Incident Response

Threat Advisory: Additional Information Regarding COVID-19 Related Cyber Attacks

Threat Advisory: Additional Information Regarding COVID-19 Related Cyber Attacks

Overview  Malware-based phishing campaigns have been on the rise since early March. The campaigns appear to be from a trusted source, such as healthcare organizations, educational institutions, government agencies, or other official sources. The associated emails often contain a link that promises key information, relevant data, or tracking information regarding the Coronavirus. A number of these emails appear to originate... Read More
March 19, 2020
Threat Advisory: Mitigating Cyber Attacks Using Coronavirus Pandemic

Threat Advisory: Mitigating Cyber Attacks Using Coronavirus Pandemic

Overview  Recently, there has been a significant increase in cyber attacks that take advantage of the global COVID-19 (Coronavirus) pandemic. Threat actors are leveraging additional information on COVID-19 to spread malware infections through phishing emails. These emails, particularly the subject lines, are designed to contain valuable information about the current status of the outbreak to lure victims into opening attachments... Read More
March 12, 2020
Why Maintaining Data Integrity is Critical in Incident Response

Why Maintaining Data Integrity is Critical in Incident Response

The National Cybersecurity Center of Excellence has released a draft version of the NIST Cybersecurity Practice Guide SP 1800-26, Detecting and Responding to Ransomware and Other Destructive Events. The proposed guide is intended to act as a best practice document to support organizations detecting and responding to data integrity events which can put an organization’s security infrastructure at risk, causing... Read More
February 11, 2020
Threat Advisory: Vulnerabilities Found in Cisco Discovery Protocol

Threat Advisory: Vulnerabilities Found in Cisco Discovery Protocol

Multiple vulnerabilities in the Cisco Discovery Protocol implementation of Cisco products were recently discovered by the Cisco Product Security Incident Response Team. These vulnerabilities are collectively known as "CDPwn".  According to Cisco, the Cisco Discovery Protocol "facilitates the management of Cisco devices by discovering these devices, determining how they are configured, and allowing systems using different network-layer protocols to learn... Read More
February 6, 2020
Threat Advisory: HG Updates on Citrix vulnerability – CVE-2019-19781

Threat Advisory: HG Updates on Citrix vulnerability – CVE-2019-19781

Over the past month, Herjavec Group has been supporting clients impacted by the vulnerability (CVE-2019-19781) impacting multiple versions of Citrix Application Delivery Controller (ADC), Citrix Gateway, and Citrix SD-WAN WANOP.  CVE-2019-19781 is a directory traversal exploit that involves adversaries initiating a large scan upon discovery of a successful connection, then dropping files onto the infected system. This establishes a backdoor... Read More
January 24, 2020
Threat Advisory: Increased Emotet Malware Activity Detected

Threat Advisory: Increased Emotet Malware Activity Detected

The Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory on the increasing use of targeted Emotet malware attacks. Emotet is a Trojan used by threat actors to act as a downloader, or dropper, of other malware. The most common delivery method for Emotet is via the use of spam emails that have a malicious Microsoft Word or Excel... Read More
January 23, 2020
Threat Advisory Update: US National Terrorism Advisory System

Threat Advisory Update: US National Terrorism Advisory System

Herjavec Group is aware of elevated concern around Iranian state-sponsored cyber threat actors. We continue to remain vigilant and will report any suspicious activity across our Managed Security Services Enterprise Base. As always, we will work with our partners to share and notify you with any new threat information as it is made available. Our operations team will continue to... Read More
January 6, 2020
Protect IT: Keep Incident Response Top of Mind When Designing Your Backup and Data Log Recovery

Protect IT: Keep Incident Response Top of Mind When Designing Your Backup and Data Log Recovery

Cybersecurity Awareness Month (CSAM) is a global initiative created by the Department of Homeland Security 16 years ago to recognize the importance of digital security for consumers and organizations alike. Enterprises, employees, and end-users alike need to band together to #BeCyberSmart. Herjavec Group is proud to be a CSAM Champion! Contributed by Matt Anthony, VP of Incident Response, Herjavec Group... Read More
October 21, 2019
Herjavec Group Announces Partnership with Chronicle, Now Part of Google Cloud, to Bring Advanced Security Solutions to Market in Canada

Herjavec Group Announces Partnership with Chronicle, Now Part of Google Cloud, to Bring Advanced Security Solutions to Market in Canada

Herjavec Group adds Chronicle to vast security portfolio to advance managed security services, threat hunting and speed of incident investigation. Herjavec Group, the leader in global cybersecurity operations, specializing in Managed Security Services and Incident Response, is the first service provider across Canada to leverage and be certified in Chronicle’s security intelligence products: Backstory and VirusTotal. Herjavec Group is the... Read More
August 27, 2019
Threat Advisory: URGENT/11 Zero-Day Vulnerability

Threat Advisory: URGENT/11 Zero-Day Vulnerability

News of the URGENT/11 zero-day vulnerabilities has begun to emerge.  These vulnerabilities affect the VxWorks real-time operating system created by Wind River and may allow a remote attacker to gain full control over an impacted device.  The VxWorks operating system is used by over 2 billion Internet of Things (IoT) devices globally including printers, VOIP phones, firewalls, routers, medical equipment,... Read More
July 30, 2019