Starting this week, Apple is releasing all-new series and films captured in Apple Immersive Video that will debut exclusively on Apple Vision Pro.

Design and construction decisions should be forward-thinking, considering environmental impacts across the entirety of the facility's lifespan — from initial installation, through maintenance, to expansion.

Apple TV+ today landed a record 72 Emmy Award nominations across 16 broadly celebrated Apple Originals.

With its focus on metal building systems, this MBMA guide fills a specific need in the market and positions the metal building industry as a leader in the energy efficiency space.

Apple teams up with experts in affordable housing development to launch the new Bay Area Housing Innovation Fund.

This symbiotic relationship also has implications for data centers. Several decades into the 21st century, the rise of digital transactions and the pivotal role of data centers highlight a critical challenge: the need for robust and sustainable energy infrastructure.

Elevate Technology: Enhance Security with Advanced Password ManagementBreached or stolen passwords are a significant cybersecurity issue, contributing to over 80% of data breaches. Hackers exploit weak, stolen, or reused passwords to gain unauthorized access, making secure password management crucial. In an era where passwords are integral to our d...

Within data centers, physical security technology emerges as an unexpected but strong ally in the pursuit of sustainability objectives.

In our previous brief, PinnacleOne highlighted the flashpoint risk in the South China Sea between the Philippines, its treaty allies – the U.S. and China.

This week, we focus executive attention on the likely future developments of AI’s application to offensive cyber operations.

Please subscribe to read future issues — and forward this newsletter to interested colleagues.

Contact us directly with any comments or questions: This email address is being protected from spambots. You need JavaScript enabled to view it.

Insight Focus | AI for Offensive Cyber Operations Isn’t Here…Yet

The hand of AI used in offensive cyber operations won’t have obvious fingerprints. Defenders are unlikely to find a fully autonomous agent on their network hacking away. Not only would attackers be risking a (currently) incredibly valuable system to discovery, but such a maneuver lacks something very important to the people executing attacks: control. Governments use many different legal frameworks, organizational structures, and oversight mechanisms to ensure that hacking operations are run intentionally, with acceptable risks, and (sometimes) deniability. Deploying a fully autonomous agent into a hostile environment creates so many unacceptable risks that it may only ever happen if innovations in defense compel it. Currently, it’s sufficiently easy to achieve most offensive objectives without AI.

Endpoint Detection and Response (EDR) has been the foundational technology of effective detection and response programs for many years, providing security teams with unparalleled visibility and response capabilities across end user systems, cloud workloads, and servers. While this remains true today, security operation centers (SOC) and incident response (IR) teams need additional capabilities ‘beyond the endpoint’ to protect modern enterprise environments.

In this blog post, learn how SentinelOne is extending the scope of our MDR service to provide 24×7 detection and response coverage across endpoint, cloud, identity, email, network, and beyond.

The Evolution of Endpoint Detection

In the early days of security monitoring and incident response, security teams relied primarily on network telemetry to identify and investigate cyber attacks. Direct visibility into activity on endpoints and servers was extremely limited, requiring SOC analysts and incident responders to infer what was happening within their environment based on network traffic to and from these systems.

This network-focused approach was reasonably effective – primarily because most network traffic was unencrypted, adding to the amount of alert ‘noise’ and making real threats hard to miss. However, as threats continued to evolve and encrypted network traffic became the norm, defenders struggled to maintain visibility into the infrastructure they were responsible for protecting.

Effective endpoint protection and endpoint detection and response (EPP/EDR) changed everything. Defenders gained full visibility into endpoint activity, such as detection of malware and other malicious activity, process execution, file system access, and network telemetry. Once a threat was identified, defenders could pivot quickly to incident response, collecting additional forensic artifacts, terminating malicious processes, and isolating compromised systems from the network thus limiting further incident scope and impact.

Apple today introduced HomePod mini in midnight, made with 100 percent recycled mesh fabric.

In many data centers, water-cooled chillers are paired with an open- or closed-circuit cooling tower for heat rejection. 

The Good | Feds Dismantle Major GenAI-Based Bot Farm Spreading Pro-Russian DisInformation Campaigns

In a joint international operation led by the FBI, law enforcement have seized two domain names and nearly a thousand social media accounts all controlled by a large bot farm dedicated to spreading Russian propaganda. Under the management of a Russian FSB officer and a deputy editor-in-chief at news organization Russia Today (RT), the bots have spread disinformation campaigns globally through a generative AI-based software called Meliorator since 2022. Based on the FBI’s findings, RT leadership have been focused on expanding their information dissemination beyond traditional television.

