The Recon SOC recently worked an IR case involving the newly emerged Akira Ransomware Group. News didn't begin to break about this threat actor until May 7, 2023, but our investigation shows evidence this crew began this particular campaign in early-mid April.
Eric Capuano
Recent Posts
Emergence of Akira Ransomware Group
May 10, 2023 12:54:20 PM / by Eric Capuano posted in Incident Response, Intel Sharing, ransomware
Audit Active Directory Attack Paths with Bloodhound
Apr 18, 2023 5:15:25 PM / by Eric Capuano posted in SecOps, Security, Open Source, InfoSec, Defense
In our experience working with SMB and enterprise IT teams, it is often unknown just how far and wide their Active Directory (AD) environment truly is and how many possible attack paths exist for a would-be threat actor. This is true because it's a non-trivial activity to sit down and map these environments out in a way that makes it possible to begin hardening and mitigating attack paths.
A Tribute to OpenSOC
Mar 8, 2023 6:19:40 AM / by Eric Capuano posted in OpenSOC
End of an Era
Recently the Recon team had to make the tough decision to take a step back from running our larger OpenSOC CTF events. It was not an easy decision as we know how much impact this project has made on the information security industry since we ran the very first public event at DakotaCon in 2018. Since then, the project grew larger and further than we ever dreamed, eventually becoming a DEF CON Black Badge contest in 2019 (on the DC site, too!) and running at multiple incredible conferences across the US.
Recon was at CactusCon 11!
Feb 9, 2023 1:37:56 PM / by Eric Capuano posted in Velociraptor, Events
We had the absolute pleasure to attend CactusCon11 this year which is easily one of our favorite smaller infosec events. Not only did we run a booth this year, but 4 of our team members gave some exciting talks on a variety of topics. In addition, we ran a DFIR CTF for participants looking to test their digital forensics skills.
Another LastPass Breach and What You Should Know
Dec 23, 2022 2:36:11 PM / by Eric Capuano posted in Security, InfoSec, Defense, Cryptography, LastPass
As you have no doubt heard, LastPass has suffered yet another breach which makes at least 3 separate incidents this year alone. The latest incident appears to be a follow-up to the previous intrusion from back in August. Rather than recap the details of the breaches, this post will focus strictly on "how does this affect me/my organization" and "is LastPass still safe to use?"
Every Organization Needs Centralized Logging
Oct 18, 2022 6:03:30 PM / by Eric Capuano posted in DFIR, Incident Response, Open Source, Defense, Monitoring, Graylog, Logging, Compliance
Logs are on the systems, why do I need this?
Okta + LAPSUS$ Security Incident
Mar 22, 2022 8:11:44 PM / by Eric Capuano posted in Incident Response, Monitoring, Logging, Cloud, SSO
As many in the industry are now aware, Okta experienced a form of security breach back in January which the wider industry was unaware of until screenshots obtained by the LAPSUS$ group were posted on Twitter on March 21st, at 10:15pm CDT.
Recon InfoSec Receives SOC 2 Type II Certification
Mar 9, 2022 9:24:51 AM / by Eric Capuano posted in InfoSec, Defense, Compliance
At Recon, we are committed to meeting the security demands of the evolving threat landscape and exceeding the expectations of our customers. We follow best practices, up to and including closely following Google's BeyondCorp approach to "Zero Trust" for our entire infrastructure. Our security philosophy is, "we must always be the most secure part of any organization that we may ever work with." This has enabled us to be a strong, trusted advisor and service provider to our customers and channel partners.
Scaling Enterprise Forensic Timelining
Oct 6, 2021 2:29:00 PM / by Eric Capuano posted in Automation, DFIR, Velociraptor, Incident Response, Forensics, Operations, SecOps, Security, SOC, Open Source
In July, Eric & Whitney gave a talk titled "Breaches Be Crazy" at the SANS DFIR Summit outlining Recon’s unique approach at scaling enterprise forensic timelining.
Detecting Threats with Graylog Pipelines - Part 3
Jan 15, 2021 2:14:00 PM / by Eric Capuano posted in Incident Response, Operations, SecOps, Security, SOC, InfoSec, Threat Hunting, Monitoring, Graylog
Now that we've normalized and enriched our events, let's get into the actual threat detection logic that brings SIEM-like features to open source Graylog.