IBM X-Force IRIS Cyberattack Preparation and Execution Frameworks

The key to a good defense is to know your enemy. In the cybersecurity realm, that means defenders must understand how attackers operate to better protect against and counteract their attempts.

Adversarial goals and tactics, techniques and procedures (TTPs) can be very different for each incident, but all attacks share some core concepts that defenders can work with to expose malevolent activity before it causes damage.

Cyberattack Preparation Powered by Threat Intelligence

Those common core concepts are the foundation of IBM X-Force Incident Response and Intelligence Services’ (IRIS) cyberattack preparation and execution frameworks, which highlight the team’s unique approach to characterizing and communicating threat intelligence to help organizations protect their networks and users.

X-Force IRIS is a team of skilled professionals who proactively help organizations fortify their defenses against today’s evolving global threat landscape. The team’s approach helps security teams inside and outside of IBM understand the design and execution of a cyberattack in a detailed, organized manner. Analysts can use that insight to help identify and respond to threats that are relevant to their organization.

Read the White Paper to Learn More

This white paper presents frameworks that explain the range of activities that can occur both prior to and during an actual network compromise. Read the complete paper to learn:

Why X-Force IRIS developed cyberattack preparation and execution frameworks;
The key elements the frameworks address in the overall cyberattack model;
The key phases of cyberattacks that can help security teams improve prevention and response;
How to communicate complex threat information with ease and control.

You can also listen to the SecurityIntelligence podcast episode, “Fight Back with the X-Force IRIS Cyberattack Preparation and Execution Frameworks,” for more insights on attack preparation and response.

Read the white paper: IBM X-Force IRIS Cyberattack Preparation and Execution Frameworks

IBM Security X-Force Team

Hive0137 and AI-supplemented malware distribution

12 min read - IBM X-Force tracks dozens of threat actor groups. One group in particular, tracked by X-Force as Hive0137, has been a highly active malware distributor since at least October 2023. Nominated by X-Force as having the “Most Complex Infection Chain” in a campaign in 2023, Hive0137 campaigns deliver DarkGate, NetSupport, T34-Loader and Pikabot malware payloads, some of which are likely used for initial access in ransomware attacks. The crypters used in the infection chains also suggest a close relationship with former…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read - The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

16 min read - Since March 2024, IBM X-Force has been tracking several large-scale phishing campaigns distributing the Grandoreiro banking trojan, which is likely operated as a Malware-as-a-Service (MaaS). Analysis of the malware revealed major updates within the string decryption and domain generating algorithm (DGA), as well as the ability to use Microsoft Outlook clients on infected hosts to spread further phishing emails. The latest malware variant also specifically targets over 1500 global banks, enabling attackers to perform banking fraud in over 60 countries…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Cyberattack Preparation Powered by Threat Intelligence

Read the White Paper to Learn More

More from Threat Intelligence

Hive0137 and AI-supplemented malware distribution

Phishing kit trends and the top 10 spoofed brands of 2023

Grandoreiro banking trojan unleashed: X-Force observing emerging global campaigns

Topic updates