.

Google CEO’s 8 Boldest AI Remarks On Cloud, Gemini And Security

The Canadian government report exposed China’s Spamouflage campaign designed to use social media to influence public opinion and politics in target countries.

China Falsely Denies Disinformation Campaign Targeting Canada’s Prime Minister

Mandiant

mandiant

In 2020, I authored an article on LinkedIn titled "Welcome to Edge Territory." (Welcome to Edge Territory – the Hidden Space Between Networks | LinkedIn) The blog was intended to start a series exploring the complexities of edge computing. The idea still intrigues me, and I am considering revisiting it—perhaps as a podcast series. One of the more startling insights from that blog was the projected $10 trillion in damages by 2025, a figure we are now on track to exceed by the end of 2024. Despite $300 billion being spent a year on prevention, this exponential growth in damage continues to outpace our efforts. I defined "edge territory" as "the unmapped space beyond the network edge between environments, where secured and unsecured networks and devices collide." I still find that definition fitting, though I would add that we continually discover new edges beyond what was previously understood. These evolving threats extend beyond manageable devices to unmanaged IoT and edge scenarios in cloud and data center deployments. So, the critical question becomes: Where can I find the edge? The edge is everywhere, constantly shifting based on how we use new computing concepts and remain productive in our daily lives, individually and organizationally. This dynamic presents a challenge that I highlighted in that earlier blog. The seen and unseen spaces at the edge invite us to cooperate more closely as a community and marketplace. I am thrilled to collaborate with other leaders working tirelessly to provide solutions for visibility and response in edge scenarios. Both attackers and defenders are keenly aware of how vulnerable we are. Since 2020, the number of known exploits has grown exponentially. The challenge posed by bounties and threat hunting has been met with increasingly sophisticated tools, making discovery more effective for attackers and cybersecurity teams. One article noted that quarterly disclosed additions to the Common Vulnerabilities and Exposures (CVE) database surged from 8,051 in 2021 to 26,447 in 2022—a staggering 320% year-over-year increase. By January 2024, the CVE database had reached 176,000 entries; as I write this, the number surpassed 240,000. What stands out about the edge is how exponential growth is clear across the board: in losses, spending, and the number of identified vulnerabilities. Addressing cybersecurity at the edge requires finding the necessary solutions for visibility and response. I want to take a moment to acknowledge and express gratitude to the many vendors, service providers, and companies on the front lines of what can only be described as a war zone in edge territory. A comprehensive approach to edge security might involve intrusion detection systems, Security Operations Centers (SOCs), firewalls, security system management, endpoint management solutions, log management solutions, event management solutions, and strategies for decreasing time for responding to an event that is detected by a tool or professional. I also want to highlight the incredible leaders and solutions in the Extended Detection and Response (XDR) space. They focus on device vulnerabilities and work diligently to reduce the meantime to detect and contain threats, using AI and other advanced technologies. For those on the front lines, I hope to bring more awareness to the sheer volume of activity and effort needed to stay ahead of the identified exploits that threaten organizations and individuals. Malicious actors' use of AI or Machine Learning Models (MLLs) is a growing concern, underscoring that edge territory is constantly evolving. A comprehensive approach to edge cybersecurity should begin with network awareness and extend to every connected device. This is a daunting challenge, as most organizations struggle to gather the necessary tools and ability to optimize awareness and response. Recent reports, such as one from Google’s Mandiant, show that the average dwell time—the time it takes to detect a cyber intrusion—has dropped to a record low of 2.24 months. As we continue to navigate edge territory, we, as a community, are working together more effectively to observe, identify, protect, and respond. This collective effort can potentially reduce the exponential growth of damage and chart a different course for the future. Recent reports, like Sophos' 2024 State of Ransomware in Healthcare, highlight the rapid increase in attacks on healthcare organizations, with incidents rising from 34% in 2021 to 67% in 2024. These statistics serve as a stark reminder that edge territory is expanding and becoming increasingly dangerous. Combined attack vectors or surface information offers a holistic view of edge territory. At the network level, monitoring vulnerabilities and traffic allows for responses. At the device level, observability from the network through the application and data layers covers every aspect of edge territory. One reason the Edge continues to evolve, and grow is the expansion of connected services and digital assets. As one analyst from Silicon Angle recently noted, "The edge is now space." I am excited to join my team in applying AI more holistically across edge-to-edge scenarios, offering greater visibility and empowering organizations to respond faster than ever with more connected analytics. With our DCX Offering, we have extended our awareness edge-to-edge and now provide automated detection and containment through isolation. This adds value to any existing solution, creating unprecedented metrics for success, with over 240,000 incidents detected and contained last year alone. We are proud to collaborate with writers and industry experts to provide our partners, vendors, and industry leaders with improved awareness of edge territory making the undefinable visible and approachable for any organization.                                                                   Follow Our Blog & News https://guarddog.ai/news/ In 2020, I authored an article on LinkedIn titled "Welcome to Edge Territory." ( Welcome to Edge Territory – the Hidden Space Between Networks | LinkedIn ) The blog was intended to start a series exploring the complexities of edge computing. The idea still intrigues me, and I am considering revisiting it—perhaps as a podcast series. Welcome to Edge Territory – the Hidden Space Between Networks | LinkedIn One of the more startling insights from that blog was the projected $10 trillion in damages by 2025, a figure we are now on track to exceed by the end of 2024. Despite $300 billion being spent a year on prevention, this exponential growth in damage continues to outpace our efforts. I defined "edge territory" as "the unmapped space beyond the network edge between environments, where secured and unsecured networks and devices collide." I still find that definition fitting, though I would add that we continually discover new edges beyond what was previously understood. These evolving threats extend beyond manageable devices to unmanaged IoT and edge scenarios in cloud and data center deployments. So, the critical question becomes: Where can I find the edge? The edge is everywhere, constantly shifting based on how we use new computing concepts and remain productive in our daily lives, individually and organizationally. This dynamic presents a challenge that I highlighted in that earlier blog. The seen and unseen spaces at the edge invite us to cooperate more closely as a community and marketplace. I am thrilled to collaborate with other leaders working tirelessly to provide solutions for visibility and response in edge scenarios. Both attackers and defenders are keenly aware of how vulnerable we are. Since 2020, the number of known exploits has grown exponentially. The challenge posed by bounties and threat hunting has been met with increasingly sophisticated tools, making discovery more effective for attackers and cybersecurity teams. One article noted that quarterly disclosed additions to the Common Vulnerabilities and Exposures (CVE) database surged from 8,051 in 2021 to 26,447 in 2022—a staggering 320% year-over-year increase. By January 2024, the CVE database had reached 176,000 entries; as I write this, the number surpassed 240,000. What stands out about the edge is how exponential growth is clear across the board: in losses, spending, and the number of identified vulnerabilities. Addressing cybersecurity at the edge requires finding the necessary solutions for visibility and response. I want to take a moment to acknowledge and express gratitude to the many vendors, service providers, and companies on the front lines of what can only be described as a war zone in edge territory. A comprehensive approach to edge security might involve intrusion detection systems, Security Operations Centers (SOCs), firewalls, security system management, endpoint management solutions, log management solutions, event management solutions, and strategies for decreasing time for responding to an event that is detected by a tool or professional. I also want to highlight the incredible leaders and solutions in the Extended Detection and Response (XDR) space. They focus on device vulnerabilities and work diligently to reduce the meantime to detect and contain threats, using AI and other advanced technologies. For those on the front lines, I hope to bring more awareness to the sheer volume of activity and effort needed to stay ahead of the identified exploits that threaten organizations and individuals. Malicious actors' use of AI or Machine Learning Models (MLLs) is a growing concern, underscoring that edge territory is constantly evolving. A comprehensive approach to edge cybersecurity should begin with network awareness and extend to every connected device. This is a daunting challenge, as most organizations struggle to gather the necessary tools and ability to optimize awareness and response. Recent reports, such as one from Google’s Mandiant, show that the average dwell time—the time it takes to detect a cyber intrusion—has dropped to a record low of 2.24 months. As we continue to navigate edge territory, we, as a community, are working together more effectively to observe, identify, protect, and respond. This collective effort can potentially reduce the exponential growth of damage and chart a different course for the future. Recent reports, like Sophos' 2024 State of Ransomware in Healthcare, highlight the rapid increase in attacks on healthcare organizations, with incidents rising from 34% in 2021 to 67% in 2024. These statistics serve as a stark reminder that edge territory is expanding and becoming increasingly dangerous. Combined attack vectors or surface information offers a holistic view of edge territory. At the network level, monitoring vulnerabilities and traffic allows for responses. At the device level, observability from the network through the application and data layers covers every aspect of edge territory. One reason the Edge continues to evolve, and grow is the expansion of connected services and digital assets. As one analyst from Silicon Angle recently noted, "The edge is now space." I am excited to join my team in applying AI more holistically across edge-to-edge scenarios, offering greater visibility and empowering organizations to respond faster than ever with more connected analytics. With our DCX Offering, we have extended our awareness edge-to-edge and now provide automated detection and containment through isolation. This adds value to any existing solution, creating unprecedented metrics for success, with over 240,000 incidents detected and contained last year alone. We are proud to collaborate with writers and industry experts to provide our partners, vendors, and industry leaders with improved awareness of edge territory making the undefinable visible and approachable for any organization.                                                                   Follow Our Blog & News https://guarddog.ai/news/ https://guarddog.ai/news/

