Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Advisory 15 January 2025 – Microsoft, Adobe, Cisco, Ivanti, Fortinet, GitHub, SAP, SonicWall, Zyxel, Google Chrome and Zoom Security Updates - updated
Black Arrow Cyber Advisory 15 January 2025 – Microsoft, Adobe, Cisco, Ivanti, Fortinet, GitHub, SAP, SonicWall and Zyxel Security Updates
Updated
Since writing further updates have been released for another Ivanti vulnerability, this time affecting Endpoint Manager, as well as updates for Google Chrome, to address 132 fixes and 16 unique security issues, and Zoom to address a number of security issues across Windows, Mac and Linux clients.
See more details on each of those in the relevant sections below
Executive Summary
Microsoft’s Patch Tuesday for January 2025 started the year with security updates for 159 flaws, including eight zero-day vulnerabilities, with three actively exploited in attacks. This Patch Tuesday also included fixes for twelve critical vulnerabilities, including information disclosure, privileges elevation, and remote code execution flaws.
Several other major software and hardware vendors released critical security updates this month to address vulnerabilities that could be exploited by attackers. Adobe issued updates for popular products such as Photoshop, Illustrator for iPad, and Animate, while Cisco addressed issues across multiple tools, including ThousandEyes and Crosswork Network Controller. Ivanti and Fortinet tackled zero-day vulnerabilities actively exploited in attacks, with Ivanti focusing on Connect Secure and Fortinet on its FortiOS and FortiProxy platforms.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an attacker to compromise the confidentiality, integrity and availability of the affected applications and the organisations data on the affected systems.
What can I do?
Black Arrow recommends applying the available security updates for all supported versions of products that have been impacted by the various vulnerabilities. The updates should be applied as soon as possible for actively exploited vulnerabilities and all other vulnerabilities that have a critical or high severity ratings.
Microsoft
Further details on specific updates within this Microsoft patch Tuesday can be found here:
https://msrc.microsoft.com/update-guide/releaseNote/2025-Jan
Adobe, Cisco, Ivanti, Fortinet, GitHub, SAP, SonicWall & Zyxel - updated to include Google Chrome and Zoom
Further details of the vulnerabilities in affected Adobe, Cisco, Ivanti, Fortinet, GitHub, SAP, SonicWall and Zyxel products can be found here:
https://helpx.adobe.com/security/security-bulletin.html
https://sec.cloudapps.cisco.com/security/center/publicationListing.x
https://www.ivanti.com/blog/january-security-update
https://github.blog/open-source/git/git-security-vulnerabilities-announced-5/
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2025.html
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0003
https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_14.html
https://www.zoom.com/en/trust/security-bulletin/?cms_guid=false&lang=en-US
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Intelligence Briefing 10 January 2025
Black Arrow Cyber Threat Intelligence Briefing 10 January 2025:
-Phishing Click Rates Triple in 2024
-What Boards Need to Know on Digital and Cyber Security Governance In 2025
-Only 26% of Europe’s Top Companies Earn a High Rating for Cyber Security
-Breach Readiness: Elevating Your Security Posture in a Constantly Evolving Threat Landscape
-Ransomware Shock: $133 Million Paid, 195 Million Records Compromised
-Operational Incident Reporting: UK Financial Regulators Propose New Rules
-Insider Threat: Tackling the Complex Challenges of the Enemy Within
-The Big Question: Are Businesses Now in the Front Line for Cyber Warfare?
-How Cyber Security Jargon Creates Barriers and Wastes Resources
-Scammers Exploit Microsoft 365 to Target PayPal Users
-Five Ways to Make Cyber Security Resilience More Than Just a Buzzword
-Meet the Chinese ‘Typhoon’ Hackers Preparing for War
-The Cyber Security Priorities For 2025: What Leaders Should Focus On
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Exec Summary
Cyber security remains a critical priority for organisations in 2025, with evolving threats demanding stronger leadership, governance, and proactive resilience measures. Phishing click rates surged by 190% in 2024, with cloud applications as primary targets and a shift in attack vectors from email to search engines and malicious ads. Meanwhile, ransomware inflicted $133.5 million in payouts, and insider threats posed complex risks, exacerbated by generative AI-enabled scams. Addressing these challenges requires a combination of advanced defences like zero trust architectures, improved governance frameworks, and clarity in communication to bridge knowledge gaps at the board level.
Governance is under heightened scrutiny as systemic risks grow. Only 26% of Europe’s top companies earned high ratings for cyber security resilience, while regulatory pressures, such as the EU’s DORA, underline the urgency for improved third-party risk management and operational resilience. Boards must prioritise expertise, particularly in AI, as gaps persist despite incremental progress. Leaders should integrate risk management across infrastructures to address geopolitical cyber warfare threats, emphasising supply chain security and AI-driven defences.
To sustain resilience, organisations must embed adaptability, automate responses, and foster cross-departmental collaboration. Strategic investments in skilled talent, incident readiness, and emerging technologies will help to ensure businesses not only survive but thrive amidst escalating cyber threats.
Top Cyber Stories of the Last Week
Phishing Click Rates Triple in 2024
Phishing click rates surged by 190% in 2024, with over eight in 1,000 users clicking phishing links monthly, according to Netskope. Cloud applications were the top targets (27%), primarily aiming to compromise accounts for illicit resale, of which Microsoft was the most targeted brand (42% of clicks), followed by banking (17%) and telco (13%) sectors. A shift was noted in phishing link locations from email-based attacks to search engines using SEO poisoning and malicious ads. Meanwhile, workplace adoption of GenAI apps rose to 94%, with organisations implementing controls such as app blocking (73%) and data loss prevention (45%).
What Boards Need to Know on Digital and Cyber Security Governance In 2025
In 2025, boardroom oversight of digital and cyber security will face increased scrutiny and expectations as systemic risks continue to grow. In 2024, cyber incidents cost UnitedHealth Group $2.5 billion and drove a 40% stock price drop at Crowdstrike, underlining the escalating consequences of poor governance. While 25% of S&P 500 directors now have cyber security expertise, up from 12% in 2020, gaps remain: 79% of boards report limited or no AI experience. Regulatory pressure, such as the European Central Bank (ECB) mandatory cyber expertise for bank boards, and frameworks like NIST CSF 2.0, signal the shift towards systemic reforms in boardroom governance.
Only 26% of Europe’s Top Companies Earn a High Rating for Cyber Security
A report by SecurityScorecard reveals that only 26% of Europe’s top 100 companies earn an A rating for cyber security resilience, with organisations rated A being 13.8 times less likely to experience a breach than those rated F. 98% of European companies faced third-party breaches in the past year, and 18% reported direct breaches, exposing gaps in internal defences. The energy sector lags significantly, with 75% of companies rated C or lower, while Scandinavian firms lead with only 20% scoring below B. As the EU’s DORA deadline looms, prioritising third-party risk management is critical for strengthening operational resilience.
Breach Readiness: Elevating Your Security Posture in a Constantly Evolving Threat Landscape
Organisations must now recognise that breaches are highly prevalent in today’s threat landscape, driven by increasingly sophisticated cyber attacks. Traditional perimeter-based defences, while essential, are no longer sufficient on their own. To mitigate the impact of inevitable breaches, adopting a zero trust approach and embedding microsegmentation can limit attackers’ movement within a network, reducing harm and operational disruption. While implementing such strategies demands cross-departmental collaboration and mindset shifts, gradual adoption can ease operational impacts. By becoming ‘breach ready’, organisations can maintain resilience, protect their reputation, and safeguard business continuity even in the face of persistent threats.
Ransomware Shock: $133 Million Paid, 195 Million Records Compromised
Ransomware continues to pose a significant threat to organisations globally, with a 2024 report revealing over 1,200 confirmed attacks and more than 195 million records compromised. Ransom payments reached $133.5 million, with an average payout of $9.5 million. Key sectors affected include business, healthcare, and government, while education saw a slight decline in incidents. Despite early signs of decreasing activity, ransomware attacks surged towards the end of the year, and experts warn of continued large-scale disruptions and data breaches in 2025. The lack of mandatory reporting in many regions further obscures the true scale of the threat.
Operational Incident Reporting: UK Financial Regulators Propose New Rules
UK financial regulators, including the FCA and PRA, are consulting on new operational incident reporting rules to strengthen operational resilience across the financial sector. The proposals aim to clarify when and how firms must report incidents such as IT outages or cyber attacks, focusing on consumer harm, market integrity, and safety risks. Firms would need to submit initial, intermediate, and final reports for each incident. Additionally, material third-party arrangements would require annual updates. These changes align with international standards like the EU’s DORA, and regulators may pursue enforcement for non-compliance. The consultation closes in March 2025.
Insider Threat: Tackling the Complex Challenges of the Enemy Within
Insider threats represent a growing challenge for organisations, with risks ranging from financial fraud and intellectual property theft to national security breaches. High-profile cases demonstrate how malicious insiders, such as bribed employees or malcontent staff, exploit weak detection systems. Sophisticated hiring scams, including the use of false identities, are increasingly enabled by generative AI. Prevention efforts include robust background checks, network anomaly detection, and sentiment analysis, but these methods are not foolproof. As technology evolves, organisations must balance effective detection with legal and ethical considerations to mitigate these complex and evolving risks.
The Big Question: Are Businesses Now in the Front Line for Cyber Warfare?
Recent reports highlight a growing shift towards cyber warfare, with businesses increasingly on the frontline of nation-state cyber attacks. The evolving threat landscape is driven by geopolitical tensions, with critical infrastructure, supply chains, and even civilian services becoming primary targets. Experts warn of a rise in AI-driven cyber weapons capable of bypassing defences and amplifying the scale of attacks. Organisations face heightened risks as ransomware evolves into a political weapon and the proliferation of IoT devices creates new vulnerabilities. A unified approach to security, integrating risk management across infrastructures, is essential to address the escalating threats in 2025.
How Cyber Security Jargon Creates Barriers and Wastes Resources
The cyber security industry, growing at 20% year-on-year, faces a critical communication challenge. Over-reliance on jargon and acronyms hinders understanding and creates barriers, particularly at the board level. Complex terms often obscure what tools do, limiting funding and leaving organisations vulnerable to cyber attacks. A shift toward clear, actionable language, focusing on securing source code, runtime applications, cloud environments, and supply chains, can break down silos and improve integration into development processes. By fostering clarity and inclusivity, organisations can better align security strategies with business priorities, ensuring both protection and efficiency.
Scammers Exploit Microsoft 365 to Target PayPal Users
Fortinet has identified a phishing attack exploiting PayPal's money request feature, leveraging Microsoft 365's Sender Rewrite Scheme (SRS) to bypass email authentication and deceive recipients. The scam involves legitimate-looking payment requests, making them hard to distinguish from genuine communications. Victims who follow the provided link risk granting scammers access to their PayPal accounts. Fortinet highlights the importance of employee education, robust data loss prevention (DLP) rules, and advanced AI-driven detection tools to identify unusual patterns, such as group messaging anomalies, and mitigate these increasingly sophisticated threats. Organisations must prioritise vigilance and proactive defences to combat such risks.
Five Ways to Make Cyber Security Resilience More Than Just a Buzzword
Organisations must shift from reactive approaches to a sustainable cyber security strategy to build true resilience. This means not just addressing immediate threats but embedding adaptability into core systems, enabling defences to evolve with emerging risks. Key measures include automating responses for agility, implementing zero trust architectures, and continuously improving through learning and self-healing mechanisms. By prioritising proactive preparation and fostering a culture of shared responsibility, businesses can move beyond survival to thrive amidst uncertainty, ensuring their defences are robust, adaptable, and future proof.
Meet the Chinese ‘Typhoon’ Hackers Preparing for War
Chinese state-sponsored hacking groups, labelled collectively as the "Typhoon" family, have emerged as a significant cyber security threat to the West, targeting critical infrastructure sectors like water, energy, and transportation. These groups, including Volt Typhoon, Flax Typhoon, and Salt Typhoon, have engaged in deep infiltration to prepare for potential disruptive cyber attacks. Notable incidents include the dismantling of botnets used to mask malicious activities, with over 100 intrusions identified by early 2025. Recent breaches by Salt Typhoon targeted telecoms, exposing sensitive communications data, including law enforcement surveillance systems, underscoring the escalating strategic risks posed by these operations.
The Cyber Security Priorities For 2025: What Leaders Should Focus On
A recent analysis highlights the evolving cyber security priorities for 2025, emphasising the critical role of leadership in driving resilience. As cyber threats become increasingly sophisticated, AI-driven attacks and supply chain vulnerabilities are top concerns, alongside stricter data privacy regulations. Leaders are encouraged to adopt zero trust principles, invest in skilled talent, and align security strategies with business objectives. Preparing for quantum computing’s impact on encryption is also vital. Practical steps include regular incident response testing, vendor risk assessments, and fostering a security-first culture. Effective leadership can turn robust cyber security into a competitive advantage.
