STAR Feb 2022 livestream links

Ukrainian tensions

• Microsoft blog on ACTINIUM group targeting Ukrainian organizations: https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/
• Unit 42 blog on Gamaredon group targeting Ukraine: https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/
• Mandiant recommendations on preparing for destructive attacks: https://www.mandiant.com/resources/protect-against-destructive-attacks (check out last month’s STAR livestream for more on this from John Hultquist: https://www.youtube.com/watch?v=ONtdjd_QvBs)

Annual reports

• CrowdStrike 2022 Global Threat Report: https://go.crowdstrike.com/global-threat-report-2022.html
• Expel 2022 annual report: https://expel.com/great-expeltations-2022/

Ransomware

• Reporting on BlackByte compromising San Francisco 49ers: https://www.bleepingcomputer.com/news/security/nfls-san-francisco-49ers-hit-by-blackbyte-ransomware-attack/
• FBI and USSS report on BlackByte: https://www.ic3.gov/Media/News/2022/220211.pdf
• Red Canary blog on BlackByte: https://redcanary.com/blog/blackbyte-ransomware/
• Raccine (“ransomware vaccine): https://github.com/Neo23x0/Raccine
• Coveware quarterly ransomware report: https://www.coveware.com/blog/2022/2/2/law-enforcement-pressure-forces-ransomware-groups-to-refine-tactics-in-q4-2021
• Allan Liska’s tweet on ransomware seasonal patterns: https://twitter.com/uuallan/status/1492517368035217410
• International governments advisory on ransomware trends: https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2928709/cisa-fbi-nsa-and-international-partners-issue-advisory-on-ransomware-trends-fro/
• Decryptor for Maze, Sekhmet, and Egregor from Emsisoft: https://www.emsisoft.com/ransomware-decryption-tools/maze-sekhmet-egregor

Miscellaneous

• Microsoft announcement on blocking macros by default in Office: https://techcommunity.microsoft.com/t5/microsoft-365-blog/helping-users-stay-safe-blocking-internet-macros-by-default-in/ba-p/3071805
• Recent reports from the DFIR Report: https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/ and https://thedfirreport.com/2022/01/24/cobalt-strike-a-defenders-guide-part-2/
• Twitter account to follow for Emotet info: https://twitter.com/Cryptolaemus1
• SentinelOne blog on ModifiedElephant group targeting India: https://www.sentinelone.com/labs/modifiedelephant-apt-and-a-decade-of-fabricating-evidence/