Meliorator allowed the bot farm operators to create highly convincing X (formerly Twitter) profiles and personas designed to amplify Russian foreign interest as well as false narratives in order to sway public opinion and fuel discord online. As of June 2024, the functionality of the generative AI software was limited to X, but the FBI are predicting its expansion into other social networks with time. Use of Meliorator has been seen across Germany, Israel, the Netherlands, Poland, Spain, Ukraine, and the United States.

As part of the joint operation, the two domains mlrtr[.]com and otanmail[.]com used to register the bots were seized alongside 968 X accounts directly linked to RT’s bot farm. This is a first major action in disrupting Russian state-sponsored social media bot farms. A joint advisory between all involved global law enforcement agencies provides a technical breakdown of the Meliorator software, recommended mitigation measures, and a list of resources on combating malign influence and disinformation campaigns. X has since suspended the remaining bot accounts listed in court documents for violating the platform’s terms of service.

The Bad | Scammers Leverage Over 700 Domains to Sell Fake Tickets to Olympic Events

As anticipation for the Olympics mounts, threat actors are ramping up their large-scale fraud campaigns designed to target hopeful buyers seeking tickets to the Paris Summer games. Security researchers tracking the activity have dubbed the campaign ‘Ticket Heist’ where threat actors offer fake tickets to Olympic events and other major sports games, concerts, and music festivals.

Researchers found that the threat actor began registering domains in 2022, averaging 20 new registrations each month since. With online hype surrounding the Olympic games and discussion about the International Olympic Committee’s ban on Russian and Belarusian athletes rising, analysts tuned in to monitor increasingly suspicious activities. They uncovered 708 domains hosting convincing websites all selling fake tickets and accommodation options for the summer games.

I have been working in technology sales for over 25 years, starting out as a sales rep carrying a bag and a quota. The industry landscape looks radically different today than it did early in my career, but one thing will forever remain unchanged. The organization you choose to work for is paramount to your happiness and long-term success.

SentinelOne is a global leader in AI-powered security. Our Singularity Platform detects, prevents, and responds to cyberattacks at machine speed, empowering organizations to secure endpoints, cloud workloads, containers, identities, and mobile and network-connected devices with speed, accuracy, and simplicity. Leading enterprises, including Fortune 10, Fortune 500, Global 2000 companies, and prominent governments trust us to Secure Tomorrow.

There’s never been a better time to join SentinelOne. We are looking for talented, experienced sales people to join our team who are hungry for a life-changing career opportunity. I am incredibly fired up about where we are going, and I’d like to share more about what makes SentinelOne so special. For me, it’s the PEOPLE, PLATFORM, PERFORMANCE, AND POTENTIAL at our company that makes this a great place to work.

The PEOPLE Are Behind the Magic at SentinelOne

It starts at the top. Our CEO, Tomer Weingarten, is a true visionary. We enjoy the full support of his strategic engagement as a customer-first leader. Since founding SentinelOne 11 years ago, Tomer has not slowed his relentless pursuit of what’s next in a competitive landscape that changes by the second.

I joined SentinelOne eight months ago and reinforced our strong sales leadership team by hiring proven leaders with growth at scale to guide our teams to their full potential. These industry-leading experts have the experience we need during this next stage of hypergrowth as we continue to enhance our GTM prowess – this includes expanding our partner ecosystem, rapidly evolving our speed to market and ongoing investment in sales specialists and support functions. Their fresh perspectives blended with the excellence, effort, and experience of our tenured Sentinels are the perfect recipe for sustained growth.

Autonomous vehicles have captured the imagination of humans for decades. There are few examples of fully autonomous vehicles available today, designed for limited commercial use, but there is international consensus on what fully autonomous vehicles are and the standards by which they are measured. Autonomous flight is also quickly becoming one of the most popular, and controversial topics in aviation, known as “continuous autopilot engagement”, where machine learning-based algorithms are handling all necessary flight tasks from engine start through full navigation, landing, and shutdown.

In every case, security and safety are paramount due to the potential of harm to life and limb; therefore, we see that automation in transportation usually starts with features that increase security and enhance safety. The goal, however, is to make travel inexpensive and accessible to everyone while increasing efficiency and lowering cost. Whether referring to it as autonomy or automation, the truth is that artificial intelligence (AI) is progressively making these seemingly science fiction-based notions a reality.

There are many parallels that can be drawn between autonomous driving cars and what can be referred to as the Autonomous Security Operations Center (ASOC). Although it is still quite far off, this blog takes a deep dive into the key characteristics that would make the ASOC a reality and what this could mean in accelerating autonomous security operations based on well-defined levels of autonomous driving (Level 0-5).