Sources:
https://www.infosecurity-magazine.com/news/phishing-click-rates-triple/
https://www.helpnetsecurity.com/2025/01/06/european-companies-cybersecurity-rating/
https://www.jdsupra.com/legalnews/operational-incident-reporting-uk-2347989/
https://www.securityweek.com/insider-threat-tackling-the-complex-challenges-of-the-enemy-within/
https://www.techradar.com/pro/how-cybersecurity-jargon-creates-barriers-and-wastes-resources
https://www.infosecurity-magazine.com/news/scammers-exploit-microsoft365/
https://techcrunch.com/2025/01/06/meet-the-chinese-typhoon-hackers-preparing-for-war/
Governance, Risk and Compliance
Report: AI and security governance remain top priorities for 2025 - SD Times
What Boards Need To Know On Digital And Cyber Security Governance In 2025
The true cost of a security breach | TechRadar
So, you don’t have a chief information security officer? 9 signs your company needs one | CSO Online
Poor Cyber Hygiene can Cost Organizations up to an Average of $677 Million - Security Boulevard
Operational Incident Reporting: UK Financial Regulators Propose New Rules | A&O Shearman - JDSupra
Personal liability sours 70% of CISOs on their role | CSO Online
The Cyber Security Priorities For 2025: What Leaders Should Focus On
How CISOs can forge the best relationships for cybersecurity investment | CSO Online
The Cybersecurity Wake-Up Call for MSMEs in 2025 | Entrepreneur
Top 9 Cyber Loss Scenarios: A Year In Review, 2024 | Kovrr - Security Boulevard
How cyber security jargon creates barriers and wastes resources | TechRadar
Executive Leadership Under Siege: Cyber Security Predictions for 2025
Five ways to make cybersecurity resilience more than just a buzzword | SC Media
Brace yourself for cyber attacks | Professional Security Magazine
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Shock—$133 Million Paid, 195 Million Records Compromised
Ransomware attacks against critical infrastructure exceed 2K in a decade | SC Media
From $22M in Ransom to +100M Stolen Records: 2025's All-Star SaaS Threat Actors to Watch
Important Preventative Strategies For Avoiding And Recovering From Ransomware Threats
Space Bears Ransomware: What You Need To Know | Tripwire
Ransomware attacks on education declined in 2024, report shows | StateScoop
How to Protect Against Ransomware: Everything You Need to Know
Ransomware Victims
New York Hospital Says Ransomware Attack Data Breach Impacts 670,000 - SecurityWeek
Atos confirms third-party breach but rejects direct Space Bears compromise | SC Media
PowerSchool Reportedly Pays Ransom to Prevent Student Data Leak - Infosecurity Magazine
IT Giant Atos Responds to Ransomware Group's Data Theft Claims - SecurityWeek
Hackers release files stolen in cyberattack on Rhode Island benefits system | StateScoop
Dental Practice Pays State in Alleged Data Breach 'Cover Up'
Almost 8500 People Affected By Casio Data Leak
Ransomware Targeting Infrastructure Hits Telecom Namibia
Phishing & Email Based Attacks
Phishing Click Rates Triple in 2024 - Infosecurity Magazine
The top target for phishing campaigns - Help Net Security
Russian hackers turn trusted online stores into phishing pages | CSO Online
Fortinet warns of sophisticated phishing campaign exploiting Microsoft 365 domains - SiliconANGLE
Scammers Exploit Microsoft 365 to Target PayPal Users - Infosecurity Magazine
Neglected Domains Used in Malspam to Evade SPF and DMARC Security Protections
How to protect yourself from phishing attacks in Chrome and Firefox | ZDNET
Other Social Engineering
Fake Government Officials Use Remote Access Tools for Card Fraud - Infosecurity Magazine
Artificial Intelligence
Report: AI and security governance remain top priorities for 2025 - SD Times
Google Chrome AI extensions deliver info-stealing malware in broad attack | Malwarebytes
Cloud, AI, and cybersecurity converge on fintech landscape | SC Media
A NATO-backed startup says agentic malware could be here as soon as 2027
New AI Challenges Will Test CISOs & Their Teams in 2025
UK Government to Ban Creation of Explicit Deepfakes - Infosecurity Magazine
Deepfake advancements pose growing cyber security risks
How will the evolution of AI change its security? | TechRadar
Trolley Problem, Safety Versus Security of Generative AI - SecurityWeek
Why an “all gas, no brakes” approach for AI use won't work - Help Net Security
Innovation, Automation, And The Cyber Security Challenges Ahead
Malware
Google Chrome AI extensions deliver info-stealing malware in broad attack | Malwarebytes
A NATO-backed startup says agentic malware could be here as soon as 2027
Over 4,000 backdoors hijacked by registering expired domains
New Banshee Malware Targeting MacOS Users Remained Undetected For Months
Neglected Domains Used in Malspam to Evade SPF and DMARC Security Protections
PLAYFULGHOST Delivered via Phishing and SEO Poisoning in Trojanized VPN Apps
A Windows filetype update may have complicated cyber threat detection efforts | TechRadar
New Infostealer Campaign Uses Discord Videogame Lure - Infosecurity Magazine
Wallet Drainer Malware Used to Steal $500 Million in Cryptocurrency in 2024 - SecurityWeek
Researchers Expose NonEuclid RAT Using UAC Bypass and AMSI Evasion Techniques
Google warns of legit VPN apps being used to infect devices with malware | TechRadar
Top 5 Malware Threats to Prepare Against in 2025
Fake Government Officials Use Remote Access Tools for Card Fraud - Infosecurity Magazine
Advanced evasion techniques leveraged by novel NonEuclid RAT | SC Media
Bots/Botnets
US Sanctions Chinese Cybersecurity Firm for Global Botnet Attacks - Infosecurity Magazine
New Mirai Botnet Exploits Zero-Days in Routers and Smart Devices - Infosecurity Magazine
Gayfemboy Botnet targets Four-Faith router vulnerability
Mobile
FireScam Malware Campaign Highlights Rising Threat To Mobile Users
Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location
Millions of Vinted, Spotify and Tinder users' data could be compromised in global hack
Porn Ban—New Threat For iPhone, iPad, Android Users
Data Privacy: Your Carrier Knows a Lot About You. Here's How to Take Back Control - CNET
Android patches several vulnerabilities in first security update of 2025 | CyberScoop
This iOS 18 feature shares your photos with Apple for analysis. Should you be worried? | ZDNET
Android Under Attack—Users Warned As FireScam Threat Evades Detection
Apple rolls out mystery update with 'important bug fixes' for iPhones and iPads | ZDNET
First Android Update of 2025 Patches Critical Code Execution Vulnerabilities - SecurityWeek
Denial of Service/DoS/DDoS
Japanese Businesses Hit By a Surge In DDoS Attacks
Internet of Things – IoT
IoT's Regulatory Reckoning Is Overdue
Buying a smart home device? Look for this new cybersecurity seal - here's why | ZDNET
White House launches cybersecurity label program for consumers | CyberScoop
New Mirai Botnet Exploits Zero-Days in Routers and Smart Devices - Infosecurity Magazine
Gayfemboy Botnet targets Four-Faith router vulnerability
How vulnerable Ecovacs robot vacuums are being hacked | Kaspersky official blog
Tesla data helped police in Las Vegas. It highlights privacy concerns | AP News
Data Breaches/Leaks
Candy Crush, Tinder, MyFitnessPal: See the Thousands of Apps Hijacked to Spy on Your Location
Millions of Vinted, Spotify and Tinder users' data could be compromised in global hack
Atos confirms third-party breach but rejects direct Space Bears compromise | SC Media
PowerSchool Reportedly Pays Ransom to Prevent Student Data Leak - Infosecurity Magazine
The real cost of data breaches for businesses - Help Net Security
CISA says Treasury was the only US agency breached via BeyondTrust - Help Net Security
UN's aviation agency confirms attack on recruitment database • The Register
Largest US addiction treatment provider notifies patients of data breach
How to empower employees to prevent data leaks | Professional Security Magazine
Washington Attorney General Sues T-Mobile Over 2021 Data Breach - SecurityWeek
Dental group lied through teeth about data breach, fined $350,000 | Malwarebytes
Hackers Claim Massive Breach of Location Data Giant, Threaten to Leak Data
Medical billing firm Medusind discloses breach affecting 360,000 people
Excelsior Orthopaedics Data Breach Impacts 357,000 People - SecurityWeek
Mortgage Cos. Fined $20M Over Cybersecurity Breach - Law360
Almost 8500 People Affected By Casio Data Leak
Organised Crime & Criminal Actors
Malicious hackers have their own shadow IT problem | CyberScoop
Web3 Attacks Result in $2.3Bn in Cryptocurrency Losses - Infosecurity Magazine
Torturing hackers in prison: surviving as an act of protest | Cybernews
CISOs’ Top Cyber Security Threats 2025: Scattered Spider, Deepfakes, and More - Security Boulevard
Cyber Criminals Don't Care About National Cyber Policy
From $22M in Ransom to +100M Stolen Records: 2025's All-Star SaaS Threat Actors to Watch
Hacker Sentenced After Stealing Unreleased Coldplay Tracks
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Cryptocurrency wallet drainers stole $494 million in 2024
Wallet Drainer Malware Used to Steal $500 Million in Cryptocurrency in 2024 - SecurityWeek
Insider Risk and Insider Threats
Insider Threat: Tackling the Complex Challenges of the Enemy Within - SecurityWeek
83% of organizations reported insider attacks in 2024
Internal threats in the cloud | Professional Security Magazine
How to empower employees to prevent data leaks | Professional Security Magazine
How can organizations mitigate the security risks caused by human error?
Supply Chain and Third Parties
Widespread cyberattack targets Google Chrome extensions, compromises 2.6 million devices | TechSpot
Chrome Compromises Highlight Software Supply Challenges
OpenAI Blames Cloud Provider For ChatGPT Outage
Atos confirms third-party breach but rejects direct Space Bears compromise | SC Media
CISA says Treasury was the only US agency breached via BeyondTrust - Help Net Security
Cloud/SaaS
Cloud, AI, and cyber security converge on fintech landscape | SC Media
Internal threats in the cloud | Professional Security Magazine
OpenAI Blames Cloud Provider For ChatGPT Outage
From $22M in Ransom to +100M Stolen Records: 2025's All-Star SaaS Threat Actors to Watch
Fortinet warns of sophisticated phishing campaign exploiting Microsoft 365 domains - SiliconANGLE
Scammers Exploit Microsoft 365 to Target PayPal Users - Infosecurity Magazine
MSSPs Have a Role in Stopping Cloud Attacks Using Stolen Credentials | MSSP Alert
Unconventional Cyber Attacks Aim for PayPal Account Takeover
Hacker Sentenced After Stealing Unreleased Coldplay Tracks
Outages
OpenAI Blames Cloud Provider For ChatGPT Outage
Proton Mail still down as Proton recovers from worldwide outage
CrowdStrike bounces back after triggering largest IT outage in history
Identity and Access Management
Identity Security to Become a Focus in 2025, Experts Say | MSSP Alert
The Benefits of Implementing Least Privilege Access - Security Boulevard
Encryption
Around 3.3M POP3 and IMAP mail servers lack TLS encryption
Millions of email users at risk — passwords could be exposed to hackers, experts warn | Tom's Guide
Making the most of cryptography, now and in the future - Help Net Security
How to password protect a USB stick in less than 5 minutes - Which? News
Encryption backdoor debate 'done and dusted' • The Register
Mixed Messages: The Salt Typhoon Encryption Debacle | Benesch - JDSupra
How to encrypt any email - in Outlook, Gmail, and other popular services | ZDNET
Linux and Open Source
Open source worldwide: Critical maintenance gaps exposed - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Router reality check: 86% of default passwords have never been changed
MSSPs Have a Role in Stopping Cloud Attacks Using Stolen Credentials | MSSP Alert
Almost half Gen Z and Millennials have had their social media passwords hacked
Critical ‘Rising Risk’ Attack Alert—Change Your Router Password Now
Social Media
Meta ditches fact checking for community notes - just like on X | ZDNET
TikTok Ban Thrusts Apple (AAPL), Google Into US-China Geopolitical Fray - Bloomberg
E.U. Commission Fined for Transferring User Data to Meta in Violation of Privacy Laws
Almost half Gen Z and Millennials have had their social media passwords hacked
New Infostealer Campaign Uses Discord Videogame Lure - Infosecurity Magazine
UK universities join retreat from Elon Musk's X, citing misinformation on platform | Reuters
Meta exempted top advertisers from standard content moderation process
Meta Now Lets Users Say Gay and Trans People Have ‘Mental Illness’ | WIRED
Training, Education and Awareness
How to empower employees to prevent data leaks | Professional Security Magazine
8 Tips for Fortifying Your Cyber Defenses With a Human Firewall
Regulations, Fines and Legislation
New HIPAA Security Rules Pull No Punches
Cyber security law updates in the UK and the EU | Technology Law Dispatch
Operational Incident Reporting: UK Financial Regulators Propose New Rules | A&O Shearman - JDSupra
IoT's Regulatory Reckoning Is Overdue
White House launches cyber security label program for consumers | CyberScoop
UK Government to Ban Creation of Explicit Deepfakes - Infosecurity Magazine
Cyber criminals Don't Care About National Cyber Policy
Dental group lied through teeth about data breach, fined $350,000 | Malwarebytes
Dental Practice Pays State in Alleged Data Breach 'Cover Up'
Mortgage Cos. Fined $20M Over Cyber Security Breach - Law360
US has ‘a lot of work to do’ on network defences, departing cyber czar says - Defense One
Models, Frameworks and Standards
New HIPAA Security Rules Pull No Punches
E.U. Commission Fined for Transferring User Data to Meta in Violation of Privacy Laws
The ongoing evolution of the CIS Critical Security Controls - Help Net Security
The NIS2 Directive in Germany: Looking Ahead | Hogan Lovells - JDSupra
Data Protection
Huge Changes Predicted For The Data Privacy Landscape
Careers, Working in Cyber and Information Security
It’s Time Businesses Address The UK’s Cybersecurity Talent Shortage
Law Enforcement Action and Take Downs
Sharing of Telegram User Data Surged After CEO Arrest
Hacker Sentenced After Stealing Unreleased Coldplay Tracks
Misinformation, Disinformation and Propaganda
Meta ditches fact checking for community notes - just like on X | ZDNET
UK universities join retreat from Elon Musk's X, citing misinformation on platform | Reuters
Meta exempted top advertisers from standard content moderation process
Meta Now Lets Users Say Gay and Trans People Have ‘Mental Illness’ | WIRED
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Historical Warfare’s Parallels with Cyber Warfare - Australian Cyber Security Magazine
Preparing for Cybergeddon - defenceWeb
The Big Question: Are businesses now in the front line for cyberwarfare? - Emerging Risks Media Ltd
Shadows Of Power: Navigating The Complexities Of Global Security – Analysis – Eurasia Review
Nation State Actors
China
Meet the Chinese 'Typhoon' hackers preparing for war | TechCrunch
How Chinese Hackers Graduated From Clumsy Corporate Thieves to Military Weapons - WSJ
China cyber threats: What businesses can do to protect themselves | ITPro
UK cyber experts on red alert after Salt Typhoon attacks on US telcos | ITPro
China’s escalating cyber attacks highlight Biden, Trump differences - Defense One
Hackers Terrify US Intelligence After Infiltrating Guam - Bloomberg
After China's Salt Typhoon, the reconstruction starts now • The Register
FCC chief urges auction to fund 'Rip and Replace' program • The Register
Japanese police claim China ran five-year cyberattack • The Register
Mandiant links Ivanti zero-day exploitation to Chinese hackers | TechTarget
46 Japanese entities hit by cyberattacks since year-end - Japan Today
US-China: A Cyberwar With Internet Agents – OpEd – Eurasia Review
Taiwan claims China-linked ship damaged submarine cable • The Register
Taiwan raises alarm over increasing Chinese cyberattacks | Taiwan News | Jan. 5, 2025 15:31
TikTok Ban Thrusts Apple (AAPL), Google Into US-China Geopolitical Fray - Bloomberg
Mixed Messages: The Salt Typhoon Encryption Debacle | Benesch - JDSupra
Chinese APT Exploits Versa Networks Zero-Day Flaw | Decipher
Russia
WordPress phishing plugin drives online shopping fraud | SC Media
Russian hackers turn trusted online stores into phishing pages | CSO Online
Banshee: The Stealer That "Stole Code" From MacOS XProtect - Check Point Research
Cyber attacks on Ukraine in 2024: a 70% increase
'Russia's Google' Yandex ordered to hide maps of oil refineries after Ukrainian attacks
Hackers claim to have breached Russia’s real estate database, Moscow denies
Tools and Controls
Why Small Business Can't Rely Solely on AI to Combat Threats
Around 3.3M POP3 and IMAP mail servers lack TLS encryption
Confidently Secure: Leveraging PAM for Enhanced Protections - Security Boulevard
How to empower employees to prevent data leaks | Professional Security Magazine
Neglected Domains Used in Malspam to Evade SPF and DMARC Security Protections
Identity Security to Become a Focus in 2025, Experts Say | MSSP Alert
From Silos to Synergy: Transforming Threat Intelligence Sharing in 2025 - SecurityWeek
Top 6 Ways To Back Your Business Up With Cyber Threat Intelligence
Innovation, Automation, And The Cyber Security Challenges Ahead
The Benefits of Implementing Least Privilege Access - Security Boulevard
Google warns of legit VPN apps being used to infect devices with malware | TechRadar
Why Traditional Fraud Scores Are No Longer Enough for Modern Threats - Security Boulevard
8 Tips for Fortifying Your Cyber Defenses With a Human Firewall
How CISOs can make smarter risk decisions - Help Net Security
Other News
Only 26% of Europe's top companies earn a high rating for cybersecurity - Help Net Security
UK Internet Domain Registry Nominet Suffers Cyber Attack - ISPreview UK
The Cyber Security Wake-Up Call for MSMEs in 2025 | Entrepreneur
Magecart Attacks Surge as E-Commerce Security Struggles to Keep Pace - Security Boulevard
Cyber security deserves a place in the political spotlight | SC Media
Cyber resiliency should be top priority for investors | News | IPE
7 Lessons From A Year Of Unprecedented Cyber Attacks
2024 was worst year on record for commercial cyber attacks | Total Telecom
Rethinking cyber security in government: Prioritizing recovery and resilience | FedScoop
So, you don’t have a chief information security officer? 9 signs your company needs one | CSO Online
Vulnerability Management
Millions of Windows 10 PCs face security disaster as Microsoft ends support
Key Cyber Initiatives from CISA: KEV Catalog, CPGs, and PRNI | CISA
Vulnerabilities
Security pros baited by fake Windows LDAP exploits • The Register
Thousands of Buggy BeyondTrust Systems Remain Exposed
Tenable Disables Nessus Agents Over Faulty Updates - SecurityWeek
Mandiant links Ivanti zero-day exploitation to Chinese hackers | TechTarget
Android patches several vulnerabilities in first security update of 2025 | CyberScoop
Mitel MiCollab, Oracle WebLogic Server vulnerabilities exploited by attackers - Help Net Security
Chrome 131, Firefox 134 Updates Patch High-Severity Vulnerabilities - SecurityWeek
Surprise Google Chrome 131 Update For Windows, Mac, Linux, Android
Hackers are exploiting a new Ivanti VPN security bug to hack into company networks | TechCrunch
Another top WordPress plugin found carrying critical security flaws | TechRadar
First Android Update of 2025 Patches Critical Code Execution Vulnerabilities - SecurityWeek
WordPress Popular Posts Plugin Vulnerability Affects 100k+ Sites
Popular open source vulnerability scanner Nuclei forced to patch worrying security flaw | TechRadar
Dell, HPE, MediaTek Patch Vulnerabilities in Their Products - SecurityWeek
SonicWall urges admins to patch exploitable SSLVPN bug immediately
Palo Alto Networks Patches High-Severity Vulnerability in Retired Migration Tool - SecurityWeek
Apple rolls out mystery update with 'important bug fixes' for iPhones and iPads | ZDNET
UK Internet Domain Registry Nominet Suffers Cyber Attack - ISPreview UK
Gayfemboy Botnet targets Four-Faith router vulnerability
Chinese APT Exploits Versa Networks Zero-Day Flaw | Decipher
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 03 January 2025
Black Arrow Cyber Threat Intelligence Briefing 03 January 2025:
-Corporate Executives are Being Increasingly Targeted by AI Phishing Scams
-Unconventional Russian Attack Could Cause 'Substantial' Casualties, Top NATO Official Warns
-35 Chrome Extensions Began Stealing People's Data After the Developers Got Phished
-China's Cyber Intrusions Took a Sinister Turn in 2024
-Third Party Risk Management is Critical as DORA and New FCA Rules Come into Effect
-Ransomware 2024: A Year of Tricks, Traps, Wins and Losses
-The Modern CISO is a Cornerstone of Organisational Success
-Ransomware Reality Check: Are You Ready to Face Organised Cyber Crime?
