Ukrainian tensions
- Microsoft blog on ACTINIUM group targeting Ukrainian organizations: https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/
- Unit 42 blog on Gamaredon group targeting Ukraine: https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/
- Mandiant recommendations on preparing for destructive attacks: https://www.mandiant.com/resources/protect-against-destructive-attacks (check out last month’s STAR livestream for more on this from John Hultquist: https://www.youtube.com/watch?v=ONtdjd_QvBs)
Annual reports
- CrowdStrike 2022 Global Threat Report: https://go.crowdstrike.com/global-threat-report-2022.html
- Expel 2022 annual report: https://expel.com/great-expeltations-2022/
Ransomware
- Reporting on BlackByte compromising San Francisco 49ers: https://www.bleepingcomputer.com/news/security/nfls-san-francisco-49ers-hit-by-blackbyte-ransomware-attack/
- FBI and USSS report on BlackByte: https://www.ic3.gov/Media/News/2022/220211.pdf
- Red Canary blog on BlackByte: https://redcanary.com/blog/blackbyte-ransomware/
- Raccine (“ransomware vaccine): https://github.com/Neo23x0/Raccine
- Coveware quarterly ransomware report: https://www.coveware.com/blog/2022/2/2/law-enforcement-pressure-forces-ransomware-groups-to-refine-tactics-in-q4-2021
- Allan Liska’s tweet on ransomware seasonal patterns: https://twitter.com/uuallan/status/1492517368035217410
- International governments advisory on ransomware trends: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2928709/cisa-fbi-nsa-and-international-partners-issue-advisory-on-ransomware-trends-fro/
- Decryptor for Maze, Sekhmet, and Egregor from Emsisoft: https://www.emsisoft.com/ransomware-decryption-tools/maze-sekhmet-egregor
Miscellaneous
- Microsoft announcement on blocking macros by default in Office: https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
- Recent reports from the DFIR Report: https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ and https://thedfirreport.com/2022/01/24/cobalt-strike-a-defenders-guide-part-2/
- Twitter account to follow for Emotet info: https://twitter.com/Cryptolaemus1
- SentinelOne blog on ModifiedElephant group targeting India: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/
.png "CTI_Blog_part_1_(1).png")