The Edge: How Do I Know I’ve Found It?

প্রান্ত: আমি কিভাবে জানব যে আমি এটি খুঁজে পেয়েছি?

The Edge: Woher weiß ich, dass ich es gefunden habe?

The Edge: ¿Cómo sé que lo he encontrado?

The Edge : Comment savoir si je l’ai trouvé ?

किनारा: मैं कैसे जानूँ कि मैंने उसे पा लिया है?

エッジ: 見つけたかどうかはどうすればわかるのでしょうか?

The Edge: 찾았는지 어떻게 알 수 있을까?

The Edge: Como sei que o encontrei?

Грань: как я узнаю, что нашел ее?

The Edge: Onu Bulduğumu Nasıl Anlarım?

The Edge: Làm sao tôi biết mình đã tìm thấy nó?

边缘：我怎么知道我找到了它？

Google Cloud x Gemini: Accomplish More in the Cloud with Generative AI

For decades, threat intelligence solutions have had two main challenges: They lack a comprehensive view of the threat landscape, and to get value from intelligence, organizations have to spend excess time, energy, and money trying to collect and operationalize the data. New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here. Recently, at the RSA Conference in San Francisco, we announced Google Threat Intelligence, a new offering that combines the unmatched depth of our Mandiant frontline expertise, the global reach of the VirusTotal community, and the breadth of visibility only Google can deliver based on billions of signals across devices and emails. Google Threat Intelligence includes Gemini in Threat Intelligence, our AI-powered agent that provides conversational search across our vast repository of threat intelligence, enabling customers to gain insights and protect themselves from threats faster than ever before. “While there is no shortage of threat intelligence available, the challenge for most is to contextualize and operationalize intelligence relevant to their specific organization,” said Dave Gruber, principal analyst, Enterprise Strategy Group. “Unarguably, Google provides two of the most important pillars of threat intelligence in the industry today with VirusTotal and Mandiant. Integrating both into a single offering, enhanced with AI and Google threat insights, offers security teams a new means to operationalize actionable threat intelligence to better protect their organizations.” Unmatched visibility into threats Google Threat Intelligence provides unparalleled visibility into the global threat landscape. We offer deep insights from Mandiant’s leading incident response and threat research team, and combine them with our massive user and device footprint and VirusTotal’s broad crowdsourced malware database. Google threat insights: Google protects 4 billion devices and 1.5 billion email accounts, and blocks 100 million phishing attempts per day. This provides us with a vast sensor array and a unique perspective on internet and email-borne threats that allow us to connect the dots back to attack campaigns.
Frontline intelligence: Mandiant's eIite incident responders, security consultants, and frontline intelligence operations analysts dissect attacker tactics and techniques, using their experience to help customers defend against sophisticated and relentless threat actors across the globe in over 1,100 investigations annually, resulting in a corpus of over 15 years of frontline intelligence.
Human-curated threat intelligence: Mandiant’s global threat experts meticulously monitor threat actor groups for activity and changes in their behavior to contextualize ongoing investigations and provide the insights you need to respond.
Crowdsourced threat intelligence: VirusTotal's global community of over 1 million users continuously contributes potential threat indicators, including files and URLs, to offer real-time insight into emerging attacks.
Open-source threat intelligence: We use open-source threat intelligence to enrich our knowledge base with current discoveries from the security community. This comprehensive view allows Google Threat Intelligence to help protect your organization in a variety of ways, including external threat monitoring, attack surface management, digital risk protection, Indicators of Compromise (IOC) analysis, and expertise. AI-driven operationalization Traditional approaches to operationalizing threat intelligence are labor-intensive and can slow down your ability to respond to evolving threats, potentially taking days or weeks to respond. https://youtu.be/QGUri8v4THc?embedable=true By combining our comprehensive view of the threat landscape with Gemini, we have supercharged the threat research processes, augmented defense capabilities, and reduced the time it takes to identify and protect against novel threats. Customers now have the ability to condense large data sets in seconds, quickly analyze suspicious files, and simplify challenging manual threat intelligence tasks. How Gemini helps simplify and assist with threat intelligence Gemini 1.5 Pro is a valuable part of Google Threat Intelligence, and we’ve integrated it so that it can more efficiently and effectively assist security professionals in combating malware. Gemini 1.5 Pro offers the world’s longest context window, with support for up to 1 million tokens. It can dramatically simplify the technical and labor-intensive process of reverse engineering malware — one of the most advanced malware-analysis techniques available to cybersecurity professionals. In fact, it was able to process the entire decompiled code of the malware file for WannaCry in a single pass, taking 34 seconds to deliver its analysis and identify the killswitch. We also offer a Gemini-driven entity extraction tool to automate data fusion and enrichment. It can automatically crawl the web for relevant open source intelligence (OSINT), and classify online industry threat reporting. It then converts this information to knowledge collections, with corresponding hunting and response packs pulled from motivations, targets, tactics, techniques, and procedures (TTPs), actors, toolkits, and Indicators of Compromise (IoCs). Google Threat Intelligence can distill more than a decade of threat reports to produce comprehensive, custom summaries in seconds. Make Google part of your security team Google Threat Intelligence is just one way we can help you in your threat intelligence journey. Whether you need cyber threat intelligence training for your staff, assistance with prioritizing complex threats, or even a dedicated threat analyst embedded in your team, our experts can act as an extension of your own team. Google Threat Intelligence is part of Google Cloud Security’s comprehensive security portfolio, which includes Google Security Operations, Mandiant Consulting, Security Command Center Enterprise, and Chrome Enterprise. With our offerings, organizations can address security challenges with the same capabilities Google uses to keep more people and organizations safe online than anyone else in the world. To learn more about Google Threat Intelligence and the rest of Google Cloud Security’s comprehensive portfolio, come meet us in person at our RSA Conference booth (N5644), and catch us at our keynotes, presentations, and meetups. You can also register for our upcoming Google Threat Intelligence use-cases webinar series, and read our expert analysis and in-depth research at the Google Cloud Threat Intelligence blog. New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here. Originally published here. Contributed by: Google Cloud For decades, threat intelligence solutions have had two main challenges: They lack a comprehensive view of the threat landscape, and to get value from intelligence, organizations have to spend excess time, energy, and money trying to collect and operationalize the data. New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here. New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here. New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here . here Recently, at the RSA Conference in San Francisco, we announced Google Threat Intelligence, a new offering that combines the unmatched depth of our Mandiant frontline expertise, the global reach of the VirusTotal community, and the breadth of visibility only Google can deliver based on billions of signals across devices and emails. Google Threat Intelligence includes Gemini in Threat Intelligence, our AI-powered agent that provides conversational search across our vast repository of threat intelligence, enabling customers to gain insights and protect themselves from threats faster than ever before. “While there is no shortage of threat intelligence available, the challenge for most is to contextualize and operationalize intelligence relevant to their specific organization,” said Dave Gruber, principal analyst, Enterprise Strategy