Blog

Threat Actor of the Month - August 2022

12.Aug.2022

Gerard, Jacobo, from Threat Context

This month we’re introducing you to GhostSec, a hacktivist group with ties to the Anonymous collective

Ransomware as a Service: Behind the Scenes

08.Jul.2022

Jose Miguel Esparza, Head of Threat Intelligence

Ransomware attack is growing at an alarming rate thanks to Ransomware as a Service (RaaS) operations. Read this blog and learn what is RaaS and how the threat actors operate these attacks to help you understand the preemptive measures you need to take to protect your organization.

A History of Ransomware

13.Jun.2022

Jose Miguel Esparza, Head of Threat Intelligence

Ransomware is the biggest cyber threat to businesses. First burst onto the scene in 1989, it has evolved significantly over the past few years from widespread attacks to highly targeted ransomware-as-a-service (RaaS) operations affecting organizations of all sizes and sectors. This article takes a look at the evolution of the ransomware ecosystem – what it looks like today, and how it has changed over time.

Possible Link Between Jester Stealer and Eternity Stealer

08.Jun.2022

Jester stealer is an information stealer that has been around since mid-July 2021. Originally sold by the Russian speaking threat group "Jester_Stealer", in several underground forums and Telegram channels, they operate under a Malware-as-a-Service (MaaS) model and present themselves as a group of programmers. Here we delved into the Jester stealer functionalities with a code-level analysis and highlight the possible link between Jester stealer and the new breed of Eternity stealer.

Credit Card Fraud Investigation: State of Underground Card Shops in 2022

20.May.2022

Beatriz Pimenta Klein and Lidia López Sanz, Threat Intelligence Analysts

In our latest credit card fraud investigation blog our threat intelligence analysts investigate the current card shop ecosystem, from active shops and the return of Rescator as well as other recently shuttered card shops and credit card fraud to look out for.

The State of Ransomware in 2022

17.May.2022

Blueliv, an Outpost24 company

Ransomware continues to be a prevalent threat to almost every modern industry after a sudden renaissance at the beginning of the COVID-19 pandemic as threat actors sought to capitalize on overwhelmed organizations and their suddenly vulnerable employees.

FTSE 100 credential theft study 2022

10.May.2022

Corporate credential theft is a targeted effort and makes FTSE 100 companies credentials particularly attractive to cybercriminals with accelerated digital transformation (BYOD and hybrid working). Once an attacker gets hold of stolen user credentials and passwords, they can sell the credentials in the cybercrime underground or use them to compromise an organization’s network, bypassing security measures and threaten the credibility and integrity of the institution.

The most critical vulnerabilities right now - April 2022

02.May.2022

Blueliv, an Outpost24 company

The first few months of 2022 have brought with them plenty of breaches and vulnerabilities for threat experts to sink their teeth into. Here's a roundup of the most critical vulnerabilities to date this year.

Dissecting Spring4Shell

31.Mar.2022

Blueliv, an Outpost24 company

An RCE vulnerability affecting Spring Core’s JDK 9 and later has become a trending topic in cybersecurity networks during the past couple days. This discovery, compared by some to the Log4Shell vulnerability, generated a lot of confusion and even got mistook with a different vulnerability affecting Spring Cloud, which got a CVE assigned the same day, and even linked them to completely unrelated commits on Spring Core’s GitHub. In this blogpost, we will clarify what happened and what you can do to protect yourself.

Russian-linked malware cyberattacks: what you need to know about Hermetic Wiper and Cyclops Blink

08.Mar.2022

Blueliv, an Outpost24 company

Just days after Russia launched its invasion against the people of Ukraine, news reports emerged of several cyberattacks. Deployed systematically ahead of the land invasion, Russian cyberattacks against Ukraine have rendered Ukrainian banks, government departments and other core services unavailable through the use of sophisticated ‘data wipers