John Dwyer

Head of Research, IBM Security X-Force

John (@TactiKoolSec) is the Head of Research for the IBM Security X-Force where he leads research efforts to understand and model adversary operations, developing threat detection methodologies, and advance the X-Force technology stack.

Defensive Security October 6, 2023

X-Force uncovers global NetScaler Gateway credential harvesting campaign

6 min read - This post was made possible through the contributions of Bastien Lardy, Sebastiano Marinaccio and Ruben Castillo. In September of 2023, X-Force uncovered a campaign where attackers were exploiting the vulnerability identified in CVE-2023-3519 to attack unpatched NetScaler Gateways to insert…

Defensive Security August 9, 2023

X-Force releases detection & response framework for managed file transfer software

5 min read - The mass exploitation of managed file transfer (MFT) attacks is on the rise. To empower cybersecurity defenders, IBM Security X-Force has released a common framework for detection and response for MFTs.

Defensive Security July 18, 2023

X-Force certified containment: Responding to AD CS attacks

6 min read - This post was made possible through the contributions of Joseph Spero and Thanassis Diogos. In June 2023, IBM Security X-Force responded to an incident where a client had received alerts from their security tooling regarding potential malicious activity originating from…

Defensive Security March 30, 2023

X-Force prevents zero day from going anywhere

8 min read - This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities…

Offensive Security March 20, 2023

When the absence of noise becomes signal: Defensive considerations for Lazarus FudModule

7 min read - In February 2023, X-Force posted a blog entitled “Direct Kernel Object Manipulation (DKOM) Attacks on ETW Providers” that details the capabilities of a sample attributed to the Lazarus group leveraged to impair visibility of the malware’s operations. This blog will…

Defensive Security January 17, 2023

Self-Checkout This Discord C2

5 min read - This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by…

Defensive Security December 21, 2022

Beware of What Is Lurking in the Shadows of Your IT

6 min read - This post was written with contributions from Joseph Lozowski. Comprehensive incident preparedness requires building out and testing response plans that consider the possibility that threats will bypass all security protections. An example of a threat vector that can bypass security…

Incident Response October 24, 2022

What drives incident responders: Key findings from the 2022 incident responder study

4 min read - Cyberattacks seldom happen when it’s convenient. In fact, it’s relatively common for them to occur on weekends or holidays — threat actors capitalize on the fact that there is fewer staff on site, and those who are there are focused…

Defensive Security June 1, 2022

Countdown to ransomware: Analysis of ransomware attack timelines

13 min read - This research was made possible through the data collection efforts of Maleesha Perera, Joffrin Alexander, and Alana Quinones Garcia. Key highlights The average duration of an enterprise ransomware attack reduced 94.34% between 2019 and 2021: 2019: 2+ months — The…

Incident Response April 25, 2022

Solving the Data Problem Within Incident Response

3 min read - One of the underappreciated aspects of incident response (IR) is that it often starts as a data problem. In many cases, IR teams are presented with an effect such as malware or adversary activity and charged with determining the cause…

Malware March 15, 2022

CaddyWiper: Third wiper malware targeting Ukrainian organizations

3 min read - On March 1, 2022, ESET reported a third destructive data wiper variant used in attacks against Ukrainian organizations dubbed as CaddyWiper. CaddyWiper’s method of destruction is by overwriting file data with “NULL” values. This is the fourth sample of malware…

Malware March 4, 2022

New wiper malware used against Ukranian organizations

3 min read - March 7, 2022 Update A correction has been applied to this blog, further analysis of the wiper malware revealed that the wiper leverages an implementation of the Mersenne Twister pseudorandom number generator (PRNG) and not ISAAC PRNG as originally reported.…

Failed to load data

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.

Subscribe today

Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats.

Cybersecurity News By Topic By Industry Exclusive Series X-Force Podcast Events Contact About Us

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

John Dwyer

X-Force uncovers global NetScaler Gateway credential harvesting campaign

X-Force releases detection & response framework for managed file transfer software

X-Force certified containment: Responding to AD CS attacks

X-Force prevents zero day from going anywhere

When the absence of noise becomes signal: Defensive considerations for Lazarus FudModule

Self-Checkout This Discord C2

Beware of What Is Lurking in the Shadows of Your IT

What drives incident responders: Key findings from the 2022 incident responder study

Countdown to ransomware: Analysis of ransomware attack timelines

Solving the Data Problem Within Incident Response

CaddyWiper: Third wiper malware targeting Ukrainian organizations

New wiper malware used against Ukranian organizations

{{{title}}}

Topic updates