Group. “Unarguably, Google provides two of the most important pillars of threat intelligence in the industry today with VirusTotal and Mandiant. Integrating both into a single offering, enhanced with AI and Google threat insights, offers security teams a new means to operationalize actionable threat intelligence to better protect their organizations.” “While there is no shortage of threat intelligence available, the challenge for most is to contextualize and operationalize intelligence relevant to their specific organization,” said Dave Gruber, principal analyst, Enterprise Strategy Group. “Unarguably, Google provides two of the most important pillars of threat intelligence in the industry today with VirusTotal and Mandiant. Integrating both into a single offering, enhanced with AI and Google threat insights, offers security teams a new means to operationalize actionable threat intelligence to better protect their organizations.” Unmatched visibility into threats Google Threat Intelligence provides unparalleled visibility into the global threat landscape. We offer deep insights from Mandiant’s leading incident response and threat research team, and combine them with our massive user and device footprint and VirusTotal’s broad crowdsourced malware database. Google threat insights: Google protects 4 billion devices and 1.5 billion email accounts, and blocks 100 million phishing attempts per day. This provides us with a vast sensor array and a unique perspective on internet and email-borne threats that allow us to connect the dots back to attack campaigns. Frontline intelligence: Mandiant's eIite incident responders, security consultants, and frontline intelligence operations analysts dissect attacker tactics and techniques, using their experience to help customers defend against sophisticated and relentless threat actors across the globe in over 1,100 investigations annually, resulting in a corpus of over 15 years of frontline intelligence. Human-curated threat intelligence: Mandiant’s global threat experts meticulously monitor threat actor groups for activity and changes in their behavior to contextualize ongoing investigations and provide the insights you need to respond. Crowdsourced threat intelligence: VirusTotal's global community of over 1 million users continuously contributes potential threat indicators, including files and URLs, to offer real-time insight into emerging attacks. Open-source threat intelligence: We use open-source threat intelligence to enrich our knowledge base with current discoveries from the security community. Google threat insights: Google protects 4 billion devices and 1.5 billion email accounts, and blocks 100 million phishing attempts per day. This provides us with a vast sensor array and a unique perspective on internet and email-borne threats that allow us to connect the dots back to attack campaigns. Google threat insights: Frontline intelligence: Mandiant's eIite incident responders, security consultants, and frontline intelligence operations analysts dissect attacker tactics and techniques, using their experience to help customers defend against sophisticated and relentless threat actors across the globe in over 1,100 investigations annually, resulting in a corpus of over 15 years of frontline intelligence. Frontline intelligence: Human-curated threat intelligence: Mandiant’s global threat experts meticulously monitor threat actor groups for activity and changes in their behavior to contextualize ongoing investigations and provide the insights you need to respond. Human-curated threat intelligence: Crowdsourced threat intelligence: VirusTotal's global community of over 1 million users continuously contributes potential threat indicators, including files and URLs, to offer real-time insight into emerging attacks. Crowdsourced threat intelligence: Open-source threat intelligence : We use open-source threat intelligence to enrich our knowledge base with current discoveries from the security community. Open-source threat intelligence This comprehensive view allows Google Threat Intelligence to help protect your organization in a variety of ways, including external threat monitoring, attack surface management, digital risk protection, Indicators of Compromise (IOC) analysis, and expertise. AI-driven operationalization Traditional approaches to operationalizing threat intelligence are labor-intensive and can slow down your ability to respond to evolving threats, potentially taking days or weeks to respond. https://youtu.be/QGUri8v4THc?embedable=true https://youtu.be/QGUri8v4THc?embedable=true By combining our comprehensive view of the threat landscape with Gemini, we have supercharged the threat research processes, augmented defense capabilities, and reduced the time it takes to identify and protect against novel threats. Customers now have the ability to condense large data sets in seconds, quickly analyze suspicious files, and simplify challenging manual threat intelligence tasks. How Gemini helps simplify and assist with threat intelligence How Gemini helps simplify and assist with threat intelligence Gemini 1.5 Pro is a valuable part of Google Threat Intelligence, and we’ve integrated it so that it can more efficiently and effectively assist security professionals in combating malware. Gemini 1.5 Pro offers the world’s longest context window, with support for up to 1 million tokens . It can dramatically simplify the technical and labor-intensive process of reverse engineering malware — one of the most advanced malware-analysis techniques available to cybersecurity professionals. In fact, it was able to process the entire decompiled code of the malware file for WannaCry in a single pass , taking 34 seconds to deliver its analysis and identify the killswitch. 1 million tokens 1 million tokens WannaCry in a single pass WannaCry in a single pass We also offer a Gemini-driven entity extraction tool to automate data fusion and enrichment. It can automatically crawl the web for relevant open source intelligence (OSINT), and classify online industry threat reporting. It then converts this information to knowledge collections, with corresponding hunting and response packs pulled from motivations, targets, tactics, techniques, and procedures (TTPs), actors, toolkits, and Indicators of Compromise (IoCs). Google Threat Intelligence can distill more than a decade of threat reports to produce comprehensive, custom summaries in seconds. Make Google part of your security team Make Google part of your security team Google Threat Intelligence is just one way we can help you in your threat intelligence journey. Whether you need cyber threat intelligence training for your staff, assistance with prioritizing complex threats, or even a dedicated threat analyst embedded in your team, our experts can act as an extension of your own team. Google Threat Intelligence is part of Google Cloud Security’s comprehensive security portfolio, which includes Google Security Operations , Mandiant Consulting , Security Command Center Enterprise , and Chrome Enterprise . With our offerings, organizations can address security challenges with the same capabilities Google uses to keep more people and organizations safe online than anyone else in the world. Google Security Operations Google Security Operations Mandiant Consulting Mandiant Consulting Security Command Center Enterprise Security Command Center Enterprise Chrome Enterprise Chrome Enterprise To learn more about Google Threat Intelligence and the rest of Google Cloud Security’s comprehensive portfolio, come meet us in person at our RSA Conference booth (N5644), and catch us at our keynotes, presentations, and meetups . You can also register for our upcoming Google Threat Intelligence use-cases webinar series , and read our expert analysis and in-depth research at the Google Cloud Threat Intelligence blog . Google Threat Intelligence Google Threat Intelligence RSA Conference booth RSA Conference booth keynotes, presentations, and meetups keynotes, presentations, and meetups Google Threat Intelligence use-cases webinar series Google Threat Intelligence use-cases webinar series Threat Intelligence blog Threat Intelligence blog New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here. New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here. New Google Cloud customers from HackerNoon receive $300 plus an additional $50 in free credits to test, deploy, and explore Google Cloud for 90 days. Get started using the link here . here Originally published here . here Contributed by: Google Cloud

