Threat Intelligence Research Lead for NETSCOUT's ASERT Research Team
Joined April 2013
- Tweets556
- Following541
- Followers1.2K
- Likes244
One self-signed TLS cert with "kickass" in it unraveled 633 proxy servers. That's CanOworms, the proxy-for-rent network @security_score STRIKE exposed. Here's what it means for third-party risk teams 🧵
That's why IP, geography and ASN reputation keep failing. One IP can host 10,000 domains, leased for as little as 3 hours. Blocklists go stale before they ship.
What to do: treat vendors, routers and IoT as entry points, assume supply chain exposure, and hunt past the listed IOCs. Full research: securityscorecard.com/blog/i… #ThreatIntel #TPRM
The question is no longer "Am I secure?" It's "Are all of my vendors secure?" Attackers exploit vendor ecosystems faster than assessment cycles can react. My take on why humans alone can't keep pace. 🎥 @security_score #TPRM securitysenses.com/videos/we…
The FBI says its jobs-site breach came from a platform managed by a third party, after a contractor missed a patch Oracle had already issued. Patch SLAs in vendor contracts mean nothing if nobody verifies them. #TPRM #ThreatIntel nextgov.com/cybersecurity/20…
Poisoned litellm 1.107.0 sat on PyPI for ~2 hours on Oct 21, built from a lookalike repo and stealing credentials. If your AI stack auto-pulls unpinned packages, that's a fourth party you never assessed. Pin, verify, rotate. #SupplyChain #AI docs.litellm.ai/blog/securit…
One stolen vendor app identity, 2,250+ Microsoft 365 tenants targeted at up to 2,900 sign-ins/min. MFA never came into play: the ConnectWise backup app already had the keys. Your vendor's OAuth grants are your attack surface. #TPRM #SupplyChain microsoft.com/en-us/security…
Your PHP2Shell exposure doesn't stop at your servers. Ask your hosting providers and MSPs today: Which PHP versions do you run? When do you patch? Which of our services share infrastructure with other customers? @security_score #TPRM securityscorecard.com/blog/s…
The retailer owns the food. A refrigeration contractor often installed the controller and holds the remote access. That's why the cold-chain attacks are a third-party inventory problem, not just a firewall finding. Our analysis w/ @ayampolskiy #TPRM securityscorecard.com/blog/h…
French reports say supermarket defrost settings were pushed to 50°C, at ~700 stores per France's Finance Minister. We used Driftnet to map 5,282 exposed Danfoss StoreView interfaces on 4,642 IPs. Exposure isn't compromise, but it's homework. #OT securityscorecard.com/blog/h…
#PHP2Shell by the numbers: Driftnet saw 7.67M IPs tagged PHP in 30 days. 2.7M advertised a version below the fix, but only 3,674 showed a fixed build. Patch the runtime, restart the workers, then verify. @security_score #ThreatIntel securityscorecard.com/blog/p…
Richard Hummel retweeted
Why every company needs a DDoS response plan - helpnetsecurity.com/2024/07/… - @NETSCOUT @MalwareAnalyzer #DDoS #Attacks #Strategy #Government #Cybercriminals #ThreatIntelligence #CyberSecurity #netsec #security #InfoSecurity #CISO #ITsecurity #CyberSecurityNews #SecurityNews
7M+ DDoS attacks were launched in the last 6 months of '23—and a number of them are politically motivated.
In this Global Data episode, three cybersecurity experts discuss concerns around the protection of voter data in the upcoming UK elections. spoti.fi/3LS6yhF
Venezuela's elections sparked protests after the president declared victory and the opposition disputed. ASERT identified a 10x increase in DDoS attacks on July 29, showing how political unrest can extend into the digital realm. netscout.link/6004YEVJ2 @NETSCOUT
After arresting 3 linked to NoName057(16), the group declared a "holy war" on Spain, rallying pro-Russian hackers. @NETSCOUT has seen a rise in attacks on Spanish websites, but daily DDoS attacks remain normal for Spanish network operators. netscout.link/6009cHbt1
Richard Hummel retweeted
ASERT's monitoring of #DDoS #hacktivism and geopolitical tensions uncovered a significant wave of attacks on #SouthKorea this week. These assaults are widespread, targeting various industries and involving numerous adversaries.
Richard Hummel retweeted
Curious about the trends in cyber threats? Join us for a 20-minute LinkedIn Live session on "Know Your Adversaries." We'll discuss the activities of NoName057(16), Anonymous Sudan, and Killnet, and how their actions are influencing the cybersecurity ecosystem. @MalwareAnalyzer
Richard Hummel retweeted
Join @MalwareAnalyzer from @NETSCOUT on Tech Talks Daily as he dives into the surge of #DDoS attacks and hacktivist groups in 2023. Learn how geopolitical tensions and advanced tactics like AI & cloud hosting are shaping the threat landscape. bit.ly/3x7kZKN
Richard Hummel retweeted
In this Tech Talks Daily Podcast episode, I sit down with Richard Hummel (@MalwareAnalyzer) from @NETSCOUT to delve into the ever-evolving DDoS threat landscape.
techblogwriter.co.uk/netscou…
