What We Do
How we do it
Oct 18, 2021
Grief Ransomware Gang Claims 41 New Victims, Targeting Manufacturers; Municipalities; & Service Companies in U.K. & Europe
Grief Operators Earned an Estimated 8.5 Million British Pounds in Four Months Key Findings: The Grief Ransomware Gang (a rebrand of the DoppelPaymer Ransomware Group) claims to have infected 41 new victims between May 27, 2021—Oct. 1, 2021 with their ransomware.Over half the companies listed on Grief’s underground leak site are based in the U.K. and Europe. The Grief Ransomware Gang appears to…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Oct 12, 2021
eSentire Launches MDR with Microsoft Azure Sentinel Extending Response Capabilities Across Entire Microsoft Security Ecosystem
Waterloo, ON – Oct. 12, 2021 -- eSentire, recognized globally as the Authority in Managed Detection and Response (MDR), today announced the expansion of its award-winning MDR services with Microsoft Azure Sentinel, as part of its integration with the complete Microsoft 365 Defender and Azure Defender product suites supporting Microsoft SIEM, endpoint, identity, email and cloud security services.…
Read More
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Apply today to partner with the Authority in Managed Detection and Response.
Login to the Partner Portal for resources and content for current partners.
Blog — Dec 01, 2017

Cyber threats: a holiday tradition

While shoppers are busy, so are opportunistic threat actors. The holiday season invariably includes great deals, online shopping, the sending and receiving of packages, and waves of emails. To make the season even more hectic, there are cyber criminals attempting to exploit all of these holiday factors.

What we are seeing:

The Security Operations Center (SOC) at eSentire keeps a close eye on security trends and what threat types are prevalent in the wild. In the two weeks leading up to Black Friday this year, there were two major spikes in information gathering events (see figure 1)—these are instances of actors scanning for system vulnerabilities. Following these two spikes, the number of intrusion attempts showed distinct increases. The intrusion attempts category is comprised of illegitimate login attempts and exploiting both known and unknown vulnerabilities.

Due to the temporal occurrence of these events it can be stated with high confidence that the information gathering threats and intrusion attempts are correlated. Once cyber criminals identified vulnerabilities in their scans (Information Gathering), they proceeded to attempt to exploit these vulnerabilities (Intrusion Attempts). This activity occurred in the weeks leading up to Black Friday and Cyber Monday, two extremely popular shopping days.

The Threat Intelligence team at eSentire has also identified multiple malware droppers, such as Emotet and Hancitor, being used to deliver credential stealing banking malware like IcedID, Ursnif and Vawtrack.

(Figure One: The event count from November 13-24 for Information Gathering and Intrusion Attempts)

External Activity:

The worries surrounding security and theft during the holidays can feel overwhelming, but you aren’t alone. On November 27th (Cyber Monday) a joint operation was conducted that seized over 20,500 domains used to sell counterfeit goods. Operation “In Our Sites” was led by Interpol and included law enforcement agencies from 25 European Union member states and the FBI [1]. The removal of unscrupulous sites like these, especially before big shopping days, makes the internet safer for all of us.

Government organizations such as the Internal Revenue Service (IRS) have placed an added focus on phishing this season with awareness reports [2]. There is a general consensus among security professionals that the threat posed by phishing emails is greater during holiday seasons. Seasonal themed phishing emails may include fake sales and notifications of package delivery. With all the ads and emails over this season, it is easy to forget about security, but phishing is one of the main methods criminals use for stealing information and delivering malicious content.

Simple Steps to Keep Yourself Safe

There are some simple steps that should be implemented year-round to help keep users safe from cyber-threats. Use unique passwords for all accounts so that if one account is compromised the malicious actor will not be able to easily compromise your other accounts. A longer password is a stronger password; make use of a passphrase rather than a single word password that could be easily broken by a brute force or dictionary attack. Only visit trusted websites that use secure communication processes; look for the padlock icon to left of the URL to be sure (see figure 2). The padlock indicates that the connection is secure. Lastly, it is always a good idea to regularly check bank and credit card statements to be sure that you haven’t been compromised.

(Figure Two: Secure connection example)

Stay secure and enjoy the incoming holiday season!

External Links

[1] https://www.irs.gov/newsroom/national-tax-security-awareness-week-no-2-dont-take-the-bait-avoid-phishing-emails-by-data-thieves

[2] https://www.europol.europa.eu/newsroom/news/biggest-hit-against-online-piracy-over-20-520-internet-domain-names-seized-for-selling-counterfeits

eSentire Threat Intel
eSentire Threat Intel Threat Intelligence Research Group