Support Contact us

  • Categories

  • Book discovery call banner for MSSPs

  • Tags

    Antivirus ATT&CK Awards AZORult breach Business Partners CISO Collaboration Community Covid19 Credentials CVE Cyber Attacks cybercrime Cyber resilience Cyber Security Cyber Threats Darknet Markets Dark web Data Breach digital risk Financial & Banking Fraud Hacktivism incident response industry Insurance Malware MSSP Partners Ransomware Real-time research SOC startup Stealer Threat Actors Threat Analysis Threat Context Threat Detection Tools Threat Intel Feeds Threat Intel Guide Threat Intelligence Threat Intel Tools Vulnerability

    • Threat Intelligence

    By studying adversaries and understanding their strategies and objectives, organizations can build more effective, more refined and more robust cyberdefenses. This series demonstrates how threat intelligence can be used to help organizations of all sizes strengthen their security posture and accelerate security decision-making processes. With a smarter and more targeted response to cyberthreats, organizations can allocate security resource more efficiently, proactively getting ahead of future attacks and raising the barrier to entry for cybercriminals intent on breaking in.

    Our top reads

    Threat intelligence
    What is Threat Intelligence and why is it important?
    ServHelper-evolution-TA505-campaigns
    TA505 evolves ServHelper, uses Predator The Thief and Team Viewer Hijacking
    Credential theft: the business impact of stolen credentials
    research-blog
    CryptoAPI in Malware
    on May 12, 2021
    The most critical vulnerabilities right now
    We may not yet be at the halfway point of 2021 but, over the course of the past 4 and a half months, Blueliv has already observed over 4,900 critical CVEs spanning widely used products from global vendors such as Panasonic, Cisco, Microsoft, and of course SolarWinds. It is...

    on March 10, 2021
    Vulnerable Microsoft Exchange servers leave thousands of organizations compromised
    This week it was reported that tens of thousands of organizations around the world were compromised using several Microsoft Exchange 0-days. Since then attackers have been busy targeting the compromised organizations in what is now presumed to be a more devastating attack than 2020’s SolarWinds incident. In the days...

    on February 19, 2021
    State of Underground Card Shops in 2021
    (life after Joker’s Stash)   Table of Contents Introduction Active credit card shops FERum Shop Brian’s Club Thefreshstuffs Missing Credit Card Shops ValidCC VaultMarket Rescator Conclusions   Introduction    On February 15, 2021, after nearly 6.5 years in business, the prolific card shop Joker’s Stash closed its doors. Those behind...

    on February 9, 2021
    Combating COMB: 3.2 billion credentials leaked in breach compilation
    2021 has barely begun and we have already witnessed what appears to be the biggest compilation of breached credentials in our lifetime. The Compilation of Many Breaches (COMB) was recently made available via an online forum, as broken by CyberNews, and contains over 3.2 billion credentials built up of...

    on February 9, 2021
    Threat intelligence vs. future data breaches
    Data breaches are increasingly common as organizations across the globe continue to wake up to the reality that it’s a question of when, not if, they will fall victim. In a 2020 report on cyber security breaches, the UK government revealed that nearly half (46%) of businesses experienced a...

    on January 20, 2021
    Threat Context for the SolarWinds Incident
    The story so far In December 2020 the widely used business software application Orion, a product of the popular IT management company SolarWinds, was reported to have been tainted with nation-state malware that affected versions 2019.4 through to 2020.2.1 of the application released between March and June 2020. This...

    on December 7, 2020
    RDPalooza: RDPs in the World of Cybercrime
      Key Points  Remote Desktop Protocol (RDP) is a built-in part of the Windows toolkit popular for facilitating remote work. Cybercriminals take interest in compromising RDP endpoints as they provide direct access into a victim environment via a graphic interface.   Internet-facing RDP endpoints – colloquially known among cybercriminals...

    on November 19, 2020
    Why SIEMs need threat intelligence to defeat Cyberthreats
    Security professionals the world over crave compliance management and the ability to pull deep insights from their complex IT environments. This need was the catalyst for the initial adoption of security information and event management (SIEM), which, since its inception over a decade ago, has provided this and more,...

