-
Cyber Défense from narrow to broad (5th Jan 2023)
Preface: Sustainability is a buzzword in the modern world in recent years. It applies to business, culture…even our education. A slogan, keep learning. Maybe it’s the Cantonese mantra, One is never too old to learn. Perhaps it also apply to cyber security protection. Background: In last twenty years, computing technology driven growth of the world.…
-
Kronos hot with ransomware, even though we do not know the reason. However, the original has weakness (14-12-2021)
Preface: In October 2020, two of the largest human resources (HR) technology vendors out there—Kronos and Ultimate Software—merged into UKG (Ultimate Kronos Group). Together, the two companies now bring customers more than 70 combined years of experience in the industry. Background: Kronos’ system integration capabilities has compatibility because it accept CSV format of file as…
-
The evasion technique of Ring 3 continues to improve. Since this is the entry point. Therefore Layer 7 with deep packet inspection is the bases for defensive technique. (6th Dec 2021)
Preface: In fact, despite the excel icon, the XLL file is a Dynamic Linked Library, a binary executable file. Background: The number of data breaches as of September 30, 2021 has exceeded 17% of the total number of incidents in 2020 (1,291 breaches in 2021, and 1,108 breaches in 2020). The fundamental objective of MS…
-
BlackMatter Ransomware – Stay Alert (18th Oct, 2021)
Preface: Ransomware common deploying malicious actions is the automatically propagation. Their target will be included ADMIN$, C$, SYSVOL, and NETLOGON default setup. Common infection technique: Believe it or not, quite a lot of ransomware developers will use simple technique.Deploy encryptors across the environment using Windows batch files (mount C$ shares, copy the encryptor, and executed…
-
DarkSide Ransomware ready to move. Operational Technology (OT) should staying alert (7-7-2021)
Preface: IDC report predicted that By 2024, 60% of industrial organizations will integrate data from edge OT systems with cloud-based reporting and analytics, moving from single-asset views to sitewide operational awareness. Background: PowerShell provides an adversary with a convenient interface for enumerating and manipulating a host system after the adversary has gained initial code execution.…
-
Are there other ways to avoid ransomware infection? (6th Jul, 2021)
Preface: A ransomware attack paralyzed the networks of at least 200 U.S. companies, said headline News. President Biden announces investigation into international ransomware attack on 3rd Jul, 2021. Background analysis: Cyber criminals are turning to fileless attacks to bypass firewalls. These attacks embed malicious code in scripts or load it into memory without writing to…
-
The Thirty-six stratagems – Know yourself and the ransomware, never lost in cyber war. 30-06-2021
Preface: The Thirty-six stratagems is a Chinese essay use to illustrate a series of stratagems used in war. It also applies to cyber warfare. Background: Kernel-based Virtual Machine (KVM) is an open source virtualization technology built into Linux®. Specifically, KVM lets you turn Linux into a hypervisor that allows a host machine to run multiple,…
-
Closer to reality: one of the ways of ransomware infection (15th June, 2021)
Preface: Ransomware infection not merely boots by vulnerability of the windows OS and or products components. Web site programming technique is the accomplice. Perhaps we can say, how successful of ransomware attacks will depends on the total number of compromised web server. What I call the trigger point. Background: Ransomware is often spread through phishing…
-
Rising Ransomware Threat To Operational Technology Assets, US (CISA) urge to critical facilities to tighten their cyber security incident management and protection. 10-6-2021
Preface: When the TCP/IP network protocol replaces the classic MODBUS protocol on a large scale. At the same time, there is a large demand for the deployment of Windows operating system servers and workstations. From the perspective of cyber security, information technology and operational technology are the same. Synopsis: On May (9th May 2021), 2017,…
-
Ransomware hard to hunt because they are doing the Guerrilla warfare! 31st May,2021
Preface: A Russian-speaking outfit called DarkSide offered would-be computer crooks not just the tools, but also customer support, New York Times said. My observation: My observation: Perhaps cyber criminals learn from practice. They know the system infrastructure weakness of industrial especially oil, powers supply facilities even logistic industry. Since Java has large capability. The test…