Maybe connecting a server to your network, giving it implicit trust, and leaving the default login credentials was a dumb move...
"And immediately after we had removed them from the environment, another attack set off, which we attributed to the same group trying to get back in through other means," he added.
This happened within 24 hours, with a credential-stuffing attack. "There was no opsec, no slow-and-low," Dwyer said. "They put the persistent in APT. Once they identify a target as valuable to them and their goals and objectives, they will continue to try to get back in."
And this is from a company that seems to at least sort of take security seriously (ignoring the glaring error that got them in this situation). Responding to this threat seems like a challenge for most companies down the supply chain.
Technology
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed