A Supply Chain Incident of Major Influence in Israel
summary
A nationwide campaign leverages an Exchange RCE released Feb 11 to breach an electronics retailer and persist for seven months, using Mimikatz, open‑source web shells, scheduled tasks, remote‑control implants, canary tokens and a C2 to harvest creds and send spearphish. Incident response clears web shells, leaves monitoring sensors, and forces patching, MFA and password resets. Response shares 300+ IOCs as a TLP WHITE, national scans find 167 impacted organizations by mid‑October, and containment completes by early November.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 3:00The Incident
- 4:30Damage Potential
- 5:23Investigation
- 7:05First Activity
- 7:55First Vulnerability
- 12:45Defense Actions
- 15:10Business Process
- 16:37Information Sharing
- 19:08Three Distributors
related talks
50mInsights into New Supply Chain and Cloud-Identity Attacks
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
51mThe Enemy Within: Modern Supply Chain Attacks
51mReal World Stories of Incident Response and Threat Intelligence
33mIn the Trenches During a Software Supply Chain Attack
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
52mLessons Learned from the Summer of Supply Chain Attacks
42mStart Covering Your Bases And Stop Chasing APT Headlines