    on November 5, 2020
    Threat intelligence vs. the rise in sophisticated ransomware
    Ransomware, alongside COVID-19, has dominated the years’ headlines, positioning it as the most observed threat of 2020. Recorded ransomware attacks have multiplied dramatically since the beginning of 2020, accounting for a third of all recorded attacks in the past 12 months. Microsoft’s latest Digital Defense Report has taken a...

    on October 15, 2020
    How far does endpoint detection and response (EDR) take you to complete threat intelligence?
    Lots of new cyber vendors are starting up all the time. Crunchbase’s list of top cybersecurity startups  is 1,089 businesses long. What you find is that everyone is specialized in their own particular segment; their own slice of technology to remedy a specific cybersecurity need. Which brings us to...

    on September 17, 2020
    Maximize SOAR investment returns with contextualized threat intelligence
    Automation creates efficiency. Reducing the need for humans to complete repetitive tasks has been fundamental to the evolution of technology since the very beginning and remains a key part of current thinking around optimal cybersecurity operations. Likewise orchestration, another fundamental tenet of using software to drive business value. Orchestration...

    on September 10, 2020
    How incident response teams and orchestration SOCs benefit from threat intelligence
    The work of a security analyst is more frustrating than it should be when there is too much information and never enough time. Incident response (IR) teams can find themselves similarly hamstrung; primed to jump on and mitigate cyber emergencies but not always arriving fast enough or having the...

    on August 25, 2020
    Threat intelligence in a post Covid-19 world. Where do we go from here?
    Even before the start of 2020, industry watchers were predicting this would be a decade of digital disruption. Just 7 months in and another “D” has become prominent: “Dependency”. If the Covid pandemic has revealed anything then surely it is how the global economy, and society in general, relies...

    on July 16, 2020
    Enhancing the value of threat intelligence via a mature, flexible API
    The compelling business value of threat intelligence is best realised when it is used in the optimum way. And while there are many examples of repeatable good practice to adopt , by far the most advantageous approach is to apply threat intelligence to the precise needs of each organization. This...

    on July 16, 2020
    What are AI and machine learning adding to threat intelligence – brains, brawn or both?
    Too much information and not enough time. This, and the cost of labor, is why machines have been at the forefront of cyber defense for almost 50 years. It is also why new breakthroughs in software development, neural networks, machine learning and artificial intelligence (AI) are constantly harnessed by...

    on June 30, 2020
    M00nD3v, HawkEye threat actor, sells malware after COVID-19 diagnosis
    Key Points The information-stealing malware dubbed M00nD3v Logger was recently auctioned off on Hack Forums,  together with HakwEye Reborn.   The threat actor – operating under the alias “M00nD3v” – states that they sold the malware in response to being diagnosed with COVID-19.  M00nD3v was previously involved in sales...

    Blueliv's corporate image
    on June 12, 2020
    How to develop efficient and advanced triage and investigation capabilities
    To mature beyond the foundational elements of their security operations, SOC teams are pursuing more advanced means of triaging (i.e. grading and prioritizing) threats and launching rich, effective investigations. This is made possible by harnessing threat intelligence to fill-in a clearer picture of their threat landscape, respond to better effect...

    on May 27, 2020
    What is digital risk protection?
    Digital risk protection (DRP) is – in common with many other forms of security – the proactive defense of business assets against the threats they face. What sets DRP apart is its relevance to the growing digital maturity of organizations across all sectors. The further that organizations progress to...

    on May 26, 2020
    Why Threat Intelligence is Central to Effective Vulnerability Prioritization
    Vulnerability management is a persistent feature of good cybersecurity practice; a routine hygiene to help proactively reduce organizational risk. But vulnerability management is also a somewhat blunt instrument when faced with a critical mass of threats, each evolving at a different pace and each with unique implications for individual...

    Hacker silhouette
    on May 11, 2020
    Sounding the Pharma Alarma: An overview of the pharmaceutical threat landscape
    The whole world is fighting the spread of COVID-19 and working to return to the lives we had before. Pharmaceutical and medical research teams in different countries are busy searching for a solution to win the battle against the virus. However, cybercriminals and threats don’t rest, even in an...

