Threat Source newsletter (Feb. 4, 2021)
Summary: Cisco Talos published a LockBit ransomware research paper after spending several weeks speaking with an operator associated with the group, covering how the attacker chooses targets and why operating in some countries is easier than others. Talos also reported that a campaign involving SolarWinds could extend beyond SolarWinds products, with U.S. officials saying attackers may have exploited other vulnerabilities for initial access, and victims reportedly including government agencies and consulting, technology, telecom, and oil and gas companies across North America, Europe, Asia and the Middle East.
Bottom line: Talos found the LockBit operator relied almost exclusively on common open-source tools and solely on victims with unpatched environments, so the barrier to this kind of intrusion is low and the exposure is ordinary patch debt. The SolarWinds campaign's reported reach across government agencies and consulting, technology, telecom, and oil and gas companies on four continents means the initial foothold may not have come through SolarWinds at all.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026