Actionable Threat Intelligence at Google Scale: Meet Google Threat Intelligence Powered by Gemini

Cryptographic Ransomware Encryption Detection: Survey: Author's Declaration

Digital Forensics and Incident Response (DFIR) is a specialized field within information security focused on managing cybersecurity incidents. It involves identifying, mitigating, and investigating these incidents, which is known as incident response. Additionally, the field includes the application of forensic techniques, referred to as digital forensics, to analyze and gather evidence. Digital forensics typically begins with an incident, but sometimes, merely detecting signs of unauthorized scanning of a company's IT infrastructure can thwart an attack. Hackers often infiltrate systems in phases and might remain inactive for a while, only to strike a critical digital asset suddenly. For this reason, it is highly effective when digital forensics teams collaborate closely with threat monitoring teams to intercept and block hacking attempts early on. Paths to a Digital Forensics Career This profession demands extensive practical knowledge of IT, encompassing everything from operating systems to mobile apps, telecommunications solutions to IoT devices, and from databases to hardware configurations. A digital forensic expert must not only have a deep understanding of how IT systems function - ideally at an admin level - but also grasp how these systems are protected and how exactly they can be compromised. The transition of someone from a job in cybersecurity, IT administration, or a backend development job into digital forensics can be incredibly valuable. There is no quick training method; the most effective approach is "learning by doing," where individuals learn on the job by tackling specific practical tasks while addressing real-world problems. While there are now excellent courses on digital forensics that can significantly enhance this hands-on learning experience, they should only serve as a supplement, not a replacement. Main Tasks in Digital Forensic Investigations The role of incident responders is to analyze traces of intrusions to answer practical questions: What exactly happened? After a cyber incident, it is vital to determine exactly how hackers gained access and what actions they took. This detailed understanding helps to more accurately assess both the direct damage from the incident and the potential reputational risks. How did this happen? It is necessary to reconstruct the entire sequence of the attack. This knowledge allows information security specialists to mitigate future cyber threats by addressing vulnerabilities that were exploited in the attack, preventing hackers from using the same or similar tactics again. What should you do at the moment? Sometimes, digital forensics specialists need to be actively involved in responding to an incident, not just analyzing the traces. There are situations where hacker activity within a company's IT infrastructure is ongoing. In such cases, it is important to respond carefully, in coordination with all members of the security team, to contain the threat. New challenges are emerging. For example, digital forensics is now used to perform compromise assessments, which involve identifying traces of IT infrastructure compromise. Detecting signs of past breaches can lead cyber investigators to uncover unpatched vulnerabilities or weaknesses in the information security framework. Often, discovering such previously unnoticed issues necessitates thorough investigations. How Long Investigations Last Usually, after a cyber incident, the investigation lasts about two to three weeks. While there are complex cases that require significantly more time, these are quite rare. Most of the time is devoted to the investigation itself, which includes all its stages and the analysis of data collected. Sometimes, this also involves actions to contain the attackers. Please remember that several days are also spent on writing detailed reports. Documentation is crucial: it is necessary to provide comprehensive information for the management of the client company, its security service, and external cybersecurity providers. In some cases, this information is also vital for law enforcement agencies, as digital forensics plays an important role in the apprehension and exposure of cyber criminals. Investigating a company's infrastructure for signs of possible intrusion is a time-consuming task due to the extensive amount of work involved. This process can take anywhere from a month to two months, depending on the size of the customer company's IT infrastructure. It is noteworthy that traces of intrusion, such as 'fingerprints' left by malware, backdoors installed by attackers, or suspicious traffic typical of specific post-exploitation frameworks, are often found. All these findings necessitate further research and detailed analysis. Evaluating a Digital Forensics Profession Strengths

Weaknesses



[+] This is interesting and creative work that requires a blend of competencies, practices, and intuition.

[-] Entering the profession involves a multistage, lengthy, and complex process.



[+] The specialty is rare, which typically means the average salary is higher than that of cybersecurity officers and admins.

[-] The working day can be irregular - for example, when it is necessary to detain malefactors, one might have to spend the night at the client's office.



Opportunities

Risks



[+] Continuous learning about the latest developments in IT, cybersecurity, and forensics keeps you sharp and well-informed.

[-] Switching fields of activity can be problematic due to technical specialties and psychological factors. Investigations are adrenaline-driven, making it difficult to easily walk away from forensics. The Ever-Learning Digital Forensic Expert A digital forensic specialist needs to engage in continuous learning, constantly updating and expanding their knowledge in IT and cybersecurity. This includes not only general IT development but also specialized knowledge in forensics, such as new findings, current challenges, and new cases. This practice introduces new techniques and tools while fostering proficiency in identifying malicious acts. For example, over time, forensic experts begin to recognize the distinct "styles" of different hacker groups. Attribution is crucial as it helps quickly untangle the chain of evidence and traces. A forensic expert continually develops their skills through practical experience and theoretical study. Specialists often need to learn independently, access information from free and paid courses, read articles and books related to their field, watch videos, and attend infosec conferences. They regularly consult specialized information resources such as This Week In 4N6,, The DFIR Report, and Sentinel Labs, along with Mandiant, Red Canary, and TrustedSec blogs. YouTube is another rich source of information, featuring channels like SANS Digital Forensics and Incident Response, 13Cubed, and John Hammond's channel. Additionally, X (formerly Twitter) is a valuable platform where tags like #DFIR and #DailyDFIR provide timely and helpful information. Conclusion The demand for digital forensics is growing along with the expansion of the cybersecurity market, but still exceeds the average for the segment. Most businesses do not require specialists with these skills; instead, digital forensic experts are often employed by specialized firms that offer various information security services. The cost of hiring a forensics specialist is usually open to negotiation and heavily relies on their qualifications and hands-on experience in handling incidents. These specialists have always been and will continue to be in short supply because there are no quick paths to becoming proficient in digital forensics. Digital Forensics and Incident Response ( DFIR ) is a specialized field within information security focused on managing cybersecurity incidents. It involves identifying, mitigating, and investigating these incidents, which is known as incident response. Additionally, the field includes the application of forensic techniques, referred to as digital forensics, to analyze and gather evidence. DFIR Digital forensics typically begins with an incident, but sometimes, merely detecting signs of unauthorized scanning of a company's IT infrastructure can thwart an attack. Hackers often infiltrate systems in phases and might remain inactive for a while, only to strike a critical digital asset suddenly. For this reason, it is highly effective when digital forensics teams collaborate closely with threat monitoring teams to intercept and block hacking attempts early on. hacking attempts Paths to a Digital Forensics Career This profession demands extensive practical knowledge of IT, encompassing everything from operating systems to mobile apps, telecommunications solutions to IoT devices, and from databases to hardware configurations. A digital forensic expert must not only have a deep understanding of how IT systems function - ideally at an admin level - but also grasp how these systems are protected and how exactly they can be compromised. The transition of someone from a job in cybersecurity, IT administration, or a backend development job into digital forensics can be incredibly valuable. There is no quick training method; the most effective approach is "learning by doing," where individuals learn on the job by tackling specific practical tasks while addressing real-world problems. While there are now excellent courses on digital forensics that can significantly enhance this hands-on learning experience, they should only serve as a supplement, not a replacement. backend development job excellent courses on digital forensics Main Tasks in Digital Forensic Investigations The role of incident responders is to analyze traces of intrusions to answer practical questions: What exactly happened? What exactly happened? What exactly happened? After a cyber incident, it is vital to determine exactly how hackers gained access and what actions they took. This detailed understanding helps to more accurately assess both the direct damage from the incident and the potential reputational risks. How did this happen? How did this happen? How did this happen? It is necessary to reconstruct the entire sequence of the attack. This knowledge allows information security specialists to mitigate future cyber threats by addressing vulnerabilities that were exploited in the attack, preventing hackers from using the same or similar tactics again. What should you do at the moment? What should you do at the moment? What should you do at the moment? Sometimes, digital forensics specialists need to be actively involved in responding to an incident, not just analyzing the traces. There are situations where hacker activity within a company's IT infrastructure is ongoing. In such cases, it is important to respond carefully, in coordination with all members of the security team, to contain the threat. New challenges are emerging. For example, digital forensics is now used to perform compromise assessments , which involve identifying traces of IT infrastructure compromise. Detecting signs of past breaches can lead cyber investigators to uncover unpatched vulnerabilities or weaknesses in the information security framework. Often, discovering such previously unnoticed issues necessitates thorough investigations. compromise assessments unpatched vulnerabilities How Long Investigations Last Usually, after a cyber incident, the investigation lasts about two to three weeks. While there are complex cases that require significantly more time, these are quite rare. Most of the time is devoted to the investigation itself, which includes all its stages and the analysis of data collected. Sometimes, this also involves actions to contain the attackers. Please remember that several days are also spent on writing detailed reports. Documentation is crucial: it is necessary to provide comprehensive information for the management of the client company, its security service, and external cybersecurity providers. In some cases, this information is also vital for law enforcement agencies, as digital forensics plays an important role in the apprehension and exposure of cyber criminals. Investigating a company's infrastructure for signs of possible intrusion is a time-consuming task due to the extensive amount of work involved. This process can take anywhere from a month to two months, depending on the size of the customer company's IT infrastructure. It is noteworthy that traces of intrusion, such as 'fingerprints' left by malware, backdoors installed by attackers, or suspicious traffic typical of specific post-exploitation frameworks, are often found. All these findings necessitate further research and detailed analysis. Evaluating a Digital Forensics Profession Strengths