-How Cops Taking Down Ransomware Gangs Led to the Meteoric Rise of Another
-Experts Unsure of Risk Appetite as EU Beefs Up Cyber Rules for Critical Infrastructure
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Summary
Cyber security threats in 2024 became more sophisticated, with AI-driven phishing, ransomware, and state-sponsored attacks presenting significant challenges. This week’s threat intelligence review shows that hyper-personalised phishing campaigns now account for 90% of successful cyber attacks, costing organisations an average of $4.9m per breach. Ransomware-as-a-service (RaaS) has lowered barriers for attackers, targeting critical sectors and driving recovery costs to $3m per incident.
Geopolitical tensions have intensified risks, with NATO highlighting hybrid attacks from Russia and China’s state-backed groups targeting critical infrastructure. These incidents underscore the vulnerabilities in sectors like energy and emergency services, necessitating urgent action to enhance resilience.
Supply chain security also remains a concern, with Chrome extension compromises demonstrating the risks of inadequate oversight. New regulations such as the EU’s NIS2 directive and UK Financial Conduct Authority (FCA) rules will push businesses to improve third-party risk management and compliance in 2025.
To combat these threats, organisations must adopt a cyber security strategy that considers zero trust architectures, multi-factor authentication, and robust incident response plans. Effective training and the strategic leadership of Chief Information Security Officers (CISOs) are critical in bridging security and business objectives, ensuring resilience against an evolving cyber threat landscape.
Top Cyber Stories of the Last Week
Corporate Executives are Being Increasingly Targeted by AI Phishing Scams
Corporate executives are increasingly targeted by sophisticated AI-driven phishing attacks, leveraging vast amounts of data to create hyper-personalised scams. Experts highlight a sharp rise in such attacks, with 90% of successful cyber attacks originating from phishing emails. These scams cost organisations significantly, with the global average cost of a data breach reaching $4.9m in 2024. Reports reveal a 28% increase in phishing attacks in Q2 2024, with some firms receiving up to 36 phishing emails daily. Businesses are urged to adopt multi-layered security measures and employee training to mitigate these escalating threats.
Unconventional Russian Attack Could Cause 'Substantial' Casualties, Top NATO Official Warns
NATO officials warn that hybrid attacks, particularly from Russia, are escalating to levels considered intolerable just five years ago, describing the situation as akin to "boiling the frog." These unconventional threats, including sabotage and cyber attacks, pose a "real prospect" of substantial casualties or significant economic harm. The rise in incidents is linked to Western support for Ukraine and Moscow's perception of NATO as an adversary. In response, NATO is updating its strategy on hybrid warfare, enhancing tracking of incidents and clarifying red lines to deter escalation, addressing ambiguities around thresholds for invoking Article 5.
35 Chrome Extensions Began Stealing People's Data After the Developers Got Phished
Recent reports have highlighted the risks associated with compromised Chrome extensions after a phishing campaign targeted developers. Attackers used fake Google warnings to trick developers into sharing login credentials, allowing them to introduce malicious updates to 35 extensions. These updates harvested data from users. Notably, even two-factor authentication was bypassed during the attacks, exposing vulnerabilities in the security process. Organisations are advised to review their use of Chrome extensions against published threat lists and ensure robust security awareness for staff managing digital assets to mitigate risks of similar incidents.
China's Cyber Intrusions Took a Sinister Turn in 2024
In 2024, Chinese state-backed cyber attacks took a concerning turn, moving from traditional espionage to pre-positioning for potential disruptive operations targeting critical infrastructure. Groups like Volt Typhoon have infiltrated US networks, including emergency services and the electric grid, using stealth techniques to avoid detection. Despite efforts to dismantle botnets, attackers maintain access to compromised systems, leveraging legitimate tools for reconnaissance and persistence. Experts warn that these activities highlight gaps in critical infrastructure security, with many organisations unaware of vulnerabilities. US agencies urge urgent action, including patching systems, upgrading outdated equipment, and adopting multi-factor authentication, to mitigate future threats.
Third Party Risk Management is Critical as DORA and New FCA Rules Come into Effect
New rules coming into effect in 2025 will require IT firms deemed “critical” to the UK financial sector to enhance transparency around cyber attacks and resilience measures. Overseen by the Financial Conduct Authority, the Bank of England and the Prudential Regulation Authority, the measures aim to ensure the sector remains resilient against threats like cyber attacks and natural disasters. While industry experts broadly welcome the focus on third-party risk management, questions remain about supplier classification and data-sharing processes. Firms will also need to conduct resilience testing, potentially collaborating with financial institutions to ensure robust protection of financial market infrastructures.
Ransomware 2024: A Year of Tricks, Traps, Wins and Losses
Ransomware attacks in 2024 reached unprecedented levels, targeting critical sectors like healthcare, public infrastructure, and the cloud. The rise of ransomware-as-a-service (RaaS) enabled less experienced attackers to launch devastating campaigns, while nation-state actors leveraged ransomware for geopolitical gains. High-profile incidents exposed vulnerabilities in healthcare, disrupted infrastructure, and fuelled economic warfare. Recovery costs soared to an average of $3 million per attack, reflecting attackers’ increasing sophistication. Generative AI played a dual role, enhancing both defences and threats. These developments underscore ransomware’s evolution into a strategic and economic weapon, demanding heightened resilience, zero-trust adoption, and global collaboration in 2025 and beyond.
The Modern CISO is a Cornerstone of Organisational Success
The role of the Chief Information Security Officer (CISO), whether internal or outsourced, has evolved from a technical focus to being integral to business strategy, bridging cyber security with operational and strategic objectives. Modern CISOs align security initiatives with business goals, enhance customer trust, and ensure compliance with complex regulatory frameworks. Key responsibilities include embedding security into operations without disrupting productivity, managing risks such as legacy systems and resource constraints, and implementing measures like zero trust architecture. As businesses face emerging threats, the CISO’s strategic leadership is increasingly vital to fostering resilience and securing competitive advantage.
Ransomware Reality Check: Are You Ready to Face Organised Cyber Crime?
Ransomware attacks remain a pressing concern, with professional criminal enterprises leveraging advanced extortion tactics that target data confidentiality rather than just availability. The shift from data encryption to exfiltration has increased ransom demands and heightened reputational risks for organisations. Many companies lack clear ransomware-specific policies, leaving leadership to make critical decisions under pressure during incidents. Preparation is vital; pre-defined payment stances, established incident response retainers, and proactive resilience measures are essential. Ransomware is not just a technical issue but a moral and business challenge, requiring C-suite collaboration to mitigate risks and avoid financing organised crime.
How Cops Taking Down Ransomware Gangs Led to the Meteoric Rise of Another
RansomHub has emerged as a dominant ransomware group in 2024, accounting for approximately 20% of all ransomware and data exfiltration incidents in Q4. The group capitalised on the law enforcement takedowns of their competitors LockBit and ALPHV, recruiting affiliates with a highly lucrative 90-10 revenue split. Their aggressive tactics and rapid rise have attracted significant attention, with over 210 victims targeted within six months, including major organisations across various sectors. While their methods are not unique, their speed and affiliate-centric model position them as a critical threat in early 2025, with law enforcement and security firms closely monitoring their activity.
Experts Unsure of Risk Appetite as EU Beefs Up Cyber Rules for Critical Infrastructure
The EU’s NIS2 directive places a renewed focus on cyber security for critical infrastructure and essential services, including energy, transport, and banking. Executives are directly accountable for compliance, with the directive requiring robust risk management, incident reporting, and scrutiny of suppliers’ security measures. Concerns remain over inconsistent enforcement across member states, which could complicate implementation. Experts predict that NIS2 will set a global benchmark for managing cyber risks, similar to the influence of GDPR on data privacy. Business leaders should prepare for increased scrutiny, especially as the directive's scope may encompass more organisations than initially expected.
Sources:
https://www.xda-developers.com/35-chrome-extensions-stealing-peoples-data/
https://www.theregister.com/2024/12/31/china_cyber_intrusions_2024/
https://www.scworld.com/feature/ransomware-2024-a-year-of-tricks-traps-wins-and-losses
https://www.helpnetsecurity.com/2025/01/03/tomorrow-ciso-role-transformation/
https://insight.scmagazineuk.com/ransomware-reality-check-are-you-ready-to-face-organised-cybercrime
https://www.theregister.com/2024/12/28/lockbit_alphv_disruptions_ransomhub_rise/
Governance, Risk and Compliance
The modern CISO is a cornerstone of organisational success - Help Net Security
Security leaders don't want to be held personally liable for attacks | TechRadar
How to Create an Enterprise-Wide Cyber Security Culture
What 2024’s Worst Cyber Attacks Show About Staying Safe in 2025
Cyber criminals tighten their grip on organisations - Help Net Security
Majority of UK SMEs Lack Cyber Security Policy - Infosecurity Magazine
CISO vs. CEO: Making a case for cyber security investments
The Most Dangerous People on the Internet in 2024 | WIRED
2025 is when the internet could finally die and the consequences will be huge | The Independent
Crafting and Refining a Strategic 2025 Cyber Security Budget - Infosecurity Magazine
2025: A Critical Year for Cyber Security Compliance in the EU and UK - Infosecurity Magazine
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Reality Check: Are You Ready To Face Organised Cyber Crime? | SC Media UK
Record-breaking ransoms and breaches: A timeline of ransomware in 2024 | TechCrunch
How LockBit and ALPHV’s takedowns fuelled RansomHub’s rise • The Register
Clop ransomware lists Cleo cyber attack victims | TechRadar
Top 10 Most Active Ransomware Groups of 2024 - Infosecurity Magazine
What 2024’s Worst Cyber Attacks Show About Staying Safe in 2025
Ransomware 2024: A year of tricks, traps, wins and losses | SC Media
Ransomware downtime costs US healthcare organisations $1.9M daily | Healthcare IT News
US Army Soldier Arrested in AT&T, Verizon Extortions – Krebs on Security
Ransomware Victims
Clop ransomware lists Cleo cyber attack victims | TechRadar
Hackers Leak Rhode Island Citizens' Data on Dark Web - Infosecurity Magazine
Atos confirms not being compromised by the ransomware group
Thomas Cook Hit by Cyber Attack, IT Systems Impacted
Phishing & Email Based Attacks
Corporate executives are being increasingly targeted by AI phishing scams | TechRadar
Look out for hyper-personalized phishing attacks, powered by AI
New details reveal how hackers hijacked 35 Google Chrome extensions
These 35 Chrome extensions began stealing people's data after the developers got phished
Phishing Attack Allowed Malicious Chrome Extension to be Published | SC Media UK
Google Chrome extensions hack may have started much earlier than expected | TechRadar
Top 12 ways hackers broke into your systems in 2024 | CSO Online
Other Social Engineering
Cyberhaven Chrome Extension Hack Linked to Widening Supply Chain Campaign - SecurityWeek
OAuth Identity Attack — Are your Extensions Affected? - Security Boulevard
Cyber security firm's Chrome extension hijacked to steal users' data
When Good Extensions Go Bad: Takeaways from the Campaign Targeting Browser Extensions
16 Chrome Extensions Hacked, Exposing Over 600,000 Users to Data Theft
Artificial Intelligence
Corporate executives are being increasingly targeted by AI phishing scams | TechRadar
Look out for hyper-personalized phishing attacks, powered by AI
AI agents may lead the next wave of cyber attacks - SiliconANGLE
LLMs could soon supercharge supply-chain attacks • The Register
'Bad Likert Judge' Jailbreaks OpenAI Defences
How will rules and regulations affect cyber security and AI in 2025? | SC Media
Deepfakes question our ability to discern reality - Help Net Security
Navigate the 2025 threat landscape with expert insights | TechTarget
2025: The Dawn of AI-Driven Cyber Crime
2FA/MFA
Google Chrome 2FA Bypass Attacks Confirmed—Millions Of Users At Risk
Malware
Experts warn of a surge in activity associated FICORA and Kaiten botnets
D-Link Botnet Attacks Surge in Global Spike - DataBreachToday
Malware botnets exploit outdated D-Link routers in recent attacks
Global Campaign Targets PlugX Malware with Innovative Portal - Infosecurity Magazine
Bots/Botnets
Experts warn of a surge in activity associated FICORA and Kaiten botnets
D-Link Botnet Attacks Surge in Global Spike - DataBreachToday
Malware botnets exploit outdated D-Link routers in recent attacks
Mobile
Wiping your Android phone? Here's the easiest way to erase all personal data | ZDNET
Critical Gmail Warning—Don’t Click Yes To These Google Security Alerts
Here's how to use the feature that protects your iPhone in case of a major cyber attack - PhoneArena
Denial of Service/DoS/DDoS
NTT Docomo hit by DDoS attack | Total Telecom
Internet of Things – IoT
Experts warn of a surge in activity associated FICORA and Kaiten botnets
D-Link Botnet Attacks Surge in Global Spike - DataBreachToday
Data Breaches/Leaks
Every minute, 4,080 records are compromised in data breaches - Help Net Security
Human error to blame in Ascension data breach that impacted 5.6 million patients | TechSpot
Massive VW Data Leak Exposed 800,000 EV Owners’ Movements, From Homes To Private Spaces | Carscoops
How Breach Readiness Will Shape Cyber Defence in 2025 - Security Boulevard
Machine gun, pistol and hundreds of devices lost by Ministry of Defence | UK News | Sky News
Cisco Confirms Authenticity of Data After Second Leak - SecurityWeek
Hackers Leak Rhode Island Citizens' Data on Dark Web - Infosecurity Magazine
ZAGG disclosed a data breach that exposed its customers' credit card data
Rhode Islanders’ Data Was Leaked From a Cyber Attack on State Health Benefits Website - SecurityWeek
Organised Crime & Criminal Actors
Cyber criminals tighten their grip on organisations - Help Net Security
Ransomware Reality Check: Are You Ready To Face Organised Cyber Crime? | SC Media UK
US Arrests Army Soldier Over AT&T, Verizon Hacking - SecurityWeek
2024: A jackpot year for North Korea's cyber criminals - Daily NK English
Insider Risk and Insider Threats
Human error to blame in Ascension data breach that impacted 5.6 million patients | TechSpot
Things not to store on your work laptop
Navigate the 2025 threat landscape with expert insights | TechTarget
US Army Soldier Arrested in AT&T, Verizon Extortions – Krebs on Security
Insurance
How to Get the Most Out of Cyber Insurance
Supply Chain and Third Parties
Cyberhaven Chrome Extension Hack Linked to Widening Supply Chain Campaign - SecurityWeek
OAuth Identity Attack — Are your Extensions Affected? - Security Boulevard
New details reveal how hackers hijacked 35 Google Chrome extensions
Google Chrome extensions hack may have started much earlier than expected | TechRadar
When Good Extensions Go Bad: Takeaways from the Campaign Targeting Browser Extensions
Chinese APT Exploits BeyondTrust API Key to Access U.S. Treasury Systems and Documents
LLMs could soon supercharge supply-chain attacks • The Register
Cloud/SaaS
Managing Cloud Risks Gave Security Teams a Big Headache in 2024
Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation
Azure compromise possible with Apache Airflow vulnerabilities | SC Media
Stay Ahead: Integrating IAM with Your Cloud Strategy - Security Boulevard
Identity and Access Management
Machine identities are the next big target for attackers - Help Net Security
Misconfigured Kubernetes RBAC in Azure Airflow Could Expose Entire Cluster to Exploitation
Encryption
Quantum Computing Advances in 2024 Put Security In Spotlight
Will quantum computing break encryption as we know it?
