Between June 19-26, 2024, Blackpoint’s Security Operations Center (SOC) responded to 179 total incidents. These incidents included 18 on-premises MDR incidents, 7 Cloud Response for Google Workspace, and 154 Cloud Response for Microsoft 365 incidents, with confirmed or likely threat actor use of:
- Brute Ratel for persistence;
- Advanced IP Scanner for reconnaissance and discovery; and
- NetSupport RAT for persistence.
In this blog, we’ll dive into the details behind these select incidents, including why they’re important for partners to account for today – even if they’ve not been attacked yet! – as well as possible mitigations leveraging your current tech stack and Blackpoint Cyber.