Fast-acting cyber gangs increasingly disabling telemetry logs
computerweekly.com
computerweekly.com
Main sales pitch here:
“We saw this happen in two incidents of Cuba ransomware. One company (Company A) had continuous monitoring in place with MDR, so we were able to spot the malicious activity and halt the attack within hours to prevent any data from being stolen.
“Another company (Company B) didn’t have this friction; they didn’t spot the attack until a few weeks after initial access and after Cuba had already successfully exfiltrated 75 gigabytes of sensitive data. They then called in our IR team, and a month later, they were still trying to get back to business as usual.”
https://news.sophos.com/en-us/2023/11/14/active-adversary-fo...
How is this notable?
Yes, but surprisingly few adversaries actually do this so if it's being observed in the wild, it's a notable development.
In IT there are 1000s of ways to skin a specific cat, and everyone has their own, so I'm not touting mine as "The way". I'm simply stating that "cleaning up logging" isn't as simple as it sounds, when it really comes down to it.