Weaknesses



[+] This is interesting and creative work that requires a blend of competencies, practices, and intuition.

[-] Entering the profession involves a multistage, lengthy, and complex process.



[+] The specialty is rare, which typically means the average salary is higher than that of cybersecurity officers and admins.

[-] The working day can be irregular - for example, when it is necessary to detain malefactors, one might have to spend the night at the client's office.



Opportunities

Risks



[+] Continuous learning about the latest developments in IT, cybersecurity, and forensics keeps you sharp and well-informed.

[-] Switching fields of activity can be problematic due to technical specialties and psychological factors. Investigations are adrenaline-driven, making it difficult to easily walk away from forensics. Strengths

Weaknesses [+] This is interesting and creative work that requires a blend of competencies, practices, and intuition.

[-] Entering the profession involves a multistage, lengthy, and complex process. [+] The specialty is rare, which typically means the average salary is higher than that of cybersecurity officers and admins.

[-] The working day can be irregular - for example, when it is necessary to detain malefactors, one might have to spend the night at the client's office. Opportunities

Risks [+] Continuous learning about the latest developments in IT, cybersecurity, and forensics keeps you sharp and well-informed.

[-] Switching fields of activity can be problematic due to technical specialties and psychological factors. Investigations are adrenaline-driven, making it difficult to easily walk away from forensics. Strengths Weaknesses Strengths Strengths Strengths Weaknesses Weaknesses Weaknesses [+] This is interesting and creative work that requires a blend of competencies, practices, and intuition. [-] Entering the profession involves a multistage, lengthy, and complex process. [+] This is interesting and creative work that requires a blend of competencies, practices, and intuition. [+] This is interesting and creative work that requires a blend of competencies, practices, and intuition. [-] Entering the profession involves a multistage, lengthy, and complex process. [-] Entering the profession involves a multistage, lengthy, and complex process. [+] The specialty is rare, which typically means the average salary is higher than that of cybersecurity officers and admins. [-] The working day can be irregular - for example, when it is necessary to detain malefactors, one might have to spend the night at the client's office. [+] The specialty is rare, which typically means the average salary is higher than that of cybersecurity officers and admins. [+] The specialty is rare, which typically means the average salary is higher than that of cybersecurity officers and admins. [-] The working day can be irregular - for example, when it is necessary to detain malefactors, one might have to spend the night at the client's office. [-] The working day can be irregular - for example, when it is necessary to detain malefactors, one might have to spend the night at the client's office. Opportunities Risks Opportunities Opportunities Opportunities Risks Risks Risks [+] Continuous learning about the latest developments in IT, cybersecurity, and forensics keeps you sharp and well-informed. [-] Switching fields of activity can be problematic due to technical specialties and psychological factors. Investigations are adrenaline-driven, making it difficult to easily walk away from forensics. [+] Continuous learning about the latest developments in IT, cybersecurity, and forensics keeps you sharp and well-informed. [+] Continuous learning about the latest developments in IT, cybersecurity, and forensics keeps you sharp and well-informed. [-] Switching fields of activity can be problematic due to technical specialties and psychological factors. Investigations are adrenaline-driven, making it difficult to easily walk away from forensics. [-] Switching fields of activity can be problematic due to technical specialties and psychological factors. Investigations are adrenaline-driven, making it difficult to easily walk away from forensics. The Ever-Learning Digital Forensic Expert A digital forensic specialist needs to engage in continuous learning, constantly updating and expanding their knowledge in IT and cybersecurity . This includes not only general IT development but also specialized knowledge in forensics, such as new findings, current challenges, and new cases. This practice introduces new techniques and tools while fostering proficiency in identifying malicious acts. For example, over time, forensic experts begin to recognize the distinct "styles" of different hacker groups. Attribution is crucial as it helps quickly untangle the chain of evidence and traces. cybersecurity A forensic expert continually develops their skills through practical experience and theoretical study. Specialists often need to learn independently, access information from free and paid courses, read articles and books related to their field, watch videos, and attend infosec conferences. They regularly consult specialized information resources such as This Week In 4N6 ,, The DFIR Report , and Sentinel Labs , along with Mandiant , Red Canary , and TrustedSec blogs. YouTube is another rich source of information, featuring channels like SANS Digital Forensics and Incident Response , 13Cubed , and John Hammond's channel. Additionally, X (formerly Twitter) is a valuable platform where tags like #DFIR and #DailyDFIR provide timely and helpful information. This Week In 4N6 The DFIR Report Sentinel Labs Mandiant Red Canary TrustedSec SANS Digital Forensics and Incident Response 13Cubed John Hammond's Conclusion The demand for digital forensics is growing along with the expansion of the cybersecurity market, but still exceeds the average for the segment. Most businesses do not require specialists with these skills; instead, digital forensic experts are often employed by specialized firms that offer various information security services. The cost of hiring a forensics specialist is usually open to negotiation and heavily relies on their qualifications and hands-on experience in handling incidents. These specialists have always been and will continue to be in short supply because there are no quick paths to becoming proficient in digital forensics.

