Identifying Threats: Why Behavior Matters

Attacker methods are evolving. Join us for an upcoming webinar to learn why cybersecurity teams must identify and track suspicious behaviors and patterns to stay a step ahead.

SOC Alert! Uptick in Ursnif Distribution

Binary Defense has noticed a recent uptick in Ursnif distributed using Reply-Chain attacks and password protected .zip files across multiple clients. Inside of the .zip files will be documents containing macros which execute and reach out to a Ursnif distribution server to download the payload. The Reply-Chain attacks are carried out by infecting one victim, accessing their emails, locating […]

TrickBot: Ono! New Tricks!

tickbot flowchart

During the past few weeks, my team and I (The Binary Defense Security Operations Center Threat Hunters), have been tracking a TrickBot gtag that has been behaving differently compared to the other TrickBot gtags. In those weeks, we observed differences in its: Distribution Runtime Post-infection High-level TrickBot Exploitation Flow TrickBot’s actions in runtime Let’s look […]

Don’t Fall Victim to Wire Transfer Fraud: Tips to Stay Safe

Hackers employ a multitude of methods in order to gain access to a company’s data, but at the end of the day, they are looking for the fastest route to payday. One such method is known as a wire transfer scam. This scam has been around for a while; you’ve surely heard of the famous […]

Phishing Financial Firms is Big Business

Cyberattacks on financial institutions in the US occur at the staggering rate of approximately 30 times per second. The reality is while major news outlets report on wide-scale breaches such as the 143 million US resident records accessed in the Equifax breach, countless other successful breaches happen daily that don’t earn national headlines. Information security […]

Secure Your Site(s): Avoid SSL/TLS Certificate Expiration

security toolbox

Not too many years ago, a few websites began adding an extra layer of security in the form of Secure Sockets Layer (SSL) certification. Today, most legitimate business sites are sure to have SSL certificates installed. Many of the SSL certificates installed and available today are actually Transport Layer Security (TLS) certificates, although they are […]

Using Sysmon and ETW For So Much More

Recently the team over at Microsoft’s SysInternals team Mark Russinovich and Thomas Garnier landed a new version of Sysmon v10 which adds a new event ID type Event ID 22 (DNS). If you are not familiar with Sysmon, it’s a free tool from Microsoft which incorporates a number of enhanced events from the operating system, […]

Credential Stuffing…A Side Effect of Data Breaches

credential stuffing

Credential stuffing is a type of brute force cyberattack which uses automation in an effort to gain unauthorized access to systems around the world…and it all starts with a simple data breach. Data from One Breach Poses Risks to Additional Systems An alarming number (almost half) of people use the same or similar password across […]

Protect Yourself from Password Spraying Attacks

binarydefense protect yourself

Password spraying attacks are just one method hackers use to gain unauthorized access to systems around the world. The technique itself is not complex, and a simple online search turns up instructions even cyber-novices can follow. While the attack is relatively simple and should be easy to defend against, it is effective, and it continues […]

AT&T Cybersecurity Names Binary Defense Global Partner of the Year

AV partner 1

Binary Defense™—a leading cybersecurity firm in Endpoint Detection and Response, SOC-as-a-Service and Counterintelligence—was named AT&T Cybersecurity’s (formerly AlienVault) 2018 Global Partner of the Year. Binary Defense had been named Global Partner of the Year in 2016 and returned to the top spot in 2018 by delivering 100% year-over-year growth. Binary Defense teams with AT&T Cybersecurity […]

Threat Intelligence: Employees’ Private Data Compromised in Airbus Data Breach

Aeronautical giant Airbus has recently discovered a breach in their system which led to unauthorized parties accessing employee information. The company assured that none of their commercial operations were affected. Information such as employee contact details and IT identification details were accessed. “Investigations are ongoing to understand if any specific data was targeted, however, we […]

Threat Intelligence: Verity Healthcare Suffers Multiple Phishing Attacks

Verity Health System, a six medical clinic operation in Redwood City, California, has informed an undisclosed number of people that their information may have been accessed due to phishing. Through these phishing attempts, attackers were able to obtain three employee emails that had messages and attachments contained within them. Other emails included patient names, treatment […]