Over 3 million mail servers without encryption exposed to sniffing attacks
The CISO’s guide to accelerating quantum-safe readiness
Passwords, Credential Stuffing & Brute Force Attacks
Passkeys were supposed to be secure and simple; here's how they fail
Regulations, Fines and Legislation
New HIPAA Rules Mandate 72-Hour Data Restoration and Annual Compliance Audits
Top 10 Data Protection Fines and Settlements of 2024 - Infosecurity Magazine
How will rules and regulations affect cyber security and AI in 2025? | SC Media
2025: A Critical Year for Cyber Security Compliance in the EU and UK - Infosecurity Magazine
UN cyber crime treaty adopted amid pushback | SC Media
US proposes cyber security rules to limit impact of health data leaks
Navigating the SEC’s Cyber Security Disclosure Rules: One Year On - Security Boulevard
US prohibits data sales to adversarial nations | SC Media
Apple to Pay $95 Million to Settle Lawsuit Accusing Siri of Snoopy Eavesdropping - SecurityWeek
Court strikes down US net neutrality rules - BBC News
Models, Frameworks and Standards
The 5 most impactful cyber security guidelines (and 3 that fell flat)
New HIPAA Rules Mandate 72-Hour Data Restoration and Annual Compliance Audits
Data Protection
Top 10 Data Protection Fines and Settlements of 2024 - Infosecurity Magazine
US prohibits data sales to adversarial nations | SC Media
Careers, Working in Cyber and Information Security
The state of cyber security and IT talent shortages - Help Net Security
Law Enforcement Action and Take Downs
Three Russian-German Nationals Charged with Espionage for Russian Secret Service
US Army Soldier Arrested in AT&T, Verizon Extortions – Krebs on Security
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
US prohibits data sales to adversarial nations | SC Media
Nation State Actors
China
China's cyber intrusions turns sinister in 2024 • The Register
What to know about string of US hacks blamed on China - BBC News
Chinese Hackers Reportedly Targeted US Sanctions Office
Nato to boost Baltic Sea presence after suspected sabotage of underwater cable | Nato | The Guardian
Finland police seize ship after undersea power cable to Estonia is cut - The Washington Post
Finland finds drag marks on Baltic seabed after cable damage | Reuters
Palo Alto Firewalls Backdoored by Suspected Chinese Hackers
US Treasury hacked: Are China and the US stepping up their cyberwar? | Cyber Crime News | Al Jazeera
AT&T and Verizon say networks secure after Salt Typhoon breach
Lumen reports that it has locked out the Salt Typhoon group from its network
Germany Says Latest Undersea Cable Cut a ‘Wake-up Call' - The Moscow Times
Estonia navy to protect undersea power link after main cable damaged - BBC News
Finland moves tanker suspected of undersea cable damage closer to port | Reuters
Russia
Nato to boost Baltic Sea presence after suspected sabotage of underwater cable | Nato | The Guardian
Finland police seize ship after undersea power cable to Estonia is cut - The Washington Post
Finland finds drag marks on Baltic seabed after cable damage | Reuters
Ukraine recovers key notarial registers affected by Russian cyber attack | Ukrainska Pravda
Ukraine Cyber Support Funding Tops €200 million | SC Media UK
US sanctions Russian, Iranian groups for election interference | CyberScoop
Germany Says Latest Undersea Cable Cut a ‘Wake-up Call' - The Moscow Times
Three Russian-German Nationals Charged with Espionage for Russian Secret Service
Luxury Western Goods Line Russian Stores, Three Years Into Sanctions
Pro-Russian hackers target Italian airport websites – DW – 12/28/2024
Cyber attack on Italy's Foreign Ministry, airports claimed by pro-Russian hacker group | Reuters
Russian media outlets Telegram channels blocked in European countries
Estonia navy to protect undersea power link after main cable damaged - BBC News
Finland moves tanker suspected of undersea cable damage closer to port | Reuters
Russian smugglers import luxury cars from Europe despite sanctions
Iran
US sanctions Russian, Iranian groups for election interference | CyberScoop
North Korea
2024: A jackpot year for North Korea's cyber criminals - Daily NK English
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Tools and Controls
CISO vs. CEO: Making a case for cyber security investments
Managing Cloud Risks Gave Security Teams a Big Headache in 2024
Rotating Penetration Testing Providers: A Key to Robust Cyber Security | Luxembourg Times
Wiping your Android phone? Here's the easiest way to erase all personal data | ZDNET
Machine identities are the next big target for attackers - Help Net Security
How Breach Readiness Will Shape Cyber Defence in 2025 - Security Boulevard
2025 to be a Year of Reckoning for AI in Cyber Security - Infosecurity Magazine
Over 3 million mail servers without encryption exposed to sniffing attacks
Majority of UK SMEs Lack Cyber Security Policy - Infosecurity Magazine
Crafting and Refining a Strategic 2025 Cyber Security Budget - Infosecurity Magazine
CISOs don't invest enough in code security - Help Net Security
Stay Ahead: Integrating IAM with Your Cloud Strategy - Security Boulevard
Top security solutions being piloted today — and how to do it right | CSO Online
Shift left security — Good intentions, poor execution, and ways to fix it - SD Times
Regulations, security, and remote work: Why network outsourcing is booming - Help Net Security
Other News
The Most Dangerous People on the Internet in 2024 | WIRED
2025 is when the internet could finally die and the consequences will be huge | The Independent
Cross-Domain Attacks: A Growing Threat to Modern Security and How to Combat Them
Machine gun, pistol and hundreds of devices lost by Ministry of Defence | UK News | Sky News
Satisfied with Your Cyber Security? Think Again - Security Boulevard
What Security Lessons Did We Learn in 2024?
Cyber Security Lags in Middle East Business Development
New Year’s cyber security resolutions that every startup should keep | TechCrunch
Tackling Cyber Security Challenges With Global Collaboration
Cyber attack on Japan Airlines: A wake-up call for aviation security - Travel Radar - Aviation News
Space Diplomacy: A New Frontier for Cyber Security Efforts - Modern Diplomacy
Addressing growing concerns about cyber security in manufacturing
Hackers Are Hot for Water Utilities
Cyber attacks are on the rise. Is the public sector prepared? - WHYY
Vulnerability Management
Top 12 ways hackers broke into your systems in 2024 | CSO Online
Vulnerabilities
Active Directory Flaw Can Crash Any Microsoft Server
LDAPNightmare PoC Exploit Crashes LSASS and Reboots Windows Domain Controllers
Hackers exploit DoS flaw to disable Palo Alto Networks firewalls
Palo Alto Networks Patches Firewall Zero-Day Exploited for DoS Attacks - SecurityWeek
Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API
An X user claimed a 7-Zip zero-day vulnerability, but 7-Zip's creator says is a fake
Azure compromise possible with Apache Airflow vulnerabilities | SC Media
15,000+ Four-Faith Routers Exposed to New Exploit Due to Default Credentials
New Windows 11 24H2 bug could block future security updates - see who's affected | ZDNET
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 27 December 2024
Black Arrow Cyber Threat Intelligence Briefing 27 December 2024:
-Hackers are Using Russian Domains to Launch Complex Document-Based Phishing Attacks
-How Nation-State Cyber Criminals Are Targeting the Enterprise
-Phishing Report Findings Call for a Fundamental Shift in Organisational Approaches to Defence
-Organisations Need to Get Real About Threat of Cyber Attacks
-Dark Web Cyber Criminals are Buying Up IDs to Bypass KYC Methods
-Cl0p Ransomware Group to Name Over 60 Victims of Cleo Attack
-Service Disruptions Continue to Blindside Businesses
-Infostealers Dominate as Lumma Stealer Detections Soar by Almost 400%
-Ransomware Attackers Target Industries with Low Downtime Tolerance
-North Koreans Stole $1.34bn In Crypto This Year
-Beware Of Shadow AI: Shadow IT’s Less Well-Known Brother
-Working with Security Consultants Will Bolster Cyber Resilience as We Enter 2025
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Hackers are Using Russian Domains to Launch Complex Document-Based Phishing Attacks
New research reveals a sharp increase in malicious emails, bypassing secure gateways every 45 seconds. Remote Access Trojans rose by 59%, while open redirects soared by 627%. Phishing attacks are shifting to Microsoft Office documents, surging by nearly 600% in malicious use, and Russian domains, used four to twelve times more, are now being used for data exfiltration. Attackers harness widely used services like TikTok and Google AMP to redirect unsuspecting users to harmful links. This surge in threats highlights the urgent need for stronger cyber security measures to protect organisations’ networks and data.
How Nation-State Cyber Criminals are Targeting the Enterprise
Nation-state threat actors, once focused on critical infrastructure, are now targeting enterprises across industries as geopolitical tensions escalate. In the past year, these advanced groups have increased attacks on organisations handling sensitive data, aiming to exfiltrate intellectual property and disrupt operations. Unlike traditional ransomware gangs, they have significant resources, persistence, and clear missions such as espionage or undermining rivals. This complex threat environment underscores the need for robust cyber security measures, from strengthening incident response planning and network visibility, to fostering partnerships with government and industry peers. Effective defence requires ongoing vigilance and collaboration to safeguard critical assets.
Phishing Report Findings Call for a Fundamental Shift in Organisational Approaches to Defence
SlashNext’s 2024 Phishing Intelligence Report reveals a significant escalation in phishing threats, urging organisations to rethink their defence strategies. Credential phishing attacks surged by 703%, while email-based threats rose by 202%, exposing users to up to 600 mobile threats annually. 80% of embedded malicious links were zero-day threats (for which there was no remedy at the time) and bypassed traditional detection methods. Social engineering attacks increased by 141%, targeting users across platforms like Microsoft Teams and Dropbox. Experts emphasise the need for proactive, adaptive security strategies, advanced identity verification, and machine learning to counter evolving threats and safeguard critical assets in a rapidly expanding threat landscape.
Organisations Need to Get Real About Threat of Cyber Attacks
The UK’s National Cyber Security Centre’s eighth annual review warns that the threat from state-led and criminal cyber attacks is greater than many organisations realise. The impact is already huge, with attacks costing businesses $2 trillion last year. Experts say technology is only part of the solution, calling for stronger human defences, “digital trust” and realistic scenario planning. By running regular incident response exercises and improving user awareness, leaders can better prepare for and respond to breaches, maintaining trust and protecting their operations.
Black Arrow works with organisations of all sizes and sectors to design and prepare for managing a cyber security incident; this can include an Incident Response Plan and an educational tabletop exercise for the leadership team that highlights the proportionate controls to help the organisation prevent and mitigate an incident.
Dark Web Cyber Criminals are Buying Up IDs to Bypass KYC Methods
A new report by iProov reveals a sophisticated dark web operation collecting genuine identity documents and biometric data, often purchased directly from individuals, to bypass Know Your Customer (KYC) processes. The operation spans Latin America and Eastern Europe, posing a significant risk to organisations relying on traditional identity verification systems. iProov warns that these complete identity packages, combining real documents with matching biometrics, are exceptionally challenging to detect. To counteract these threats, firms must adopt a multi-layered, real-time verification approach to confirm both humanity and identity, significantly enhancing defences against advanced impersonation fraud.
Cl0p Ransomware Group to Name Over 60 Victims of Cleo Attack
The Cl0p ransomware group has exploited vulnerabilities in Cleo’s file transfer products, affecting over 60 organisations, with victims being contacted and provided proof of stolen data. Blue Yonder, a supply chain software provider, is the only named victim so far, though more are expected to be publicly identified unless ransoms are paid. The vulnerabilities, exploited since early December, allowed attackers to steal files without authentication, and Cleo’s tools are used by over 4,000 customers. Cl0p’s actions mirror its previous MOVEit campaign, further highlighting the persistent risks of unpatched file transfer systems.
Service Disruptions Continue to Blindside Businesses
PagerDuty's latest report highlights service disruptions as a pressing concern for businesses, with 88% of executives predicting another major incident within a year. The July global IT outage exposed gaps in preparedness, with 83% of executives caught off guard, resulting in lost revenue (37%) and delayed responses (39%). Nearly half of UK, US, and Australian leaders, along with a majority in Japan, cite insufficient real-time data tools as a hindrance. As 86% admit to prioritising efforts to build security rather than being ready to react if the security is breached, the report emphasises the need for proactive planning to mitigate the financial and reputational impacts of future disruptions.
Infostealers Dominate as Lumma Stealer Detections Soar by Almost 400%
An infostealer is a type of malicious software designed to secretly gather private information, such as passwords, financial details, or other sensitive data, from an infected device. Once it collects this data, it sends it to the attacker, who can then misuse it for financial gain, identity theft, or other illegal activities. Cyber security software provider ESET has found a 369% increase in detections of the Lumma Stealer infostealer, now dominating attacks by targeting 2FA browser extensions, user credentials and cryptocurrency wallets. Organisations should consider the threat of infostealers and other malicious software as part of a cohesive cyber security strategy.
Ransomware Attackers Target Industries with Low Downtime Tolerance
Cyber security provider Dragos found that 23 ransomware groups, including newly emerged or rebranded operators, impacted industrial organisations in Q3 2024. They targeted sectors with low downtime tolerance, such as healthcare and finance, resulting in significant operational halts, financial losses, and data compromises. One major automotive software firm paid a $25m ransom, while an oilfield services provider lost $35m. Attackers have evolved to bypass multi-factor authentication and exploit VPN weaknesses, with living-off-the-land and remote access tools enabling stealthy intrusions. They also increasingly rely on initial access brokers, using advanced malware to persist in virtual environments and critical operations.