From Autonomous Vehicles to Autonomous SOC

In traditional travel, it is typical to see one driver for one vehicle and one pilot for one aircraft. The same goes for cybersecurity – there is typically one analyst for one investigation or incident. Nowadays, one driver can monitor many highly automated vehicles with no steering wheels and no brake pedals. A single pilot can control and monitor many aircrafts. Soon, the information security community will see one security analyst handling many concurrent investigations or incidents through the use of AI-powered tools and agents.

Here are the key characteristics apparent within each level of the SAE international standards of driving automation:

Apple and MLB today announced the August schedule for “Friday Night Baseball,” a weekly doubleheader available to Apple TV+ subscribers.

Three new games join Apple Arcade in August, including Temple Run: Legends and Vampire Survivors+.

SentinelOne recently launched Singularity Operations Center, the new unified console, to centralize workflows and accelerate detection, triage, and investigation for an efficient and seamless analyst experience. This pivotal update includes integrated navigation to improve workflows and new and enhanced capabilities such as unified alerts management. Providing a deeper look into the Operations Center, this blog post focuses on how unified alert management enables faster and more comprehensive investigations for today’s security teams.

Accelerate Investigation with Centralized Alerts

Traditionally, security analysts must deploy multiple security tools to protect their organizations. Each individual tool manages alerts differently in addition to disconnected workflows among the tools themselves. With this approach, analysts are unable to correlate alerts across disparate solutions. This fragmented approach complicates the triage process, leading to an increased mean time to respond (MTTR) and potential oversight during an investigation.

To combat these challenges, SentinelOne developed the unified console to provide broader visibility and management across the security ecosystem. The Operations Center empowers teams to consolidate and centralize all security alerts into a single cohesive queue, including those from SentinelOne native solutions and industry-leading partners. This approach eliminates the need to pivot among disconnected consoles and work within disjointed workflows, providing seamless SOC workflows and facilitating rapid response to threats.

Use Case | Investigating a Lockbit Ransomware Infection

Engineered for speed and efficiency, LockBit is an advanced and pervasive ransomware strain. It leverages sophisticated encryption algorithms to rapidly lock down critical data within targeted networks. LockBit employs double extortion techniques, where attackers exfiltrate sensitive data before encryption and threaten to publish it on dedicated leak sites if their demands are unmet. It operates under a Ransomware-as-a-Service (RaaS) model, enabling affiliates to deploy the malware in exchange for a portion of ransom proceeds. Its attack vectors often include exploitation of vulnerabilities, phishing, and lateral movement within compromised networks, making it a versatile and potent threat. Continuous updates and modular capabilities allow LockBit to bypass traditional security measures, emphasizing the need for advanced detection and response strategies in defending against this threat.

Let’s explore how to investigate a LockBit infection in the Singularity Operations Center. After logging into the console, the Overview Dashboard provides a broad view of security alerts and related assets. There are multiple open alerts, ten of which are of high or critical severity. From the numerous open alerts, this example will focus on the critical alerts.

The Good | International Joint Operation Takes Down Over 600 IP Addresses Abusing Cobalt Strike Tool

Hundreds of IP addresses abusing Cobalt Strike have been shut down in a joint effort involving law enforcement across several nations. Codenamed “Morpheus”, the joint operation resulted in flagging 690 IP addresses and domains used to infiltrate victim networks. So far, 593 of them have been taken offline.

The servers flagged in Operation Morpheus used old, unlicensed versions of Cobalt Strike – a popular penetration testing tool used by red teams to simulate cyberattacks in order to evaluate the security posture of a network. Over the years, cracked, stolen, or reverse-engineered versions of the tool have made their way into the hands of malicious actors, enabling them to carry out a host of complex and damaging attacks.

Although the tool is legitimate and designed for threat emulation exercises and supporting offensive security operations, Cobalt Strike continues to be a double-edged sword being widely exploited and gaining a reputation on the dark web as a ‘go-to’ network intrusion tool. Illicit versions of Cobalt Strike, often accompanied by free training guides and tutorial videos, have lowered the barrier for entry into cybercrime, allowing criminals with limited funds or technical expertise to launch sophisticated attacks.

The success of Operation Morpheus is the result of collaboration between the United Kingdom’s National Crime Agency, authorities from Australia, Canada, Germany, the Netherlands, Poland, the United States, and various industry partners providing analytical and forensic support.

While acting as a virtual command post for the three-year-long operation, Europol confirmed that over 730 pieces of cyber threat intelligence and close to 1.2 million IoCs were shared between all participating parties. International disruptions like Operation Morpheus are critically effective in removing the tools and services that underpin cybercriminal infrastructure online.

When combined with the €1.5 billion investment from AustralianSuper in September 2023, Vantage has raked in a whopping $11 billion in new investment over the past nine months.