Ransomware Attacks a Decade In: What Changed? What Didn’t? – Mike Mitchell – ESW #397
2025 brings us close to an interesting milestone - ransomware attacks, in their current, enterprise-focused form, are almost a decade old. These attacks are so common today, it's impossible to report on all of them. There are signs of hope, however - ransomware payments are significantly down. There are also signs defenders are getting more resilient, and are recovering more quickly from these attacks.
Today, with Intel471's Mike Mitchell, we'll discuss what defenders need to know to protect against today's ransomware attacks. He'll share some stories and anecdotes from his experiences with customers. He'll also share some tips, and tricks for successful hunts, and how to catch attacks before even your tools trigger alerts.
Segment Resources:
Mike Mitchell is Vice President, Threat Hunt Intelligence, of Intel 471. Prior to joining Intel 471, he was a co-founder of recently acquired threat hunting provider Cyborg Security. While at Cyborg, he was a cross-functional founder focused on technical implementation, sales, product architecture, and managing the content development team and its deliverables. Mike has more than 12 years of diverse cybersecurity experience in roles including senior solutions and security engineer, director of sales engineering to co-founder of Cyborg Security. Before his career in cybersecurity, Mike spent a number of years in pro baseball with the Colorado Rockies.
AlmaLinux and the State of Open Source Enterprise Linux – benny Vasquez – ESW #397
And now, for something completely different!
I've always urged the importance for practitioners to understand the underlying technology that they're challenged with defending. When we're yelling at the Linux admins and DevOps folks to "just patch it", what does that process entail? How do those patches get applied? When and how are they released in the first place?
This is often one of the sticking points when security folks get nervous about "going open source", as if 90% of the code in their environments doesn't already come from some open source project. It's a legitimate concern however - without a legal contract, and some comfort level that a paid support team is actually going to fix critical vulnerabilities, how do we develop trust or a relationship with an open source project?
In this interview, benny Vasquez, the Chair of the board of directors for AlmaLinux, will fill in some of the gaps for us, and help us understand how an open source project can not only be trusted, but in many cases may be more responsive to security teams' needs than a commercial vendor.
Segment Resources:
- benny's 'highly scientific' survey on cloud vs on-prem usage across AlmaLinux users
benny is currently the Chair of the AlmaLinux OS Foundation, has a long history in business and community building, and a long and idealistic love of open source.
Identiverse 2025 is returning to Las Vegas, June 3-6. Hear from 250+ expert speakers and connect with 3,000+ identity security professionals across four days of keynotes, breakout sessions, and deep dives into the latest identity security trends. Plus, take part in hands-on workshops and explore the brand-new Non-Human Identity Pavilion. Register now and save 25% with code IDV25-SecurityWeekly at https://www.securityweekly.com/IDV2025
Cybereason CEO quits, Skybox shuts down, More Bybit heist details – ESW #397
In the enterprise security news,
- Why is a consulting firm raising a $75M Series B?
- A TON of Cybereason drama just dropped
- Skybox Security shuts down after 23 years
- The chilling effect on security leaders is HERE, and what that means
- IT interest in on-prem, does NOT mean they’re quitting the cloud
- Updates on the crazy Bybit heist
- the state of MacOS malware
- Skype is shutting down
- Mice with CRISPR’ed woolly mammoth fur is NOT the real life Jurassic Park anyone was expecting
All that and more, on this episode of Enterprise Security Weekly.
Adrian Sanabria
- UN-ACQUISITION: SoftBank-Backed Cybereason CEO Quits After Boardroom Turmoil
The drama here is intense.
Let's back up a bit and go through the whole story:
- Cybereason was one of the original EDR vendors that emerged around the same time that next-gen AV started eating legacy AV's lunch. This resulted in Symantec, McAfee and several other security giants falling from grace and getting parted out by PE firms.
- Cybereason had some great marketing and raised a lot of money - $800M, resulting in a $2.7B valuation at their peak - they were one of over 50 cybersecurity unicorns as recently as 2022.
- Cybereason FILED FOR IPO in January 2022.
- Then, they killed the IPO and were one of the first cybersecurity companies to announce layoffs, in mid 2022.
- By April 2023, the news was that Cybereason cut their valuation by 90% (down to ~$250M)
- In November 2024, we read press releases that Cybereason was set to merge with Trustwave.
All right! Now we're all caught up to today's news. The main points here are that:
- Cybereason's CEO is stepping down after fighting with investors for months
- The merger with Trustwave has been terminated
- The plan was to put an additional $100M into Cybereason, a deal that could still close within the next week, with the CFO stepping in as interim CEO.
- SHUTDOWN: Skybox Security shuts down, lays off 300 employees as Tufin acquires assets
There were once four firewall orchestration vendors: Firemon, AlgoSec, Tufin, and Skybox Security.
Then the cloud happened.
Now there are three.
The End.
- TRENDS: LLM Hacks Its Evals
Agentic AI's amazing productivity hack? Cheat on the test.
These things are getting WAY too human.
- TRENDS: How to exploit top LRMs that reveal their reasoning steps
As AI tools and models get more sophisticated, the problems get more complex and harder to solve.
- TRENDS: Why Security Leaders Are Opting for Consulting Gigs
Very few surprises in here, but interesting to see it called out as a larger trend. On a daily basis, I see folks laughing at even the IDEA of taking a CISO role.
- TRENDS: Owen Rogers on LinkedIn: *Treat claims of cloud repatriation with caution*
TL;DR - there are stories about orgs pulling workloads out of the cloud, but it's more of a redistribution of resources into a hybrid model, not a widespread trend of folks "quitting the cloud."
- BREACHES: Bybit Hack Traced to Safe{Wallet} Supply Chain Attack Exploited by North Korean Hackers
Here are the latest updates on the largest heist in history (digital currency or otherwise):
- Bybit wasn't compromised directly - a third party, Safe{Wallet} was the source of the attack
- The attack has been attributed to North Korea - crypto theft makes up a large portion of the country's GDP
- Bybit offered a $140M bounty to anyone that can trace the stolen funds (which it has already covered with private funds it had in reserve)
- Bybit announced that 3% of the stolen funds were frozen, 20% had 'gone dark' and 77% was still traceable, despite going through several tumblers and getting converted into Bitcoin.
A great writeup here, from Elliptic, provides some insight on how it's even possible to steal $1.5B in cryptocurrency and potentially get away with it.
- RESEARCH: The Mac Malware of 2024: A comprehensive analysis of the year’s new macOS malware
If you're defending Macs, this is worth a read to understand what the latest Mac malware is up to!
- RESEARCH: How We Hacked Multi-Billion Dollar Companies in 30 Minutes Using a Fake VSCode Extension
I'm not a huge fan of security orgs testing theories in production, but this is a good reminder that your employees will do 0.3 seconds of due diligence before clicking on something, probably not even registering the misspelling.
We just need to plan for that and be ready to protect them when they screw up.
- EPITAPH: As Skype shuts down, its legacy is end-to-end encryption for the masses
Skype was E2EE before it was cool
- MEDIA: Zero Day (American TV series) – Wikipedia
Just heard about this today, so I know nothing about it. I'll be back next week with reviews!
- SQUIRREL: Scientists genetically engineer mice with thick hair like the extinct woolly mammoth
- FUNDING: Provided by Security, Funded #183 – The Shutdown Blues
