Enciclopedia de
Actores de Amenazas

SMS-based two-factor authentication is broken. SIM swapping a technique Scattered Spider uses routinely lets attackers intercept your text codes in minutes. Replace it with hardware keys or authenticator apps.

Clop spent 12 months researching MOVEit before exploiting it. RansomHub actively exploits Citrix and Fortinet vulnerabilities that have had patches available for months. Unpatched systems are open doors.

LockBit's first move after gaining access is to find and destroy your backups. If your backup is connected to your network, it will be encrypted too. You need a backup that ransomware cannot reach.

RDP (Remote Desktop Protocol) exposed to the internet is one of the most common ransomware entry points. Attackers scan for open RDP ports 24/7 using automated tools. If you have RDP open, you are actively being probed right now.

You cannot protect what you don't know exists. Shadow IT unauthorized devices connected to your network is a major blind spot. Attackers love forgotten devices: old servers, personal laptops, IoT devices with default passwords.

Macro-enabled Office documents (.docm, .xlsm) are one of the oldest and most reliable malware delivery methods and they still work. Clop and LockBit both use malicious macros in phishing attachments to drop ransomware. Disabling macros takes 15 minutes and eliminates an entire attack category.

DNS filtering blocks malicious websites before your browser even connects to them. When ransomware tries to phone home to its command-and-control server, DNS filtering cuts the connection. It also blocks phishing sites, malware downloads, and botnet infrastructure all at the DNS layer before any damage occurs.