North Koreans Stole $1.34bn In Crypto This Year
Hackers linked to North Korea have reportedly stolen $1.34bn in cryptocurrency so far this year, accounting for over half of all such thefts. This surge highlights a reliance on illicit digital funds to finance ballistic missile and nuclear programmes, with the US estimating a third of North Korea’s missile development is funded by hacking. Attacks slowed after a reported strategic partnership with Russia in June which may have reduced North Korea’s dependency on cyber crime, although overall crypto-based hacking has risen. Despite total stolen amounts being lower than in previous years, the number of breaches is at a record 303, indicating an ongoing need for robust cyber security measures.
Beware Of Shadow AI: Shadow IT’s Less Well-Known Brother
Research indicates that 50–75% of employees use non-company AI tools, raising concerns around data leakage, compliance, and vulnerabilities to cyber attack. The number of these applications continues to surge, yet only 15% of organisations have a formal AI policy in place. This lack of oversight can lead to reputational and legal damage. While AI promises innovation and productivity gains, leaders must address Shadow AI by establishing robust governance, enforcing granular controls, and conducting frequent security audits. Boards should ensure their cyber security strategy helps mitigate these risks while unlocking AI’s benefits.
Working with Security Consultants Will Bolster Cyber Resilience as We Enter 2025
With a shortage of talent, new regulations on the horizon, and an evolving threat landscape, cyber resilience is becoming a top priority for organisations. The upcoming UK Cyber Security and Resilience Bill and stringent frameworks for financial institutions highlight the urgent need for robust defences. Despite this focus on cyber security, many organisations face recruitment hurdles due to an undersupplied talent pool. As a result, hiring external cyber security specialists is emerging as a cost-effective solution, giving businesses access to the necessary skills without the lengthy recruitment process. This approach helps close the talent gap while strengthening defences into 2025 and beyond.
Sources:
https://informationsecuritybuzz.com/phishing-report-findings-fundamental/
https://www.securityweek.com/cl0p-ransomware-group-to-name-over-60-victims-of-cleo-attack/
https://www.helpnetsecurity.com/2024/12/26/service-disruptions-concern/
https://www.infosecurity-magazine.com/news/infostealers-lumma-stealer/
https://www.infosecurity-magazine.com/news/ransomware-industries-downtime/
https://www.silicon.co.uk/security/cyberwar/north-korea-hacking-593725
https://www.securityweek.com/beware-of-shadow-ai-shadow-its-less-well-known-brother/
Governance, Risk and Compliance
Organisations Need To Get Real About Threat Of Cyber Attacks
Working with security consultants will bolster cyber resilience as we enter 2025
Small Business Cyber Security Statistics
Half of UK businesses hit by cyber breaches in 2024 - Digital Journal
The holiday crunch: Threats security teams face and how to mitigate them | ITPro
Managing Threats When Most of the Security Team Is Out of the Office
How Nation-State Cyber Criminals Are Targeting the Enterprise
Cyber security response: Not just an IT issue but an emergency preparedness priority - Nextgov/FCW
Why the industry can’t afford complacency in 2025 | SC Media
New Study Reveals Widening Gap Between Cyber Attack Causes and Public Perception
Top Cyber Security Compliance Issues Businesses Face Today - Security Boulevard
Navigating the Cyber Threat Landscape: Lessons Learned & What’s Ahead
Cyber Risks and Insurance 2025 Forecast | Wiley Rein LLP - JDSupra
Cyber security spending trends and their impact on businesses - Help Net Security
Cyber security: The changing threat and risk landscape | A&O Shearman - JDSupra
Businesses Need New AI Governance in Cyber Security and Privacy
How to Streamline Your Cyber Security Risk Management Process
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Attackers Target Industries with Low Downtime Tolerance - Infosecurity Magazine
Small Business Cyber Security Statistics
Half of UK businesses hit by cyber breaches in 2024 - Digital Journal
Clop ransomware is now extorting 66 Cleo data-theft victims
LockBit Admins Tease a New Ransomware Version - Infosecurity Magazine
LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages
New Warning As Self-Deleting Cyber Attack Targets Windows, Mac
Top 10 Cyber Law Enforcement Operations of 2024 - Infosecurity Magazine
Beware Feb. 3, 2025—Diabolic Ransomware Gang Issues New Attack Warning
Suspected LockBit dev faces extradition to the US • The Register
How companies can fight ransomware impersonations - Help Net Security
Nearly four decades on and, like Jesus, ransomware won't die • The Register
6 Crafty Tactics Cyber Criminals Use To Snag Money From Home Users Fast
Facing the Specter of Cyber Threats During the Holidays
Brazilian Hacker Charged for Extorting $3.2M in Bitcoin After Breaching 300,000 Accounts
Ransomware Victims
Clop ransomware is now extorting 66 Cleo data-theft victims
5.6M people exposed in Ascension Health ransomware incident earlier this year | Cybernews
Hackney Council: Cyber Attack Cost 'hundreds of thousands' - BBC News
Krispy Kreme breach, data theft claimed by Play ransomware gang
Ransomware Group Claims Theft of Personal, Financial Data From Krispy Kreme - SecurityWeek
Phishing & Email Based Attacks
Phishing Report Findings Call For A Fundamental Shift In Organisational Approaches To Defence
This devious two-step phishing campaign uses Microsoft tools to bypass email security | TechRadar
Hackers are using Russian domains to launch complex document-based phishing attacks | TechRadar
Fake DocuSign docs used to secure corporate credentials in mishing campaign | SC Media
Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service
A new Microsoft 365 phishing service has emerged, so be on your guard | TechRadar
Urgent New Gmail Security Warning For Billions As Attacks Continue
Defence Giant General Dynamics Says Employees Targeted in Phishing Attack - SecurityWeek
Other Social Engineering
You Need to Create a Secret Password With Your Family | WIRED
Lazarus APT targeted employees at an unnamed nuclear-related organisation
North Korean “Laptop Farm” IT Worker Scam Targets Multiple High-Profile Companies | Ankura - JDSupra
Artificial Intelligence
AI-driven scams are about to get a lot more convincing - Help Net Security
AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case
Beware Of Shadow AI – Shadow IT's Less Well-Known Brother - SecurityWeek
AI impersonators will wreak havoc in 2025. Here’s what to look for | PCWorld
Italy’s Data Protection Watchdog Issues €15m Fine to OpenAI Over ChatG - Infosecurity Magazine
You Need to Create a Secret Password With Your Family | WIRED
Urgent New Gmail Security Warning For Billions As Attacks Continue
Businesses Need New AI Governance in Cyber Security and Privacy
Will AI Drive Efficiency and Budget Growth? Risks, Rewards & Reality - Security Boulevard
Open source machine learning systems are highly vulnerable to security threats | TechRadar
The Intersection of AI and OSINT: Advanced Threats On The Horizon - SecurityWeek
2FA/MFA
Evilginx: Open-source man-in-the-middle attack framework - Help Net Security
Home for the holidays? Share this top cyber security advice with friends and family | TechCrunch
Malware
Infostealers Dominate as Lumma Stealer Detections Soar by Almost 400% - Infosecurity Magazine
AI Could Generate 10,000 Malware Variants, Evading Detection in 88% of Case
New Warning As Self-Deleting Cyber Attack Targets Windows, Mac
Cryptomining Malware Found in Popular Open Source Packages - Infosecurity Magazine
Researchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social Accounts
New 'OtterCookie' malware used to backdoor devs in fake job offers
Iran's Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware
Bots/Botnets
Webcams and DVRs Vulnerable to HiatusRAT, FBI Warns - Infosecurity Magazine
BadBox rapidly grows, 190,000 Android devices infected - Security Affairs
How Not To Become A Botnet Victim: A Practical Guide For Everyone
New botnet exploits vulnerabilities in NVRs, TP-Link routers
How Androxgh0st, the hybrid botnet, rose from Mozi's ashes • The Register
Botnets leverage decade-old D-Link vulnerabilities in new attack campaigns - SiliconANGLE
A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs
Mobile
Apple warns spyware targets via ‘threat notifications,’ offers these next steps - 9to5Mac
CISA: Use Signal or other secure communications app - Help Net Security
Fake DocuSign docs used to secure corporate credentials in mishing campaign | SC Media
ICO Warns of Festive Mobile Phone Privacy Snafu - Infosecurity Magazine
iOS devices more exposed to phishing than Android - Help Net Security
FBI Says Use Secret Word, NSA Says Reboot iPhone—Should You Listen?
Spyware Maker NSO Group Found Liable In US Court | Silicon UK
Denial of Service/DoS/DDoS
DNSSEC Denial-of-Service Attacks Show Technology's Fragility
Top 10 Cyber Law Enforcement Operations of 2024 - Infosecurity Magazine
DDoS Attacks Surge as Africa Expands Its Digital Footprint
Palo Alto Releases Patch for PAN-OS DoS Flaw — Update Immediately
7 Ways to Stop VoIP DDoS Attacks from Crashing Your Phones
Internet of Things – IoT
Webcams and DVRs Vulnerable to HiatusRAT, FBI Warns - Infosecurity Magazine
BadBox rapidly grows, 190,000 Android devices infected - Security Affairs
New botnet exploits vulnerabilities in NVRs, TP-Link routers
How Androxgh0st, the hyrbird botnet, rose from Mozi's ashes • The Register
A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs
6 Easy Ways To Make Your Smart Home More Secure
Data Breaches/Leaks
Infostealers Dominate as Lumma Stealer Detections Soar by Almost 400% - Infosecurity Magazine
Small Business Cyber Security Statistics
Half of UK businesses hit by cyber breaches in 2024 - Digital Journal
Clop ransomware threatens 66 Cleo attack victims with data leak
These were the badly handled data breaches of 2024 | TechCrunch
5.6M people exposed in Ascension Health ransomware incident earlier this year | Cybernews
Ascension: Health data of 5.6 million stolen in ransomware attack
FTC orders Marriott and Starwood to implement strict data security
Peugeot Data Breach: Hackers Threaten to Release Stolen Client Information
What Should You Do When You Receive a Data Breach Notice? - CNET
Organised Crime & Criminal Actors
Major Biometric Data Farming Operation Uncovered - Infosecurity Magazine
New Study Reveals Widening Gap Between Cyber Attack Causes and Public Perception
Message service predominantly used by Pixel users intercepted by authorities - PhoneArena
Suspected LockBit dev faces extradition to the US • The Register
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
North Korea hackers behind 60% of all crypto stolen in 2024
North Koreans Stole $1.34bn In Crypto This Year | Silicon UK Tech
NFT scammers charged for stealing $22 million through "rug pulls" - Help Net Security
US and Japan Blame North Korea for $308m Crypto Heist - Infosecurity Magazine
Cryptomining Malware Found in Popular Open Source Packages - Infosecurity Magazine
South Korea sanctions 15 North Koreans for crypto heists and cyber theft
Crypto scam suspect arrested in bed as cyber crime cops raid home - Manchester Evening News
Brazilian Hacker Charged for Extorting $3.2M in Bitcoin After Breaching 300,000 Accounts
Insurance
Cyber Risks and Insurance 2025 Forecast | Wiley Rein LLP - JDSupra
Cloud/SaaS
Rockstar2FA Collapse Fuels Expansion of FlowerStorm Phishing-as-a-Service
A new Microsoft 365 phishing service has emerged, so be on your guard | TechRadar
Amazon Security Warning As 3 High-Rated Vulnerabilities Hit Cloud
Why Cloud Identity Attacks Outpace On-Premises Risks
Outages
Service disruptions continue to blindside businesses - Help Net Security
Identity and Access Management
Non-Human Identities Gain Momentum, Requires Both Management, Security
Why Cloud Identity Attacks Outpace On-Premises Risks
Encryption
Why cryptography is important and how it’s continually evolving - Security Boulevard
Linux and Open Source
What open source means for cyber security - Help Net Security
Cryptomining Malware Found in Popular Open Source Packages - Infosecurity Magazine
Strengthening open source: A roadmap to enhanced cyber security - Nextgov/FCW
The Linux log files you should know and how to use them | ZDNET
Open source machine learning systems are highly vulnerable to security threats | TechRadar
Passwords, Credential Stuffing & Brute Force Attacks
Home for the holidays? Share this top cyber security advice with friends and family | TechCrunch
Social Media
Drug Dealers Have Moved on to Social Media | WIRED
Researchers Uncover PyPI Packages Stealing Keystrokes and Hijacking Social Accounts
Regulations, Fines and Legislation
Meet the In-Laws: the UK’s Digital Legislative Agenda for 2025 | Ropes & Gray LLP - JDSupra
EU DORA: Are you in scope, and if so, how can you prepare? | King & Spalding - JDSupra
The Cyber Resilience Act: A Field Guide for CTOs and CISOs | HackerNoon
A Hit-and-Miss First Year for SEC’s Cyber Incident Reporting Rules | MSSP Alert
Trump 2.0 Portends Big Shift in Cyber Security Policies
Guardians Of Peace: The EU’s Role In Global Security – OpEd – Eurasia Review
Europe's move toward cyber security sovereignty [Q&A]
INTERPOL welcomes adoption of UN convention against cyber crime
FTC orders Marriott and Starwood to implement strict data security
Italy’s Data Protection Watchdog Issues €15m Fine to OpenAI Over ChatGPT - Infosecurity Magazine
Cyber experts applaud White House cyber security plan
Models, Frameworks and Standards
EU DORA: Are you in scope, and if so, how can you prepare? | King & Spalding - JDSupra
The Cyber Resilience Act: A Field Guide for CTOs and CISOs | HackerNoon
Data Protection
5 Questions to Ask to Ensure Data Resiliency
Law Enforcement Action and Take Downs
BadBox rapidly grows, 190,000 Android devices infected - Security Affairs
LockBit Developer Rostislav Panev Charged for Billions in Global Ransomware Damages
NFT scammers charged for stealing $22 million through "rug pulls" - Help Net Security
LockBit Taunts New Version as Original Developer Charged | SC Media UK
Interpol Identifies Over 140 Human Traffickers in New Initiative - Infosecurity Magazine
Top 10 Cyber Law Enforcement Operations of 2024 - Infosecurity Magazine
Massive live sports piracy ring with 812 million yearly visits taken offline
Message service predominantly used by Pixel users intercepted by authorities - PhoneArena
Crypto scam suspect arrested in bed as cyber crime cops raid home - Manchester Evening News
Brazilian Hacker Charged for Extorting $3.2M in Bitcoin After Breaching 300,000 Accounts
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
The 2024 cyberwar playbook: Tricks used by nation-state actors | CSO Online
Middle East Cyberwar Rages On, With No End in Sight
Nation State Actors
How Nation-State Cyber Criminals Are Targeting the Enterprise
China
CISA: Use Signal or other secure communications app - Help Net Security
DHS Says China, Russia, Iran, and Israel Are Spying on People in US with SS7
Hundreds of organisations were notified of potential Salt Typhoon compromise - Nextgov/FCW
Major cyber security attack from China exposes systematic flaws - TheStreet
Feds lay blame while Chinese telecom attack continues | CyberScoop
Russia
Russia fires its biggest cyber weapon against Ukraine | CSO Online
Ukraine blames Russia for mega cyber attack on ‘critically important’ infrastructure – POLITICO
Hackers are using Russian domains to launch complex document-based phishing attacks | TechRadar
DHS Says China, Russia, Iran, and Israel Are Spying on People in US with SS7
Russian cyber attack: Breach occurred at 'top-level account,' MP says
Iran
DHS Says China, Russia, Iran, and Israel Are Spying on People in US with SS7
OilRig Hackers Exploiting Windows Kernel 0-day to Attack Organisations
Iran's Charming Kitten Deploys BellaCPP: A New C++ Variant of BellaCiao Malware
North Korea
North Korea hackers behind 60% of all crypto stolen in 2024
North Koreans Stole $1.34bn In Crypto This Year | Silicon UK Tech
US and Japan Blame North Korea for $308m Crypto Heist - Infosecurity Magazine
Lazarus APT targeted employees at an unnamed nuclear-related organisation
North Korean “Laptop Farm” IT Worker Scam Targets Multiple High-Profile Companies | Ankura - JDSupra
New 'OtterCookie' malware used to backdoor devs in fake job offers
South Korea sanctions 15 North Koreans for crypto heists and cyber theft
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Middle East Cyberwar Rages On, With No End in Sight
Europe is the top target for hacktivists, Orange Cyberdefence report reveals | Total Telecom
