#Seguridad #Red #Datos #Ciberseguridad #Internet #Conexiones #Network #Redes #RedesDeDatos #SeguridadEnLaRedDeDatos #SeguridadGestionada #Sophos #SophosMDR
-
📌¿Qué es la seguridad en la red de datos?
-
🗓 14/12/2023

📰 En la era digital actual, donde la información fluye a través de vastas redes interconectadas, la seguridad en la red de datos se ha vuelto un pilar fundamental.
-
🔗 Fuente:👇🏻 👇🏻 https://www.muyseguridad.net/2023/12/14/seguridad-red-datos/

¿Qué es la seguridad en la red de datos?

En la era digital actual, donde la información fluye a través de vastas redes interconectadas, la seguridad en la red de datos se ha vuelto un pilar fundamental. Este concepto abarca un conjunto de medidas y prácticas diseñadas para proteger la integridad, confidencialidad y disponibilidad de la información que circula a través de sistemas informáticos. […]

MuySeguridad. Seguridad informática.

Upon receiving updated threat intelligence, #SophosMDR threat hunters immediately started searching across our customer base for any additional impacted users. The blog post includes SQL queries that Sophos #XDR customers can use (in their Sophos Central console) to identify any suspicious activity.

It's also possible for non-Sophos customers to convert these queries into a #Sigma rule.

One caveat: we observed that a common false positive process activity was the #PaperCut print archive function. But if you identify suspicious activity on a PaperCut server, it's valuable to isolate the machine while you continue to investigate.

We will continue to track these and other threat actors abusing this platform and will update our blog (https://news.sophos.com/en-us/2023/04/27/increased-exploitation-of-papercut-drawing-blood-around-the-internet/) (and the indicators of compromise published on Github at https://github.com/sophoslabs/IoCs/blob/master/papercut-nday-indicators-of-compromise.csv) as needed.

6/6

Increased exploitation of PaperCut drawing blood around the Internet

A recent remote code execution (RCE) vulnerability is increasingly in use to deliver Cobalt Strike and other remote management software, along with multiple ransomware threats – what you need to kn…

Sophos News

The #SophosMDR team also discovered cases where threat actors targeting #PaperCut were abusing the bitsadmin.exe Windows application to download payloads. #BITSAdmin is commonly abused by active adversaries as a "living off the land binary" or #LOLbin, handy for accomplishing the task of downloading payloads.

The tools exploited in the attacks have included what we refer to as “dual-use agents,” used both legitimately by IT staff and maliciously by attackers. At the time of writing, Sophos has observed the abuse of #AnyDesk, #Atera, #Synchro, #TightVNC, #NetSupport, and #DWAgent remote management tools across multiple campaigns.

4/6