STAR Livestream with Katie Nickels - September 24, 2021 Episode NOTES

Intro

• Submit to the SANS CTI Summit 2022 CFP: https://www.sans.org/mlp/cti-summit-2022-cfp/
• Centre for Cybersecurity Belgium (CCB) events: https://app.livestorm.co/ccb/

Ransomware

• https://www.coveware.com/blog/2021/7/23/q2-ransom-payment-amounts-decline-as-ransomware-becomes-a-national-security-priority
• Conti
• https://us-cert.cisa.gov/ncas/alerts/aa21-265a
• https://www.bleepingcomputer.com/news/security/translated-conti-ransomware-playbook-gives-insight-into-attacks/
• Treasury sanctions: https://home.treasury.gov/policy-issues/financial-sanctions/recent-actions/20210921
• BlackMatter attack on food distribution company: https://arstechnica.com/information-technology/2021/09/5-9-million-ransomware-attack-on-farming-co-op-may-cause-food-shortage/
• Not the cheese! https://threatpost.com/ransomware-cheese-shortages-netherlands/165407/
• Grief scare tactics: https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-wipe-decryption-key-if-negotiator-hired/
• Negotiation chat (mild profanity) that reflects how a lot of us feel sometimes: https://twitter.com/ddd1ms/status/1440766066871848966?s=19
• On a lighter note: https://twitter.com/jckichen/status/1440061412215181318?s=20

Exploitation of recent vulnerabilities

• Great piece by Patrick Howell O’Neill: https://www.technologyreview.com/2021/09/23/1036140/2021-record-zero-day-hacks-reasons/
• Zero days in the wild spreadsheet from Project Zero: https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit#gid=0
• Threats exploiting the MSHTML vulnerability: https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/
• Top routinely exploited vulnerabilities list: https://us-cert.cisa.gov/ncas/alerts/aa21-209a
• https://ccb.belgium.be/en/vulnerability-policy

Grab bag of other reports

• A new malware family with one of the best names ever: https://security-soup.net/squirrelwaffle-maldoc-analysis/
• Jupyter backdoor that is pretty widespread: https://blog.morphisec.com/new-jupyter-evasive-delivery-through-msi-installer
• Flubot text message threat: https://www.safeonweb.be/en/news/beware-dangerous-flubot-virus-dont-click-suspicious-text-messages

TLP and information sharing

• TLP Amber confusion: https://twitter.com/cyb3rops/status/1440690913919975433
• https://www.cisa.gov/tlp