Windows TCO (Total Cost of Ownership) Stories
-
New Iranian state-sponsored [cracking] campaign uncovered
The hackers gained access to a wide variety of digital content, including emails and web transactions, and used their malware to snoop on various government and private sector conversations to conduct espionage and map out the network infrastructure that could be used to hone future attacks. The report wasn’t specific about what data was stolen, but did mention incursions in Saudi Arabia, Jordan, Kuwait, Israel and Oman.
-
[Repeat] From Albania to the Middle East: The Scarred Manticore is Listening
The attacks rely on LIONTAIL, an advanced passive malware framework installed on Windows servers. For stealth purposes, LIONTIAL implants utilize direct calls to Windows HTTP stack driver HTTP.sys to load memory-residents payloads.
-
Iranian APT Group Utilize IIS-based Backdoors to Compromise Windows servers
This backdoor is installed on Windows servers, which enables threat actors to execute remote commands through HTTP requests. Additionally, the backdoor also sets up listeners for the list of URLs provided in its configuration and executes payloads from requests sent by the threat actors to those specific URLs.
-
SEC Charges SolarWinds and Chief Information Security Officer with Fraud, Internal Control Failures
As the complaint alleges, SolarWinds’ public statements about its cybersecurity practices and risks were at odds with its internal assessments, including a 2018 presentation prepared by a company engineer and shared internally, including with Brown, that SolarWinds’ remote access set-up was “not very secure” and that someone exploiting the vulnerability “can basically do whatever without us detecting it until it’s too late,” which could lead to “major reputation and financial loss” for SolarWinds. Similarly, as alleged in the SEC’s complaint, 2018 and 2019 presentations by Brown stated, respectively, that the “current state of security leaves us in a very vulnerable state for our critical assets” and that “[a]ccess and privilege to critical systems/data is inappropriate.”