Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Mark Loman
Exploit Mitigation for the AI Era: Why Default-On Protection Matters
The core of my last post was an asymmetry. An attack can unfold in two steps or 20, but the vocabulary it draws from never grows. The same small set of primitives (executable memory, control flow, process manipulation, credential access, encryption) is all any attack has ever had to work with. Guard that set, and the form of the attack stops mattering. Two developments since then sharpen the picture. One put a number on how fast the attacker's side is moving.
Sophos Endpoint in action: Blocking a novel supply chain attack
Sophos Endpoint is architected from the ground up to automatically block exploits, ransomware, and attacker techniques by default with zero manual tuning. This threat case showcases how the unique anti-exploitation capabilities included with Sophos Endpoint blocked a supply chain attack through JDownloader, a free, Java-based download manager from AppWork GmbH that automates bulk downloads from one-click file hosters and video sites.
Ransomware: AI changes the writer. It doesn't change the math.
In 2013, CryptoLocker introduced the modern ransomware playbook. It also introduced something most of the industry has still not come to terms with: remote encryption. A compromised machine reaching across the network to encrypt a file server, leaving the protected server with no malicious process to terminate, no binary to quarantine, and no signal strong enough for EDR to act on with certainty.
How Sophos Endpoint defends in the AI era
When Mozilla shipped Firefox 150 with fixes for 271 issues identified by Anthropic’s Mythos model, the headlines focused on the count. The detail that mattered was further down: Mozilla credited only three CVEs to the model. The remaining 268 were classified as defense-in-depth, hardening, or bugs in code paths that could not be exploited. That gap, between what AI can find and what attackers can use, is where modern defense lives. The rest of the public record reinforces it.
Protection antialtération de Sophos : comment bloquer les potentielles activités malveillantes ?
Une fois qu’un acteur malveillant a atteint un de vos systèmes endpoint, les solutions EDR sont souvent le seul obstacle entre lui et son objectif, qu’il s’agisse de déployer un ransomware, d’installer un malware, d’accéder à des données ou de lancer de nouvelles attaques.
Putting the dampener on tamperers
Once a threat actor is on an endpoint, EDR solutions are often the only obstacle between them and their objective – whether that’s deploying ransomware, installing malware, accessing data, or launching further attacks. As a result, threat actors regularly look for ways to disable security products: escalating privileges if necessary to try to kill processes and services, running EDR killers, and a host of other techniques.
CryptoGuard: un approccio asimmetrico alla battaglia contro il ransomware
Il ransomware è una delle minacce più pericolose per le organizzazioni di oggi. Combatterlo non è un compito facile, soprattutto se si considera che gli aggressori affinano continuamente le loro tecniche e i loro approcci.
CryptoGuard : une approche asymétrique pour combattre les ransomwares
Les ransomwares représentent toujours la menace la plus dangereuse à laquelle les entreprises sont confrontées aujourd’hui. La combattre n’est pas une tâche facile, d’autant plus que les acteurs malveillants perfectionnent continuellement leurs techniques et leurs approches.
CryptoGuard: An asymmetric approach to the ransomware battle
** 本記事は、英語記事タイトル の翻訳です。最新の情報は英語記事をご覧ください。** Ransomware is one of the most significant threats facing organizations today. Battling it is no easy task, particularly given that threat actors are continually refining their techniques and approaches.
CryptoGuard: An asymmetric approach to the ransomware battle
Ransomware is one of the most significant threats facing organizations today. Battling it is no easy task, particularly given that threat actors are continually refining their techniques and approaches. Recent shifts, for example, include tweaks to ransomware-as-a-service (RaaS) models; the adoption of new programming languages; evolutions in targeting and deployment; and increasingly launching attacks after business hours and at weekends to hinder detection and incident response efforts.
Une défense automatisée contre les cibles mobiles (AMTD) innovante
Alors que le paysage des cybermenaces devient de plus en plus complexe, les équipes de sécurité se retrouvent confrontées à un volume de menaces qui augmente rapidement. De nombreuses entreprises sont confrontées à des volumes d’alertes élevés et à des faux positifs, entraînant ainsi un jeu du chat et de la souris perpétuel qui sollicite les ressources et diminue l’efficacité de la sécurité.