Apple warns spyware targets via ‘threat notifications,’ offers these next steps - 9to5Mac
Pegasus spyware maker NSO Group is liable for attacks on 1,400 WhatsApp users - The Verge
Tools and Controls
ICO Warns of Festive Mobile Phone Privacy Snafu - Infosecurity Magazine
DNSSEC Denial-of-Service Attacks Show Technology's Fragility
What is security service edge (SSE)? | ITPro
Modern IAM: What it looks like, how to achieve it | SC Media
API security blind spots put businesses at risk - Help Net Security
The Linux log files you should know and how to use them | ZDNET
The Pen Test Trap: Why Most Businesses Get It Wrong | MSSP Alert
Cyber security response: Not just an IT issue but an emergency preparedness priority - Nextgov/FCW
Do Honeypots Still Matter? | HackerNoon
Cyber security spending trends and their impact on businesses - Help Net Security
Maximizing the impact of cyber crime intelligence on business resilience - Help Net Security
The Intersection of AI and OSINT: Advanced Threats On The Horizon - SecurityWeek
How Generative AI Is Powering A New Era Of Cyber Security
Too Much 'Trust,' Not Enough 'Verify'
5 Common DNS Vulnerabilities and How to Protect Your Network - Security Boulevard
New 'OtterCookie' malware used to backdoor devs in fake job offers
How to Streamline Your Cyber Security Risk Management Process
The Role of Enterprise Browsers in Securing Remote Work and Hybrid Teams - IT Security Guru
Law enforcement agencies see AI as a key tool for reducing crime - Help Net Security
Other News
The holiday crunch: Threats security teams face and how to mitigate them | ITPro
Managing Threats When Most of the Security Team Is Out of the Office
New Study Reveals Widening Gap Between Cyber Attack Causes and Public Perception
The Worst Hacks of 2024 | WIRED
Decoding the end of the decade: What CISOs should watch out for | Computer Weekly
Cyber Security Resolutions: Skill Sets to Prioritize in 2025
The complexities of cyber security in local government | UKAuthority
The Geopolitics of Water: Cyber Attacks' Impact on Water Stress in the U.S. and Beyond
Scottish rail network 'wholly unequipped' for digital world amid 'Nightsleeper' cyber attack fears
Estate agents warned against festive cyber attacks - Property Industry Eye
Vulnerability Management
Emerging Threats, Vulns to Prepare for in 2025
Impact of Unpatched Vulnerabilities in 2025 - Security Boulevard
Top 7 zero-day exploitation trends of 2024 | CSO Online
Vulnerabilities
Sophos Issues Hotfixes for Critical Firewall Flaws: Update to Prevent Exploitation
How to Protect Your Environment from the NTLM Vulnerability
BeyondTrust says hackers hit its remote support products | TechRadar
Critical SQL Injection Vulnerability in Apache Traffic Control Rated 9.9 CVSS — Patch Now
Apache warns of critical flaws in MINA, HugeGraph, Traffic Control
Microsoft warns of Windows 11 24H2 installation issue that blocks all future security updates
Palo Alto Releases Patch for PAN-OS DoS Flaw — Update Immediately
Fortinet flags some worrying security bugs coming back from the dead | TechRadar
Amazon Security Warning As 3 High-Rated Vulnerabilities Hit Cloud
Adobe warns of critical ColdFusion bug with PoC exploit code
Critical Vulnerabilities Found in WordPress Plugins WPLMS and VibeBP - Infosecurity Magazine
OilRig Hackers Exploiting Windows Kernel 0-day to Attack Organisations
Open source machine learning systems are highly vulnerable to security threats | TechRadar
Microsoft fixes bug behind random Office 365 deactivation errors
Botnets leverage decade-old D-Link vulnerabilities in new attack campaigns - SiliconANGLE
TrueNAS device vulnerabilities exposed during hacking competition | TechRadar
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 20 December 2024
Black Arrow Cyber Threat Intelligence Briefing 20 December 2024:
-Mobile Spear Phishing Targets Executive Teams
-From Digital Risk to Physical Threat: Why Cyber Security Must Evolve for Executives
-Why HNWIs are Seeking Personal Cyber Security Consultants
-Ransomware in 2024: New Players, Bigger Payouts, and Smarter Tactics
-Credential Phishing Attacks Up Over 700 Percent
-All Major European Financial Firms Suffer Supplier Breaches
-Phishers Cast Wide Net with Spoofed Google Calendar Invites
-Security Leaders Say Machine Identities Are Next Big Target for Cyber Attack
-Ransomware Defences are Weakened by Backup Technology
-Cyber Security is Never Out-of-Office: Protecting Your Business Anytime, Anywhere
-Ransomware, Deepfakes, and Scams: The Digital Landscape in 2024
-UK Companies Face Increasing Cyber Security Risks Across a Range of Threats
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Mobile Spear Phishing Targets Executive Teams
Over the past few months, sophisticated spear phishing campaigns have intensified, targeting corporate executives via mobile devices and trusted business platforms. These attacks leverage advanced redirection techniques, PDF-based phishing links and compromised domains to bypass traditional defences. Mobile devices represent a distinct and often unsecured attack surface, enabling threat actors to harvest high-value corporate credentials with alarming efficiency. To protect against these evolving threats, organisations require education and awareness as well as advanced, on-device detection and prevention measures. Recent research has shown that zero-day protection and adaptive, mobile-specific security solutions are now critical to safeguarding sensitive enterprise data.
From Digital Risk to Physical Threat: Why Cyber Security Must Evolve for Executives
Protecting executives goes beyond digital measures, as these leaders’ personal safety and actions directly affect company valuation, investor confidence, and regulatory scrutiny. The US Securities and Exchange Commission (SEC)’s emphasis on governance and risk transparency underscores the importance of securing executives against both cyber and physical threats. Proactive approaches - blending digital and physical security, continuous monitoring of key terms, and behavioural science insights - are vital. By identifying threats early, understanding their social context, and ensuring senior leaders appreciate these vulnerabilities, organisations can strengthen resilience, reassure stakeholders, and meet regulatory expectations in evolving threat landscape.
Why HNWIs are Seeking Personal Cyber Security Consultants
High net worth individuals (HNWIs) are facing increasingly complex and evolving cyber threats, from phishing and ransomware to social engineering. Their wealth, influence and public profile make them prime targets, exposing them to severe financial, reputational and personal risks. HNWIs need to ensure they have conducted tailored risk assessments, and ensure appropriate security controls, constant monitoring, and privacy management for individuals and families. With global cyber crime costs projected to reach $10.5 trillion annually by 2025, these actions help safeguard digital assets, protect reputations, and ensure peace of mind in an ever more volatile online environment.
Ransomware in 2024: New Players, Bigger Payouts, and Smarter Tactics
Ransomware remains the leading global cyber security threat in 2024, with new groups rising after criminal takedowns. Demands soared, including a record-breaking $75 million ransom. Attacks span multiple sectors, with the construction industry hit hardest, and often occur overnight or at weekends. Over three-quarters paid ransoms, with average demands exceeding $1.5 million, and recovery costs surpassing $2.7 million. Smaller enterprises are especially vulnerable.
Credential Phishing Attacks Up Over 700 Percent
Phishing remains a top concern for organisations worldwide, with a new report showing credential-based attacks increasing by 703% in late 2024. Overall email threats rose by 202%, exposing employees to up to six threats per week and as many as 600 mobile threats annually. 80% of malicious links were previously unknown, underscoring limitations in static defences. Social engineering-based attacks surged by 141%, forcing leaders to reconsider their approach. Experts anticipate continued escalation in 2025, stressing the need for comprehensive and proactive security strategies backed by real-time detection and adaptable mitigation measures to outpace increasingly agile attackers.
All Major European Financial Firms Suffer Supplier Breaches
New research found that all major European financial firms experienced supplier-related breaches last year. Only a quarter achieved top-tier cyber security resilience ratings, while nearly all suffered from third- and fourth-party breaches. Around a fifth also endured a direct breach. Some 33% of financial services companies received a lower rating, with pending EU regulations like DORA adding urgency. Scandinavian firms outperformed peers, whereas French organisations reported the highest rate of supply chain breaches. Improving domain name system (DNS) configurations, endpoint security and patching cycles were recommended to strengthen defences.
Phishers Cast Wide Net with Spoofed Google Calendar Invites
A recent phishing campaign has spoofed Google Calendar invites, reaching about 300 organisations with more than 4,000 malicious emails over four weeks. Fraudsters trick users into clicking bogus links that eventually lead to fake sites designed to steal personal and financial details. Such attacks are lucrative: last year, victims in one country lost nearly $19 million to phishing scams. Security experts advise verifying links before clicking, and using two-factor authentication. As criminals easily adapt their methods, staying vigilant and questioning unusual requests remain vital for safeguarding against these persistent social engineering threats.
Security Leaders Say Machine Identities Are Next Big Target for Cyber Attack
New research shows many organisations faced cloud related security incidents last year, causing delays for over half, service outages for almost half, and data breaches for nearly a third. Security leaders warn that machine identities, especially access tokens and service accounts, are the next major target. They also predict more sophisticated supply chain attacks involving AI. Conflicts persist between security and development teams, and complexity grows as machine identities proliferate. Experts say securing these identities, along with automated protection and comprehensive controls, is now essential to safeguard cloud environments and ensure stable, secure business operations.
Ransomware Defences are Weakened by Backup Technology
Recent research by Object First shows ransomware attacks increasingly target backup data and exploit vulnerabilities. Research participants said their outdated systems (34%), limited encryption (31%) and failed backups (28%) weaken defences. Immutable storage is seen as vital, with 93% agreeing it is essential and 97% planning to invest. Zero Trust principles are widely supported, but managing these technologies poses challenges. Nearly 41% lack the necessary skills and 69% cannot afford extra expertise. The findings underscore the urgency for resilient, ransomware-proof backup systems and highlight the need for robust cyber security measures to mitigate these evolving threats.
Cyber Security is Never Out-of-Office: Protecting Your Business Anytime, Anywhere
With many staff away during the festive season, cyber criminals see an ideal opportunity to strike. Ransomware attacks surge by around 30% on public holidays and weekends, with 89% of security professionals worried about off-hours threats. As payment rates have fallen from around 80% to 36% over five years, attackers now exploit vulnerable times such as night shifts to make their attacks more effective. Organisations must ensure year-round vigilance, including strong authentication, continuous patching, and clear incident response plans. Proper training, supply chain security, data encryption and processes to verify money transfers are essential. In short, robust cyber security plans cannot afford an “out of office.”
Ransomware, Deepfakes, and Scams: The Digital Landscape in 2024
ESET’s 2024 threat report highlights a surge in investment and crypto scams, often using deepfakes and celebrity images to enhance credibility. New ransomware operators have emerged to fill the void left by ransomware gangs such as Lockbit, with RansomHub alone claiming nearly 500 victims, including major companies. Infostealer activity has shifted as infostealers RedLine and Meta were taken down, boosting their competitor Lumma’s popularity by 368%. Malware trends are mixed, with the detection of Agent Tesla malware down by 26% but Formbook malware showing a dramatic spike of up to 7,000 daily detections. Despite some law enforcement successes, the cyber security landscape remains unpredictable and continuously evolving.
UK Companies Face Increasing Cyber Security Risks Across a Range of Threats
New findings from Horizon3.ai’s "Cyber Security Report UK 2024/2025" show a growing risk environment across various industries, with nearly half of UK organisations (48%) citing stolen user credentials as a top cyber security threat. Insufficiently secured or unknown data stores were noted by 42%, and almost a third (29%) flagged attacks exploiting known but unpatched software vulnerabilities. In the survey of 150 executives and IT professionals, 69% reported at least one cyber attack in the past two years, yet 66% lack adequate defences. Experts advise continuous penetration testing and more proactive, attacker-focused security measures to strengthen resilience, given the escalation in attack complexity and severity.
Sources:
https://securityboulevard.com/2024/12/mobile-spear-phishing-targets-executive-teams/
https://securityboulevard.com/2024/12/why-hnwis-are-seeking-personal-cybersecurity-consultants/
https://www.helpnetsecurity.com/2024/12/19/ransomware-surveys-2024/
https://betanews.com/2024/12/18/credential-phishing-attacks-up-over-700-percent/
https://www.infosecurity-magazine.com/news/all-europes-top-financial-firms/
https://www.theregister.com/2024/12/18/google_calendar_spoofed_in_phishing_campaign/
https://www.techradar.com/pro/security/ransomware-deepfakes-and-scams-the-digital-landscape-in-2024
Governance, Risk and Compliance
Why HNWIs are Seeking Personal Cyber Security Consultants - Security Boulevard
From digital risk to physical threat: Why cyber security must evolve for executives | SC Media
Innovation, insight and influence: the CISO playbook for 2025 and beyond | Computer Weekly
77% of IT leaders cite cyber security as top challenge in global survey
ISC2 Survey Reveals Critical Gaps in Cyber Security Leadership Skills - Infosecurity Magazine
How to turn around a toxic cyber security culture | CSO Online
The evolution of incident response: building a successful strategy | TechRadar
The Importance of Empowering CFOs Against Cyber Threats
How the cyber security landscape affects the financial sector
Threat of personal liability has CISOs sweating | ITPro
70% of cyber security leaders influenced by personal liability concerns | Security Magazine
CISO accountability: Navigating a landscape of responsibility - Help Net Security
How weaponized AI drives CISO burnout – and what to do about it | SC Media
CISO Challenges for 2025: Overcoming Cyber Security Complexities - Security Boulevard
MSSP Market Update: Fortune 500 Firms Fail at Cyber Security | MSSP Alert
2025 is set to bring changes in technology adoption and the evolving attack surface
Cyber security In 2025 – A New Era Of Complexity
To Defeat Cyber Criminals, Understand How They Think
The evolution of incident response: building a successful strategy | TechRadar
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware threat shows no sign of slowing down | Microscope
Clop is back to wreak havoc via vulnerable file-transfer software | CyberScoop
The year in ransomware: Security lessons to help you stay one step ahead - Security Boulevard
Ransomware in 2024: New players, bigger payouts, and smarter tactics - Help Net Security
‘Tis the Season to Be Alert for Cyber Threats: 5 Unjoyful… | Intel 471
Cyber security is never out-of-office: Protecting your business anytime, anywhere
46% of financial institutions had a data breach in the past 24 months - Help Net Security
Akira and RansomHub Surge as Ransomware Claims Reach All-Time High - Infosecurity Magazine
Clop ransomware claims responsibility for Cleo data theft attacks
Ransomware, deepfakes, and scams: the digital landscape in 2024 | TechRadar
RansomHub emerges as dominant ransomware group as 2024 ends | SC Media
LockBit ransomware gang teases February 2025 return | Computer Weekly
How Cyber Attacks Hold Patient Care Hostage | MedPage Today
Ransomware Gang Says Deloitte Sucks at Their Job - Going Concern
How Do We Build Ransomware Resilience Beyond Just Backups?
