What We Do
How we do it
Jul 29, 2021
UPDATE: PetitPotam NTLM Relay Attack
THE THREAT PetitPotam is a variant of the NTLM Relay attack discovered by security researcher Gilles Lionel. It is tracked as an authentication bypass vulnerability in Active Directory (Certificate Services); currently no CVE identifier has been assigned to this vulnerability. Proof of Concept (PoC) code released last week [1] relies on the Encrypting File System Remote (EFSRPC) protocol to…
Read More
View all Advisories →
About Us
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 1000+ organizations in 70+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
Read about how we got here
Leadership Work at eSentire
Jul 12, 2021
Tecala and eSentire Partner to Protect Enterprises across APAC from Business-Disrupting Cyber Attacks
Sydney, 12 July, 2021 - Tecala, Australia’s award-winning technology services and IT consulting provider, today announced it has chosen eSentire, the global Authority in Managed Detection and Response (MDR) cybersecurity services, as their exclusive MDR solution provider in Australia and New Zealand. This partnership will enable Tecala to augment its cybersecurity practice and offer enterprises…
Read More
Our award-winning partner program offers financial rewards, sales and marketing tools and personalized training. Accelerate your business and grow your revenue by offering our world-class Managed Detection and Response (MDR) services.
Learn about our Partner Program
Blog — Dec 01, 2017

Cyber threats: a holiday tradition

3 min read

While shoppers are busy, so are opportunistic threat actors. The holiday season invariably includes great deals, online shopping, the sending and receiving of packages, and waves of emails. To make the season even more hectic, there are cyber criminals attempting to exploit all of these holiday factors.

What we are seeing:

The Security Operations Center (SOC) at eSentire keeps a close eye on security trends and what threat types are prevalent in the wild. In the two weeks leading up to Black Friday this year, there were two major spikes in information gathering events (see figure 1)—these are instances of actors scanning for system vulnerabilities. Following these two spikes, the number of intrusion attempts showed distinct increases. The intrusion attempts category is comprised of illegitimate login attempts and exploiting both known and unknown vulnerabilities.

Due to the temporal occurrence of these events it can be stated with high confidence that the information gathering threats and intrusion attempts are correlated. Once cyber criminals identified vulnerabilities in their scans (Information Gathering), they proceeded to attempt to exploit these vulnerabilities (Intrusion Attempts). This activity occurred in the weeks leading up to Black Friday and Cyber Monday, two extremely popular shopping days.

The Threat Intelligence team at eSentire has also identified multiple malware droppers, such as Emotet and Hancitor, being used to deliver credential stealing banking malware like IcedID, Ursnif and Vawtrack.

(Figure One: The event count from November 13-24 for Information Gathering and Intrusion Attempts)

External Activity:

The worries surrounding security and theft during the holidays can feel overwhelming, but you aren’t alone. On November 27th (Cyber Monday) a joint operation was conducted that seized over 20,500 domains used to sell counterfeit goods. Operation “In Our Sites” was led by Interpol and included law enforcement agencies from 25 European Union member states and the FBI [1]. The removal of unscrupulous sites like these, especially before big shopping days, makes the internet safer for all of us.

Government organizations such as the Internal Revenue Service (IRS) have placed an added focus on phishing this season with awareness reports [2]. There is a general consensus among security professionals that the threat posed by phishing emails is greater during holiday seasons. Seasonal themed phishing emails may include fake sales and notifications of package delivery. With all the ads and emails over this season, it is easy to forget about security, but phishing is one of the main methods criminals use for stealing information and delivering malicious content.

Simple Steps to Keep Yourself Safe

There are some simple steps that should be implemented year-round to help keep users safe from cyber-threats. Use unique passwords for all accounts so that if one account is compromised the malicious actor will not be able to easily compromise your other accounts. A longer password is a stronger password; make use of a passphrase rather than a single word password that could be easily broken by a brute force or dictionary attack. Only visit trusted websites that use secure communication processes; look for the padlock icon to left of the URL to be sure (see figure 2). The padlock indicates that the connection is secure. Lastly, it is always a good idea to regularly check bank and credit card statements to be sure that you haven’t been compromised.

(Figure Two: Secure connection example)

Stay secure and enjoy the incoming holiday season!

External Links

[1] https://www.irs.gov/newsroom/national-tax-security-awareness-week-no-2-dont-take-the-bait-avoid-phishing-emails-by-data-thieves

[2] https://www.europol.europa.eu/newsroom/news/biggest-hit-against-online-piracy-over-20-520-internet-domain-names-seized-for-selling-counterfeits

eSentire Threat Intel
eSentire Threat Intel Threat Intelligence Research Group