Pioneering Automated Moving Target Defense (AMTD)
As the cyber threat landscape becomes ever more challenging, security teams find themselves dealing with a rapidly growing number of threats. Many organizations struggle with high alert volumes and false positives, resulting in a perpetual game of catch-up that taxes resources and diminishes security efficacy. Automated moving target defense (AMTD), an emerging concept developed and championed by Gartner, seeks to change that dynamic.
Automated Moving Target Defense (AMTD) の道を切り開く
** 本記事は、Pioneering Automated Moving Target Defense (AMTD) の翻訳です。最新の情報は英語記事をご覧ください。** サイバー脅威の状況がますます厳しさを増す中、セキュリティチームは急増する脅威に対処しています。多くの組織は、大量のアラートや誤検知と格闘しており、結果として恒常的にリソースが消費され、セキュリティの有効性が低下しています。 Automated Moving Target Defense (AMTD: 自動化された移動標的型防御) は、 Gartner が開発・提唱する新たな概念であり、この状態を改善しようとするものです。AMTD 技術を採用したセキュリティ製品やサービスは、IT 環境内の変化を制御することで、攻撃をプロアクティブに阻止し、侵害行為を混乱させることで、攻撃者にかかるコストを引き上げます。 脅威に依存しないテクノロジーである AMTD を導入したソリューションは、攻撃関係を逆転させ、攻撃の戦術、技術、手順 (TTP) の大部分を無効化することで、組織に劇的な保護効果をもたらします。 エンドポイントでの...
LockFile ransomware’s box of tricks: intermittent encryption and evasion
LockFile is a new ransomware family that emerged in July 2021 following the discovery in April 2021 of the ProxyShell vulnerabilities in Microsoft Exchange servers. LockFile ransomware appears to exploit the ProxyShell vulnerabilities to breach targets with unpatched, on premises Microsoft Exchange servers, followed by a PetitPotam NTLM relay attack to seize control of the domain.
BlackMatter ransomware emerges from the shadow of DarkSide
On Friday May 7, 2021, an affiliate of the DarkSide Ransomware-as-a-Service (RaaS) hit Colonial Pipeline, a major U.S. fuel pipeline. The attack led to widespread supply disruption, global headlines, and intense scrutiny by the national authorities. A week later, DarkSide announced it was shutting down its operations after its servers were allegedly seized and its cryptocurrency wallets drained.
Independence Day: REvil uses supply chain exploit to attack hundreds of businesses
On July 2, while many businesses had staff either already off or preparing for a long holiday weekend, an affiliate of the REvil ransomware group launched a widespread crypto-extortion gambit. Using an exploit of Kaseya’s VSA remote management service, the REvil actors launched a malicious update package that targeted customers of managed service providers and enterprise users of the on-site version of Kaseya’s VSA remote monitoring and management platform.
A defender’s view inside a DarkSide ransomware attack
The recent ransomware intrusion of a major US gasoline pipeline operator was the work of an affiliate of DarkSide, a ransomware-as-a-service ring that has been responsible for at least 60 known cases of double-extortion so far this year. DarkSide has struck several high-profile victims recently, including companies listed on the NASDAQ stock exchange.
A defender’s view inside a DarkSide ransomware attack
The recent ransomware intrusion of a major US gasoline pipeline operator was the work of an affiliate of DarkSide, a ransomware-as-a-service ring that has been responsible for at least 60 known cases of double-extortion so far this year. DarkSide has struck several high-profile victims recently, including companies listed on the NASDAQ stock exchange.
Black Kingdom ransomware begins appearing on Exchange servers
Following the DearCry ransomware attacks reported on last week, another ransomware gang has also started to target vulnerable Exchange servers with another ransomware, called Black KingDom. Sophos telemetry began detecting the ransomware on Thursday March 18 as it targeted Exchange servers that remain unpatched against the ProxyLogon vulnerabilities disclosed by Microsoft earlier this month. The Black KingDom ransomware is far from the most sophisticated payload we’ve seen.
