Category Archives: Incident Response (IR)

Web injections are back on the rise: 40+ banks affected by new malware campaign

Posted on by

Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript […]

The post Web injections are back on the rise: 40+ banks affected by new malware campaign appeared first on Security Intelligence.

Continue reading Web injections are back on the rise: 40+ banks affected by new malware campaign→

What cybersecurity pros can learn from first responders

Posted on by

Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the […]

The post What cybersecurity pros can learn from first responders appeared first on Security Intelligence.

Continue reading What cybersecurity pros can learn from first responders→

What keeps incident responders up at night: Common pitfalls that cyber responders encounter when arriving at the scene

Posted on by

What does the worst day look like for incident responders? What keeps them up at night? And what makes their jobs more difficult? Cyber responders from IBM X-Force shared their first-hand accounts for what can turn a bad situation into a worst-case scenario when it comes to responding to a cybersecurity incident. Read on to […]

The post What keeps incident responders up at night: Common pitfalls that cyber responders encounter when arriving at the scene appeared first on Security Intelligence.

Continue reading What keeps incident responders up at night: Common pitfalls that cyber responders encounter when arriving at the scene→

Tequila OS 2.0: The first forensic Linux distribution in Latin America

Posted on by

Incident response teams are stretched thin, and the threats are only intensifying. But new tools are helping bridge the gap for cybersecurity pros in Latin America. IBM Security X-Force Threat Intelligence Index 2023 found that 12% of the security incidents X-force responded to were in Latin America. In comparison, 31% were in the Asia-Pacific, followed […]

The post Tequila OS 2.0: The first forensic Linux distribution in Latin America appeared first on Security Intelligence.

Continue reading Tequila OS 2.0: The first forensic Linux distribution in Latin America→

Alert fatigue: A 911 cyber call center that never sleeps

Posted on by

Imagine running a 911 call center where the switchboard is constantly lit up with incoming calls. The initial question, “What’s your emergency, please?” aims to funnel the event to the right responder for triage and assessment. Over the course of your shift, requests could range from soft-spoken “I’m having a heart attack” pleas to “Where’s […]

The post Alert fatigue: A 911 cyber call center that never sleeps appeared first on Security Intelligence.

Continue reading Alert fatigue: A 911 cyber call center that never sleeps→

X-Force releases detection & response framework for managed file transfer software

Posted on by

How AI can help defenders scale detection guidance for enterprise software tools If we look back at mass exploitation events that shook the security industry like Log4j, Atlassian, and Microsoft Exchange when these solutions were actively being exploited by attackers, the exploits may have been associated with a different CVE, but the detection and response […]

The post X-Force releases detection & response framework for managed file transfer software appeared first on Security Intelligence.

Continue reading X-Force releases detection & response framework for managed file transfer software→

Unmasking hypnotized AI: The hidden risks of large language models

Posted on by

The emergence of Large Language Models (LLMs) is redefining how cybersecurity teams and cybercriminals operate. As security teams leverage the capabilities of generative AI to bring more simplicity and speed into their operations, it’s important we recognize that cybercriminals are seeking the same benefits. LLMs are a new type of attack surface poised to make […]

The post Unmasking hypnotized AI: The hidden risks of large language models appeared first on Security Intelligence.

Continue reading Unmasking hypnotized AI: The hidden risks of large language models→

What’s new in the 2023 Cost of a Data Breach report

Posted on by

Data breach costs continue to grow, according to new research, reaching a record-high global average of $4.45 million, representing a 15% increase over three years. Costs in the healthcare industry continued to top the charts, as the most expensive industry for the 13th year in a row. Yet as breach costs continue to climb, the […]

The post What’s new in the 2023 Cost of a Data Breach report appeared first on Security Intelligence.

Continue reading What’s new in the 2023 Cost of a Data Breach report→

Attacker exploits vulnerability in Active Directory Certificate Services to take control of domain

Posted on by

This post was made possible through the contributions of Joseph Spero and Thanassis Diogos. In June 2023, IBM Security X-Force responded to an incident where a client had received alerts from their security tooling regarding potential malicious activity originating from a system within their network targeting a domain controller. X-Force analysis revealed that an attacker […]

The post Attacker exploits vulnerability in Active Directory Certificate Services to take control of domain appeared first on Security Intelligence.

Continue reading Attacker exploits vulnerability in Active Directory Certificate Services to take control of domain→

SIEM and SOAR in 2023: Key trends and new changes

Posted on by

Security information and event management (SIEM) systems remain a key component of security operations centers (SOCs). Security orchestration, automation, and response (SOAR) frameworks, meanwhile, have emerged to fill the gap in these capabilities left by many SIEM systems. But as many companies have begun reaching the limits of SIEM and SOAR systems over the last […]

The post SIEM and SOAR in 2023: Key trends and new changes appeared first on Security Intelligence.

Continue reading SIEM and SOAR in 2023: Key trends and new changes→