Cyber Risk in the Technology Sector

Understand more about cyber risk in this sector.

Cyber Risk Graph

Explore how this sector relates to the wider risk graph

Threat Reports

Publicly available threat reporting on cyber attacks against Technology.

Report

Chinese State-Sponsored RedJuliett Intensifies Taiwanese Cyber Espionage via Network Perimeter Exploitation

This report by Recorded Future's Insikt Group details activity by RedJuliett between November 2023 and April 2024. RedJuliett, also known by ...

View Source

Report

APT41 Has Arisen From the DUST

This report from Mandiant outlines APT41 activity observed since 2023 including successful compromises of logistic, media, technology and ...

View Source

Report

Cloaked and Covert: Uncovering UNC3886 Espionage Operations

This article by researchers from Google's Mandiant outlines intrusion activity by UNC3886, a suspected China-nexus cyber espionage group. The ...

View Source

Report

APT45: North Korea’s Digital Military Machine

This report from threat intelligence analysts at Google's Mandiant marks the graduation of this cyber actor to a fully designated APT - APT45. The ...

View Source

Report

Flax Typhoon using legitimate software to quietly access Taiwanese organizations

This blog post by Microsoft Threat Intelligence outlines the Flax Typhoon intrusion set and TTPs demonstrated by the group. It describes the actor ...

View Source

Report

ANALYSIS OF THE APT31 INDICTMENT

Blog post providing analysis of a March 2024 US Department of Justice indictment of 7 hackers associated with APT31. The post details attribution ...

View Source

Report

GOLD IONIC DEPLOYS INC RANSOMWARE

This blog post from Secureworks describes the intrusion set they track as GOLD IONIC, also known as INC Ransom Group. The post outlines GOLD IONIC ...

View Source

Report

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

This blog post from researchers at Trend Micro discusses the cyberespionage group Earth Hundun and its malware, Waterbear and Deuterbear, which ...

View Source

Report

APT41 (Double Dragon): A Dual Espionage and Cyber Crime Operation

This 2022 report by researchers at FireEye threat intelligence outlines the intrusion set they designate as APT41. They describe the group as 'a ...

View Source

Report

Unveiling TeleBoyi: Chinese APT Group Targeting Critical Infrastructure Worldwide

This presentation from TeamT5 describes the intrusion set they refer to as TeleBoyi and was presented at JPCERT's JSAC2024 conference on January ...

View Source

Report

Alert: CVE-2024-3094, a serious backdoor in XZ Utils, permits RCE

This alert from Vulcan's Voyager18 team outlines a potential supply chain attack against the XZ Utils package for multiple Linux distributions. ...

View Source

Report

Earth Krahang Exploits Intergovernmental Trust to Launch Cross-Government Attacks

This article by researchers at Trend Micro discusses an Advanced Persistent Threat (APT) group they name Earth Krahang who have been observed ...

View Source

Report

Ongoing ITG05 operations leverage evolving malware arsenal in global campaigns

This Security Intelligence blog post by researchers at IBM's X-Force describes activity by ITG05 - a group which shows overlap with APT28/Forest ...

View Source

Report

People's Republic of China-Linked Cyber Actors Hide in Router Firmware

This Cybersecurity Advisory from CISA and partners details activities of the People's Republic of China (PRC)-linked cyber actors known as ...

View Source

Report

GhostSec’s joint ransomware operation and evolution of their arsenal

This Threat Spotlight from Cisco Talos describes the evolution of GhostSec's ransomware operations including their work with the Stormous ...

View Source

Report

StopRansomware: Rhysida Ransomware

This is a joint Cybersecurity Advisory by the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and ...

View Source

Report

APT37 (REAPER) - The Overlooked North Korean Actor

This special report by FireEye discusses an investigation into APT37, a suspected North Korean cyber espionage group. According to the report, ...

View Source

Report

Midnight Blizzard: Guidance for responders on nation-state attack

Following a compromise of Microsoft corporate systems by Midnight Blizzard which was detected on 12th January 2024, this blog post outlines ...

View Source

Report

APT1: Exposing One of China's Cyber Espionage Units

The APT1 report represents years of work by Mandiant, who analysed data across hundreds of breaches globally. The report identifies APT1 as a ...

View Source

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use against Technology.

Search:

ATT&CK ID	Title	Associated Tactics
T1505.003	Web Shell	Persistence
T1190	Exploit Public-Facing Application	Initial Access
T1584	Compromise Infrastructure	Resource Development
T1068	Exploitation for Privilege Escalation	Privilege Escalation
T1583.003	Virtual Private Server	Resource Development
T1595.002	Vulnerability Scanning	Reconnaissance
T1133	External Remote Services	Initial Access, Persistence
T1560.001	Archive via Utility	Collection
T1543.003	Windows Service	Persistence, Privilege Escalation
T1594	Search Victim-Owned Websites	Reconnaissance
T1567.002	Exfiltration to Cloud Storage	Exfiltration
T1574.001	DLL Search Order Hijacking	Defense Evasion, Persistence, Privilege Escalation
T1574.002	DLL Side-Loading	Defense Evasion, Persistence, Privilege Escalation
T1569.002	Service Execution	Execution
T1036.005	Match Legitimate Name or Location	Defense Evasion
T1071.001	Web Protocols	Command and Control
T1070.004	File Deletion	Defense Evasion
T1014	Rootkit	Defense Evasion
T1003	OS Credential Dumping	Credential Access
T1071	Application Layer Protocol	Command and Control
T1036	Masquerading	Defense Evasion
T1546	Event Triggered Execution	Persistence, Privilege Escalation
T1059	Command and Scripting Interpreter	Execution
T1550	Use Alternate Authentication Material	Defense Evasion, Lateral Movement
T1543	Create or Modify System Process	Persistence, Privilege Escalation
T1572	Protocol Tunneling	Command and Control
T1505	Server Software Component	Persistence
T1105	Ingress Tool Transfer	Command and Control
T1598.003	Spearphishing Link	Reconnaissance
T1070.006	Timestomp	Defense Evasion
T1005	Data from Local System	Collection
T1016.001	Internet Connection Discovery	Discovery
T1057	Process Discovery	Discovery
T1480	Execution Guardrails	Defense Evasion
T1622	Debugger Evasion	Defense Evasion, Discovery
T1547.012	Print Processors	Persistence, Privilege Escalation
T1083	File and Directory Discovery	Discovery
T1140	Deobfuscate/Decode Files or Information	Defense Evasion
T1132.002	Non-Standard Encoding	Command and Control
T1129	Shared Modules	Execution
T1049	System Network Connections Discovery	Discovery
T1027.001	Binary Padding	Defense Evasion
T1573	Encrypted Channel	Command and Control
T1082	System Information Discovery	Discovery
T1497.003	Time Based Evasion	Defense Evasion, Discovery
T1012	Query Registry	Discovery
T1041	Exfiltration Over C2 Channel	Exfiltration
T1106	Native API	Execution
T1595.003	Wordlist Scanning	Reconnaissance
T1020	Automated Exfiltration	Exfiltration

Showing 1 to 50 of 128 entries