    Deploying the right threat intelligence at the right level
    on January 24, 2020
    Deploying the right threat intelligence at the right level
    Threat intelligence has an influential role to play in organizations, but – like any technology-related solution – it must be applied in the right way to meet its full potential. This blog discusses how to maximize resources by deploying the right threat intelligence, at the right level, for your organization. There...

    research-blog
    on January 10, 2020
    TOP 5 ATT&CK techniques used by Threat Actors tied to Iran
    On the 3rd of January 2020, the Iranian Major General Qasem Soleimani was killed in a US drone strike ordered by President Donald Trump at Baghdad International Airport. Since then, popular demonstrations and military responses have been seen coming from Iran. It’s important to remember, however, that wars and...

    ServHelper-evolution-TA505-campaigns
    on December 17, 2019
    TA505 evolves ServHelper, uses Predator The Thief and Team Viewer Hijacking
    Countries targeted by TA505 using ServHelper    Introduction ServHelper is a backdoor first spotted at the end of 2018 by Proofpoint and linked to TA505. This threat actor is known to have distributed Dridex and Locky in the past, in addition to FlawedAmmyy, FlawedGrace and Get2/SDBBot more recently, amongst others.   This blog post will offer some analysis on developments relating to ServHelper, including detail...

    financial-services
    on December 5, 2019
    Top security concerns for the Financial Services industry in 2020
    Following on from the release of our whitepaper earlier this week, a survey has concluded that the Banking and Financial Services sector is struggling with a skills shortage along with the sheer volume of threats and alerts as it continues its ongoing battle against cybercrime. This is according to...

    cyberthreat-intelligence-financial-services-banking
    on December 4, 2019
    Follow the money: cyberthreat intelligence for Banking & Financial services
    Banks and financial services handle some of the most valuable information to cybercriminals, from account and credit card data to sensitive PII (personally identifiable information). As such, these organizations remain at the forefront for risk as cybercriminals become increasingly sophisticated and malicious in their methods. A new generation of...

    What does good resilience look like
    on November 18, 2019
    What does good resilience look like?
    Business leaders can learn a lot about cyberdefense by studying how a lioness protects her cubs. Like any mother, she puts up the stiffest defenses against all known forms of attack. But she will also take care to instill resilience in her offspring in case, inevitably, those defenses at...

    research-blog
    on November 6, 2019
    Spanish consultancy Everis suffers BitPaymer ransomware attack: a brief analysis
    On 4th November 2019 researchers and the media reported a massive ransomware attack against several Spanish companies. Some of this news was exaggerated as it transpired that just two companies confirmed a security incident. However, both companies were attacked by a different threat actor.  This blog post will seek to clarify some details concerning the attack against Everis, which was different to...

    Roast the perfect blend of automation and human intelligence
    on November 4, 2019
    Roast the perfect blend of automation and human intelligence
    For those who enjoy a good cup of coffee, many more would surely choose a barista-made brew than take their chances from a vending machine. Automation, so the argument goes, is not a panacea. This coffee analogy is often brought out in debates about the emergence of security automation...

    threat intel industry
    on September 18, 2019
    State of the market: Threat Intel in 2019
    Lifting the veil The threat intelligence market is growing rapidly but there is still some haziness in organizations’ understanding of the segment. Many consider threat intelligence the answer to thwarting the increasingly complex and devastating cyberattacks that plague organizations and individuals, but few understand exactly what it means beyond...

    Cyberthreat intelligence retail
    on September 12, 2019
    The cost of doing business: cyberthreat intelligence for retail & e-commerce
    The internet has changed the way that goods and services are bought and sold. The retail and e-commerce sector continues to undergo rapid transformation as consumer expectation increases. We demand high quality experiences, products and services, on desktop and on mobile. On the back end, analytic engines, third-party integrations...

    on June 26, 2019
    EuskalHack
    Last week, Blueliv was invited to participate in the fourth edition of EuskalHack in San Sebastián. Geared towards sharing information, the event hosted presentations focused on new discoveries, personal projects and tools from different disciplines in cybersecurity. These included both red team and blue team activities, both sharing information...

