Blog

Threat Research

SID injection attack

Is this SID taken? Varonis Threat Labs Discovers Synthetic SID Injection Attack

Eric Saraga

Eric Saraga

A technique where threat actors with existing high privileges can inject synthetic SIDs into an ACL creating backdoors and hidden permission grants.

ContiLeaks: Ransomware Gang Suffers Data Breach

Jason Hill

Jason Hill

Conti, a prolific ransomware group, has suffered a leak of both internal chat transcripts and source code being shared by a reported Ukrainian member

Ransomware Year in Review 2021

Varonis Threat Labs

Varonis Threat Labs

In this post, we dive into six ransomware trends that shaped 2021.

Using Power Automate for Covert Data Exfiltration in Microsoft 365

Eric Saraga

Eric Saraga

How threat actors can use Microsoft Power Automate to automate data exfiltration, C2 communication, lateral movement, and evade DLP solutions.

BlackCat Ransomware (ALPHV)

Jason Hill

Jason Hill

Varonis has observed the ALPHV (BlackCat) ransomware, actively recruiting new affiliates and targeting organizations across multiple sectors worldwide.

Mixed Messages: Busting Box’s MFA Methods

Tal Peleg

Tal Peleg

Varonis Threat Labs discovered a way to bypass multi-factor authentication (MFA) for Box accounts that use an SMS code for login verification.

Bypassing Box's Time-based One-Time Password MFA

Tal Peleg

Tal Peleg

The Varonis research team discovered a way to bypass Box's Time-based One-Time Password MFA for Box accounts that use authenticator applications.

No Time to REST: Check Your Jira Permissions for Leaks

Omri Marom

Omri Marom

Varonis researchers enumerated a list of 812 subdomains and found 689 accessible Jira instances. We found 3,774 public dashboards, 244 projects, and 75,629 issues containing email addresses, URLs, and IP...

Einstein's Wormhole: Capturing Outlook & Google Calendars via Salesforce Guest User Bug

Nitay Bachrach

Nitay Bachrach

If your organization uses Salesforce Communities and Einstein Activity Capture, you might have unknowingly exposed your administrator's Outlook or Google calendar events to the internet due to a bug called...

BlackMatter Ransomware: In-Depth Analysis & Recommendations

Dvir Sason

Dvir Sason

CISA has issued a security bulletin regarding the BlackMatter 'big game hunter' ransomware group following a sharp increase in cases targeting U.S. businesses. To mitigate these attacks, it is recommended...

Abusing Misconfigured Salesforce Communities for Recon and Data Theft

Nitay Bachrach

Nitay Bachrach

Our research team has discovered numerous publicly accessible Salesforce Communities that are misconfigured and expose sensitive information.

Good for Evil: DeepBlueMagic Ransomware Group Abuses Legit Encryption Tools

Jason Hill

Jason Hill

A group known as "DeepBlueMagic" is suspected of launching a ransomware attack against Hillel Yaffe Medical Center in Israel, violating a loose "code of conduct" that many ransomware groups operate...

Try Varonis free.

Get a detailed data risk report based on your company’s data.
Deploys in minutes.