The Nozomi Networks Labs team delivers this semi-annual report to provide insights into how the world’s largest industrial organizations and critical infrastructure operators can protect themselves from these advanced threats. Our threat intelligence, enriched by indicators of compromise, threat actor profiles and vulnerability data from Mandiant, empowers customers to proactively defend their systems.

Alto’s methodology employs a data-first approach with the objective of supporting experts and practitioners establish an evidence-based understanding of the complex, multivariate nature of extremism and radicalization online and its multi-layered relationship with: the vulnerabilities linked to certain narratives and ideologies that constitute a part of public discourse and can be weaponized with specific aims. this report does highlight specific domains, channels and other digital spaces to aid practitioners in understanding the mechanics of the digital spaces analyzed.

That is the purpose of this report is to show you the hours saved, the data aggregated, and the research methodologies laid bare. you’ll find several sections covering some of the bigger mass exploitations of 2022, also known as celebrity vulnerabilities.

This report presents multiple segments detailing various key aspects of major mass exploitations of 2023. We encourage you to view the year through the perspective of a defender, say on a security operations (SOC) team, with limitless access to GreyNoise data. From this vantage point, see how 2023 might have appeared if you had utilized our datasets* to remain at the forefront of thwarting widespread internet exploits.

In the second quarter of 2023 GreyNoise researchers observed a substantial change in the behavior of some regular internet scanning idioms. Inventory scans—where both benign and malicious actors perform regular checks for a given technology or specific vulnerability being present—significantly reduced in frequency and scale. These targeted attacks threaten to circumvent existing defense capabilities and expose organizations to a new wave of disruptive breaches. Defenders must evolve in response.

The Flashpoint 2024 Global Threat Intelligence Report offers a critical examination of the current threat environment. This year’s analysis goes beyond traditional threat intelligence, incorporating Flashpoint’s unparalleled data and insights to shed light on cyber threats, geopolitical turmoil, and escalating physical conflicts around the world. The goal: help your organization to strengthen its defenses, ensure operational resilience, and proactively confront multifaceted threats—thereby safeguarding critical assets, preventing financial losses, and protecting lives.

The report raises a number of interesting findings, which you’ll read about in the pages to come. However, one through line that emerges is the need for reliable threat intelligence and its impact on threat hunters’ ability to do their jobs well. Threat intelligence, or lack thereof, is a commonality across the top challenges respondents identified. Access to threat intelligence also affects nearly every aspect of how respondents say they do their jobs.

The goal of this report is to help security professionals remain at the forefront of securing organizations, as its content is based on real-world techniques employed by attackers to target cloud-based environments. As commercial adoption of cloud technologies continues, cloud-focused malware campaigns have increased in sophistication and number – a collective effort to safeguard both large enterprises and small businesses alike is key.

This annual report features the work of 37 sophisticated cybersecurity teams working in partnership to advance 29 open-source projects that improve cyber defense for the whole community. This report captures the energy and passion that Center Participants bring to advancing threat- informed defense for all. Use it as a reference and share it with your teams and colleagues to further change the game on the adversary.

CompTIA’s 2024 State of Cybersecurity report explores the many variables that must be considered in balancing the cybersecurity equation. As cybersecurity becomes a critical business imperative, every process must be scrutinized for potential vulnerabilities. This practice of risk analysis then drives decisions around workflow, skill-building and technology implementation. With technology trends evolving and attack patterns changing, true equilibrium is impossible to achieve. The balancing act is a full-time job.

In this report, we’ll discuss three automotive-related cybersecurity emerging risks we’ve identified in 2023, arising from the rapid proliferation of SDVs. Growth in backend attacks allowing access to sensitive vehicle data and controls, the ever-evolving SBOM and the critical role it plays in enhancing automotive threat intelligence and cyber are on the rise in the agriculture, construction, and heavy machinery industries that fare fast to adopt software-defined and autonomous capabilities.

This is the third edition of ThreatQuotient’s annual survey of senior cybersecurity professionals, exploring the topic of cybersecurity automation adoption. Read this report to understand how CISOs and senior cybersecurity professionals are handling the incorporation of cybersecurity automation into their strategies to protect the complex, extended enterprise – and their analyst teams – from the pressures of escalating cyber threats.

This report helps uncover vulnerabilities missed by traditional security tools and detect unnoticed malicious activities. To understand how security professionals utilize threat hunting, we surveyed 218 security analysts to identify effective strategies, challenges, and metrics for success.

In April 2023, ReversingLabs partnered with Dimensional Research to survey 321 security and IT professionals on their software supply chains for its report, “Software Supply Chain Security Risk Survey.” This analysis presents key findings and actionable recommendations for security organizations in four key areas: traditional applications security shortcomings, software supply chain complexity and security, security in software development and enterprise-wide security risks.

Process for Attack Simulation and Threat Analysis (PASTA) is a threat modeling methodology, co-developed by VerSprite’s CEO Tony UcedaVelez. It provides a process for simulating attacks to applications, analyzing cyberthreats that originate them, and mitigating cybercrime risks that these attacks and threats pose to organizations. The process is employed by security professionals across industries to prioritize risks and develop a mature cybersecurity framework that is woven into the business culture and the application development process.

In 1H 2023, we observed significant activity among advanced persistent threat (APT) groups, a rise in ransomware frequency and complexity, increased botnet activity, a shift in MITRE ATT&CK techniques used by attackers, and more. As we examine activity in the first half of 2023, we see cybercrime organizations and nation-state cyber-offensive groups swiftly adopting new technologies. Notably, some of these actors operate much like traditional enterprises, complete with well-defined responsibilities, deliverables, and objectives.

This report has been put together using CISA’s KEV Catalog and the month-on-month analysis that CSW’s researchers have delivered to our customers for the past year. Our researchers used the NVD, MITRE, and other repositories to map each vulnerability to Tactics, Techniques, and Procedures (TTPs) to understand the actual risk posed by these vulnerabilities. We cross-referenced the KEVs with our ransomware and threat groups’ database maintained in Securin Vulnerability Intelligence (VI) to provide additional threat context to the KEV Catalog. We have also used our proprietary threat intelligence platform (Securin VI) to predict and recommend vulnerabilities that need to be a part of the KEV Catalog.

In this, our seventh annual survey, we added many questions but didn’t really take any away. Our new areas of focus include operational threat hunting, threat intelligence, data ingestion into the SIEM, and SOAR, as well as more detailed questions relevant to staff hiring and retention.

Constella’s threat intelligence team continuously collects identity records from data breaches and leakages found in open sources, on the surface, social, deep, and dark web, to track data related company breaches and the specific personally identifiable information (PII) exposed that represents a risk to organizations and their employees and customers. In this report, we detail the implications of the proliferation of info stealers and botnet malware and what these threats mean for the security of consumers and companies.

For this report, Securonix partnered with the Cyentia Institute to analyze a dataset of more than 54 billion events fed into more than 154k policies generating an average of more than 750k violations per hour. The goal? To quantify our assumptions and findings in a way that can help organizations calibrate what’s going on in their own environments.

In the summer and fall of 2019, EY surveyed 246 global institutions that had a third-party risk management (TPRM) function in various sectors, including but not limited to, retail and commercial banking, investment banking, insurance, advanced manufacturing and mobility, technology, media and entertainment, power and utilities, and health.