#Incident Response
All CosmicBytez Labs articles tagged #Incident Response, across news, security advisories, how-to guides, and projects.
- News
When Your Ransomware Negotiator Works for the Other Side
Dark Reading's analysis of negotiator Edward Dubrovsky's arrest warns crisis urgency lets compromised IR vendors bypass normal vetting controls.
- News
Prominent Ransomware Negotiator Faces Extortion Charges
Edward Dubrovsky, 54, a prominent Cypfer-linked ransomware negotiator, was arrested in Pennsylvania and charged with conspiracy to extort money.
- News
Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe
Canadian cybersecurity executive Edward Dubrovsky, 54, was arrested in Pennsylvania on extortion charges amid the FBI's ShinyHunters breach probe.
- News
Retail Giant Ahold Delhaize Takes Systems Offline After Cyberattack
Ahold Delhaize took systems offline across Albert Heijn, Delhaize, Stop & Shop and Food Lion after a cyberattack disrupted online orders and payroll access.
- News
Ransomware Recovery CEO Charged Over Secret Ransom Payments
MonsterCloud's owner allegedly paid hackers for decryption keys, then billed victims up to 18x more while claiming proprietary recovery tech.
- HOWTO
Deploying Canarytokens for Early Breach Detection
Plant free honeytokens across file shares, AWS, email, and Active Directory so an intruder trips an alert the moment they touch something they shouldn't.
- News
Attackers Exploited Citrix NetScaler Zero-Day for Weeks Before Detection
Mandiant says a Citrix NetScaler zero-day was exploited for three-plus weeks before detection, hitting dozens of orgs; state-sponsored actors suspected.
- News
Kiteworks & Citrix Incidents Show Challenges of Zero-Day Response
Kiteworks forced a nine-hour global shutdown over threat intel; Citrix stayed silent on two actively exploited NetScaler zero-days before patching them.
- News
Kiteworks & Citrix Incidents Expose the Hard Tradeoffs of Zero-Day Disclosure
A DarkReading analysis contrasts Kiteworks' proactive shutdown advisory with Citrix's quiet pre-patch silence during active NetScaler exploitation.
- News
Mandiant: Suspected State Hackers Exploited NetScaler Zero-Day for Three-Plus Weeks Undetected
Mandiant traced NetScaler zero-day exploitation to Sept. 3, weeks before detection, hitting dozens of orgs tied to suspected state actors.
- News
Automated AI Agent Used to Breach Cybersecurity Nonprofit DIVD
DIVD says an autonomous AI agent ran post-exploitation activity after attackers exploited a flaw, calling the intrusion 'loud and very, very messy.'
- News
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Bitget says a zero-day in a third-party security product gave attackers internal credentials used to forge withdrawal commands and steal $388 million.
- News
Citrix Patches Actively Exploited NetScaler Zero-Days After a Weekend of Unofficial Warnings
Citrix stayed publicly silent for days while CERTs, insurers, and researchers warned of active NetScaler exploitation ahead of its own advisory.
- News
The SOC Doesn't Need to Start Over With Every Alert: AI Is Cutting Attacker Retry Time to Minutes
AI now resolves failed attack attempts in minutes instead of hours, and Conifers.ai argues SOCs need shared operational memory to keep pace.
- HOWTO
Packet Analysis with Wireshark and tshark: A Practical Guide
Capture, filter, and triage network traffic like an analyst. Learn Wireshark display filters, tshark for headless captures, and how to spot common attack...
- News
Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds
Sysdig traced a human attacker from Marimo RCE to SSH bastion access in 8 seconds: no AI, just hand-built tradecraft.
- News
CISA Calls for More Guidance, Less Spin, as Cyber Outages Escalate
CISA, FBI, and Five Eyes partners publish joint crisis-comms guidance urging providers to drop PR spin and disclose outage root causes transparently.
- News
Ransomware Protection for MSPs: A 6-Point Checklist for Faster Recovery
Acronis lays out a 6-point ransomware resilience framework for MSPs, from reducing exposure to clean, cross-tenant recovery.
- News
ATF Breach Hit System Holding Investigation-Target Data, Officials Say
ATF says the Qilin-linked breach hit a standalone system holding data on investigation targets, not gun-owner records, amid a 'major incident' probe.
- News
ATF Confirms 'Major Incident' After Qilin Ransomware Gang Claims Breach
The ATF is investigating a cybersecurity incident on a standalone system after Qilin ransomware listed the agency as a victim on its leak site.
- News
ReliaQuest Confirms Failed Data-Theft Attack After ShinyHunters Employee Impersonation
ReliaQuest disclosed a social engineering attack where ShinyHunters impersonated an employee to steal data — the attempt was detected and blocked.
- News
Ransom Busters: Ransomware Affiliate Poses as Data Recovery Firm
A ransomware affiliate operating as 'Ransom Busters' contacts breach victims posing as a recovery service, then double-extorts them for $20K–$60K.
- HOWTO
Writing and Deploying YARA Rules for Malware Detection
Learn to write effective YARA rules to identify malware, hunt threats, and scan endpoints for indicators of compromise — from basic syntax to real-world...
