O365/Cloud Service Breaches

With more and more infrastructure getting moved into the cloud, the CSIRT has seen a big increase in breaches related to cloud services. The cause of these breaches ranges from simple credential stuffing and phishing attacks, right through to far more advanced and targeted attacks. Orange Cyberdefense’s aim when dealing with any cloud service-based incident; work out the root cause of the attack, and advise our clients so the same attack is not possible in the future. Where possible the CSIRT will also try and improve any general security issues to help strengthen your overall cloud security posture.

Ransomware outbreaks

In the last 12 months, the CSIRT has seen two types of ransomware; the first is the more traditional. A non-targeted phishing link is clicked on by a user, that then (via numerous attack vectors) infects the user’s system with ransomware. Typically this attack method doesn’t use self-propagating strains and is easy to contain and eradicate. The second type is far more dangerous. The CSIRT has seen attackers gain a foothold on a network, then use a variety of network attack tools to get higher and higher network privileges. Once the attackers have a good hold on the network, they deploy and activate very well written ransomware. These attacks typically affect the majority of a client’s IT estate, including the deletion of backups. The experience of the CSIRT dictates that the later attacks are hard to recover from and can cost millions to get out of.