Luke Richards

Threat Intelligence Lead

Luke is the Threat Intel Lead for Vectra. He has been with the company for 7 years, joining as a consultant analyst and working with customers and high level incident response directly. Before joining Vectra, Luke was a senior Security Analyst for an international Engineering and Defence contractor where he developed security team toolsets, processes, and incident response playbooks.

‍

Post from

Luke Richards

Encrypted Command and Control: Can You Really Cover Your Tracks?

Why uncovering command and control channels is key to stopping today’s cyber attacks.

OpenSSL Security Advisory

On November 1st 2022, after teasing the main show the week before, OpenSSL released their advisory describing two risks to OpenSSL 3.0.0 - 3.0.6. This was originally teased as a Critical level alert, which would have been the first Critical since 2015, however this was downgraded to a High owing to what OpenSSL describe as "mitigating factors".

What If there was a Supply Chain Compromise of an IDP like Okta?

What If there was a Supply Chain Compromise of an IDP? The recent security incident at Okta represents yet another perspective on supply chain compromises. This blog provides perspective on the current situation and mitigation and defense strategies to manage such an event.

Russian Cyber Attacks: What We Know so far

Updated perspective on cyberthreats as a result of ongoing Ukrainian/Russian conflict, including specific custom recall queries, and aggregation of common Russian state actor TTPs.

Mitigating, Detecting, and Responding to Russian Cyberactivity

Vectra customers should be aware that current global events related to Russian recognition of separatist regions of the Ukraine carry with them the risk of increased cyber activity conducted by Russian state level actors. This includes evidence that the FSB, the main Intelligence Organization in Russia, is responsible for the DDoS against Ukrainian systems in February 2022.

Log4Shell - The Evolution of an Exploit

A few days after the Log4Shell vulnerability was discovered, we now have more observations about how the exploit is being leveraged. Here's what we know, today.

CVE-2021-44228: Impact of Log4j Zero-Day Vulnerability

Explore the impact of the Log4j zero-day vulnerability (CVE-2021-44228), methods of detection, and the latest exploitation attempts by threat actors.

Putting CVE-2021-1675 PrintNightmare to Rest

A new remote code execution vulnerability in Windows Print Spooler, now known as CVE-2021-1675, or PrintNightmare can be exploited by attackers to take control of affected systems. Find out how to detect and stop this exploit with Vectra.

SolarWinds Orion Hack: What To Know and How to Protect Your Network

Discover what you need to know about the SolarWinds Orions compromise, how it unfolded and why monitoring users in the cloud is imperative to protect your enterprise.