For individuals

Intrusions commenced with email bomb delivery and phone calls luring targets into downloading AnyDesk to facilitate the deployment of next-stage information-stealing payloads, including the AntiSpam.exe executable and SystemBC loader.

Attacks by both hacking operations mostly involved the delivery of malicious emails seeking a review of a purportedly encrypted PDF attachment, which seeks targets' password and two-factor authentication code to facilitate email access and online storage compromise.

Intrusions aimed at exfiltrating credentials from nearly a dozen former and current U.S. officials and people associated with the campaigns of former President Donald Trump and President Joe Biden were conducted by APT42 between May and June.

The CrowdStrike incident highlighted the dangers of auto-updates – here’s how to set up a test lab for a patching strategy that will keep the organization safe.