Complex Cybersecurity Topics Made Not-So-Complicated.

Outside of my role at Human Security, I spend my free time writing articles on complex cybersecurity issues. It's something I love to do. My work includes data and trends analysis, technical pieces on reverse engineering and TTPs, and discussions on the business of the cybercriminal underground. Several examples of my work can be found below.

Articles Written

Augmenting Threat Hunting Using Threat Intelligence - April 18, 2023

Almost any organization can benefit from threat hunting - whether as part of a full-fledged adversary emulation exercise to determine how implemented security controls hold up against actor-specific TTPs or simply in order to ensure organizational systems are configured as expected. This becomes even more critical for entities that are frequently targeted by both ransomware and state-sponsored threat actors including government organizations, public utilities, hospitals, and schools. As seen in Figure 1, ransomware attacks against these entities may be slowing somewhat, but are very likely to continue. Threat hunting does not require a large team of experts to be effective,...

‘Sophisticated’ Vs. ‘Unsophisticated’ Ransomware - August 15, 2022

The most notable ransomware-as-a-service (RaaS) groups are well-known for the widely publicized attacks they conduct, even outside of the cybersecurity community. However, there also exist smaller, very short-lived groups that use ransomware derived from existing variants. They’re often considered 'unsophisticated' threat groups, and may be taken less seriously than that by a higher-level organization. How you deal with each type is important.

‘Internet of Things’ Devices and Ransomware - July 13, 2022

When discussing the ever-changing ransomware threat landscape, we often talk about what devices threat actors will target next. In addition to mobile devices, the other technology I get asked about the most is 'Internet of Things' (IoT), and whether we should expect threat actors to begin going after the 'smart' products in our homes or businesses.

Ransomware vs. Malware: What’s the Difference? - June 16, 2022

With the Russian invasion of Ukraine came the deployment of several destructive malware families, known as 'wipers', against entities in Ukraine, with nine distinct variants observed to date. The first two, WhisperGate and HermeticWiper/PartyTicket, masqueraded as ransomware, but they were actually destructive tools rather than legitimate ransomware. This raises an important question: What’s the difference between true ransomware and these destructive tools?

Initial Access Vectors for Ransomware - May 13, 2022

Initial access vectors are the methods threat actors use to first gain access to an organization’s systems. They can include exploitation of vulnerabilities, stolen credentials, phishing, or brute-forcing services like RDP or SSH. Many of these accesses can be purchased from threat actors who specialize in obtaining initial access, known as Initial Access Brokers.

'Living Off the Land' Ransomware - April 6, 2022

This month, our focus is on living-off-the-land techniques, and why they help ransomware threat actors execute attacks more stealthily. The concept of living-off-the-land (LotL) was first introduced by researchers to the broader security community in 2013, and has remained popular with threat actors ever since.

5 Tips for Building a Cybersecurity Career as a Woman - March 8, 2022

I’m Lindsay, a malware analyst and reverse engineer, with a special enthusiasm for obfuscation and anti-reverse engineering techniques used in malware! I am also a woman in the field of cybersecurity. I am often asked 'How did you get into cybersecurity?' or 'What advice would you give young women interested in cybersecurity?'

Mobile Phone Ransomware: a Primer - February 3, 2022

Mobile phones are certainly ubiquitous—85% of Americans currently own a smartphone, and in 2020, 3.5 billion people owned a smartphone worldwide. With so many devices out there, it seems like mobile would be an excellent target for ransomware threat actors. However, we don’t hear a lot about devastating ransomware attacks targeting smartphone operating systems, like iOS or Android. Let’s explore why.

Ransomware Increasingly Targets Linux and ESXi - January 12, 2022

Ransomware attacks have continued to plague organizations over the past few years, especially with the move to big game hunting at the end of 2019, and the debut of 'double extortion' in 2020. Initially, threat actors primarily targeted Windows-based environments, but have more recently expanded capabilities to include Linux-based systems. In 2021, well-known groups including REvil, Conti, RansomExx, and BlackMatter released ransomware specifically designed to target Linux and ESXi, and we expect this trend will continue.

2022 Ransomware Survey Results - January 1, 2022

We talk a lot about ransomware attacks within our own organizations—how to prepare for them, what to do when they happen, and the best way to stop the overall threat. While an ever-popular question is 'should we pay the ransom?'' (which most said they are unlikely to), there are so many other highly impactful aspects to ransomware preparedness and response. We surveyed more than 500 IT and security professionals to look at the impact of ransomware in 2021 and 2022 to begin to answer that question.

Articles Featured In

Free VPN apps on Google Play turned Android phones into proxies

Bleeping Computer - March 26, 2024

Over 15 free VPN apps on Google Play were found using a malicious software development kit that turned Android devices into unwitting residential proxies, likely used for cybercrime and shopping bots.

Hackers are using these Android apps on the Play store to stage attacks — delete them all right now

Tom's Guide - March 26, 2024

These apps are turning Android smartphones into proxies in the background.

Thousands of phones and routers swept into proxy service, unbeknownst to users

Ars Technica - March 26, 2024

Two new reports show criminals may be using your device to cover their online tracks.

Apps secretly turning devices into proxy network nodes removed from Google Play

Help Net Security - March 26, 2024

Your smartphone might be part of a proxy network, and you might not even know it: all it takes is for you to download apps whose developers have included the functionality and didn’t mention it.

