Response to CISA Advisory (AA24-234A): Strengthening Defenses Through Effective Event Logging and Threat Detection

In response to the recent CISA Advisory (AA24-234A) outlining best practices for event logging and threat detection, AttackIQ, in alignment with CISA’s guidance, strongly encourages organizations to engage in continuous testing against known, real-world adversary behaviors and TTPs through rigorous security control validation.

Author: Nick Desler Read More
AttackIQ’s New NIST CSF Assessment: A Game-Changer for Cybersecurity
AttackIQ Flex

AttackIQ’s New NIST CSF Assessment: A Game-Changer for Cybersecurity

The cybersecurity landscape is constantly evolving, with threats becoming increasingly sophisticated. Organizations are under immense…
Read More
Navigating the DORA Landscape with AttackIQ’s Automated Assessment
AttackIQ Flex

Navigating the DORA Landscape with AttackIQ’s Automated Assessment

The financial services and insurance industries have always been in the center of targeted waves…
Read More
Emulating Sandworm’s Prestige Ransomware
Adversary Emulation

Emulating Sandworm’s Prestige Ransomware

AttackIQ has released a new attack graph that emulates the behaviors exhibited by Prestige ransomware since the beginning of its activities in October 2022. Prestige has been observed targeting organizations in the transportation and related logistics sectors located in Ukraine and Poland. In November 2022, it was assessed that the Russian adversary known as Sandworm was most likely behind these attacks.
Read More

Most Recent

Attack Graph Response to CISA Advisory AA23-129A: Hunting Russian Intelligence “Snake” Malware
Adversary Emulation

Attack Graph Response to CISA Advisory AA23-129A: Hunting Russian Intelligence “Snake” Malware
AttackIQ has released two new attack graphs in response to the recently published CISA Advisory (AA23-129A) that details the efforts taken by U.S. agencies to disrupt the peer-to-peer network infrastructure used by the Russian threat actor Turla and their Snake malware. Turla is the public name given to actors associated with cyberattacks conducted by Center 16 of Russia’s Federal Security Service (FSB).
Read More
Response to Lazarus’ 3CX Supply Chain Compromise
Adversary Emulation

Response to Lazarus’ 3CX Supply Chain Compromise
AttackIQ has released a new attack graph that aims to emulate the activities linked to the recent supply chain attack against the software developed by the company 3CX. This new release aims to emulate the activities carried out during the initial stages of the system compromise and the hands-on keyboard activity led by Lazarus Group.
Read More
Emulating the Infamous Modular Banking Trojan BokBot
Adversary Emulation

Emulating the Infamous Modular Banking Trojan BokBot
AttackIQ has released two new attack graphs that emulate recent activities involving the banking trojan known as BokBot, which has been primarily focused on exfiltrating data and stealing credentials. This new release continues our focused research on emulating shared e-crime malware used in attacks by multiple adversaries.
Read More