The Journey into Digital Forensics: Exploring Career Opportunities (Revealing Insights)

Let's learn about via these 58 free stories. They are ordered by most time reading created on HackerNoon. Visit the to find the most read stories about any technology. Cybersecurity Writing Contest /Learn Repo 1. The Cybersecurity Writing Contest 2022: Round 2 Results Announced! Hackers, the Round 2 Results for the Cybersecurity Writing Contest by Twingate and HackerNoon are here! 2. Common Vulnerabilities and Exposures: A Poem There's still some cases of malware
always-alarmed-and-on, always
large-in-scale in sight and run via
spray pray on-site. 3. Ransomware: Early Signs, Protection, and Staying Ahead In this article, you will learn about the signs of ransomware and how you can identify them. 4. Why I'm Fascinated by Cybersecurity: Interview with Jaspreet Kaur A women-in-tech interview with Jaspreet Kaur; a researcher, faculty, blogger, and consultant in the field of cyber security. 5. The Cybersecurity Writing Contest 2022: Round 3 Results Announced! Hackers, Assemble! Here we are with the third round’s results announcement of the Cybersecurity Writing Contest by Twingate & HackerNoon! 6. Myths and Misconceptions About Private Browsing Many people who use private browsing incorrectly believe they're protected. Private Browsing doesn't make you anonymous. 7. 'Outlaw Hacking Group' Resurfaces A digital forensics by CYE's Critical Cyber Operations group found that the the "Outlaw Hacking Group" may be back. 8. Biting Back Against Phishers How one company learned to deal with Phishing attempts that tried to compromise their cybersecurity system and how they learned to fight back against them. 9. What will IBM's Acquisition of Randori Mean for Cybersecurity? IBM announced plans to acquire a leading attack surface management provider and offensive security company Randori. 10. What I Learned from Teaching a Cybersecurity Class After Passing CompTIA Security+ This is a reflection of what I learned from teaching a cybersecurity class for beginners after I had passed CompTIA Security+ 11. Quick Guide to the Open Source Security Summit The Open Source Security Foundation met for Linux Foundation’s North American Summit, here are highlights to help every developer keep Open Source secure. 12. Top 7 Access Control System Manufacturers Here is a list of the top 7 access control system providers that offer feature-rich security systems for your business/organization. 13. Harmony's Horizon Bridge Attack: How $100M was Siphoned Off By a Hacker The attack was successful because two validators' private keys were suspected to be compromised. 14. Cyber Deterrence is More Important than Nuclear Deterrence Sleep Tight - It Ain’t Gonna Be A Nuclear Fight! 15. Why Bitcoin is Not an "Ideal" Ransomware Currency Bitcoin ain't a ticket to “cyber gangsta’s paradise.” 16. Protect Your Digital Identity— Level One (Mobile) In part one of this guide to protect your digital ID, I will talk about the basics — measures that anyone can use to reduce risks to their devices. 17. The Cybersecurity Writing Contest: Final Round Results Announced! Hackers, Assemble! The final round’s results announcement of the Cybersecurity Writing Contest by Twingate & HackerNoon are now Live! 18. Fetch.ai Releases DabbaFlow: Encrypted File Sharing Platform for Secure Data Transfers DabbaFlow, an end-to-end encrypted file-sharing platform developed by Fetch.ai, a Cambridge-based artificial intelligence lab, was launched recently. 19. Crypto Wallets Exposed "Mnemonic Phrase Vulnerabilities" (4 Already Fixed) MetaMask and Phantom said today that they had patched a security flaw that could, in some cases, allow attackers to obtain mnemonic phrases. 20. The Black Market for Data is on the Rise Once the laughingstock of the Internet, hackers are now some of the most wanted criminals in the world. 21. The Essential Guide to Security and Compliance for the Public Cloud Using an Infrastructure-as-a-Service provider makes it easier to achieve and maintain compliance, but here are some caveats to consider. 22. Is Open Source Software A Practical Alternative? Privacy and cybersecurity have been ongoing concerns in recent years. Open-source software can be a solution to these concerns, is it really the case? 23. Tor: Love and Cybersecurity Thunder Tor and The Guardian (of the Journalistic Galaxy) also took their relationship to the next level. 24. Cybersecurity Threats in Crypto Exchanges Everyone Should Know Cybercriminals have turned to utilizing a variety of tools and strategies aimed to target cryptocurrency exchange customers, steal their money, or steal. 25. How Can I Tell if My Steam Account Has Been Hacked? (and How to Recover It) his time, I would like to focus on Steam account security, which has recently gotten some attention in the community after waves of phishing attacks. 26. How to Avoid Credit Card Skimming: 5 Tips to Keep Your Information Safe Credit card skimming occurs when someone places an electronic device on or near a credit card reader. This device captures and stores your credit card details. 27. The Biggest Cyber Security Threat of 2022 is Social Engineering The biggest threat to cybersecurity in 2022 is social engineering. This type of cybercrime involves manipulating people into giving up sensitive information 28. The Cybersecurity Writing Contest 2022: Round 1 Results Announced! Hackers, Assemble! Here we are with the results announcement of the Cybersecurity Writing Contest! 29. How to Keep Your Mobile Devices Secure Our phones are our lifelines. They hold our prized possessions such as photos, music, and texts from our loved ones. So, why wouldn’t we do everything we can to 30. A Comprehensive Guide to Security Certification for SaaS In this article, we will explore what security certification for SaaS is, its importance, and how to get the best out of it by minimizing the risks. 31. The Cybersecurity Writing Contest by Twingate and HackerNoon Yasssss The Cybersecurity Writing Contest is here! HackerNoon is excited to host the contest in collaboration with Twingate! 32. Fighting the Hydra of DDoS Attacks (Spoiler: They Got Worse) Interview with Link11 regarding their new DDoS report -- the state of DDoS attacks. 33. The Best Cybersecurity Practices for Data Centres Read on to learn about the specifications of data center security and the risks that threaten it. Discover the cybersecurity best practices that you need. 34. How To Protect Copyrighted Digital Content In The Age Of Cyber-Fraud? Today it is a hot topic how to protect copyrighted digital content. The most popular ways are DRM, HDCP, and Denuvo. I`ll shortly discuss them with their cons. 35. ANSI X12 EDI Basics: A Guide to the ANSI X12 Standards ANSI X12 EDI is one of the most important concepts that you must be aware of prior to implementing EDI in your organization. 36. Mobile Banking: 5 Rules of Safety You Should Know How safe it is to use mobile applications and web versions of banks to make payments? 37. How “Predictive Text” Functionality can Reproduce Mnemonic Crypto Wallet Phrases Redditor Andre, an information security practitioner, accidentally discovered that the smartphone's "predictive words" function guessed the mnemonic of his bitc 38. Reverse Social Engineering: A Call to Quit Sharing More Than Necessary Social engineering is the use of a person's sensitive information to launch a targeted cyber-attack on them. Reverse social engineering mitigates the rate... 39. An Intro to Zero Trust Architecture Zero Trust isn’t a new concept. It was first presented in 2009 by John Kindervag, a former principal analyst at Forrester Research. 40. How Blockchain has Improved Detection of Malware Blockchain has not only become the fundamental technology for cryptocurrencies; it has also become a reliable means of detecting malware quickly and accurately. 41. Security Infrastructure and the Multi-Cloud Achieving high-availability cloud architecture requires more than one cloud. From an architecture perspective, there are only three options for mission critical 42. The 5 Things Businesses Need to Know to Stop Online Fraud! The 5 Things Businesses Need to Know to Stop Online Fraud! 43. AI and Data: Balancing Progress, Privacy, and Security With ChatGPT dominating the tech and other news, the concernabout data security might have momentarily taken a back seat. Yet, the expansion of AI/ML technologies' potential impact on Data privacy and security should sound the alarm for organizations and individuals alike. 44. Software Development Tricks Coding for Beginners and More This week on HackerNoon's Stories of the Week, we looked at three articles that covered the world of software development from employment to security. 45. How to Protect your ERP System Against Cyber Attacks How to protect your ERP system against cyber attacks? 46. Blind Attacks: Understanding CSRF (Cross Site Request Forgery) This article contains complete (and step-by-step) information about CSRF attacks. 47. 0-Days are on the Rise and that Means a Lot More Work for SOC Teams In a recent report by the incident response giant Mandiant, which was purchased by Google in March, their researchers found that 2021 was a record year. 48. The Cybersecurity Writing Contest 2022: Round 5 Results Announced! Hackers, Assemble! Here we are with the fifth round’s results announcement of the Cybersecurity Writing Contest by Twingate & HackerNoon! 49. Crucial Cloud Computing Security Threats Everyone Should Know A rundown of the business impact and mitigation measures of the top cloud computing security threats from the 2022 Cloud Security Alliance survey 50. Incomplete Guide for Securing Containerized Environment Write Once, Run Everywhere embraces flexibility of spinning applications up and down for users. Let's find out why and how to secure containerized environment. 51. Hacked: MetaMask User Lost US$81,000 In ETH Crypto investor Jonny Reid shared his experience of stealing encrypted assets in his MetaMask wallet on Twitter.  He is still unable to find the hack. 52. Network Security: Things Most People Don’t Think About There are a lot of things most people do not think about that can dramatically increase the level of security on a network 53. The Cybersecurity Writing Contest 2022: Round 4 Results Announced! Hackers, Welcome back! Here we are again with the fourth round of the Cybersecurity Writing Contest result announcement by Twingate & HackerNoon! 54. Explaining Info-Sec in Layman's Terms [Part I] Understanding the common keywords used in the info-sec industry that are used in conjunction with that complicated OWASP Top 10 WAST 55. What is Credit Card Skimming and How Do You Prevent it? This story describes what credit card skimming is and how to prevent it. 56. A Comprehensive Guide to OpenAPI Specification OpenAPI Specification (formerly Swagger Specification) is an API description format for REST APIs. An OpenAPI file allows you to describe your entire API. 57. An Intro to Multi-Factor Authentication and the Types of MFA This is an introduction to multi-factor authentication in the field of cybersecurity. 58. 5 Ways SaaS Can Help Speed Up Cybersecurity Implementation SaaS is making cybersecurity implementation less expensive and easy, and businesses, especially startups, are now leveraging its tools to drive efficiency. Thank you for checking out the 58 most read stories about Cybersecurity Writing Contest on HackerNoon. to find the most read stories about any technology. Visit the /Learn Repo

