Dec 06

The core function of a SOC

The core function of a SOC (Security Operations Center) is to investigate, monitor, prevent, and respond to threats. SOC teams benefit from using a single platform with integrated yet disparate technologies for a full-picture view that is continually updated with emerging threat intelligence. This unified perspective simplifies security monitoring, supports incident response workflows, and provides all the core functionality required for building a SOC. Here’s a blog post about the main functions.

Continue reading

Nov 27

Play ransomware infection routine

A ransomware gang named “Play” was discovered on the Dark Web. Along with them, a list of 22 victims has been revealed. There is a piece of evidence that points to a possible connection between Play ransomware and Quantum ransomware, which is an offshoot of the notorious Conti ransomware group. The Cobalt Strike beacons that were used in Play’s attacks bear the same watermark, 206546002, as those previously dropped by Emotet and SVCReady botnets that have also been observed in Quantum ransomware attacks. This suggests that the two ransomware groups share some of the same infrastructure. Play Ransomware specifically targets backup solutions in order to ensure that the victim has no other option to recover the data. Play group is particularly methodical in developing and implementing backup removal techniques. Here’s a blog post on the infection routine and backup environment attack method.

 

Continue reading

Nov 24

Identify a piece of malware with Yara

Yara rules classify and identify malware samples by creating descriptions of malware families (it is a tool used to identify files, based on textual or binary pattern). YARA rules are like a piece of programming language, they work by defining a number of variables that contain patterns found in a sample of malware. If some or all of the conditions are met, depending on the rule, then it can be used to successfully identify a piece of malware.

Continue reading

Nov 09

Critical Veeam Backup for Google Cloud Vulnerability – CVE-2022-43549

A critical security vulnerability has been discovered in Veeam Backup for Google Cloud (KB4374). If you don’t have automatic updates enabled, then better take a look at this.

Veeam

Continue reading

Nov 08

VMware Explore General Session Recap

VMware Explore General Session Recap – Looking forward to an exciting week full of knowledge acquisition and networking, the event has begun with the General Session at VMware Explore in Barcelona. Basically, the keynote provides some very good techie announcements, but it needs to also apply more of a business perspective of how these deliver business value. If you’re in Barcelona for the big event and still have some space to fill in your schedule, be sure to meet Monaco Digital’s teams and talk about Cloud, Edge, Data Protection, and Security.

VMware Explore

Continue reading