Romanian Netwalker ransomware affiliate sentenced to 20 years in prison
How to mitigate wiper malware | TechTarget
Ransomware Victims
46% of financial institutions had a data breach in the past 24 months - Help Net Security
Clop ransomware claims responsibility for Cleo data theft attacks
How the ransomware attack at Change Healthcare went down: A timeline | TechCrunch
The Bookseller - News - Waterstones hit by Blue Yonder ransomware gang attack
Ransomware Gang Says Deloitte Sucks at Their Job - Going Concern
Rhode Island confirms data breach after Brain Cipher ransomware attack
Major Auto Parts Firm LKQ Hit by Cyber Attack - SecurityWeek
Phishing & Email Based Attacks
How Companies Lose Millions Of Dollars To Phishing
Credential phishing attacks up over 700 percent
Midnight Blizzard Taps Phishing Emails, Rogue RDP Nets
Phishing Attacks Double in 2024 - Infosecurity Magazine
Credential phishing attacks rose by 703% in H2 of 2024 | Security Magazine
Mobile Spear Phishing Targets Executive Teams - Security Boulevard
MUT-1244 targeting security researchers, red teamers, and threat actors - Help Net Security
Organisations Warned of Rise in Okta Support Phishing Attacks - SecurityWeek
Google Calendar invites spoofed in phishing campaign • The Register
Crooks use Docusign lures to attempt Azure account takeovers • The Register
Credential phishing attacks surge, report reveals | SC Media
Executives targeted in mobile spearphishing attacks | Security Magazine
YouTube Channels Targeted With Windows Malware Phishing Attacks
Inside the latest phishing campaigns: dissecting CarPhish, EDG, Tpass, and Mamba2FA kits - VMRay
HubPhish Exploits HubSpot Tools to Target 20,000 European Users for Credential Theft
HubSpot phishing targets 20,000 Microsoft Azure accounts
European firms subjected to HubSpot-exploiting phishing | SC Media
New fake Ledger data breach emails try to steal crypto wallets
New Gmail Security Warning For 2.5 Billion—Second Attack Wave Incoming
Other Social Engineering
FTC warns of online task job scams hooking victims like gambling
New Investment Scam Leverages AI, Social Media Ads to Target Victims Worldwide
Cyber Criminals Exploit Google Calendar to Spread Malicious Links - Infosecurity Magazine
Microsoft Teams Vishing Spreads DarkGate RAT
Mobile Spear Phishing Targets Executive Teams - Security Boulevard
MUT-1244 targeting security researchers, red teamers, and threat actors - Help Net Security
DarkGate malware spread via Microsoft Teams, AnyDesk | SC Media
Hackers Exploit Microsoft Teams to Gain Remote Access to User’s System
‘Tis the Season to Be Alert for Cyber Threats: 5 Unjoyful… | Intel 471
Cyber security is never out-of-office: Protecting your business anytime, anywhere
Interpol: Stop calling it 'pig butchering' • The Register
Now Scammers Are Abusing Legitimate Services to Show You Fake CAPTCHAs
Watch Out for These Holiday Cyber Attacks
Artificial Intelligence
The threat of AI-driven cyber warfare is real and it can disrupt the world
Ransomware, deepfakes, and scams: the digital landscape in 2024 | TechRadar
New Investment Scam Leverages AI, Social Media Ads to Target Victims Worldwide
Bosses struggle to police workers’ use of AI
How weaponized AI drives CISO burnout – and what to do about it | SC Media
With 'TPUXtract,' Attackers Can Steal Orgs' AI Models
Identity fraud attacks using AI are fooling biometric security systems | TechRadar
Cloud Threat Landscape Report: AI-generated attacks low for the cloud
2024 Cyber Review: Trump Re-Election Eclipses AI and Ransomware Stories
AI is becoming the weapon of choice for cyber criminals - Help Net Security
Cyber leaders are bullish on generative AI despite risks: report | CIO Dive
Malvertisers Fool Google With AI-Generated Decoys
Malware
How infostealers are used in targeted cyber attacks
Microsoft Teams Vishing Spreads DarkGate RAT
DarkGate malware spread via Microsoft Teams, AnyDesk | SC Media
Hackers Exploit Microsoft Teams to Gain Remote Access to User’s System
Winnti hackers target other threat actors with new Glutton PHP backdoor
PHP backdoor looks to be work of Chinese-linked APT group | CyberScoop
Google, Amnesty International uncover new surveillance malware | SC Media
FBI spots HiatusRAT malware attacks targeting web cameras, DVRs
Hackers Exploit Webview2 to Deploy CoinLurker Malware and Evade Security Detection
Malvertising on steroids serves Lumma infostealer - Help Net Security
That cheap webcam? HiatusRAT may be targeting it, FBI warns | CSO Online
Raccoon Stealer malware operator gets 5 years in prison after guilty plea
YouTube Creators Targeted in Major Phishing Campaign - Infosecurity Magazine
How to mitigate wiper malware | TechTarget
Evasive Node.js loader masquerading as game hack - Help Net Security
The Mask APT Resurfaces with Sophisticated Multi-Platform Malware Arsenal
FBI Warns of HiatusRAT Attacks on Cameras, DVR Systems - SecurityWeek
A new antivirus model to fight against evasive malware - Diari digital de la URV
Critical flaw in WordPress plugin exploited to install malicious software | SC Media
Bitter APT Targets Turkish Defence Sector with WmRAT and MiyaRAT Malware
Thai Police Systems Under Fire From 'Yokai' Backdoor
Lazarus targets nuclear-related organisation with new malware | Securelist
Malicious Microsoft VSCode extensions target devs, crypto community
Bots/Botnets
Mirai botnet targets SSR devices, Juniper Networks warns
Juniper Warns of Mirai Botnet Targeting Session Smart Routers - SecurityWeek
Mobile
Mobile Spear Phishing Targets Executive Teams - Security Boulevard
Addressing BYOD Vulnerabilities in the Workplace - Security Boulevard
This Nasty Android Malware Is Picking Up Pace and Targeting Certain Devices
Executives targeted in mobile spearphishing attacks | Security Magazine
BadBox malware botnet infects 192,000 Android devices despite disruption
Serbian police used Cellebrite to unlock, then plant spyware, on a journalist's phone | TechCrunch
Authorities abroad use phone-cracking tools to install spyware, report says - The Washington Post
New Android NoviSpy spyware linked to Qualcomm zero-day bugs
Internet of Things – IoT
Chinese wi-fi tech used in British homes investigated over hacking fears
Concerns over consumer surveillance in some smart devices | News UK Video News | Sky News
Multiple flaws in Volkswagen Group's infotainment unit allow for vehicle compromise
FBI spots HiatusRAT malware attacks targeting web cameras, DVRs
That cheap webcam? HiatusRAT may be targeting it, FBI warns | CSO Online
Zero Day Initiative — Detailing the Attack Surfaces of the Tesla Wall Connector EV Charger
Mirai botnet targets SSR devices, Juniper Networks warns
Juniper Warns of Mirai Botnet Targeting Session Smart Routers - SecurityWeek
FBI Warns of HiatusRAT Attacks on Cameras, DVR Systems - SecurityWeek
Germany blocks BadBox malware loaded on 30,000 Android devices
Data Breaches/Leaks
46% of financial institutions had a data breach in the past 24 months - Help Net Security
Huge cyber crime attack sees 390,000 WordPress websites hit, details stolen | TechRadar
Hacker Leaks Cisco Data - SecurityWeek
Consumers wrongly attribute all data breaches to cyber criminals - Help Net Security
Millions stolen from LastPass users in massive attack — what you need to know | Tom's Guide
390,000+ WordPress Credentials Stolen via Malicious GitHub Repository Hosting PoC Exploits
LastPass threat actor steals $5.4M from victims just a week before Xmas
Deloitte handling 'major' cyber attack on Rhode Island system • The Register
Nearly 400,000 WordPress credentials stolen | Security Magazine
LastPass Hackers Allegedly Stole $5 Million This Week—Report
How common are consumer data breaches? | Chain Store Age
Texas Tech University System data breach impacts 1.4 million patients
Meta Fined $264M for Security Breach in Facebook's 'View As' Feature - CNET
International Development Firm Chemonics Sued Over Breach (1)
900,000 People Impacted by ConnectOnCall Data Breach - SecurityWeek
Regional Care Data Breach Impacts 225,000 People - SecurityWeek
Organised Crime & Criminal Actors
Consumers wrongly attribute all data breaches to cyber criminals - Help Net Security
UK’s internet watchdog unveils online criminal crackdown
Ofcom Issues Guidance for Tech Firms to Tackle Online Harms - Infosecurity Magazine
Major cyber crime crackdowns signal a shift in global cyber security strategies - Policing Insight
Texan man gets 30 years in prison for running CSAM exchange • The Register
Bobbies on the beat won't stop the cyber crime wave | The Spectator
Why Are Crypto Scammers (And Not Hackers) Looking For You? | HackerNoon
Hacker sentenced to 69 months for stealing payment card info | SC Media
Cryptocurrency hackers stole $2.2 billion from platforms in 2024 - Help Net Security
Raccoon Stealer malware operator gets 5 years in prison after guilty plea
Cyber Criminals and the SEC: What Companies Need to Know
Trump to Wage War on Cyber Criminals, Says Advisor
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
LastPass threat actor steals $5.4M from victims just a week before Xmas
Hackers Exploit Webview2 to Deploy CoinLurker Malware and Evade Security Detection
Why Are Crypto Scammers (And Not Hackers) Looking For You? | HackerNoon
Cryptocurrency hackers stole $2.2 billion from platforms in 2024 - Help Net Security
North Korean Hackers Stole $1.3 Billion in Crypto in 2024
New fake Ledger data breach emails try to steal crypto wallets
Crypto Hacks in 2024: Centralized Exchanges Are Now the Top Targets for Cyber Criminals
Interpol: Stop calling it 'pig butchering' • The Register
Crypto holder loses assets priced at $2.5 million
Malicious Microsoft VSCode extensions target devs, crypto community
Insider Risk and Insider Threats
Kroll Settles With Ex-Employees Over Cyber Security Trade Secrets
GCHQ worker accused of taking top secret data home - BBC News
Insurance
Lloyd's of London Launches New Cyber Insurance Consortium
What will happen in the cyber insurance space during 2025? | Insurance Business America
Supply Chain and Third Parties
Supply Chain Risk Mitigation Must Be a Priority in 2025
Deloitte handling 'major' cyber attack on Rhode Island system • The Register
Harnessing Threat Intel and Automation to Counter Supply Chain Risks | MSSP Alert
Property deals hit by IT security failure at search service
CERT-UA: Russia-linked UAC-0125 abuses Cloudflare Workers to target Ukrainian army
Cloud/SaaS
Clop is back to wreak havoc via vulnerable file-transfer software | CyberScoop
Crooks use Docusign lures to attempt Azure account takeovers • The Register
SaaS: The Next Big Attack Vector | Grip Security - Security Boulevard
DarkGate malware spread via Microsoft Teams, AnyDesk | SC Media
Crooks use Docusign lures to attempt Azure account takeovers • The Register
CISA issues new directive to bolster cloud security – and Microsoft was singled out | ITPro
Ransomware attacks exploit Cleo bug as Cl0p claims it • The Register
US Government Issues Cloud Security Requirements for Federal Agencies - Infosecurity Magazine
Cloud Threat Landscape Report: AI-generated attacks low for the cloud
HubSpot phishing targets 20,000 Microsoft Azure accounts
European firms subjected to HubSpot-exploiting phishing | SC Media
Microsoft 365 users hit by random product deactivation errors
Identity and Access Management
Why Role-Based Access Control is Critical to Your Security Stack | MSSP Alert
Proactive Approaches to Identity and Access Management - Security Boulevard
Machine identity attacks will be top of mind for security leaders in 2025 | ITPro
Encryption
The Simple Math Behind Public Key Cryptography | WIRED
Why 2025 Will Be Pivotal in Our Defence Against Quantum Threat
Passwords, Credential Stuffing & Brute Force Attacks
"Password Era is Ending " Microsoft to Delete 1 Billion Password to Replace "Passkey"
Millions stolen from LastPass users in massive attack — what you need to know | Tom's Guide
Credential phishing attacks rose by 703% in H2 of 2024 | Security Magazine
LastPass threat actor steals $5.4M from victims just a week before Xmas
390,000+ WordPress Credentials Stolen via Malicious GitHub Repository Hosting PoC Exploits
LastPass 2022 hack fallout continues with millions of dollars more reportedly stolen | TechRadar
Nearly 400,000 WordPress credentials stolen | Security Magazine
HubPhish Exploits HubSpot Tools to Target 20,000 European Users for Credential Theft
What is a Compromised Credentials Attack? - Security Boulevard
MUT-1244 targeting security researchers, red teamers, and threat actors - Help Net Security
Social Media
New Investment Scam Leverages AI, Social Media Ads to Target Victims Worldwide
Study reveals vulnerability of metaverse platforms to cyber attacks
YouTube Creators Targeted in Major Phishing Campaign - Infosecurity Magazine
European Commission Opens TikTok Election Integrity Probe - Infosecurity Magazine
Meta fined for 2018 breach that exposed 30M accounts • The Register
Malvertising
New Investment Scam Leverages AI, Social Media Ads to Target Victims Worldwide
Fake Captcha Campaign Highlights Risks of Malvertising Networks - Infosecurity Magazine
Malvertising on steroids serves Lumma infostealer - Help Net Security
Malvertisers Fool Google With AI-Generated Decoys
Regulations, Fines and Legislation
UK’s internet watchdog unveils online criminal crackdown
Ofcom Issues Guidance for Tech Firms to Tackle Online Harms - Infosecurity Magazine
Why We Should Insist on Future-Proofing Cyber Security Regulatory Frameworks - Security Boulevard
Why the UK's "outdated" cyber security legislation needs an urgent refresh | ITPro
Hundreds of websites to shut down under UK's 'chilling' internet laws
The Top Cyber Security Agency in the US Is Bracing for Donald Trump | WIRED
EU Sanctions Russian Cyber Actors for “Destabilizing Actions” - Infosecurity Magazine
Understanding NIS2: Essential and Important Entities - Security Boulevard
Study finds ‘significant uptick’ in cyber security disclosures to SEC | CyberScoop
Meta Fined $264M for Security Breach in Facebook's 'View As' Feature - CNET
Meta fined for 2018 breach that exposed 30M accounts • The Register
Trump Looks to Go 'On the Offense' Against Cyber Attackers
Models, Frameworks and Standards
How the cyber security landscape affects the financial sector
An easy to follow NIST Compliance Checklist - Security Boulevard
Understanding NIS2: Essential and Important Entities - Security Boulevard
Using CIS Benchmarks to Assess Your System Security Posture | MSSP Alert
NIS2 Penetration Testing and Compliance - Security Boulevard
Backup and Recovery
Careers, Working in Cyber and Information Security
Closing the SMB cyber security skills gap: Key steps | SC Media
Leadership in Cyber Security: A Guide to Your First Role
The key to growing a cyber security career are soft skills - Security Boulevard
Law Enforcement Action and Take Downs
Major cyber crime crackdowns signal a shift in global cyber security strategies - Policing Insight
Arizona man arrested for alleged involvement in violent online terror networks | CyberScoop
Texan man gets 30 years in prison for running CSAM exchange • The Register
Man Accused of SQL Injection Hacking Gets 69-Month Prison Sentence - SecurityWeek
Hacker sentenced to 69 months for stealing payment card info | SC Media
Raccoon Stealer malware operator gets 5 years in prison after guilty plea
Dodgy Firestick crackdown: full list of UK areas targeted by police
Germany blocks BadBox malware loaded on 30,000 Android devices
Romanian Netwalker ransomware affiliate sentenced to 20 years in prison
Misinformation, Disinformation and Propaganda
Romania’s election was target of cyber attacks and misinformation, parliament finds
European Commission Opens TikTok Election Integrity Probe - Infosecurity Magazine
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Nation State Actors
China
Chinese wi-fi tech used in British homes investigated over hacking fears
Feds Investigate, Mull Ban on Chinese-Made Routers | Newsmax.com
TP-Link routers could be banned in the US over national security concerns | TechSpot
European Commission Opens TikTok Election Integrity Probe - Infosecurity Magazine
PHP backdoor looks to be work of Chinese-linked APT group | CyberScoop
Trump security advisor urges offensive cyber attacks on China • The Register
Russia
Russia Recruits Ukrainian Children for Sabotage and Reconnaissance - Infosecurity Magazine
Ukrainian Minors Recruited for Cyber Ops and Reconnaissance in Russian Airstrikes
Midnight Blizzard Taps Phishing Emails, Rogue RDP Nets
EU Sanctions Russian Cyber Actors for “Destabilizing Actions” - Infosecurity Magazine
Romania’s election was target of cyber attacks and misinformation, parliament finds
Russian hackers use RDP proxies to steal data in MiTM attacks
APT29 group used red team tools in rogue RDP attacks
CERT-UA: Russia-linked UAC-0125 abuses Cloudflare Workers to target Ukrainian army
Ukraine's Defence Minister agrees with US to deepen cooperation in cyber security | Ukrainska Pravda
Russian FSB relies on Ukrainian minors for criminal activities disguised as "quest games"
Recorded Future CEO applauds "undesirable" designation by Russia
US Organisations Still Using Kaspersky Products Despite Ban - Infosecurity Magazine
Iran
Iran crew used 'cyberweapon' against US critical infra • The Register
North Korea
North Korean Hackers Stole $1.3 Billion in Crypto in 2024
Lazarus targets nuclear-related organisation with new malware | Securelist
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
The Mask APT Resurfaces with Sophisticated Multi-Platform Malware Arsenal
Bitter APT Targets Turkish Defence Sector with WmRAT and MiyaRAT Malware
Serbian police used Cellebrite to unlock, then plant spyware, on a journalist's phone | TechCrunch
Authorities abroad use phone-cracking tools to install spyware, report says - The Washington Post
New Android NoviSpy spyware linked to Qualcomm zero-day bugs
Tools and Controls
From digital risk to physical threat: Why cyber security must evolve for executives | SC Media
Why Role-Based Access Control is Critical to Your Security Stack | MSSP Alert
Addressing BYOD Vulnerabilities in the Workplace - Security Boulevard
DarkGate malware spread via Microsoft Teams, AnyDesk | SC Media
Hackers Exploit Microsoft Teams to Gain Remote Access to User’s System
Hackers Scanning RDP Services Especially Port 1098 For Exploitation
To Defeat Cyber Criminals, Understand How They Think
Are threat feeds masking your biggest security blind spot? - Help Net Security
The evolution of incident response: building a successful strategy | TechRadar
New APIs Discovered by Attackers in Just 29 Seconds - Infosecurity Magazine
Harnessing Threat Intel and Automation to Counter Supply Chain Risks | MSSP Alert
Penetration testing – a critical component of financial cyber security in 2025
Machine identity attacks will be top of mind for security leaders in 2025 | ITPro
The pros and cons of biometric authentication | TechTarget
Wallarm Releases API Honeypot Report Highlighting API Attack Trends
Might need a mass password reset one day? Read this first.
