Authlogics, a company that provides enterprise password security and multi-factor authentication technologies is incentivising organisations to take action against the worrying rise in breached passwords. The company is offering an unprecedented money-back guarantee for its new Authlogics Password Security Management 4.1.

The latest version of Authlogics Password Security Management 4.1 provides complete visibility of an organisation’s password breach status. A new dashboard displays graphs, alerts, and reports regarding the historic and current passwords breach status of each user in the organisation (up to every four hours). CEO of Authlogics, Steven Hope, states, “Within days of using the system you will see your organisation’s exposure to data breaches from compromised passwords falling and in turn strengthening the security of the organisation and its assets, as well as lowering exposure to regulatory risk and helpdesk costs.”

The scale of the breached password problem is highlighted in the 2022 ForgeRock Consumer Identity Breach Report, which suggests two billion data records containing usernames and passwords were compromised in 2021, representing a 35% increase from 2020. Meanwhile, last month IBM highlighted the rising cost of a data breach from an average of $3.86 million to $4.24 million.

Authlogics Password Security Management 4.1 is an end-to-end auditing, real-time protection, remediation, and reporting solution. It provides protection against breached and shared passwords, and mitigates common identity-based attacks such as phishing and keylogging, whilst removing the burden of password resetting from users and helpdesks. It is powered by the Authlogics Password Breach Database which contains records of more than 4.6 billion previously compromised credentials.

Hope adds: “I am rarely one to quote a politician, however, when the former UK government minister, Sajid Javid, said in his final speech to the House of Commons last month, ‘Not doing something is an active decision’ it really resonated.” Hope continues: “As technology vendors, we must look for new ways to remove the factors that inhibit organisations from taking the right course of action. In the case of security systems cost, or to be more precise, the ability to demonstrate a clear return on investment is often the reason for choosing not to act.”

The money-back-guarantee is offered to any organisation that deploys Authlogics Password Security Management 4.1. Hope concludes, “This unprecedented offer, combined with our scaled pricing makes the decision to do nothing hard to justify for any organisation of any size. It is our aim to make secure authentication accessible and affordable for all.”

CrowdStrike has introduced the industry’s first AI-powered Indicators of Attack (IoAs), new innovations for fileless attack prevention at scale and enhanced visibility for stealthy cloud intrusions. Delivered on the CrowdStrike Falcon platform and powered by the CrowdStrike Security Cloud, these new detection and response capabilities stop emerging attack techniques and enable organizations to optimize the threat detection and response lifecycle with speed, scale and accuracy.

More than a decade ago, CrowdStrike invented IoAs, which brought a fundamentally new approach to stopping breaches based on real adversary behaviour, irrespective of the malware or exploit used in an attack. CrowdStrike has also pushed the boundaries of applying AI in cybersecurity to identify and stop the most advanced, emerging attacks. Now, CrowdStrike is leveraging powerful AI techniques to create new IoAs at machine speed and scale.

“CrowdStrike leads the way in stopping the most sophisticated attacks with our industry-leading Indicators of Attack capability, which revolutionized how security teams prevent threats based on adversary behaviour, not easily changed indicators,” said Amol Kulkarni, chief product and engineering officer at CrowdStrike. “Now, we are changing the game again with the addition of AI-powered Indicators of Attack, which enable organizations to harness the power of the CrowdStrike Security Cloud to examine adversary behaviour at machine speed and scale to stop breaches in the most effective way possible.”

The Falcon platform’s new capabilities include:

Industry’s first AI-powered IoAs
Organizations today are under pressure to defend expanding attack surfaces against emerging threats and adversary tradecraft. With the Falcon platform, organizations can:

• Detect new classes of attacks, faster than ever: Find emerging attack techniques with new IoAs created by continuously learning AI models trained on real-world adversary behaviour and the world’s richest threat intelligence.
• Drive automated prevention with high-fidelity detections: Shutdown attacks based on a chain of behaviours, irrespective of the specific malware or tools used, with cloud-native AI models constantly delivered to the Falcon agent with newly-found IoAs.
• Activate IoAs at cloud scale, trained on human-led expertise: Synthesize insights with AI-powered IoAs from CrowdStrike’s world-renowned threat hunting team to minimize false positives, maximize analyst productivity and deploy threat hunting at scale.

Of note, AI-powered IoAs have identified over 20 never-before-seen adversary patterns, which have been validated by experts and enforced on the Falcon platform for automated detection and prevention.

New innovations for fileless attack prevention at scale
According to the 2022 CrowdStrike Global Threat Report, 62% of all attacks are malware-free. These fileless attacks can be carried out entirely in memory, creating a blindspot for threat actors to exploit. With the Falcon platform, organizations can:

• Prevent the most advanced fileless attacks: Stop advanced persistent threats (APT) and prevalent tools, like Cobalt Strike, with advanced memory scanning techniques that augment best-of-breed AI/ML and IoA detections with lightning-fast scanning of all memory at an unprecedented scale.
• Leave bloated memory scanning behind: Shed the heavy resource constraints of legacy approaches that made memory scanning a non-starter with high-performance memory scanning techniques, optimized for Intel CPU/GPUs.
• Initiate memory scans on behaviour, not a fixed schedule: Automate scans with behaviour-based triggers to find and stop fileless attack patterns in real-time, not after a potential breach.