'MichaelKors' Showcases Ransomware's Fashionable VMware ESXi Hypervisor Trend

Dark Reading - May 16, 2023

Wide use and lack of support for malware detection technologies has made VMware's virtualization technology a prime target for cyberattackers.

VMware’s ‘target-rich environment’ is growing more volatile, CrowdStrike warns

CyberSecurityDive - May 16, 2023

Ransomware groups continue to target VMware because they know the virtualization infrastructure is vulnerable and lacks security tools, threat researchers said.

VMware ransomware was on the rise leading up to ESXiArgs spree, research finds

CyberSecurityDive - February 13, 2023

Recorded Future analysis underscores a growing ransomware threat confronting organizations using VMware ESXi.

Russia Media Day

Politico Pro - October 19, 2022

This article is available to Politico Pro subscribers.

Cyberattaques : qu’est-ce qu’un accès initial?

LeMag IT - June 30, 2022

Le monde de la cybersécurité est marqué par un jargon qui lui est bien propre. Certains termes peuvent manquer de clarté pour le non-initié. Lindsay Kaye, de Recorded Future, nous aide à décoder le concept d’accès initial.

Cyberattaques : en quoi consiste le déplacement latéral?

LeMag IT - June 21, 2022

Le monde de la cybersécurité est marqué par un jargon qui lui est bien propre. Certains termes peuvent manquer de clarté pour le non-initié. Lindsay Kaye, de Recorded Future, nous aide à décoder le concept de déplacement latéral.

Egregor ransomware group explained: And how to defend against it

CSO - February 21, 2021

Egregor is one of the most rapidly growing ransomware families. Its name comes from the occult world and is defined as “the collective energy of a group of people, especially when aligned with a common goal,” according to Recorded Future’s Insikt Group. Although descriptions of the malware vary from security firm to security firm, the consensus is that Egregor is a variant of the Sekhmet ransomware family.

3 Ways Hacks Exploiting the COVID-19 Crisis Have Evolved

The Record - January 22, 2021

Over the last year, the COVID-19 pandemic has been punctuated by a series of crises and developments: In February, the U.S. declared a public health emergency; In March, the economy contracted and unemployment skyrocketed; Relief packages were both passed and stalled in Congress throughout the year; And by December, vaccines were given emergency approval.

A COVID-19 shot for $150? Online scams surge as slow vaccine rollout frustrates

Reuters - January 5, 2021

As millions of people await their turn to get a COVID-19 vaccine that could be months away, scammers online, in emails and on messaging apps are luring victims with claims they can deliver shots within days for as little as $150.

Opportunistic Egregor ransomware is an emerging and active threat

ComputerWeekly - December 4, 2020

Researchers at Recorded Future’s Insikt Group highlight links between the emerging Egregor ransomware and other strains, and offer guidance on defending against it

From pranks to APTs: How remote access Trojans became a major security threat

CSO - November 9, 2020

RATs were first created to prank friends. Today, they’re cheaply available and used by everyone from cybercriminals to espionage groups.

Why the extortion of Vastaamo matters far beyond Finland — and how cyber pros are responding

CyberScoop - October 29, 2020

At issue are the obligations of health care organizations to defend their data, and victims’ ability to hold them accountable for failing to do so.

New Ransomware Uses Sophisticated Evasion Techniques

CoinTelegraph - June 11, 2020

Recorded Future says that Thanos deploys a particular encryption technique in its attack and offers a revenue-sharing scheme for external hackers.

Thanos Ransomware First to Weaponize RIPlace Tactic

ThreatPost - June 10, 2020

Thanos is the first ransomware family to feature the weaponized RIPlace tactic, enabling it to bypass ransomware protections.

Why COVID-19 is big business for bad actors

DanPatterson - May 29, 2020

Threat researcher Lindsay Kaye of Recorded Future explains how scammers profit from coronavirus.

COVID-19 outbreak gives rise to opportunistic scammers

ITWeb - March 19, 2020

The South African Banking Risk Information Centre (Sabric) is warning bank consumers of cyber criminals exploiting the coronavirus (COVID-19) outbreak to spread an array of online scams.

Hospitals under threat as hackers exploit coronavirus to carry out cyber attacks

The Telegraph - March 17, 2020

Security experts warn that global concern over coronavirus risks creating a fertile hunting ground for cybercriminals

Hackers are exploiting the coronavirus crisis by posing as World Health Organisation officials in order to steal bank details and target government infrastructure

Business Insider - March 16, 2020

Hackers are exploiting growing anxiety over the coronavirus crisis by posing as officials from the World Health Organisation and government officials in order to steal the personal details of people online.

Espías aprovechan la paranoia sobre coronavirus para robar datos por correo electrónico

Forbes Mexico - March 16, 2020

Cibercriminales envían archivos referentes al coronavirus por email, que ocultan un spyware para robar los datos personales de usuarios y empresas.

Intelligence agencies use coronavirus information to target enemies, analysts say

NBC News - March 13, 2020

Intelligence agencies around the world are sending out fake coronavirus information to hack and spy on their targets, cybersecurity researchers say.

Coronavirus Scam Alert: Watch Out For These Risky COVID-19 Websites And Emails

Forbes - March 12, 2020

Cybercriminals and nation state-sponsored spies didn't take long to catch onto the coronavirus panic. Research released Thursday shows crooks and snoops have been rapidly registering vast numbers of potentially-malicious websites and sending out masses of scam emails as they try to make money from the pandemic.