A cybersecurity incident doesn't pause while your team figures out what to do next. Every minute an attacker remains in your environment, they have more time to expand their foothold, exfiltrate data, or encrypt additional systems — and the business is losing money the entire time. But here's the critical nuance most organizations miss: the goal isn't to start recovering as fast as possible. It's to understand what you're dealing with and contain the incident first.
Topics: Data Breach, Information Security, Incident Response, cybersecurity insurance, Cybersecurity Consulting
ProCircular has been monitoring a troubling uptick in ClickFix attacks—a sneaky form of social engineering that tricks users into running harmful scripts on their systems. This type of attack is particularly clever, masquerading as legitimate interactions to catch users off guard.
Topics: Cybersecurity, Data Protection, Security Awareness Training, MXDR, social engineering
With EDR (Extended Detection and Response) becoming more necessary and common, it begs the question of what tactics and techniques are evading these protections. ProCircular recently conducted a penetration test involving evasion methods that did just that by successfully bypassing EDR protections by leveraging lay-of-the-land tools and incident response techniques. Our objective was to achieve full domain compromise within the targeted network, demonstrating the vulnerabilities and potential weaknesses that need to be addressed for robust cybersecurity. A walkthrough of the attack can be examined below.
Topics: Cybersecurity, Penetration Testing, Incident Response, hacking
As businesses evolve to achieve higher security maturity, threat actors and penetration testers must also rise to the challenge. Modern third-party security applications such as Endpoint Detection and Response (EDR), Extended Detection and Response (XDR), Windows Defender products, and application allowlists have made offensive tools obsolete. Gone are the days when all a penetration tester needed was a remote shell or desktop connection to extract user data and credentials from local machines and domain controllers. Instead of fighting against signature-based and obfuscation methods, attackers are turning to digital forensics incident response (DFIR) tools, like KAPE, to get the dirty work done for them. After all, you never have to sneak into the party if the bouncer thinks you’re already on the list.
Topics: Cybersecurity, Incident Response, hacking
Recently, it was announced that Katie Arrington was promoted to acting CIO for the Department of Defense. With the efforts for CMMC being spearheaded by her and the task force she was a part of, many have taken to social media to speculate on the decay of the program. Despite this, most assessors and organizations are still expecting the CMMC program to maintain its course.
Topics: Cybersecurity, CMMC