SentinelOne

?? ?? Purple AI is here and now generally available! To learn more about the industry’s leading AI security analyst, watch the video below. ?? Why Purple AI? Because it’s unlike anything available on the market: ?? Early adopters report that Purple AI makes threat hunting and investigations 80% faster.? ?? Translates natural language into sophisticated PowerQueries.? ?? Speed and visibility with lightning fast-queries with one console, one platform, and the industry’s most-performant data lake.? ?? One-click threat hunting quickstarts, suggested next queries for deeper investigations, and intelligent summaries and shareable investigation notebooks. ?? Ready to transform your security operations?? Get a demo: https://s1.ai/Purple-AI

?? ???? SentinelLabs has found an active network of North Korean IT Worker front companies linked to China, overlapping with four companies recently disrupted by U.S. government agencies. Read the research by Tom Hegel and Dakota Cary: https://s1.ai/IT-Front This IT workers scheme shows a deliberate and evolving strategy by the DPRK that leverages the global digital economy to fund state activities, including weapons development. In this new research, we identified unique characteristics of multiple websites, now subject to law enforcement and taken offline by the U.S. Government, associated with North Korean IT worker front companies. In recent months, these four front companies copied the online brands of legitimate organizations in an attempt to to impersonate American software and technology consulting businesses. Drawing on details from these four companies, we were able to find multiple leads to a network of North Korean IT Worker front companies originating in China, all of which remain active online today. To help visualize the connections we describe, we created the below graphic to provide a simplified representation of the key relationships and pivots.

?? ?? ? Unveiling our new AI Security Posture Management (AI-SPM), the protection your workplace needs for both known and shadow AI use. AI-SPM provides: ? Comprehensive AI Inventory Automation: Gain full visibility into your AI services, including ML models, training jobs, and deployed pipelines across platforms like Amazon SageMaker and Azure OpenAI. ? Misconfiguration Detection: Spot vulnerabilities in your AI supply chain, such as unsecured APIs or improperly configured training jobs, to prevent data breaches and model misuse. ? Attack Path Analysis: Visualize potential security threats in Graph Explorer, minimizing false positives so security engineers can focus on real threats to your AI workloads. ?? To learn more, read our blog post by Anand Prakash, Senior Director of Product Management at SentinelOne: https://s1.ai/AI-SPM-Blg

?? #AWSreInvent attendees, mark your calendars. In this speaking session featuring Relay Network and SentinelOne’s Chris Hosking,?you’ll learn how to prioritize cloud security approaches based on evidence in your own environment.? Add it to your agenda!

?? When Dark Reading includes a meme in its coverage of our "State of Cloud Ransomware in 2024" research... Here's the context: "Instead of solely leaning on leaky buckets and cloud service provider (CSP) vulnerabilities to exfiltrate sensitive data, a fresh crop of cloud-targeting ransomware is aimed instead at exploiting unprotected Web applications to drop encryptors and lock up victims' data ... Cloud ransomware?operators have started to mine Web applications for opportunities in increasing volumes, according to SentinelOne." To learn more, read: ?? The full article by Becky Bracken: https://s1.ai/DR-CldRnsm ?? The original research by SentinelLabs's Alex Delamotte: https://s1.ai/cloud-rw

?? ?? ? All smiles for Michael P. from Arete, the lucky winner of a brand-new Tesla Model 3 as part of our Virtual Partner Summit giveaway! Michael received the symbolic keys to his electric ride at PartnerOne during #OneCon 2024. ?? Michael, congratulations once more!

??? Our weekly cybersecurity news roundup ??The Good: A cyber extortionist was sentenced to 10 years in prison for crimes against U.S. medical clinics. The Bad: China-aligned Volt Typhoon is rebuilding its KV-Botnet malware network. The Ugly: An Iranian-based threat actor has been targeting the aerospace sector with fake job offers. To learn more, read the full blog post: https://s1.ai/GBU6-Wk46

?? ?? The stateless and ephemeral nature of serverless computing does not guarantee its security. In a new blog post by SentinelOne’s?Yehonatan Bitton, we break down how a series of misconfigurations of AWS Lambda by an admin could lead to a potential?security breach. Get the mitigation strategies for preventing lateral movement attacks like this in Lambda environments. ?? To learn more, read the full blog post: https://s1.ai/Lambda-Bl

??? ???? Attacks like the "Iranian Dream Job Campaign"—which is luring the aerospace industry with fake jobs—often target employees through personal channels like LinkedIn and personal email, says SentinelOne's Tom Hegel, bypassing enterprise defenses. “Since job hunting is personal, employees may not disclose these interactions to their employer, increasing vulnerability,” said Hegel. “In a competitive job market, these lures can be especially tempting. To counteract this, organizations should educate their employees on the risks of engaging with unsolicited job offers and emphasize caution with social media interactions, where attackers can easily impersonate legitimate contacts with malicious intent. This attack technique is not unique to North Korea or Iran.” ??? To learn more, read the full article by Steve Zurier: https://s1.ai/Ir-Aerospc