Blog - Page 2 of 15

Response to CISA Advisory (AA23-144A): China State-Sponsored Actor Volt Typhoon Living off the Land to Evade Detection

AttackIQ has released two new assessments that emulate the techniques associated with a People’s Republic of China (PRC) state-sponsored cyber actor known as Volt Typhoon. Volt Typhoon makes extensive use of living off the land tools to remaining undetected for as long as possible while complete their espionage goals.

Authors: Francis Guibernau Andrew Costis Giovanni López May 25, 2023 Read More

Adversary Emulation

Response to CISA Advisory AA23-131A: Malicious Actors Exploit PaperCut MF and NG

On May 11, 2023, the Cybersecurity and Infrastructure Security Agency (CISA) released a joint Cybersecurity Advisory (CSA) detailing ongoing exploitation of a vulnerability in PaperCut MF and NG by cyber criminals. AttackIQ has released four new scenarios that emulates the exploitation of CVE-2023-27350 to help customers validate their security controls and their ability to defend against this widely exploited vulnerability.

May 12, 2023 Read More

Adversary Emulation

Emulating Recent Activity from the Russian Adversary Nobelium / APT29

AttackIQ has released a new attack graph that emulates recent activities conducted by the adversary known as Nobelium against European Union (EU) governments. These attacks continue Russia's efforts to gather intelligence on countries supporting Ukraine in the ongoing Russia-Ukraine war.

May 4, 2023 Read More

Adversary Emulation

Emulating Kimsuky’s Espionage Operations: A Closer Look at North Korea’s Efforts to Infiltrate South Korea

AttackIQ has released four new attack graphs that emulate the espionage activities led by Kimsuky, a politically motivated North Korean adversary with links to the nation's intelligence operations.

April 26, 2023 Read More

Most Recent

Adversary Emulation

Attack Graph Response to CISA Advisory (AA23-074A): Threat Actors Exploit Progress Telerik Vulnerability in U.S. Government IIS Server

AttackIQ has released a new attack graph that emulates the Tactics, Techniques, and Procedures (TTPs) used by a cybercriminal-focused adversary who carried successfully exploited CVE-2019-18935 against an instance of Telerik UI at a federal civilian executive branch (FCEB) agency.

March 17, 2023 Read More

TTPs

Hiding in Plain Sight: Monitoring and Testing for Living-Off-the-Land Binaries

For malicious actors, opportunity can be found in the mundane. As adversaries continue to refine their approach with newer and more sophisticated methods to perform malicious activity, it is critical for detection engineers to stay up to date in the latest threat intelligence and adversary behaviors to monitor.

March 16, 2023 Read More

Adversary Emulation

Attack Graph Response to CISA Advisory (AA23-061A): #StopRansomware: Royal Ransomware

AttackIQ has released a new fully featured attack graph that emulates the tactics, techniques, and procedures (TTPs) observed in cyberattacks involving Royal Ransomware.

March 3, 2023 Read More

Adversary Emulation

Emulating the Cybercriminal Initial Access Broker TA551

AttackIQ has released a new fully featured attack graph that emulates the tactics, techniques, and procedures (TTPs) associated with a 2020 intrusion from the cybercriminal group TA551.

March 3, 2023 Read More

Center for Threat-Informed Defense

A Year of Impact: AttackIQ’s Applied Research in Threat-Informed Defense

Reactive to Preactive. Atomic to Anatomic. Lists to Graphs. Simulation to Emulation. To be prepared for the next attack, defenders must adapt and shift their focus to a threat-informed defense, to think like the adversary, and to test their security programs in a realistic manner.

February 27, 2023 Read More

Adversary Emulation

Emulating the Always Persistent Cybercrime Malware Emotet

AttackIQ has released two new attack graphs emulating recent Emotet campaigns that resulted in data exfiltration and ransomware extortion. This release continues our focused research on shared e-crime malware used in attacks by multiple threat actors.

February 17, 2023 Read More

Adversary Emulation

Democratizing the Practice of Adversary Emulation

AttackIQ is democratiziing the practice of threat-informed defense and adversary emulation, including by funding research from the Center for Threat-Informed Defense on micro-emulation planning. Learn more out how we put adversary emulation into practice in the AttackIQ Security Optimization Platform.

February 14, 2023 Read More

Adversary Emulation

Emulating the Shared Cybercrime Loader BumbleBee

AttackIQ has released two attack graphs that emulate the shared cybercrime malware loader known as BumbleBee. This release is a continuation of our cybercrime malware emulation initiative detailing how customers can protect themselves against a wide range of actors who share tooling.

February 3, 2023 Read More

Adversary Emulation

Emulating the Constantly Evolving Cybercrime Malware QakBot

AttackIQ has released three new attack graphs that emulate multiple infection chain variations involving the widely utilized cybercrime malware known as QakBot.

January 25, 2023 Read More

Adversary Emulation

Emulating the Highly Sophisticated North Korean Adversary Lazarus Group

AttackIQ has released a bundle of content consisting of six new attack graphs that seek to emulate the campaigns and operations led by the infamous North Korean-sponsored adversary Lazarus Group against entities worldwide across multiple sectors.

January 5, 2023 Read More

Adversary Emulation

Emulating the Politically Motivated North Korean Adversary Andariel

AttackIQ has released a bundle of content that includes three new attack graphs that seek to emulate different cyberspace operations led by the North Korean-sponsored threat actor Andariel against multiple entities located in Asia, predominantly in South Korea, through the use of downloaders, backdoors, and custom ransomware.

December 22, 2022 Read More

Adversary Emulation

Attack Graph Response to APT36 Targeted Attacks Against Indian Governmental Organizations

AttackIQ has released a new attack graph that seeks to emulate the activity carried out by the politically motivated Pakistan-based adversary known as APT36 or Transparent Tribe. This newly released attack graph emulates the behaviors observed in attacks against victims working in Indian government organizations.

December 19, 2022 Read More