Article
SIEM vs. XDR: Advances in Security Monitoring and Cyber Defense
Arete Analysis
Cybersecurity 101
The cybersecurity industry is chockfull of jargon, abbreviations, and acronyms. So much so that it can often be difficult to decide which tools may provide the best protection for your company. To help, we’d like to clarify some terms and review the benefits of a few solutions.
Let’s begin with SIEMs
Security information and event management (SIEM) technology has been around for a long time. Having evolved from log aggregation, log management, and event management, SIEMs serve to collect, aggregate, analyze, and store large volumes of log data from across numerous systems.
SIEM vendors began by taking a broad approach and collecting available log and event data from almost any source across an enterprise. Over time, they extended a SIEM’s reach from the office to the manufacturing floor and beyond. The goal was to gain more complete visibility across an organization’s landscape — from firewalls and switches to operating systems and applications. Unfortunately, the level of detail in the data from each source is typically low. In other words, SIEMs provide wide, but shallow data sets, which requires far more work to derive meaning from them — and work is time and money.
Not only can it take years to map all the low–resolution log data to a meaningful alert, but also, with COVID–19 creating the new work–from–home norm, companies are now gathering far few system logs. Thanks to alternative, cloud–based solutions, many users simply never need a virtual private network (VPN) to communicate back to the company network.
Even though many SIEM solutions are adding agents to endpoints to gather and push logs to a cloud collector, if a person is working from home and not accessing the network for data, why create alerts from that computer’s logs if they don’t affect the security of the internal network? This would require a security engineer to further tune segregation issues — and that’s if you’re lucky enough to have an engineer on staff.
The advantages of EDR and XDR
Today, extended detection and response (XDR) tools are gaining traction. As the name would imply, they are an evolution of endpoint detection and response (EDR) tools, which combine antivirus with post–detection analysis capabilities — for example, enhanced alerting, automatic stopping and quarantining of malicious behavior, signature– and threat intelligence–based detection, and full–blown artificial intelligence on systems for autonomous operations.
While an XDR solution may appear similar in function to a SIEM platform, it offers much more. And that’s why Arete chooses to use XDR with our Managed Detection and Response (MDR) service.
The XDR console lives in the cloud to allow for fast, accurate reporting on what’s occurring across your entire pool of assets. In fact, it provides rich metadata on every event that occurs on monitored endpoints; records every DNS request, file access, and intercommunication between computers; and uses artificial intelligence to detect inappropriate actions by programs and scripts, stopping them before they can affect the kernel or memory.
XDR can also threat hunt for indicators related to attack precursors, which allows us to notify you of inappropriate communications coming through your firewalls or from unprotected endpoints that may be connected to your environment. It also static detects badness as malicious actors touch or execute files. In short, it’s hard to hide from XDR — and in using it to protect the core systems that contain your data, Arete protects your ability to do business.
Other advantages XDR has over SIEMs include:
The ability to detect all assets on networks where company computers with the agent reside.
USB control to prevent exfiltration.
Firewall control native to Windows systems.
Network interface card control to stop communications in an emergency.
Vulnerability data on all covered Windows, Linux and Mac systems.
XDR tools are not only capable of reporting on ransomware damage, but their autonomous behavior-based capabilities can detect and stop ransomware before it can cause any damage.
Back to Blog Posts
Article
Arete's 2026 Q1 Crimeware Report
Harness Arete’s unique data and expertise on extortion and ransomware to inform your response to the evolving threat landscape.
Article
CMS Vulnerability Leads to ClickFix Campaign
Threat actors compromised at least 700 education and technology websites in a recent ClickFix campaign by exploiting a critical SQL injection flaw (CVE-2026-26980) in the Ghost content management system (CMS). Adversaries combined the vulnerability with the ClickFix social engineering tactic to steal admin keys and inject a malicious JavaScript that delivers a fake Cloudflare or CAPTCHA verification pop-up, tricking victims into copying and pasting a malicious command into their systems.
What’s Notable and Unique
Rather than targeting the end user first, this campaign is unique in its initial exploitation of the system, followed by social engineering attempts. This hybrid attack style is likely being leveraged to bypass traditional defenses.
This recent campaign also highlights how trusted web properties can be weaponized at scale and coupled with unpatched CMS vulnerabilities. Rather than using the CMS compromise to perpetrate a single attack, threat actors turned it into a supply-chain attack that ultimately affected over 700 trusted websites.
Analyst Comments
As network defenders and their tools enhance threat detection capabilities, adversaries increasingly seek methods to bypass these defenses. By combining vulnerability exploitation, social engineering techniques, and staging for ancillary attacks, this campaign successfully bypassed traditional defenses and inflicted significant impact. Defending against hybrid cyberattacks requires comprehensive security controls beyond simply patching vulnerabilities. Organizations should focus on limiting movement within the environment, detecting abuse of trusted applications, and preventing end-user manipulation.
Sources
700+ education and tech websites hijacked in huge ClickFix malware campaign
Under the engineering hood: Why Malwarebytes chose WordPress as its CMS
Think before you Click(Fix): Analyzing the ClickFix social engineering technique
Ghost CMS Vulnerability Exploited to Infect 700 Sites With ClickFix Malware
Article
Threat Actors Leverage Fake JPEG Files for Initial Access
In a recent campaign, researchers observed threat actors using fake JPEG image files as a delivery mechanism to initiate the deployment of additional malicious components. The false JPEG files are typically distributed via phishing emails or other social engineering-based lures, and are actually PowerShell-based malware that deploys a trojanized version of ConnectWise ScreenConnect to establish and maintain persistence in the compromised environment.
What’s Notable and Unique
This campaign leverages JPEG images as the initial lure, where the images are not merely decoys but part of the infection workflow. Victims are typically led to download or open an image that triggers hidden execution logic or redirects them to a payload-delivery sequence that initiates later stages of the intrusion chain.
The attack chain is designed to blend into legitimate environments, making detection more difficult. Execution typically relies on scripted or native Windows components, often including PowerShell or other living-off-the-land binaries, enabling fileless or near-fileless execution and reducing forensic artifacts on disk.
The multistage design ensures that the initial JPEG does not directly contain the full payload but instead triggers retrieval or decryption steps that progressively assemble the final malicious components in memory.
Analyst Comments
This campaign illustrates how threat actors continue to blur the line between legitimate file handling and malicious execution chains, indicating potential overlap with remote management or administrative tooling. The use of JPEG-based staging combined with script-based execution reflects a broader evolution toward a stealth-first intrusion design, in which file formats serve as triggers rather than payload containers.
Sources
OPERATION SILENTCANVAS : JPEG BASED MULTISTAGE POWERSHELL INTRUSION
Podcast
Cyber Risk and Insurance for Law Firms
In this episode of Bytes of Insight, host Vinny Sakore is joined by Laura Zaroski, Managing Director of the Law Firms Group at Gallagher, as they discuss the evolution of cyber risk for law firms. Tune in for firsthand insights on how to select the right cyber policy, the incident response process, and the nuances of ransom payments and sensitive data.