- News
Akira Hackers Disable EDR with Safe Mode, Steal Data but Fail to Encrypt
An Akira affiliate rebooted a compromised system into Safe Mode to blind EDR tools, exfiltrated data via s5cmd, then failed to encrypt due to memory errors.
- News
Wesco Confirms Security Incident After ExfilSquad Claims 2.6M Record Theft
Fortune 500 distributor Wesco confirmed a breach of its cloud CRM after ExfilSquad published 2.6M allegedly stolen records when ransom talks failed.
- News
Coast Guard Says It Is Monitoring Cyberattack That Disrupted North Carolina's Ports
A cyberattack on August 4, 2026 forced all three North Carolina Ports Authority facilities — Wilmington, Morehead City, and Charlotte Inland Port — to...
- News
River Bank Says Hackers Deleted Data Stolen in Ransomware Attack
River Bank & Trust in Alabama says it obtained representations from the ransomware group that attacked it in June 2026 that the stolen data has been...
- News
Analog Devices Discloses Data Breach, Says Operations Unaffected
American semiconductor giant Analog Devices has disclosed that an unauthorized party accessed some of its systems and exfiltrated certain files, though...
- News
ShinyHunters Claims Brinks Home Breach, Threatens to Leak Stolen Data
Notorious threat actor ShinyHunters claims to have breached residential security company Brinks Home, threatening to publicly release sensitive customer...
- News
Microsoft Blames Massive Microsoft 365 Outage on Automated Maintenance Bug
Microsoft has revealed that a bug in its automated network maintenance request system caused Thursday's major global outage by mistakenly removing IP...
- Project
TheHive: Self-Hosted Incident Response Case Management
Build a production-grade security incident response platform using TheHive 5, Cassandra, Elasticsearch, and MinIO — then integrate it with Wazuh alerts...
- News
New Spirals Ransomware Encrypts Victim Network in Under 24 Hours
A newly identified ransomware group called Spirals has demonstrated alarming operational speed, completing the full attack lifecycle — initial access,...
- News
Latvian State Forests Still Restoring Systems Weeks After Ransomware Attack
Latvia's state-owned forest management company LVM remains in recovery mode weeks after a ransomware attack that went undetected for nearly two weeks,...
- News
Accenture Confirms Data Breach After Hacker Claims Source Code Theft
Professional services giant Accenture confirms it contained a security incident after a threat actor claimed to have stolen source code from the company,...
- News
New Prinz Eugen Ransomware Prioritizes Recent Files for Encryption
A new Go-based ransomware operation named Prinz Eugen targets recently modified files first, uses ChaCha20-Poly1305 encryption, and communicates with...
- Project
Building a SOAR Platform with Shuffle in Your Homelab
Deploy Shuffle, the open-source SOAR platform, to automate security workflows and orchestrate your homelab tools — from Wazuh alerts to enrichment lookups...
- News
Bug Bounty Research Triggers ServiceNow Security Alert
Authorized bug bounty research on ServiceNow inadvertently triggered security alerts that led organizations to believe they were actively being breached....
- Project
Building a Wazuh XDR + SIEM Homelab
Deploy a full Wazuh stack in Docker to gain host-based intrusion detection, file integrity monitoring, vulnerability scanning, and active response across your…
- News
Dashlane Brute-Force Attack Leads to Limited Encrypted Vault Downloads
Dashlane's security systems automatically locked affected accounts to protect users after a brute-force attack resulted in a limited number of encrypted vault…
- HOWTO
Anatomy of a Ransomware Attack on a Canadian Ag Operation
A composite case study of a typical 2026 ransomware incident hitting a Canadian agricultural business — from the first phishing email through full encryption…
- HOWTO
Velociraptor DFIR Setup, Hunts, and Forensic Collection
Deploy Velociraptor for endpoint visibility, run fleet-wide hunts, collect forensic artifacts, and accelerate incident response with VQL queries.
- News
Cisco Releases Open Source Tool for AI Model Provenance
Cisco has released a new open source toolkit designed to track and verify the provenance of AI models throughout the supply chain, addressing risks from...
- News
Feuding Ransomware Groups Leak Each Other's Data
When rival ransomware groups 0APT and KryBit turned on each other, they exposed infrastructure details, operational data, victim lists, and internal...
- News
American Utility Firm Itron Discloses Breach of Internal IT
Itron, Inc. has disclosed a cybersecurity incident via SEC Form 8-K in which an unauthorized third party accessed certain internal systems at the utility...
- News
The Backup Myth That Is Putting Businesses at Risk
Backups protect your data, but they don't keep your business running during downtime. Understanding the difference between backup and BCDR is critical as...
- Project
Velociraptor DFIR: Endpoint Forensics and Incident Response
Deploy Velociraptor — the open-source DFIR platform — to collect forensic artifacts, run live endpoint hunts with VQL, and build an incident response...
- HOWTO
Network Traffic Analysis with Zeek: From Deployment to Threat Detection
Deploy Zeek (formerly Bro) on Linux to passively monitor network traffic, generate structured logs, write detection scripts, and forward data to your SIEM...
