Lockbit 3.0 and Royal Mail – Chats Published

The loss of availability Ransomware causes is enough to make your day/week/s bad, the loss of data, bad month/quarter or longer.

Lockbit posted “Royal Mail need new negotiator.” Followed by “ALL AVAILABLE DATA PUBLISHED !”

What we actually found is that they published the chat history:

Getting into Cyber

Why is the cybersecurity hiring process so broken?

In this blog today we look at the 6 TOP reasons why the CYBERSECURITY hiring process is largely broken and some ways we can look at addressing these:

The cybersecurity hiring process can be considered “broken” for a number of reasons, some of which include:

Threat Intel

ESXiargs Summary 09-02-2023 10:03

What do we know?

Adversary: Unknown, likely Criminal Actor/s

Initial Access Vector: Unknown/Unproven

Impact: ~3K+ Hosts have had Remote Code Execute and their ESXi logon pages changed (plus had encryption routines run to encrypt virtual machines, with varying success). A Second encryption routine has been deployed to some hosts; the threat actor is expanding/changing capabilities.

Risk: Further impact, Additional Threat Actors Exploit the vulnerability

Vulnerabilities

ESXIArgs Vulnerable ESXi Spreadsheet

I knocked this up quickly but I “think” it’s accurate. Use at own risk etc.

ESXi-RCE-Vulnerable-Builds Download

Let me know if you find any errors/changes required etc.

Education

How to get some OPSEC with Kali?

There are major questions that must be answered here!

How do we change the hostname in KALI Linux?
How do we change the default TTL to look like a Windows Machine?
How do we pretend to be a SAMSUNG device/How do we change our MAC address?

Getting into Cyber

How to get into Cyber? It’s EASY!

Quick, I’ll tell you a little secret… to get into CYBER you must first follow this guide:

Now if you are going to GET INTO CYBER you need to have a range of things:

Computer Hacking Skills
Num-chuk Skills

Right ok, so let’s get some Hacking Skills!

Head over to KALI LINUX and download KALI

Threat Intel

ESXiARGS Ransomware – Global Incident

Thousands of ESXi hosts around (some of the) globe have been encrypted by cyber criminals. This post is a fast publish showing some of what has occurred, it’s impact and now includes limited remedial advice.

If you have been affected by this ransomware event there is an attempted recovery script by CISA

https://github.com/cisagov/ESXiArgs-Recover/blob/main/recover.sh

Leadership

Why is security so hard?

It requires being thorough.
It required documenting things.
It requires conducting training and drills.
It adds what can be viewed as additional effort/cost to the primary goals (sell widgets/services/time)
It involves weird and wonderful ways of abusing functionality that is not always apparent or expected, thus to the typical consumers/user of a service, the idea that it might be abused actually seems very unlikely (to a criminal or security pro, the idea it will be abused seems far more likely based on threat intelligence etc.)

Leadership

Virtual Desktop Infrastructure (VDI) & Cyber Essentials

Do you have a VDI solution in use at your business? Be that something like CITRIX, VMware View or Remote Desktop Services (VDI mode or Server Based Computing SBC) mode?

Well let’s consider this with regard to cyber essentials.

In a recent update post:

The January changes to the Cyber Essentials scheme reflect the changing cyber threats in today’s digital environment – Iasme

Leadership

Technology in the Wild

Whilst every marketing person will talk about the latest and greatest tech innovation and product, how much does that reflect the reality of technology deployed in the world? Everyone is running Windows 11 and Windows Server 2022 right?! They also don’t use computers, because everything is cloud and mobile first right! and security, well everyone has that down as well! Great… let’s just go and check those statements out… oh wait…. no maybe err.. let’s take a look with our friends at shodan.io