containment
2 posts
Article
CISA is holding the leak with its hands
CISA is in containment mode after a data leak. What containment actually means, what failed, and why the assurance claim is now suspended.
Article
Encrypted files are writing back to disk
Active ransomware event analysis from an operator perspective: what failed, the underlying mechanism, and the conditions that must now hold.