While the WUWT website itself is fine, both Charles and Anthony are evaluating threat messages and Malware scans right now for our personal workstations. There is no threat to any of you visiting the site.
But, while we ensure our workstations are threat free, new postings will likely be delayed and/or lighter than usual.
Thank you for your attention to this matter!
Are you running an email gateway? Well over half of all compromises begin with an email (which may contain only a small part of the eventual attack). The email gateway ensures that the vast majority of attacks never even get to you. Provided you buy a good one of course. ProofPoint is my go to. The other question I would ask is, are you running an Enterprise class endpoint protection? Crowdstrike or SentinelOne are my go to’s though they will be pricy for a small number of desktops. Not knowing what your attack surface looks like, I’d consider an entry level ProofPoint deployment combined with perhaps Field Effect which basically gets you a comprehensive security suite founded by ex Five Eyes that has every feature practical for a small organization other than an email Gateway.
There are other combos I can think of, but if you are threat hunting after the fact using run of the mill anti-malware scans, you are taking a very big risk. A sophisticated attack can bury itself deep enough to evade detection. Modern threat hunting requires professional threat hunters with a full suite of threat hunting tools, which is part of what you get with Field Effect.
DM me if you want to get into the weeds on this thing. I’m recently retired but last decade has been 100% security in high value targets.
~davidmhoffer
