DemoIntelligenceSources.md

Demo Intelligence Sources

Intelligence 1: Microsoft breached by Midnight Blizzard

• Source: https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/
• Source: https://msrc.microsoft.com/blog/2024/03/update-on-microsoft-actions-following-attack-by-nation-state-actor-midnight-blizzard/

Intelligence 2: Cloudflare breached by an unknown adversary using Okta credentials

• Source: https://blog.cloudflare.com/thanksgiving-2023-security-incident
• Source: https://blog.cloudflare.com/how-cloudflare-mitigated-yet-another-okta-compromise
• Source: https://sec.okta.com/harfiles

Intelligence 3: Boeing breached by LockBit using new Citrix vulnerability

• Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a
• Source: https://www.mandiant.com/resources/blog/session-hijacking-citrix-cve-2023-4966

Intelligence 3: BHI Energy breached by Akira

• Source: https://www.documentcloud.org/documents/24075435-bhi-notice
• Source: https://www.bleepingcomputer.com/news/security/us-energy-firm-shares-how-akira-ransomware-hacked-its-systems/
• Source: https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html

Intelligence 4: BlackCat affiliate attacking Canadian organizations

• Source: https://www.cyber.gc.ca/en/alerts-advisories/alphvblackcat-ransomware-targeting-canadian-industries
• Source: https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
• Source: https://blog.bushidotoken.net/2023/08/tracking-adversaries-scattered-spider.html

Intelligence 5: UNC4736, a North Korea-linked adversary, performs double software supply chain attack

• Source: https://www.3cx.com/blog/news/desktopapp-security-alert/
• Source: https://www.3cx.com/blog/news/mandiant-security-update2/
• Source: https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise

Intelligence 6: EquiLend faces ransomware attack

• Source: https://equilend.com/press-releases/equilend-cyber-security-incident/
• Source: https://equilend.com/press-releases/equilend-cyber-security-incident-frequently-asked-questions/
• Source: https://www.bankinfosecurity.com/equilend-continues-system-restoration-post-ransomware-attack-a-24267

Intelligence 7: OneNote malspam leads to Nokoyawa ransomware attack

• Source: https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/