Enhanced visibility for stealthy cloud intrusions
As Linux environments, data and applications have moved to the cloud, adversaries have also moved to the cloud to open backdoors, steal sensitive data and conceal their movement. With the Falcon platform, organizations can:

• Hunt stealthy rootkits and reduce dwell time: Identify malicious activity early in the kill chain with deep Linux kernel visibility to fuel threat hunting and investigation of hidden, emerging Linux attacks.
• Bolster managed cloud threat hunting: Disrupt the most sophisticated threats in cloud environments with new kernel telemetry events for Falcon OverWatch experts, building on CrowdStrike’s recently announced Fallon OverWatch Cloud Threat Hunting service.

“Using CrowdStrike sets Cundall apart as one of the more advanced organizations in an industry that typically lags behind other sectors in IT and cybersecurity adoption,” said Lou Lwin, CIO at Cundall. “Today, attacks are becoming more sophisticated and if they are machine-based attacks, there is no way an operator can keep up. The threat landscape is ever-changing. So, you need machine-based defences and a partner that understands security is not ‘one and done.’ It is evolving all the time.”

According to Forrester, “No security tool can detect every attack. Cybersecurity pits adversaries against defenders. Defensive technologies rely on rules, heuristics, and outliers to find evil. Those technologies lack one essential component that threat hunting introduces: the creativity of the practitioners defending enterprise environments.”

These capabilities are generally available for Falcon Prevent (NGAV) and Falcon Insight (EDR) customers.

Sophos, a global leader in next-generation cybersecurity, today announced in the Sophos X-Ops Active Adversary whitepaper, “Multiple Attackers: A Clear and Present Danger,” that Hive, LockBit and BlackCat, three prominent ransomware gangs, consecutively attacked the same network. The first two attacks took place within two hours, and the third attack took place two weeks later. Each ransomware gang left its own ransom demand, and some of the files were triple encrypted.

“It’s bad enough to get one ransomware note, let alone three,” said John Shier, senior security advisor at Sophos. “Multiple attackers create a whole new level of complexity for recovery, particularly when network files are triple encrypted. Cybersecurity that includes prevention, detection and response are critical for organizations of any size and type—no business is immune.”

The whitepaper further outlines additional cases of overlapping cyberattacks, including cryptominers, remote access trojans (RATs) and bots. In the past, when multiple attackers targeted the same system, the attacks usually occurred across many months or multiple years. The attacks described in Sophos’ whitepaper took place within days or weeks of each other—and, in one case, simultaneously—often with the different attackers accessing a target’s network through the same vulnerable entry point.

Typically, criminal groups compete for resources, making it more difficult for multiple attackers to operate simultaneously. Cryptominers normally kill their competitors on the same system, and today’s RATs often highlight bot killing as a feature on criminal forums. However, in the attack involving the three ransomware groups, for example, BlackCat—the last ransomware group on the system—not only deleted traces of its own activity but also deleted the activity of LockBit and Hive. In another case, a system was infected by LockBit ransomware. Then, about three months later, members of the Karakurt Team, a group with reported ties to Conti, were able to leverage the backdoor LockBit created to steal data and hold it for ransom.

“On the whole, ransomware groups don’t appear openly antagonistic towards one another. In fact, LockBit explicitly doesn’t forbid affiliates from working with competitors, as indicated in Sophos’ whitepaper,” said Shier. “We don’t have evidence of collaboration, but it’s possible this is due to attackers recognizing that there are a finite number of ‘resources’ in an increasingly competitive market. Or, perhaps they believe the more pressure placed on a target—i.e. multiple attacks—the more likely the victims are to pay. Perhaps they’re having discussions at a high level, agreeing to mutually beneficial agreements, for example, where one group encrypts the data and the other exfiltrates. At some point, these groups will have to decide how they feel about cooperation—whether to further embrace it or become more competitive—but, for now, the playing field is open for multiple attacks by different groups.”

Most of the initial infections for the attacks highlighted in the whitepaper occurred through either an unpatched vulnerability, with some of the most notable being Log4Shell, ProxyLogon, and ProxyShell, or poorly configured unsecured Remote Desktop Protocol (RDP) servers. In most cases involving multiple attackers, the victims failed to remediate the initial attack effectively, leaving the door open for future cybercriminal activity. In those instances, the same RDP misconfigurations, as well as applications like RDWeb or AnyDesk, became an easily exploitable pathway for follow-up attacks. In fact, exposed RDP and VPN servers are some of the most popular listings sold on the dark web.

“As noted in the latest Active Adversary Playbook, in 2021 Sophos began seeing organizations falling victim to multiple attacks simultaneously and indicated that this may be a growing trend,” said Shier. “While the rise in multiple attackers is still based on anecdotal evidence, the availability of exploitable systems gives cybercriminals ample opportunity to continue heading in this direction.”