DearCry ransomware attacks exploit Exchange server vulnerabilities
A recently-patched set of vulnerabilities in on-premises versions of Microsoft Exchange Server has been actively exploited for over two months. The exploit, initially attributed to a Chinese state-sponsored actor, has now been adopted for a range of cybercrime activities—the latest being a ransomware called DearCry. Sophos recently detected and stopped a DearCry attack using the exploit, and obtained samples for analysis.
WastedLocker’s techniques point to a familiar heritage
It’s a lot easier to change a ransomware’s appearance (or obfuscate its code) than to change its underlying goals or behavior. After all, ransomware must necessarily reveal its intent when it strikes. But there are behavioral traits that ransomware routinely exhibits that security software can use to decide whether the program is malicious. Some traits – such as the successive encryption of documents – are hard for attackers to change.
How the most damaging ransomware evades IT security
Ransomware has been around for decades, yet it remains a common and lucrative cyberthreat. We decided to take a closer look at the behaviour of ransomware once it is inside a victim system, and how the various tools and techniques observed are used by the most prevalent ransomware families, from WannaCry, Matrix and GandCrab to Ryuk, SamSam, MegaCortex, and more.
Ragnar Locker ransomware deploys virtual machine to dodge security
A new ransomware attack method takes defense evasion to a new level—deploying as a full virtual machine on each targeted device to hide the ransomware from view. In a recently detected attack, Ragnar Locker ransomware was deployed inside an Oracle VirtualBox Windows XP virtual machine. The attack payload was a 122 MB installer with a 282 MB virtual image inside—all to conceal a 49 kB ransomware executable.
Living off another land: Ransomware borrows vulnerable driver to remove security software
Sophos has been investigating two different ransomware attacks where the adversaries deployed a legitimate, digitally signed hardware driver in order to delete security products from the targeted computers just prior to performing the destructive file encryption portion of the attack. The signed driver, part of a now-deprecated software package published by Taiwan-based motherboard manufacturer Gigabyte, has a known vulnerability, tracked as CVE-2018-19320.
How the most damaging ransomware evades IT security
Ransomware has been around for decades, yet it remains a common and lucrative cyberthreat. We decided to take a closer look at the behaviour of ransomware once it is inside a victim system, and how the various tools and techniques observed are used by the most prevalent ransomware families, from WannaCry, Matrix and GandCrab to Ryuk, SamSam, MegaCortex, and more.
Blocking attacks against Windows “CTF” vulnerabilities
Operating systems and run-time environments typically provide some form of isolation between applications. For example, Windows runs each application in a separate process. This isolation stops code running in one application from adversely affecting other, unrelated applications. This means a non-administrative user mode process can’t access or tamper with kernel code and data, and an unauthorized user mode process can’t dig into the code and data of another process.
NSA tools used to hack hotels; WikiLeaks in CIA Couch Potato dump
FireEye researchers have “moderate” confidence that the programme is being run by the Russian group APT28/Fancy Bears, citing the fact that it found malicious documents on these networks that had been used to install the cybergang's signature malware - Gamefish. The document is delivered through a spearphishing attack that uses a document that appears to be a basic reservation form.
InfoSec 2017: Stella Rimington: Lessons of diversity from the Cold War
"When I first met MI5 in the middle of 1960s nobody had heard of British intelligence at all," said Stella Rimington, the former head of MI5, as she opened this year's InfoSecurity Europe. She recalled her introduction to an agency whose transformations she had witnessed over 40 years. Her speech recalled more than a few details which echo today's cyber-security industry, facing a keenly interested if largely ignorant public and dominated, by and large, by men.
The rise of nation state attacks - with intelligence gathering the aim
The current threat landscape is evolving in a way never seen before. From sophisticated ransomware that re-infects long after a ransom is paid, to the emergence of personal IoT attacks. The shape, size, and methods of cyber-attacks are growing in complexity, and frequency. However, one of the more concerning cyber trends we are seeing is the rise of technical cyber-attacks against states and societies.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Mark
Contact Mark, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack