Weekly Cyber Briefing: 27 October 2025

Assured’s CISO reacts:

We’ve all lived in hope that AWS will never fail. This recent outage brings to light the blind faith we have in AWS, GCP, Azure, and the SaaS applications we depend upon. Key services with time-criticality to our business or customers should trigger the following considerations:

• Are our own apps and data in cloud infra, deployed with multi-region failover? If serving multiple jurisdictions, it is common for different regions to provide resiliency for one another.
• Going even further, are our apps and data deployed to multi-cloud (or can they be from back up) so GCP can provide the platform if AWS were to fail (or vice versa)?
• Is the SaaS we consume built with multi-region resilience? We often want to know which region it’s in from a GDPR/DPA18 compliance lens, but what about which regions?
• We may have the back-ups for the data and app configurations, but can we use them or deploy them if the entire enterprise app were to fail? E.g., we might have Salesforce data, but we need somewhere to deploy it if Salesforce.com isn’t available. In this example, HubSpot can’t take a Salesforce backup, so find a solution that keeps the business running.

Assured’s CISO reacts:

This is another example of the dangers of placing sensitive data with a supplier. We know that Lynx was the ransomware group behind the attack, so we’ve looked into how to protect from their most common TTPs, including:

• Deletes shadow copies and disables snapshotting on both Windows and Linux/ESXi.
• Encrypts with AES-128 CTR + Curve25519, and renames files.LYNX, and uses restorable encryption APIs.
• Enumerates file shares, mounts hidden volumes, and accesses network drives to find and encrypt as much data as possible

1: T1078.004 – Valid Accounts: Cloud Accounts

Mitigation: M1030 – Use Strong Authentication
Platform: Intune

Implementation (Intune):

• Require devices to be Azure AD joined and compliant using a custom compliance policy:
• Apply Conditional Access to require MFA + compliant device for all vendor accounts:
  • Risk: Medium & High
  • Grant: Require MFA, Require a compliant device
  • Session: Re-auth every 12 hrs

2: T1543.003 – Create or Modify System Process: Windows Service

Mitigation: M1042 – Control Application Access
Platform: GPO

Implementation (GPO):

• Restrict login rights for vendor accounts:
  • Deny log on through RDP = ThirdPartyServiceAcct
• Disable elevation visibility:
  • Enumerate admin accounts on elevation = Disabled
  • Enable command-line auditing:
    Audit Process Creation > Include command line = Enabled.

3: T1021.002 – Remote Services: SMB/Windows Admin Shares

Mitigation: M1026 – Audit Network Share Access
Platform: Intune

Implementation (Intune):

• Enable audit policies using OMA-URI:
• Enable ASR rule in Endpoint Security:
  • Rule: “Audit access to network shares by untrusted processes”
  • Trigger alert on share access by vendor accounts outside business hours.

4: T1490 – Inhibit System Recovery

Mitigation: M1023 – Restrict System Access to Essential Systems
Platform: GPO

Implementation (GPO):

• Limit Shadow Copy service:
  • Volume Shadow Copy service → Startup: Manual or Disabled
  • Run under a restricted service account, not LocalSystem
• Lock down the VSS folder:
  • Remove inheritance on C:\System Volume Information
  • Permit only SYSTEM and Administrators

5: T1570 – Lateral Tool Transfer

Mitigation: M1049 – Minimize Lateral Movement
Platform: Intune

Implementation (Intune):

• Use AppLocker in Intune via OMA-URI to deny vendor tools:
  • Deny execution in C:\Users\ThirdPartyVendor\Tools\*
• Device restrictions:
  • “Private network sharing” = Not allowed
  • “Prohibit access to removable storage” = Yes
  • “Prohibit cross-domain connectivity” = Yes

6: T1486 – Data Encrypted for Impact

Mitigation: M1018 – Data Backup and Recovery
Platform: GPO

Implementation (GPO):

• Enable audit for VSS deletion:
  • Advanced Audit Policy > Object Access > Audit File System = Success, Failure
  • Set SACL on snapshot dirs for Audit: Delete → Fail
• Prevent backup deletion:
  • Windows Components > Windows Backup > Prevent deletion of backups = Enabled
  • Create Scheduled Task (hourly):

Get-VolumeShadowCopy | Out-File “C:\Logs\VSSList.log” -Append

./Device/Vendor/MSFT/AppLocker/ExecutableRules/Policy

./Device/Vendor/MSFT/Policy/Config/WindowsEventLogging/EnableAuditObjectAccess = 1
./Device/Vendor/MSFT/Policy/Config/WindowsEventLogging/AuditDetailedFileShareAccess = 1

CSP: ./Device/Vendor/MSFT/Policy/Config/Identity/RequireDeviceAzureADJoined = true
CSP: ./Device/Vendor/MSFT/Policy/Config/Identity/RequireDeviceCompliant = true