What Indicators of Attack Are and How Darknet Intelligence Can Reveal Them
Summary
Indicators of attack (IoAs) are behaviors that can signal an attack in progress or about to occur. The article describes darknet examples and how credential-exposure signals preceded three reported incidents.
Key points
- IoAs focus on attacker behavior and tactics that may signal an ongoing or imminent attack; indicators of compromise point to a breach that has already occurred.
- Examples of potential darknet IoAs include malware or exploit-kit advertising, discussion of tools that disable security software, and sharing of attack techniques.
- DarkOwl describes using its darknet data and products to identify threat activity and monitor exposed credentials.
- The article says DarkSonar detected increased credential exposure before General Motors disclosed a 2022 credential-stuffing attack involving customer information and reward points.
- It cites a compromised, unused VPN password in the 2021 Colonial Pipeline intrusion and darknet credentials as a relevant exposure signal.
- It says increased email exposure preceded the 2021 Fujifilm ransomware incident, while noting the specific ransomware was not disclosed and Qbot was only believed to be involved.
Article Details
- Topic
- Indicators of Attack (IoAs), darknet threat intelligence, and DarkOwl’s tools for identifying attack activity and credential exposure