COVID-19 has rapidly taken over the headlines across the globe. As
with many other major events, threat actors are quick to adapt
relevant topics as part of their phishing campaigns to increase the
likelihood of success. The same rings true for COVID-19, especially
due to its global impact.

On this latest Eye on Security podcast, John Atrache, Principal
Consultant for Mandiant, joins me to discuss all things email in the
time of COVID-19. We cover a variety of topics, including how threat
actors are continuously updating their phishing campaigns as new
developments around the pandemic arise. We also cover the importance
of organizations increasing their vigilance during these challenging
times, and how to implement quick and effective hardening controls to
mitigate the risk of successful phishing attack.


Listen to the episode today, and then learn even more by checking out
our blog post on COVID-19 themed phishing attacks and how to manage
email phishing risks:
https://www.fireeye.com/blog/executive-perspective/2020/03/managing-em
ail-phishing-risks.html

We are back with the second part of our M-Trends podcast where Luke
McNamara, Principal Analyst continues discussing highlights and
insights from this year’s report with Jurgen Kutscher, EVP of Mandiant
Solutions.

We pick back up with the nature of multiple attackers in an
environment—notably, whether or not they are aware of other attackers
in the environment and if they are collaborating. Jurgen then
discusses the rise of insider threats and how organizations can
improve the monitoring and detection of insider threats.

Ransomware use continues to rise—attackers are having success and
generating revenue, so we don’t expect this trend to level off any
time soon. Jurgen provides steps that organizations can take to reduce
their risk of falling victim to ransomware, and suggests organizations
take a look at our ransomware white paper for more containment
strategies:
https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/w
p-ransomware-protection-and-containment-strategies.pdf

Check out our podcast today, and also hear Jurgen’s top cyber security
recommendations for 2020.

FireEye released M-Trends 2020 earlier this year to provide visibility
into frontline investigations of the most interesting and impactful
cyber attacks of the year. In this first episode of our two-part
M-Trends 2020 podcast, Luke McNamara discusses the report with Jurgen
Kutscher, EVP of Mandiant Solutions.

We begin the episode by highlighting the key themes from M-Trends
2020, such as dwell time and the continued exploitation of legitimate
credentials. Jurgen discusses the decrease in dwell time and whether
it’s due to organizations getting better at detections or the changing
nature of attacks. You’ll also hear about trends in cloud security and
recommendations for the healthcare industry when it comes to cloud, as
well as insights into compromise detection by third parties.

Listen to the podcast today to dive into M-Trends 2020, and be sure to
tune in for part two where we discuss insider threats, ransomware, and
Jurgen’s recommendations for the year ahead.

In this latest episode, we featured M-Trends contributors Dominik
Weber (Director - FLARE) and Dan Perez (Manager - Adversary Pursuit)
to take us on a deep dive of our annual M-Trends report. We discussed
how key metrics from our incident response investigations changed,
including: dwell times, source of notification, number of threat
actors tracked, and malware families/trends broken down by operating
system. Additionally, we highlighted things that stood out to Dominik
and Dan, including:
-Malware that used email for command and control
-Malware that leveraged cryptography to protect further stages for
analysis [execution guardrails!]
-How FLARE determines whether a malware sample is a "new" family vs a
variant of an existing family we've seen before
-Targeted ransomware trends
-Chinese threat groups who have been active lately (APT40, APT41,
APT5, and several uncategorized clusters), as well as how the recent
US Justice Department indictments may have impacted operations by
those APT groups
-Dominik's involvement in the annual FLARE-ON challenge and what it's
like to create a challenge (encrypted web shell)

For the full M-Trends report, visit:
https://www.fireeye.com/current-threats/annual-threat-report/mtrends.h
tml

To find out more about the FLARE-On challenge, visit:
http://flare-on.com/

Cloud security is more important today than ever before. To learn more
about the topic, Luke McNamara sat down with Martin Holste, CTO for
Cloud at FireEye, Chris Schreiber, FireEye product strategist, and JR
Weiks, FireEye security principal engineer.

In this first of two podcasts on cloud security, they discuss some of
the security challenges that occur when migrating to the cloud,
specifically highlighting some of the common problems that quickly
rise to the top once that journey begins. Additionally, they dive into
some of the different tactics that threat actors use to exploit cloud
infrastructure and how organizations can protect themselves.

Check out the podcast, and for more information head over to our
FireEye Cloud Security page and our FireEye Partnership with AWS page.

Cloud security is more important today than ever before. Luke McNamara
was joined once again by Martin Holste, CTO for Cloud at FireEye,
Chris Schreiber, FireEye product strategist, and JR Weiks, FireEye
security principal engineer.

In this second of two podcasts on cloud security, they examine how the
point products and various processes that make up cyber security today
will set the stage for the future of security operations centers
(SOC). The ideal way to initiate this transformation to the SOC of
tomorrow is with a single cyber security platform such as FireEye
Helix, which is a cloud-hosted security operations platform.
Integrating visibility, protection and detection with advanced
analytics is not a dream of the future, but an achievable reality
right now.

Check out the podcast, and also learn more about how FireEye Helix
seamlessly integrates disparate security tools and augments them with
next generation SIEM, orchestration and threat intelligence
capabilities to capture the untapped potential of security
investments.

In October 2019, FireEye launched its Purple Team and Continuous
Purple Team Assessments to enable organizations to quantifiably
evaluate security controls and programs against Verodin simulated
attack scenarios. With Purple Team Assessments, Mandiant experts guide
an organization’s security team through highly-realistic attack
scenarios.

Luke McNamara spoke with one of our global red team leads who is on
the front lines managing this new offering, Evan Pena. During their
discussion, Evan explains what exactly a purple team is vs. a
traditional red and blue team, what are the outputs/deliverables that
come from a purple team, in what capacity will Verodin be used to
deliver this new offering, and more.

For more information about FireEye Mandiant Purple Team Assessments,
including the FireEye Verodin Security Instrumentation Platform (SIP),
please visit
https://www.fireeye.com/services/purple-team-assessment.html

Luke McNamara spoke with Jens Christian Høy Monrad, Head of FireEye
Intelligence, EMEA at FireEye on the EMEA threat landscape. In their
discussion, Jens spoke on the multidimensional threats to the region,
what those threats look like today, election security affecting these
countries, and continued challenges for the public and private sector.