- News
Dutch Finance Ministry Takes Treasury Banking Portal
The Netherlands Ministry of Finance has taken its treasury banking portal offline after detecting a cyberattack that went undetected for roughly two...
- News
Stryker Cyberattack Wiped Tens of Thousands of Devices — No
A cyberattack on medical technology giant Stryker remotely wiped tens of thousands of employee devices using only legitimate Microsoft tools — no malware...
- HOWTO
How to Deploy Wazuh SIEM/XDR for Unified Security Monitoring
Step-by-step guide to deploying Wazuh as an open-source SIEM and XDR platform. Covers server installation, agent deployment across Windows and Linux,...
- HOWTO
How to Configure Microsoft Sentinel Analytics Rules
End-to-end SOC guide for Microsoft Sentinel: build KQL-based scheduled and NRT analytics rules, wire automation rules for incident triage, and deploy...
- HOWTO
SentinelOne Application Control Policies
Organizations face security risks from unauthorized applications, malware disguised as legitimate software, and shadow IT installations that bypass...
- HOWTO
SentinelOne Control vs Complete Feature Comparison
This document provides a comprehensive comparison between SentinelOne Singularity Control and Singularity Complete SKUs to help MSP teams understand the...
- HOWTO
SentinelOne Create and Manage Exclusion Policies
SentinelOne exclusion policies allow security teams to prevent false-positive detections and performance issues by excluding specific files, folders,...
- HOWTO
SentinelOne Data Retention and Storage Management
Organizations using SentinelOne Singularity Complete receive 14-365+ days of Deep Visibility EDR data retention by default. This historical telemetry...
- HOWTO
SentinelOne Deep Visibility Threat Hunting
Deep Visibility is SentinelOne's EDR telemetry engine that provides comprehensive endpoint data collection for threat hunting, incident investigation, and...
- HOWTO
SentinelOne File Fetch and Forensic File Collection
During threat investigations, security analysts need to retrieve suspicious files from endpoints for deeper forensic analysis. Traditional methods...
- HOWTO
SentinelOne Firewall Control Management
Traditional endpoint protection focuses on file-based malware, but network-based attacks (lateral movement, command-and-control callbacks, port scanning,...
- HOWTO
SentinelOne Forensics Rollback and Remediation
This document provides comprehensive procedures for forensic evidence collection, ransomware rollback, and threat remediation using SentinelOne Complete...
- HOWTO
Invoke SentinelOne Threat Hunt
Proactive threat hunting is essential for identifying sophisticated threats that evade automated detection systems. This script automates the process of...
- HOWTO
SentinelOne MSP Client Onboarding
This runbook provides a standardized process for onboarding new MSP clients to SentinelOne Singularity Complete. Following this methodology ensures...
- HOWTO
SentinelOne Policy Configuration Best Practices
This guide provides comprehensive best practices for configuring SentinelOne policies in MSP environments managing multiple client sites with Singularity...
- HOWTO
SentinelOne Purple AI Usage Guide
Security Operations Centers (SOCs) face overwhelming alert volumes, complex threat investigations, and resource constraints. Analysts spend hours writing...
- HOWTO
SentinelOne Ranger Network Discovery and IoT Visibility
Modern enterprise networks contain a complex mix of managed endpoints (workstations, servers), IoT devices (IP cameras, printers, smart building systems),...
- HOWTO
SentinelOne Remote Shell Operations
Full Remote Shell is a SentinelOne Complete feature that provides authorized administrators with secure, native command-line access to managed endpoints...
- HOWTO
SentinelOne Sandbox Integration Configuration
SentinelOne detects suspicious files but automated malware analysis requires sandbox integration. Manually uploading files to VirusTotal, Joe Sandbox, or...
- HOWTO
SentinelOne STAR Custom Detection Rules
Storyline Active Response (STAR) is SentinelOne's cloud-based automated hunting, detection, and response engine that allows security teams to create...
- HOWTO
SentinelOne Threat Investigation Workflow
When SentinelOne detects a threat on an endpoint, security analysts must quickly investigate the alert to determine if it's a genuine malware infection,...
- HOWTO
SentinelOne Timeline Forensics and Attack Chain Analysis
Understanding the complete attack chain requires correlating hundreds of events (process creation, network connections, file modifications, registry...
- Checklist
Incident Response Checklist
Step-by-step incident response checklist following NIST SP 800-61 framework. Covers preparation, detection, containment, eradication, recovery, and...
- Security
Iron Mountain Responds to Everest Ransomware Breach Claims
Information management giant Iron Mountain clarifies that alleged 1.4TB breach was limited to marketing materials after single credential compromise.
- HOWTO
Incident Response Playbook: Ransomware
Complete ransomware incident response playbook following NIST framework. Covers detection, containment, eradication, recovery, and lessons learned.
- HOWTO
Windows Security Event Log Analysis: Detect Threats with PowerShell
Learn to analyze Windows Security Event Logs to detect brute force attacks, lateral movement, privilege escalation, and other security threats using PowerShell.