58 Stories To Learn About Cybersecurity Writing Contest

219 Stories To Learn About Cyber Security Awareness

On September 24th, SlowMist, a security firm, a massive $200 million hack of the Mixin Network. The hack occurred during the “early morning” of September 23rd and focused on Mixin’s cloud service provider database. blockchain reported Mixin Network, founded in 2017, proclaims itself to be a “free, lightning-fast, peer-to-peer, cross-chain transactional network for digital assets.” Shortly after the hack was reported, Mixin released a confirming they were hacked for approximately $200 million. statement In the wake of this staggering hack, Mixin has temporarily suspended all customer deposits and withdrawals. Mixin Network gave no indication about when this suspension will be lifted. Two days after the $200 million hack, Feng Xiaodong, founder of the Mixin Network, appeared on a Twitch livestream to address customer concerns regarding their assets. Shockingly, the company founder stated Mixin “can only ensure at least half of the assets are secure,” leaving doubt for customers as to the fate of the other half. According to a claim made by Xiaodong, Bitcoin was the “core asset” stolen during the hack. During the livestream, Xiaodong also stated that Mixin would only be able to refund users “up to a maximum of 50%” of their stolen assets. The remainder of the stolen assets will be distributed to affected users as “tokenized liability claims,” which Mixin will buy back from customers “with its future profits.” In a plea to the hacker, Mixin sent a asking for the hacker to refund the stolen funds. message Mixin has offered the hacker, who has been nicknamed the “Mixin Network Exploiter,” a reward of $20 million in return for refunding the customer assets. “Most of our platform assets were users’, and we hope you can refund them. You can keep $20M of the assets as a BUG Bunty Reward for the BUG. Contact us via bug@mixin.one for the reward details.” - Message from Mixin to the Hacker On the 27th of September, four days after the hack occurred, Mixin released an on social media. updated statement With the assistance of Google (via their subsidiary Mandiant) and SlowMist, Mixin Network was able to complete its investigation into the hack. According to the statement, Mixin’s situation “is much more optimistic than expected,” and “the losses are not as significant as estimated.” However, Mixin has not released any specific details about the methods that were used to hack their system. All we know at this point is their cloud service provider was attacked, and this resulted in the hacker gaining access to platform funds. Many individuals following this story are curious as to why a self-proclaimed “decentralized” network would keep $200 million assets in a hot wallet and why they would even be utilizing a database when everything should be recorded on the blockchain. To drive home the point further, even Binance CEO Changpeng Xhao, more commonly referred to as CZ, on the Mixin hack by saying that “not everything that claims to be decentralized is.” commented What percentage of crypto projects are truly decentralized? Do you think the hacker will return the stolen funds for the $20 million reward? Would you? What are your thoughts on this news? Join the conversation below! Also published . here

