At Inception Security, our mission is to equip organizations with the knowledge and tools to combat advanced cyber threats. As experts in threat intelligence and incident response, we've conducted extensive research into numerous APT campaigns. This includes uncovering the NightEagle group—also tracked as APT-Q-95—for its precision and sophistication. Through our proprietary analysis and forensic investigations, we've determined that this North American-aligned APT has been l

Top Reasons Why Incident Response Table Top Exercises Are Important In today's digital world, cyber threats are becoming more sophisticated, frequent, and disruptive than ever before. As a result, organizations must take a proactive approach to manage cyber risks, and incident response (IR) tabletop exercises are a crucial part of that approach. In this blog post, we will explore why IR tabletop exercises are essential for businesses and organizations and how Inception Securi

Let's talk about remote assistance tools! As you would expect, a remote assistance tool is used to assist end-users from a remote location. These tools are great and are widely used by helpdesk and IT support staff to help users with various workstations issues. If allowed within the settings of the host computer, the remote user can also share control of the host computer, opening files, accessing information, and inputting data by mouse and keyboard. This is extremely helpf

We have recently observed threat actors evolving their procedures in light of Microsoft disabling macros by default in office documents. This new technique would allow threat actors to continue to bypass security controls to infect one or more hosts in an environment. In light of the latest Microsoft Office vulnerabilities, we will likely see broad adoption of macro-less infected documents that will lead to many organizations getting hacked. While Microsoft has shared mitigat

A user account is created in Active Directory for each user in your environment. Over time as users leave the organization, their accounts do not always get removed from Active Directory. As a result, many organizations have an excessive amount of stale user accounts in Active Directory. You can identify a stale account using the last time the password was changed or the user's last login timestamp. Stale user accounts in Active Directory pose a significant risk to the organi

What is Cyber Insurance? A cyber insurance policy is commonly called "cyber risk insurance" or "cyber liability insurance" coverage. It is a product that allows businesses to transfer the costs involved with cyber recovery from a cyber incident or similar event. Typically, the critical aspect of cyber insurance will be network security coverage. This coverage is leveraged in a network security failure, such as data breaches, malware, ransomware attacks, business accounts, an

What are Profile Lists? Windows keeps track of user-profiles and their locations in the registry. The profile location is stored under the key below: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList This registry key contains one subkey for each user profile on a Windows machine. Inside of each of these subkeys is a registry value called ProfileImagePath that holds that user's profile path. You can also see when each subkey was last written and other details abou

Business continuity and disaster recovery (BCDR or BC/DR) is a collection of processes and procedures that assist a company in recovering from a disaster and returning to normal business operations. It is a broad approach that encompasses both IT and commercial operations and tasks in the aftermath of a disaster. BCDR frequently integrates business operations and information technology to decrease catastrophic risks and support organizations in swiftly resuming normal operati

What is Windows Prefetch? Windows Prefetch creates files when a user opens an application on a Windows host. The Windows Operating system will make a prefetch record when an application is run from a specific area for the absolute time. Microsoft introduced prefetch with the Windows XP operating system. The idea behind the prefetch is that it would accelerate the boot process and start-up process. In older versions of Windows, prefetch files were limited to 128 files. With ne

Phishing attacks remain the number one technique used in cyberattacks. Some of the most common phishing attacks leveraged attachments to facilitate the initial infection chain. We disproportionally see Microsoft Office documents and PDF files used to embed the malicious code as far as the attachments themselves go. When we say Microsoft Office documents, we refer to files created by the Microsoft Office suite such as Microsoft Word, Excel, PowerPoint, etc. Historically we wou

As we look across the landscape, we see that cyberattacks continue to succeed in all business sectors. In the cases we have observed, the cyberattack leveraged weak security controls and, as a result, could have been prevented by organizations adopting security best practices. A new study shows that ransomware, phishing, social engineering, denial of service (DoS) attacks, and the business fallout of a data breach rank as the top concerns of global organizations. The recently

Considering today's attack surface's massive and hyper-dimensional nature, we begin to see how challenging it is to manage this attack surface in a modern enterprise. The risk surface of the enterprise is constantly expanding. Threats are finding their way into enterprises, constantly morphing and adapting to network defenses. It is thus a daunting task to bring the vast scope of an organization's enterprise attack surface into focus. Many security leaders lack awareness of a

Endpoint Detection & Response (EDR) A critical task for most organizations has become setting up advanced threat protection as cyberattacks have skyrocketed and become more sophisticated. Starting with a robust endpoint detection and response system is the first step in this process. Detecting and responding to endpoint threats, also known as EDR, is a cybersecurity process that gathers and analyses data collected by endpoints, usually workstations and servers. As a result, s

QBot, also known as Qakbot or pinkslipbot, is an information stealer that has been active since 2007. It is malware software that can monitor the browser's activities and lots of information on the victim's computer. It is also known as a banking trojan capable of stealing finance-related data from the infected device and loader by using c2 servers to target payload and downloads. Other important information that QBot can steal from a system are: Name of the account City Coun

Pandora ransomware came into the spotlight in March of 2022 after posting some high-profile victims on its leak site. The ransomware group announced its first victim on Feb 21st, 2022. Their biggest victim was Denso, a car parts manufacturer. After an attack on one of its offices in Germany, Denso confirmed that cybercriminals leaked stolen, classified information from the Japan-based car-components manufacturer. Pandora claims to have exfiltrated 1TB of data from Denso. So w

Producing and preserving copies of data to safeguard businesses against data loss is referred to as backup and recovery. The data from backups are usually restored to its previous location or to a different place where it will be used to substitute the lost or damaged data. Companies of all sizes need to protect themselves against ransomware, phishing scams, malware, and other cyberattacks. These attacks can often completely devastate your company in the blink of an eye. Howe

A Russian-based Conti Ransomware gang chat leak has started a new debate. The massive chat leak from inside has provided a clearer picture of cybercriminal motives to the cyber researchers. Furthermore, it has made it evident that the Russian Ukraine war has divided the criminals who work for ransomware. Some of the lessons that cyber researchers can learn are: Hacking computers for ransomware groups is a boring job One of the most prevalent comments about chat leaks is that

Ransomware is the type of suspicious software Cybercriminals use to encrypt your data, rendering it unusable. As a result, the attackers demand the ransom money to release the victim's data. Once the attack is successfully executed, the victim has to pay money to access their data, but paying to the attacker is not a good decision because once they produce, the attacker knows they can get money from the victim, so they attack again and again. If you don't pay, you'll lose mo

Incident response is a method for dealing with various forms of security events, cyber threats, and data breaches in an organized manner. The goal of the incident response approach is to identify, contain, eradicate, and reduce the cost of a cyberattack or live event. To be prepared for a future attack, a well-built incident response (IR) plan will be essential in limiting the potential business impacts of an incident. It is critical to address security breaches quickly and e

Strong passwords play an essential role in safeguarding your company's data and client information. Unfortunately, due to weak or non-existing password policies, many companies face a high risk of data breaches. Nowadays, cyber-attacks are common, and hackers use many techniques to crack passwords. Although a brute force attack is still old, it is still practical and common among hackers. Brute force attacks work on" trial-and-error" methods and guess the hidden content of we