TOPIC
Roles and responsibilities during an incident, the first hours, external communication, restoring operations and the review afterwards.
Microsoft and partners disrupted infrastructure linked to YAM Store and the CoGUI and Iron Man phishing kits. The figures describe targeted messages, not confirmed successful attacks.
Microsoft has observed at least 13 larger Star Blizzard campaigns since January, with activity affecting more than 100 organizations. Its new RedFlick technique shortens the path from a message to malware, but these are targeted operations, not a mass attack on every business.
A test version of the Czech business register made national ID numbers and some non-public documents accessible. The ministry shut the test portal down, but is still investigating how many people may have been affected.
The disruption of EvilTokens highlights the need to protect payment approvals. What Microsoft reported, and three practical steps for finance and IT.
The September INC Ransom listing needs to be read alongside the Partners group's August disclosures. The company confirms access to personal data; the attacker's identity remains unverified.
The M&S case shows why the first hour of an incident is not only an IT concern. Decisions about services, sales and communication need to be ready before pressure arrives.