Topic · 6 articles
Insider Threat
Credentialed access, stolen tokens, and the sessions that authenticate correctly.
Spans Threat Brief and RackTop Perspective.
Valid logins, an MFA bypass, and 678,000 records: the French tax breach
France’s tax administration disclosed that an attacker used a staff account and a contractor account, plus a multi-factor bypass, to consult and extract data on 678,000 people and businesses. Nothing was encrypted. Every query looked like work.
5 min read
Before the ransom note: what hackers learn from your files
Ransomware is the loudest threat to unstructured data, but it is not the first one. Hackers and APTs read your files long before they encrypt anything, and what they learn shapes the entire attack. Cyberstorage exists because protection has to start at the read, not the ransom note.
5 min read
INC ransomware is stealing the identity layer, not just the perimeter
A pair of SonicWall SMA 1000 vulnerabilities gives attackers root on the VPN appliance, and INC ransomware is using that access to read passwords off the wire, copy live session databases, and lift MFA seeds. When credentials are stolen rather than bypassed, every login that follows is authentic, and only file activity still shows the attack.
6 min read
Silent Ransom Group is stealing law firm files without ransomware
The FBI has warned twice about Silent Ransom Group, an extortion crew that talks its way into law firms by posing as IT support, then copies client files out with ordinary remote-access and file-transfer tools. Nothing gets encrypted. By the time the ransom note arrives, often within a half hour of the exfiltration, the only question left is what exactly they took.
7 min read
The breach that does not trip the alarm
Ransomware is loud. Data theft is quiet. A credentialed insider or a patient attacker can read sensitive files for months while every dashboard stays green, because nothing is watching the data itself. Data Centric Zero Trust and Cyberstorage exist to change that.
7 min read
One stolen token, 700,000 files: what the Novo Nordisk breach says about the data layer
An extortion group says it copied roughly 1.3 TB, more than 700,000 files, from Novo Nordisk after finding a single access token, then spent more than two months reading source code, research, and manufacturing data. No systems were locked. The leverage was the files themselves.
4 min read
See data-layer defense in your environment
In a 30-minute demo we’ll show Active Defense stopping an attack inline, immutable recovery, and surgical rollback — mapped to your data and your threats.