The Recon SOC recently worked an IR case involving the newly emerged Akira Ransomware Group. News didn't begin to break about this threat actor until May 7, 2023, but our investigation shows evidence this crew began this particular campaign in early-mid April. 

In our experience working with SMB and enterprise IT teams, it is often unknown just how far and wide their Active Directory (AD) environment truly is and how many possible attack paths exist for a would-be threat actor. This is true because it's a non-trivial activity to sit down and map these environments out in a way that makes it possible to begin hardening and mitigating attack paths. 

End of an Era

Recently the Recon team had to make the tough decision to take a step back from running our larger OpenSOC CTF events. It was not an easy decision as we know how much impact this project has made on the information security industry since we ran the very first public event at DakotaCon in 2018. Since then, the project grew larger and further than we ever dreamed, eventually becoming a DEF CON Black Badge contest in 2019 (on the DC site, too!) and running at multiple incredible conferences across the US.

We had the absolute pleasure to attend CactusCon11 this year which is easily one of our favorite smaller infosec events. Not only did we run a booth this year, but 4 of our team members gave some exciting talks on a variety of topics. In addition, we ran a DFIR CTF for participants looking to test their digital forensics skills.

As you have no doubt heard, LastPass has suffered yet another breach which makes at least 3 separate incidents this year alone. The latest incident appears to be a follow-up to the previous intrusion from back in August. Rather than recap the details of the breaches, this post will focus strictly on "how does this affect me/my organization" and "is LastPass still safe to use?"

Do you have resources on prem? In the cloud? How about in multiple clouds? How do you access them all, and how do you track all of those resources? How do you handle key management? Password management? User management? How do you maintain who or what has SSH and RDP access? How do you provide secure access to internal websites or even other data sources? How do you know your admins and analysts and end users are accessing them securely? How do you know who has keys sitting in their downloads folder? How do you track any of it? 

If anyone in your organization handles financial transactions, invoices, or payroll changes over email, you're at risk of wire transfer fraud. Criminals target sophisticated social engineering attacks toward anyone that can authorize or redirect payments or financial transactions, including accountants, salespeople, payroll and HR staff, and executives. The core issue is this: email is never a trustworthy way to validate a person's identity. It is critical that your leadership and users understand this. 

Recon InfoSec, an industry-recognized leader in Managed Detection & Response, cybersecurity assessments, incident response, and training, is offering its portfolio of services and capabilities through an exclusive channel partner program.

With the ongoing conflict in Ukraine and U.S. sanctions against Russia continuing to build, the need has never been greater for American infrastructure entities to protect their operations from cyber threats and attacks.