Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Meet insurability requirements with MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
For members of the notorious ALPHV, also known as BlackCat, ransomware group, it’s been some great few months. For the security and business leaders at Tempur Sealy, one of the largest mattress and bedding manufacturers in the world, not so much.
On July 23, 2023, the CEO of Tempur Sealy reported that a cyberattack had shuttered the company’s business operations after ALPHV infiltrated the company’s IT environment. The news about Tempur Sealy follows on the heels of the cyberattack targeting Estée Lauder Companies, the second-largest cosmetics company globally.
In both cases, the ALPHV ransomware group claimed responsibility in a post on a Dark Web message forum and even shared a sampling of sensitive documents they exfiltrated, such as customers’ banking information, shipping addresses, order details, and even coupon usage. In the case of Tempur Sealy, the reason behind sharing the sample documents was a brazen move to force the company to publicly disclose the cyberattack.
Of course, the impact on Tempur Sealy was undoubtedly significant:
The ALPHV/BlackCat ransomware is developed and operated as a ransomware-as-a-service (RaaS) by a group known as Alpha Spider. Additionally, based on further research from our Threat Response Unit (TRU), the top targeted sectors observed have been legal, business services, software, finance, healthcare, and manufacturing.
In many cases, ALPHV uses triple extortion to force its targets to do its bidding and pay the ransom; if the victims don’t take action, the group threatens to leak the exfiltrated data to the public and even disrupt operations further by conducting Distributed Denial of Service (DDoS) attacks.
The Canadian Centre for Cyber Security also issued an Alert with details on the tactics, techniques, and procedures (TTPs) used by ALPHV to deploy ransomware:
While it’s unclear exactly how ALPHV managed to gain initial access into Tempur Sealy’s internal environment, it’s likely that some form of social engineering was at play here, underscoring the importance of regularly conducting managed phishing and security awareness training with your employees – even your executive leadership team.
A more important factor to consider is what kind of endpoint protection platform you have set in place, especially if your organization still uses an on-premises or hybrid environment for data storage. What’s more, you need an endpoint detection and response (EDR) solution that can protect your assets no matter where your users or data reside – in the cloud, mobile, virtual, or physical environments.
This also means you need to pay closer attention to your EDR solution provider and evaluate the tools and technologies they’re using to protect your assets. In their Dark Web forum message, ALPHV went so far as to single out Tempur Sealy’s incident response and MDR provider, Arctic Wolf, and even singled out that Arctic Wolf’s endpoint agent is a “rebranded OSSEC” (i.e., an open-source host-based intrusion detection system).
Unfortunately, OSSEC itself comes with its own set of challenges:
Notes from eSentire’s Threat Response Unit (TRU):
- Our 24/7 SOC Cyber Analysts, in addition to TRU, have implemented detections for the ALPHV/BlackCat ransomware. More importantly, we also have capabilities to detect and contain some of the more common attack vectors and precursor malware associated with this threat actor group.
- TRU has observed and stopped 100+ attacks across our global customer base involving malware that is a precursor to ALPHV/BlackCat ransomware; about 35% of these have been in 2023.
Preventing the various attack technique and tactics utilized by the modern threat actor requires actively monitoring the threat landscape, developing, and deploying endpoint detections, and the ability to investigate logs & network data during active intrusions.
We recommend implementing the following controls to help secure your organization against BlackCat ransomware attacks:
There is no guarantee that your organization will never be targeted by a ransomware attack. This is why it’s important to have the right security provider by your side – one with a team of 24/7 SOC Cyber Analysts and Elite Threat Hunters – who can help you anticipate, withstand, and recover from the toughest cyberattacks.
To learn how eSentire MDR can help you build a more resilient security operation, connect with an eSentire cybersecurity specialist.
eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.