This year has been a challenging one for organizations that faced data breaches, intrusions and ransomware attacks at the hands of cyber criminals and nation-state attackers. Cybersecurity firm FireEye announced on Dec. 8, 2020, that an adversary targeted and gained unauthorized access to its Red Team tools — an important call to every company to remain vigilant and be prepared for a potential incident.

FireEye reported that the attack affected its networks and released information to the industry and authorities. As part of its rapid response, the company has released countermeasures (posted to GitHub) that can help detect or block the use of their stolen Red Team tools.

This incident underscores that any organization can be targeted and attacked by a persistent and sophisticated adversary. In this case, FireEye notes the tactics used against it are “consistent with a nation-state cyber-espionage effort.”

Among the many incidents that plagued companies this past year, this serves as a reminder of the necessity of methodical preparation for when an incident may occur, including:

• Have an incident response plan and an internal team in charge of incident identification and escalation.
• Develop incident response plans according to risks and threats that apply to your organization, practice the plans and ensure key leaders know their roles.
• Prepare and rehearse your cyber crisis management plan. If your executives, communications, legal, finance and marketing teams are meeting for the first time on how they would respond to an incident in the hours after one occurs, it is too late.
• As needed, have an incident response firm on retainer and know when to call for help and who makes that decision as quickly as possible.

IBM Security’s X-Force team will provide additional materials about the incident on X-Force Exchange. Please visit often or subscribe to receive email notifications to stay up to date. Please revisit this blog for additional updates as relevant.

If your organization requires immediate assistance with incident response, please contact IBM Security X-Force’s US hotline 1-888-241-9812 or Global hotline (+001) 312-212-8034. Learn more about X-Force’s threat intelligence and incident response services.