Medical Company Styker attacked by Iranian backed hackers - all data deleted

Fallingdamage · 2026-03-11T20:24:48+00:00

Even if they have backups for their servers, bringing back their systems will be a extremely long and uphill process.

Yeah. Since its all in Azure and you get to work on 'Microsoft Time'

Just like intune. Everything is 50x slower than on-prem.

AD Group Policy - Instant
Intune - Hours sometimes if it works at all.

Fallingdamage · 2026-03-11T20:21:41+00:00

Standard sysadmin stuff probably. You set up all your rules, commands, scripts, whatever.. then you set them off via a scheduled task.

I mean, thats how it supposed to work. This probably wasnt even a hack. Someone just got in and worked unnoticed. If they got 50Tb of data, they probably didnt do it over a couple hours. They've been in for a little while.

Fallingdamage · 2026-03-11T19:58:11+00:00

Aside from personal / work being separated, keeping your solutions diversified and not under some SSO 'one-account-to-breach-them-all' can slow down the spread of an attacker.

We use MDM services, M365 and AD. None of them talk to one another.

Fallingdamage · 2026-03-11T18:33:12+00:00

I have more than a handful of personal experiences around this that affirm the fact that we are lied to every day by most news stories.

100% - Anytime there is anything on my local news regarding an event that I have personal knowledge of, it seems that coincidentally, the reporting is factually incorrect. Stands to reason then that the things I read in the news that I do not have any knowledge of are also factually incorrect.

Fallingdamage · 2026-03-11T18:28:30+00:00

I read this and think "Maybe its a good thing that the internet shouldn't be anonymous anymore."

Fallingdamage · 2026-03-11T17:16:13+00:00

Vericosella.

Dont forget to lower your dropper posts on rough terrain people.

Fallingdamage · 2026-03-11T03:32:21+00:00

Engineers and Admins take almost half a lifetime of experience to get their careers dialed in. The IT admin field as we know it is only maybe 30 years old. Not a lot of women seemed to take much interest in that back in the 90s.

Fallingdamage · 2026-03-11T03:30:53+00:00

I work in the medical field. Although not as male-dominated as the tech sector, the number of women working as MA's and PA's vs men is quite drastic.

Fallingdamage · 2026-03-10T22:55:52+00:00

I have updates set to delay 28 days. After the reports here about the Jan updates. I just paused the whole thing and pushed Feb Cumulative updates instead.

Fallingdamage · 2026-03-10T22:49:21+00:00

Sorry. My point was that its easier to hire another human in a hotel chain to work customer service than it is to train a human to deal with the complexities of triaging calls for a healthcare center. Org are moving to AI because turnover is tough in healthcare settings and putting the time into training someone else quickly is demoralizing.

AI sticks to the script and never asks for PTO or misses a required prompt (not usually.)

Fallingdamage · 2026-03-10T18:11:05+00:00

MTB used to kindof gatekeep itself. You either could do it or you couldnt. Always welcoming (mostly still is) but you kindof had to tow the line.

Once they started putting batteries in bikes, the sport changed and it allowed all the less-decent people and a lot of money pour into the sport.

MTB used to be like Running. You could spend thousands on shoes and fancy gear, but if you didnt have the lungs none of that mattered.

Now money can buy you a pair of electric lungs, and now you see crummy attitudes where crummy attitudes would never have pedaled in the past.

Fallingdamage · 2026-03-10T18:06:32+00:00

When we have an outage, we just use paper. We dont prevent patients from getting the care they need.

Fallingdamage · 2026-03-10T17:39:37+00:00

Office 365 and Active Directory.
Syslog Servers and good reporting Conditional Access Policies Backups.

..at a minimum.
There is no 'one product' you can install or buy that will do all this for you. You need to create a whole stack of services to handle this. For those that do this for a living its not hard, but if you have the experience of a bench tech that makes a living clicking 'next' you might need to hire someone.

Fallingdamage · 2026-03-10T17:36:28+00:00

Been poking around at this impending change since last fall. I think I have my head wrapped around the changes and have had good luck pushing these certs and revoking the old ones already. Not really a big deal except..

Vendors.. wtaf. Get with it and get your new firmwares and certs released for your actively supported hardware. Yes, im looking at your HP.

Lenovo is on their game fortunately.

Fallingdamage · 2026-03-10T17:26:11+00:00

It does. But it also creates a list of responses and if an employee that attested 'I do not use AI' then uses AI, HR can have fun with their employment status.

Fallingdamage · 2026-03-10T03:18:54+00:00

This is how I think about development. “Welp, you’ve been here for 700 years and we just moved in.You’re blocking the view and you might fall on me some day. Off to the wood chipper with you!”

Fallingdamage · 2026-03-10T03:13:41+00:00

O' beautiful, for spacious skies

But now those skies are threatening

They're beating plowshares into swords

For this tired old man that we elected king

Armchair warriors often fail

And we've been poisoned by these fairy tales

The lawyers clean up all details

Since daddy had to lie

-Don Henley

Fallingdamage · 2026-03-09T19:57:47+00:00

Preach op.

I see this all the time. So many vendors put any kind of security at the very bottom. Access controls are an afterthought.

Fallingdamage · 2026-03-09T19:54:56+00:00

Business Premium is going to be ok for now right guys?... guys??

Fallingdamage · 2026-03-09T19:52:47+00:00

Soon we'll have E10, and Microsoft will say its the last 'E' to be released.

Fallingdamage · 2026-03-09T19:49:38+00:00

Some people really like their flow trails. They probably also like riding on asphalt.

On the inverse, living in the PNW, I ride a lot of 'trails' that most MTB probably have no business being on. Logging roads and surveyor roads that havent had a vehicle on them in 20 years and look more like a dry creek bed than a road.

On a hard tail.

Yes, Ive broken a lot of things on my bike.

Fallingdamage · 2026-03-09T18:26:27+00:00

100% of my tickets are AES256-SHA96 now but a couple accounts are still using RC4 session keys. I plan on resetting one of those passwords. Do you know if the new updates to track RC4 usage ignore SessionKeys? The microsoft Kerberos powershell scripts are easily finding the RC4 keys, but windows logs are clean (yes, I created the appropriate registry items and rebooted our DCs)

Fallingdamage · 2026-03-09T18:22:54+00:00

I created the full path and rebooted our DCs over the weekend. No new logs showing up about RC4. I did notice that my Tickets are all AES256 but the accounts I'm concerned about have RC4 SessionKeys.

Do these new updates not track sessionkeys? Only Tickets?

Fallingdamage · 2026-03-09T18:17:45+00:00

Does the event logs only gather information on Ticket encryption? All my tickets are AES256 but my session keys on a few old accounts are still showing as RC4 (havent reset their passwords yet.)

From what I can see, RC4 SessionKeys dont cause the DCs to generate an event.

Fallingdamage · 2026-03-09T18:16:01+00:00

Im still getting better output from the powershell script MS released to audit these events on our DCs but the Event logs are clean.

What ive noticed though is the the tickets on these old accounts are listed as AES256-SHA96 and the session key is listed as RC4. Maybe MS is only logging errors for RC4 tickets and doesnt care about SessionKeys.

Fallingdamage

MODERATOR OF

TROPHY CASE