Marsh’s Post

The CrowdStrike software update has caused outages for millions of users of Microsoft Windows devices worldwide. If you believe the outage has impacted your business, we urge you to reach out to your usual Marsh contact or one of our regional cyber specialists as soon as possible. https://lnkd.in/gaFb9KVW Our team is standing by to provide support with your insurance coverage/recovery and event management issues. We will continue to monitor the situation and encourage you to visit Marsh.com for further updates. #cyberrisk #cybersecurity #riskmanagement #cyberinsurance #MarshAsia

Business interruption insurance and cyber insurance are important to any business. They support in the unlikely event of any catastrophe to your operations that will interrupt your business including cyber attacks. Recent spate has shown how vulnerable systems and operations and supply chain can be. Protect yourselves now. If you’re a client who has been impacted, please reach out to your client executives and if you’re a prospect who might be interested to see how best to protect your operations contact me through LI. No client big or small should be left exposed. At Marsh McLennan, we are here to help.

The 'Global IT Outage' is another key reminder of how important and detrimental it is for busisnesses to have resilient cyber & business risk protocols in place, to not only protect the balance sheet, but the business' overall reputation. I work closely with Marsh's Technology Practice and very happy to have a conversation with concerned business owners regarding their risk strategy. Get in touch 📧 [email protected] #globalitoutage #itsecurity #cyberevent #crowdstrike #software #itinfrastructure #cyber #businessinterruption #riskmanagement #incidentresponceplanning #reputation

To protect your business and ensure maximum recovery potential, it is crucial that you notify your insurer as soon as possible about any potential loss, even if you don't have all the facts yet. Reach out for assistance in submitting a notice and to stay updated on the situation. Some insurers are managing their own outage-related issues that may impact their ability to receive or process your notice. Act quickly to secure the support you need.

🚨 CrowdStrike Vulnerability Detected 🚨 Windows host systems are experiencing major outages of CrowdStrike due to a faulty update. CrowdStrike has confirmed that all customers remain fully protected, however there is risk of actions impersonating CrowdStrike support representatives and accessing sensitive data. We encourage anyone experiencing these issues to ensure they are in contact with CrowdStrike directly using their portal: https://bit.ly/3WEGU6l Here are some immediate steps you can take to ensure your cyber environment remains secure:     1. Boot Windows into Safe Mode in the Windows Recovery Environment 2. Navigate to the C\Windows\System32\drivers\CrowdStrike directory 3. Locate the file matching “C-00000291*.sys” and delete it 4. Boot the host normally If you have questions or require immediate support, please reach out to our team: 📞 1-866-563-2771⁠ 📧 [email protected]⁠

Abuse of valid accounts through credentials is skyrocketing. This was borne out in the IBM X-Force Report, and more recently in the recent Verizon DBIR. But why? There's a simple answer that many security teams still don't fully understand: Stealer Logs. Infostealer malware infects computers and steals all of the credentials from a single user along with active session cookies that can be used to bypass 2FA. These are then distributed in "stealer log files" with each log being all of the credentials and data from one user. At Flare we currently collect about 1 million new logs per week. The volume is astonishingly high. Many of these logs are distributed for free in Telegram channels making it ridiculously easy for even low sophistication actors to find a telegram channel, download logs, and start trying the creds against corporate applications. If your security team isn't monitoring for infostealer logs with corporate creds - you should be.

Most people will think that a cybersecurity attack causes the technology team the biggest headache. But the unfortunate case of CrowdStrike shows that many more outages are usually caused by bugs, or software and hardware glitches. Just a few weeks ago, many faced intermittent issues with O365 Outlook due to some Exchange Online glitch. How to minimise such a problem as much as possible? One could start with the practice of always applying patches in a contained environment, see if there are any issues, and then roll it out to all in batches. We try to always roll out updates to a subset of internal IT first. These fellas will be our guinea pigs to be sacrificed in the event the updates don't go as well as planned. But it gets more tricky if the rollout of updates are entirely left to a third party, like in the unfortunate case of CrowdStrike. Perhaps a subset of IT should still be the first to get such as the first line of defence, ready to take the bullet.

Vendettamafia group has released two products botnet and vendettaware. 1. Vendetta Bonet: which has claimed power of 700 GB/sec raw & 50+Millions request/sec 2. "VendettaWare" software is a comprehensive toolset designed for discreet cyber operations. It includes features like the Password & Cookie Extractor for accessing sensitive data, Screen & Webcam Extractor for capturing images, and a Credentials Extractor for retrieving detailed PC information. The File Extractor obtains important files, while the All In One Extractor combines various attack types. The software also offers a Ransomware function, Private Encrypter and Binder, and RAT Mode for real-time actions. Extra features include an FTP Server System for log monitoring, Windows Defender Bypass, and UAC Bypass for enhanced stealth.

Vendettamafia group has released two products botnet and vendettaware. 1. Vendetta Bonet: which has claimed power of 700 GB/sec raw & 50+Millions request/sec 2. "VendettaWare" software is a comprehensive toolset designed for discreet cyber operations. It includes features like the Password & Cookie Extractor for accessing sensitive data, Screen & Webcam Extractor for capturing images, and a Credentials Extractor for retrieving detailed PC information. The File Extractor obtains important files, while the All In One Extractor combines various attack types. The software also offers a Ransomware function, Private Encrypter and Binder, and RAT Mode for real-time actions. Extra features include an FTP Server System for log monitoring, Windows Defender Bypass, and UAC Bypass for enhanced stealth.

In a world where Everyone in Technology is worried about the Effective controls Each Org had around their Internal Cybersecurity/ Ransomware Detection and the Ability To respond quickly / Data Privacy / Business Continuity / Backups and Recovery Should we be worried that a Single content Update from one Security vendor can bring down so Many devices around the world considering that same sensor / product push might have impacted other Types of OS too.. Should we look at this as a Globally forced DR Excersize in case there is An actual Well Funded Adverse Actor” threatening all these Devices with a Ransomware or Malware kind of Incident ?? Assuming every Major Org does some soul -searching internal reviews along with impact analysis after this Event, We all can only Wish/Hope that None of the bad Actor(s) took advantage of the Diversion towards Windows systems and Crowdstrike . To all those support team members and System Administrators that spent the past 48 hours rebooting everyone of those Windows machines, All I can say is #ThankYou #SysAdmin #Crowdstrike #MicrosoftWindows #SingleContentUpdate #GlobalOutage