Mixin Network's $200 Million Hack: What Happened and What's Next

What Are Supply Chain Attacks? Supply chain attacks involve compromising a company that has some sort of access to the network of another company. A third party may be used to attack the intended target. There are different variants of a supply chain attack. One approach is to attack one company to launch attacks against other companies. The SolarWinds attack serves as an example of this. Hackers installed malware on the software of the company. When an update was sent to its clients, the malicious software was installed, unbeknownst to the clients or SolarWinds. Supply Chain Attack Challenges for Organizations Another supply chain attack example involves hackers attacking a company by going through a third party with a business/network connection to their main target. The best example of this is the cyber attack against Target. The supermarket chain’s card readers had malware installed onto them by hackers. The credit card details of millions of customers were stolen as a result. Target’s relationship with a third-party company that serviced air conditioning units was instrumental in the attack. In order for the company to access air conditioning units remotely, it established a VPN (Virtual Private Network) connection with Target. After an employee of the company fell victim to a phishing attack, the hackers were able to gain access to the VPN connection and spread the malware for the main attack. With new supply chain attack events, come more questions about what represents effective management of supply chain cyber security risks. There are many ways to execute supply chain attacks. The 3CX attack is a great example of this. In a rare case, enterprise phone provider 3CX was compromised through another supply chain attack. A malware-laced version of financial software, X_Trader, was used by hackers to compromise the systems of 3CX. Cybersecurity company, Madiant (which was hired to investigate the breach) suspected the attackers to be North Korean state-backed hackers. A report by Google’s Threat Analysis group corroborates this finding. The report shows that Trading Technologies’ website was compromised in February 2022 as part of a North Korean operation targeting users of FinTech and cryptocurrency. The investigation by Mandiant shows that an employee at 3CX downloaded a version of the X_Trader software in April 2022 (without realizing it contained malicious programming) from Trading Technologies’ website, which hackers digitally signed with the company’s then code-signing certificate to make the software look legitimate. The X_Trader installer was digitally signed by a valid code signing certificate (which was set to expire in October 2022) with the subject of “Trading Technologies International, Inc.” Despite the software being reportedly retired in 2020 by Trading Technologies, it was still made available for download on the Trading Technologies website in 2022. Using the software, the hacking group gained backdoor access to the device of the employee. The access was used to move laterally through 3CX’s network and ultimately compromise the desktop phone application of 3CX. A Fast-Reverse Proxy tool was key in moving laterally in the environment of 3CX. Information-stealing malware was planted inside the corporate networks of customers, marking the first time concrete evidence has been found of a software supply chain attack that leads to another supply chain attack. “The identified software supply chain compromise is the first we are aware of which has led to an additional software supply chain compromise,” wrote Mandiant’s research team in a new disclosure blog. The rare event shows the creative ways access to networks can be used to distribute malware, crossing over into verticals and using follow-on intrusion campaigns. Malware, Veiledsignal, was instrumental in providing the threat actor with administrative-level access and persistence to the compromised system. Using this, they stole the credentials of the 3CX employee. 10 Million Affected by Cybersecurity Attacks What may come as a surprise to many is that supply chain attacks surpassed malware-based attacks in 2022 by 40%. It would be interesting to know how and why this happened. 10 million people were affected by the attacks. You may ask yourself, how? In contrast, malware-based attacks affected 4.3 million people. This points to the many vectors to exploit in supply chains. It’s hard to avoid activities that expose supply chains to cyber security risks. Looking Forward and Risk Mitigation The number of supply chain attacks increased by 600%. 88,000 reports surfaced of organizations compromised through their supply chains. Mitigation can be achieved through auditing third parties, using auditors to ensure accountability, and compliance with security standards. Network access may also be limited so that a vendor only gets access to the information and privileges it needs to carry out its work. There are so many vectors and vulnerabilities that can lead to supply chain attacks. More creative methods of exploiting vulnerabilities have surfaced with time, giving rise to a greater need for cyber security strategies that not only take entities into consideration but also their vendors and others in the supply chain who may have a greater responsibility for the cyber security interests of other entities than themselves. Education, automation, and segmentation will be critical in tightening the gaps in supply chains that make it easier for threat actors to compromise systems. Sources: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise https://www.csoonline.com/article/573925/supply-chain-attacks-increased-over-600-this-year-and-companies-are-falling-behind.html#:\~:text=The number of documented supply,supply chain management company Sonatype. https://blog.google/threat-analysis-group/ https://www.project44.com/blog/supply-chain-cybersecurity#:\~:text=According to the report%2C more,and individuals from cyber-attacks.

Explaining Supply Chain Attacks: Here's What You Need to Know

Small to medium-sized businesses (SMBs) are starting to improve their security postures, thanks to more accessible security tools and platforms. By 2025, cybersecurity spending by SMBs is projected to hit . Of course, whether or not these investments will yield positive results is yet to be seen. $90 billion Security leadership is still a major contributor to an organization's cybersecurity success. Unfortunately, hiring a full-time chief information security officer (CISO) is still a luxury many smaller firms cannot afford. Managed service providers (MSPs) and consulting firms are addressing this by offering virtual CISO services. With this model, SMBs now have high-level security tasks such as strategic security planning. cost-effective means to outsource Virtual CISO platforms are also emerging to help these MSPs serve SMBs better, with some using artificial intelligence (AI) to automate CISO tasks like risk and compliance assessments and detailed remediation planning, allowing MSPs to provide comprehensive cybersecurity guidance to SMBs efficiently. Such innovations should be a boon to CISOs, considering the pace at which . Some threats are more difficult to thwart than others. Take zero-day exploits, for instance. Here, hackers use systems and software vulnerabilities that are otherwise unknown to the public to gain access to networks and launch cyberattacks. cybersecurity threats are evolving A report by Mandiant revealed that a record were exploited in 2021, underscoring that hackers have been using such exploits actively. Larger organizations with better cybersecurity resources are already struggling to mitigate such threats, making them quite challenging for SMBs to address. 80 zero-day vulnerabilities What Are Zero-Day Vulnerabilities “Zero-day exploits” are called that because the public has zero days to prepare for them. These vulnerabilities can exist in various forms. They can be system and application bugs. They can be misconfigurations in machines, appliances, and servers. They can even be faulty interactions between apps and operating systems. Through these exploits, hackers can breach systems and launch various other cyberattacks. Some of the most famous cyberattacks sustained by large corporations were supposedly due to zero-day exploits. In 2014, Sony Pictures suffered from a . Hackers used a vulnerability to gain a foothold inside Sony's network. Over several weeks, they were able to steal 100 terabytes of information, including business plans and emails. The attack remained undetected until the hackers leaked Sony's data online. massive data breach Another example of a worrying zero-day exploit involves , a popular logging framework deployed in many servers and used in applications. A bug in Log4j allowed hackers to execute code remotely on machines that use Log4j. Among the popular services that used Log4j were Apple iCloud and Minecraft. While these services were already able to patch the vulnerability, all apps and their users have been theoretically at risk. Log4j Why SMBs Are at Risk SMBs should be particularly wary of the risks that zero-day exploits bring. Smaller companies’ networks are usually comprised of multiple devices that use different operating systems and applications, meaning vulnerabilities can always be present in the network. All it takes is just one fault in any of these components for the organization to become easily hackable. What makes these vulnerabilities particularly worrying is that malicious actors often know about them before security companies and software developers become aware that they exist. While undiscovered, malicious actors can exploit the vulnerability until fixed or patched. And, even in cases where the exploit has been uncovered and a fix is made available, hackers can continue using them against unpatched machines and apps. Hackers look for infrastructures affected by these faults. Attacks today are also largely automated, so hackers can scan work devices and networks connected to the internet for vulnerable systems using bots and scripts. Innately, SMBs with fewer mitigation tools are more exposed. Falling victim to a cyberattack is costly. An attack can cause downtime and data loss. It also opens up the company to potential fines. Loss of customer trust is also possible. According to the Hiscox Group, the median cost of a cyberattack is in the US. For SMBs, this scale of damage can be fatal. around $19,000 How CISOs Can Help Through the guidance of CISOs, small businesses can minimize the risks associated with zero-day exploits. Using risk assessments, CISOs identify all weak areas of concern and create a clear picture of the company's security posture. CISOs can then create actionable remediation plans. Essential tasks often include keeping machines and software up-to-date to help resolve existing faults. In addition, protection tools like anti-malware and firewalls can be deployed to prevent malicious files and traffic from entering their networks. CISOs can also define policies that could guide employees on the best security practices. Monitoring crucial advisories and security bulletins for trending attack strategies is likewise key to the CISO’s purview. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA), for example, . offers a helpful feed of threat alerts With this approach to readiness, as soon as a zero-day vulnerability becomes known, they can immediately tell if their organizations are affected and even identify which infrastructure components are involved. Interventions can be made by applying fixes or temporarily taking down vulnerable endpoints until patches can be deployed. Platforms can also greatly enhance CISOs’ capabilities. By leveraging AI and automation, CISOs can continuously update their strategies based on emerging threats. Guided by up-to-date plans, security staff can immediately work on remediation efforts. Accessible Security Expertise Matters There is always a possibility that zero-day vulnerabilities are present in any company's infrastructure. It may be challenging to protect against the unknown, but measures can be taken to minimize any organization's cyberattack exposure. SMBs are particularly vulnerable, so they should prioritize building their security strategies. Fortunately, CISOs and CISO services can bring the expertise needed by SMBs. This way, smaller organizations can minimize the risks brought about by zero-day exploits, even with limited budgets.

Stories, News & Mentions about MANDIANT

Mandiant’s Stories on HackerNoon

Mandiant's News & Mentions