SECUINFRA Falcon Team
Digital Forensics & Incident Response experts
The SECUINFRA Falcon Team is specialized in the areas of Digital Forensics (DF) and Incident Response (IR). This includes classic host-based forensics, but also topics such as malware analysis or compromise assessment.
In addition to the activities for which we are responsible within the scope of customer orders, the Falcon team is also responsible for the operation, further development and research of various projects and topics in the DF/IR area. These include, for example, threat intelligence or the creation of detection rules based on Yara.
Today many businesses rely on virtualization technology to run and scale their infrastructure. One of the most popular Hypervisor systems on the market is VMware ESXi, which is regularly targeted in Ransomware attacks for the last 3+ years to increase damage to the victims IT systems.
In order to minimize monetary and reputational damage in the event of a successful IT security attack, immediate and correct response measures, a comprehensive overview of the extent of the cyber attack, and a full clarification of the incident are indispensable.
Due to recent events, the SECUINFRA Falcon Team strongly recommends updating the firmware of VPN/remote access solutions from the manufacturers SonicWall, Fortinet and Citrix.
The SECUINFRA Falcon Team analyzed a recent attack conducted by the south-Asian Advanced Persistent Threat group „Bitter“.
With the plethora of daily threats, an organization's cybersecurity teams need to be able to respond immediately and efficiently to existing threat situations.
What can you do now to uncover existing compromises of your network in a timely manner and thus avert massive financial damage and reputational risks from your company? With a Compromise Assessment (CA), an effective investigation method is available that makes hidden attack activities in your network visible.
The registered number of IT security incidents as a result of the rapid development of new and adapted cyber attack methods is worrying - and can sometimes have serious financial consequences as well as reputational damage for companies.
We will first begin at the entry point of this RAT and analyze its executed code before we jump into all possible modules this RAT possesses.
According to Malware Bazaar, samples have been distributed since around mid-January. The final payload is a .NET RAT, which allows the attacker to send commands to the infected system.
This article is intended to provide a deeper insight into the important topic of reporting obligations in the event of an IT security incident.