    on May 28, 2019
    Data breach under GDPR: one year later
    The European Union General Data Protection Regulation (GDPR) came into force on 25th May 2018. Just over a year later, European data protection regulators have reported nearly 90,000 data breach notifications so far, and notably these are only those which have been legally disclosed. Law firm DLA Piper recently suggested...

    on May 21, 2019
    Shining a light on the darknet
    A common visualization for the Internet is an iceberg. The indexed ‘surface’ web is less than 10% of what is visible, but 90% is non-indexed and known as the deep web. A small subset of the deep web includes hidden information and services: the dark web, or darknet. It’s...

    on May 3, 2019
    Threat Actor activity: a quick recap
    In our recent Threat Landscape Report we profiled several active threat actors which have made an impact over the past year. All of the threat actors in this article remain under close observation. Sharing this intelligence is part of our ongoing mission to collaborate with industry peers, enrich the...

    on February 14, 2019
    Threat intelligence for healthcare: how to get the most out of your investment
    Healthcare C-suite leaders are facing challenging times. This is the most breached sector globally, accounting for 24% of all cases investigated by Verizon. Valuable patient data, mission critical but exposed digital endpoints and strict compliance requirements all add to the cybersecurity challenge. This is where threat intelligence (TI) can...

    on January 31, 2019
    Real-time threat detection and why timing is the key to threat intelligence
    You wouldn’t sit idle under siege. However, when it comes to confronting real-time cyberthreats, it is what some businesses are doing – oftentimes without even realizing it. Organizations are increasingly finding themselves targets of cybercrime, carried out by hacktivists, nation states, or financially motivated criminals. In fact, on average...

    financial sector
    on January 11, 2019
    Effective threat intelligence for the financial sector
    Financial sector CISOs and security teams face a tough challenge. They need to keep the organization  safe from the huge volume of indiscriminate threats that are unfortunately the price of doing business on the internet today. But they must also ensure they’re as resilient as possible to targeted, sophisticated...

    on November 30, 2018
    Why threat intelligence helps CISOs make better security decisions
    In just a few short years, the discipline of threat intelligence (TI) has grown from something on the cutting edge of cybersecurity, to a must-have feature for any CISO serious about effectively managing online risk. Allowing organizations to finally move from a reactive to a proactive posture, it can...

    on November 30, 2018
    Top 10 Criteria for Buying the Best Threat Intelligence Solutions
    CISOs are busy people. The chances are you’re balancing a variety of tasks: from communication with the board, to managing incident response, organization-wide training strategies, and a growing regulatory compliance burden driven by the GDPR and EU NIS Directive. This leaves little time to spend on due diligence to...

    on November 30, 2018
    What does threat mitigation mean in practice?
    Cyber threats have reached epidemic proportions. In the UK for example, nearly half (43%) of all businesses polled by the government in 2018 said they’d suffered a security breach or attack in the previous 12 months — and the real figure could be much higher. One vendor said it...

    on November 30, 2018
    Threat intelligence tools your cybersecurity team needs
    Threat intelligence (TI) is a vital capability for any IT security department. If used effectively, it can offer CISOs the ability to take security from a reactive to a proactive posture, enabling them to better manage cyber risk and support the business-wide digital transformation agenda. But the major caveat...

    on November 30, 2018
    How to choose the right Threat Intelligence for your organization
    Today’s CISOs face an unprecedented range of pressures. They are tasked with creating the secure foundation on which the success of boardroom-led digital transformation efforts rest. They must manage a growing volume and variety of risks across networks, applications, clouds, endpoints, servers and supply chains. And they must do...

    Threat intelligence
    on November 2, 2018
    What is Threat Intelligence and why is it important?
    Index Introduction What threat intelligence isn’t ‘Data’ ‘Information’ What threat intelligence is? Gathering Processing and actionable delivery Integration, visualization and dissemination Categories of threat intelligence Tactical Operational Strategic When to use threat intelligence Before an attack During an attack After an attack The benefits of real-time, dynamic threat intelligence...

    Demo Free Trial MSSP
    Program