A Log4j threat actor was stopped
At 3 a.m., Huntress called Blue Tree Technology® about an active hack on a client server.
The challenge
In late 2021, the Log4j vulnerability was the problem. The vendor had already patched. Threat actors found a way in after that patching, and a client was affected. The Cybersecurity and Infrastructure Security Agency published Apache Log4j vulnerability guidance.
What happened
Blue Tree Technology® got a call from Huntress at 3 a.m. Huntress was tracking an active hack that needed to be addressed immediately. Huntress gave the machine name where the attacker came in, and a specific way to check where the malicious file was. That check confirmed which server had the problem.
How it was detected and stopped
Blue Tree Technology® called the client's hosting provider, who shut the server down. The threat had not spread. The system was restored from a clean backup taken before the compromise.
The outcome
Huntress had caught it, and Blue Tree Technology® had a plan. The client's owner asked whether there was anything he needed to do. The answer was no. He asked for an update.
At the time, Blue Tree Technology® was evaluating Huntress. The other security vendor Blue Tree Technology® used also called about the same threat, three weeks later. That gap was a major deciding factor in choosing to work with Huntress, a company on top of security the way Blue Tree Technology® demanded.
Lessons for small and midsize businesses
- A phone call from a real SOC cut through the alert noise. An email-only alert could easily have been missed among all the tools' notifications.
- Afterwards, Huntress was rolled out on every device.
- Blue Tree Technology® uses automated RMM monitoring plus MDR, EDR, and ITDR with a SOC that watches for and blocks threats.
Talk with Blue Tree Technology®
If you want to talk through detection and response for your business, contact Blue Tree Technology®.