How we are different

• First-to-market research: BlackBerry’s Threat Research and Intelligence Team has released numerous first-to-market research reports over the past year leveraging BlackBerry’s data-driven digital ecosystem and analytical capabilities. These research reports have revealed new developments in the ransomware and malware space, and targeted, state-sponsored APT activity, including Symbiote, DCRat, Chaos Yashma ransomware and LokiLocker, all of which have been well-received by BlackBerry customers and the broader security community.

• Unique analysis in quarterly Threat Report: BlackBerry is uniquely positioned to uncover threats that affect industries that aren’t often discussed in other reports. BlackBerry’s latest Threat Report, now released on a quarterly basis, includes analysis of GuLoader and the BlackCat ransomware group, that targets small-to-medium sized enterprises, largely in the manufacturing sector, and threaten victims to ‘leak’ compromised data to further extort their ransom. In the report, BlackBerry also explores the pernicious threats targeting macOS, malicious codes that are sometimes even explicitly downloaded by users. BlackBerry researchers noted that 34 percent of client organizations using macOS had Dock2Master on their network, which collects user data from its own ads.

• Putting research into practice: In 2022, BlackBerry released Finding Beacons in the Dark: A Guide to Cyber Threat Intelligence, the most comprehensive collection of cyber threat intelligence (CTI) focused on Cobalt Strike team servers. The e-book educates organizations on what they can do to proactively protect their devices and networks from the growing threat of Cobalt Strike beacons and team servers by outlining key CTI concepts and how to build an effective CTI program. Highlights include tips for building detailed profiles of threat actors, broadening knowledge of existing threat groups, tackling ongoing and new threat actor campaigns, providing intelligence for SOC analysis and incident responders, fine-tuning security and IDS/IPS solutions, and ascertaining campaign timelines for future attacks and incident response engagements.