Incident Response
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F276RMh52vEEBfRj1WDwH6l%2F512511c420b4dd874e1ae78c8edb927a%2FBlog-Newsletter-Header-June.jpg&w=3840&q=75)
Familiar Threat Actor Attack Tactics Find New Life
Changes in technology are prompting threat actors to revive old attack methods that may seem ordinary on the surface but still lead to cyber insurance claims.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F5wHDfACJaihbx5nGusAE2q%2F30012857bb63b92785d5580c1412da5e%2FSecurity-Labs-SEOPoisoning.jpg&w=3840&q=75)
SEO Poisoning Attacks Demand More Scrutiny from Search Engine Users
Threat actors are capitalizing on the trust we put in search engines by hiding malicious websites in plain sight using a tactic known as SEO poisoning.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F4TnBj3IW4IORoIe9xWEaR7%2F9be323701fd2559cfc662a510495ccbd%2FSecurity-Labs-SIM-Swapping_Extortion.jpg&w=3840&q=75)
Threat Actor Claims 100% Success With SIM-Swapping Extortion
SIM-swapping extortion attacks are on the rise due to self-service password resets, which help threat actors bypass interaction with their victims.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F24cYVhiQ9MfoTiPrJ2QWQW%2Fe256ca488d0d6afa31fa652c458a5412%2FBlog_Not_All_Endpoint_Security_Solutions_Are_Created_Equal.jpg&w=3840&q=75)
Blogs
Not All Endpoint Security Solutions Are Created Equal
As more businesses adopt endpoint security solutions, a clear disconnect has emerged between how they’re marketed and how they truly function.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2q0NLVHJ4byIG3tqWezuQi%2F8751734c3bc316ac91e2a87076cf430a%2FBlog_Timely-Reporting.png&w=3840&q=75)
Blogs
Timely Reporting Can Be the Deciding Factor in Cyber Insurance
The cyber insurance industry must work to normalize the reporting of suspicious activity and encourage businesses to use the resources at their disposal.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3Bra2ENCNKJXa7pEfMhqqh%2F783981a306fce81c65bf34859510a582%2FBlog_april-newsletter__1_.png&w=3840&q=75)
The Double-Edged Sword of Using Boundary Devices
Boundary devices can help mitigate cyber threats and enable secure remote access. However, these technologies are often directly targeted in cyber attacks.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3M0bsgMw6yBymSKCJqPDvu%2Fe01f07384817b68db54aed7f2b61362e%2FCoalition_Blog-Ready_to_Report.jpg&w=3840&q=75)
Cyber Incident Reporting: Important Questions to Ask for Essential Business Planning
Cyber incident reporting obligations can be complex. Businesses must consider how they will meet the requirements before an incident to expedite the process.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F60AxWV6Y0etLTLatdVBKYz%2Faa4c2a43501e579c29dd05cb4cbfadcd%2FLockBit_ConnectWise_ScreenConnect.png&w=3840&q=75)
LockBit Ransomware Used in Exploitation of ConnectWise ScreenConnect
Coalition Incident Response has discovered a link between the LockBit ransomware gang and the ConnectWise ScreenConnect vulnerabilities.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F7DJ9OCR1ge6Zpw8d5JDUnO%2F9903b86927e98b6aaa725211e75378b3%2FBlog_Cyber-Tax-Fraud.png&w=3840&q=75)
Common Cyber Tax Fraud Schemes (and How to Help Mitigate Them)
During tax season, businesses tend to unknowingly lower their defenses to attackers — and almost all cyber tax fraud starts with a phishing email.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F28oI7DIG04euRoYt3j0ZlP%2Fc3cf70f3e5d10533b2cc8e5cfaf73b45%2FBlog_MDR-MFA.png&w=3840&q=75)
Why MDR is the Next MFA for Cyber Insurance
Cyber insurance providers are increasingly encouraging businesses to implement MDR — if not incentivizing it — just as they did with MFA.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F3thnbLPfhIsoVPH5uFuQIe%2Fbb97a89f49b374f34aec31a57f3fb223%2FIvanti_Security_Alert_Security-Labs__1_.png&w=3840&q=75)
Ivanti VPN Zero-Day Avoided with Device Isolation
Two zero-day vulnerabilities are impacting Ivanti VPN devices. Learn how proactive outreach to Coalition policyholders is helping mitigate the threat.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F1Kz6S4X8ifz4VGcRWovsMG%2Fad479f2801b2b956e8253feb4d1691a6%2FSecurity-Labs-QR.png&w=3840&q=75)
QR Codes Increasingly Used in Phishing Attacks
Threat actors are using QR codes in phishing attacks to gain access to business networks. Learn the risks and how to evaluate a QR code for legitimacy.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F2DB6nxsHoEs35LHD9wp9az%2Faabd7e5867b2188a22a9c5370afc6cdb%2FBlog_SecLabs-Cyber-Risk.png&w=3840&q=75)
Coalition Security Services: More Protection From Cyber Risk
Learn about our expanded security offering, Coalition Security Services, and how it can help protect your business from cyber risks.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2FYLKwZ7oz8nrJwGLLDdi5g%2F334bf1518be2ccbd24ce2e458e8a5c95%2FBlog_SecLabs-Ransomware_Negotiation.jpg&w=3840&q=75)
Everything You Always Wanted to Know About Ransomware Negotiation (But Were Afraid to Ask)
Have you ever wondered how ransomware negotiations and payments happen? An Incident Responder breaks down everything from crypto to AI and more.
![](/https/www.coalitioninc.com/_next/image?url=https%3A%2F%2Frp.liu233w.com%3A443%2Fhttps%2Fimages.ctfassets.net%2Fo2pgk9gufvga%2F7qjCeq83CG7xly03qY5iZO%2F396b8b45e2332e5dcd0513f90bb38bb4%2FBlog_Pay-on-behalf.png&w=3840&q=75)