The evolution of incident response: building a successful strategy | TechRadar
Making smart cyber security spending decisions in 2025
Why You Must Replace Your Legacy SIEM and Migrate to Modern SIEM Analytics? - IT Security Guru
Russian hackers use RDP proxies to steal data in MiTM attacks
APT29 group used red team tools in rogue RDP attacks
What will happen in the cyber insurance space during 2025? | Insurance Business America
Is Your Cloud Infrastructure Truly Protected? - Security Boulevard
The Feds Have Some Advice for 'Highly Targeted' Individuals: Don't Use a VPN
Gaining Confidence Through Effective Secrets Vaulting - Security Boulevard
NCSC Mail Check Changes & Their Impact on UK Public Sector Email Security - Security Boulevard
Reports Published in the Last Week
Other News
Hackers Scanning RDP Services Especially Port 1098 For Exploitation
Travel Cyber Security Threats and How to Stay Protected - Security Boulevard
Schools Need Improved Cyber Education (Urgently) - IT Security Guru
Study reveals vulnerability of metaverse platforms to cyber attacks
WiFi hacking for the everyday spy | Cybernews
Leadership skills for managing cyber security during digital transformation - Help Net Security
UK businesses risk disruption as PSTN switch-off approaches | Computer Weekly
MSSP Market Update: Fortune 500 Firms Fail at Cyber Security | MSSP Alert
2025 is set to bring changes in technology adoption and the evolving attack surface
Cyber Security In 2025 – A New Era Of Complexity
The Feds Have Some Advice for 'Highly Targeted' Individuals: Don't Use a VPN
Resolve to Be Resilient: Top Cyber Priorities for State and Local Government
Cyber Security Threats to Our Most Basic Needs
Cyber Security in the legal sector: awareness & proactive strategies - Legal News
Global cyber security impact on food and drink firms
Inform: The cyber complexities facing local government | UKAuthority
Santa-hacking - how to carry out a cyber attack on Father Christmas - Prolific North
Watch Out for These Holiday Cyber Attacks
How to tell if a USB cable is hiding malicious hacker hardware | PCWorld
Inform: The cyber complexities facing local government | UKAuthority
The Education Industry: Why Its Data Must Be Protected
How fan engagement impacts cyber security in sports - Verdict
Why cyber security is critical to energy modernization - Help Net Security
Vulnerability Management
Are threat feeds masking your biggest security blind spot? - Help Net Security
No, Microsoft has not 'reversed course' on Windows 11 hardware requirements | ZDNET
Vulnerabilities
2024 Sees Sharp Increase in Microsoft Tool Exploits - Infosecurity Magazine
Patch Alert: Critical Apache Struts Flaw Found, Exploitation Attempts Detected
Critical OpenWrt Vulnerability Exposes Devices to Malicious Firmware Injection
Microsoft Patches Vulnerabilities in Windows Defender, Update Catalog - SecurityWeek
Citrix shares mitigations for ongoing Netscaler password spray attacks
Cleo MFT Zero-Day Exploits Are About Escalate
Over 25,000 SonicWall VPN Firewalls exposed to critical flaws
Windows kernel bug now exploited in attacks to gain SYSTEM privileges
Clop ransomware group claims responsibility for exploiting Cleo file transfer vulnerabilities
Over 300 orgs compromised through several DrayTek exploits | SC Media
Fortinet warns about Critical flaw in Wireless LAN Manager FortiWLM
Chrome 131 Update Patches High-Severity Memory Safety Bugs - SecurityWeek
Hackers Exploiting Critical Fortinet EMS Vulnerability to Deploy Remote Access Tools
Hackers are abusing Microsoft tools more than ever before | TechRadar
BeyondTrust Patches Critical Vulnerability Discovered During Security Incident Probe - SecurityWeek
New Apache Tomcat Vulnerabilities Let Attackers Execute Remote Code
Undocumented DrayTek Vulnerabilities Exploited to Hack Hundreds of Orgs - SecurityWeek
Critical flaw in WordPress plugin exploited to install malicious software | SC Media
Researchers claim an AMD security flaw could let hackers access encrypted data | ITPro
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 13 December 2024
Black Arrow Cyber Threat Intelligence Briefing 13 December 2024:
-Cyber Security Risks Rise During Mergers & Acquisitions
-Ransomware Gangs’ Merciless Attacks Bleed Small Companies Dry
-AI & Cyber Security to Shape the Tech Landscape in 2025
-Phishing: The Silent Precursor to Data Breaches
-Business Cyber Understanding Gap Creates New Vulnerabilities
-Cyber Defence vs Cyber Resilience: Why It's Time to Prioritise Recovery
-UK SMEs Are Concerned About Preparedness for Cyber Attacks as Fraud Rises
-Cyber Risk to Intensify in 2025 as Attackers Switch Tactics
-Companies Pull Company and Board Leadership Bios from Their Websites After Insurance Executive’s Killing
-Boardroom Risks Revealed in Latest Beazley Report
-Employee Visits to Adult or Gambling Sites Doubles Risk of Infection by Malware
-North Korea's Fake IT Worker Scam Hauled in at Least $88 Million Over Six Years
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Cyber Security Risks Rise During Mergers & Acquisitions
ReliaQuest’s analysis reveals heightened cyber security risks during mergers and acquisitions, with half of incidents stemming from threat actors exploiting potential security gaps, and the remainder from non-malicious employee issues. The manufacturing, finance and retail sectors were the hardest hit. One private equity CISO observed a 400% surge in phishing attempts post-M&A announcements. Key risks include phishing attacks, data leaks, and vulnerabilities due to legacy systems. ReliaQuest recommends proactive strategies like pre-due-diligence assessments, training, network segmentation, and unified logging to mitigate these risks and ensure smoother integration during M&As.
Ransomware Gangs’ Merciless Attacks Bleed Small Companies Dry
Ransomware attacks surged by 70% in 2023, hitting 4,611 reported incidents according to industry research, with one gang alone extorting an estimated $42 million. Around 80% of victims are small and medium-size organisations. Many rely on cyber security insurance with limits around £1 million, yet the median ransom soared to $6.5 million this year. This gap between insurance coverage and actual costs has driven some companies into administration. Experts warn that, although attackers often use unsophisticated techniques, they remain ruthless. Robust monitoring software, password protection and comprehensive incident response plans can provide critical defences against this escalating threat.
AI & Cyber Security to Shape the Tech Landscape in 2025
The tech landscape of 2025 will be defined by the growth of specialised AI solutions and evolving cyber security measures, according to sector leaders from Nutanix, Rubrik, Snowflake, Obsidian Security, ManageEngine, and Infoblox. Cloud-based AI agents will automate threat detection, but also heighten risks of data leaks and identity-based attacks. Industry-specific models will transform finance, healthcare, manufacturing, and hospitality, offering faster, more precise services. Organisations must enhance data access controls, involve all staff in cyber security, and align IT and business goals. Government regulations and platform-based strategies will play a critical role in supporting innovation and safeguarding operations.
Phishing: The Silent Precursor to Data Breaches
Phishing remains a silent precursor to destructive data breaches, accounting for 31% of cyber security incidents - outdone only by weak or compromised credentials and pretexting. By exploiting human psychology, phishing bypasses technological safeguards, enabling the theft of sensitive data and triggering large-scale cyber attacks. One major infrastructure breach was initiated through a phishing-driven compromise, underscoring the threat’s far-reaching impact. Organisations can reduce phishing risks by prioritising employee training, filtering malicious emails, and implementing multi-factor authentication. This multi-layered approach, combined with a strong incident response plan, is essential to help safeguard systems and protect sensitive information in the modern cyber threat landscape.
Business Cyber Understanding Gap Creates New Vulnerabilities
Cyber security insurance provider Resilience has found that many UK mid-to-large businesses lack a clear grasp of cyber security as a financial risk, despite 74% having experienced cyber crime. The survey of IT and financial leaders highlighted a worrying gap between media focus on data breaches (cited by 72% as their main worry) and the larger financial impact of ransomware (responsible for more than 80% of losses). Limited use of quantitative risk registries (54%) further hampers businesses’ ability to mitigate cyber threats.
Cyber Defence vs Cyber Resilience: Why It's Time to Prioritise Recovery
AI-driven cyber attacks are prevalent, with intruders able to remain undetected for months and most ransomware campaigns targeting backup repositories. This demands a shift from solely cyber defence to holistic cyber resilience. A strategy includes a robust backup approach, active monitoring, and an isolated recovery environment to ensure data remains clean and recoverable. Equally important is cross-functional collaboration between IT and security teams to flag and respond to breaches quickly. By prioritising recovery and resilience, organisations can maintain business operations, minimise downtime, and stay ahead of evolving cyber threats in today’s borderless IT landscape.
UK SMEs Are Concerned About Preparedness for Cyber Attacks as Fraud Rises
Online payment provider Mollie has reported that five and a half million UK SMEs lost an average of £10,800 to fraud this year, leaving nine in 10 C-Suite executives concerned about their survival. Fraud types included phishing (58%), refund scams (42%), account takeovers (30%) and carding attacks (23%). Firms spent around 15 days annually handling these threats, diverting critical resources from core operations. This underscores a growing need for effective cyber security measures that combat rising threats without stifling business growth. Mollie’s research highlights the importance of equipping smaller enterprises with balanced solutions to safeguard revenue and productivity, protecting them from ever-evolving forms of cyber attack.
Cyber Risk to Intensify in 2025 as Attackers Switch Tactics - Moody’s
According to Moody’s 2025 cyber security outlook, the threat environment is evolving as attackers target bigger businesses and harness AI for more potent attacks. Ransomware soared by 70% from 2022 to 2023, with ransom payments hitting a record $1.1 billion. Meanwhile, the share of victims paying ransoms is falling, driving cyber criminals to focus on larger organisations. Supply chain incidents are growing in parallel with the proliferation of AI-enabled scams and greater reliance on external providers. Moody’s recommends warns that robust risk assessments and improved cyber security measures, including passkeys, can help address these mounting challenges.
Companies Pull Leadership Bios from Their Websites After Insurance Executive’s Killing
Following the tragic shooting of a leading insurance executive in New York City, major health insurers have swiftly removed leadership bios from their websites. Archived versions of UnitedHealthcare, Anthem Blue Cross Blue Shield, and Elevance Health pages show these details were public until shortly after the incident. Faced with heightened security concerns, organisations are reinforcing protective measures, while private security firms report a surge in new business. This underscores an evolving risk landscape for senior leaders, prompting companies to carefully manage executive information online and reassess personal safety protocols.
Boardroom Risks Revealed in Latest Beazley Report
Beazley’s latest report highlights cyber security as the top boardroom concern, cited by 45% of executives. Regulatory compliance (41%) and ESG (35%) follow closely, yet 60% of respondents feel only moderately or poorly prepared for cyber attacks. ESG influences are expected to surge, with 68% foreseeing major board impact, but just 39% feel ready. The report urges proactive risk management, encouraging boards to strengthen internal expertise, invest in technology, and align governance strategies with shifting priorities.
Employee Visits to Adult or Gambling Sites Doubles Risk of Infection by Malware
According to new research, employees visiting gambling or adult sites can double the risk of malware infections, including coinminers, trojans, and hacking tools. Browsing illegal sites may increase malware threats by up to five times, while frequent visits to unknown websites also raise infection odds. By identifying how specific user behaviours relate to distinct malware types, organisations can tailor their cyber security defences accordingly. Governments might prioritise hacktools, whereas healthcare could focus on ransomware. Overall, the study suggests that targeted, behaviour-based cyber security measures can help organisations reduce risks cost-effectively for their unique threat profiles.
North Korea's Fake IT Worker Scam Hauled in at Least $88 Million Over Six Years
North Korea’s covert IT workforce has reportedly generated $88 million over six years by posing as remote tech professionals, according to the US Department of Justice. Hiding their true identities and locations, these “IT warriors” channel their earnings into Pyongyang’s coffers, while some leverage access privileges to steal proprietary data and extort employers. Even cyber security businesses have been duped. Authorities have uncovered over 130 participants, linked to firms in China and Russia. Officials warn the threat persists, with continued guidance on detecting the scam and a multimillion-dollar reward in place to disrupt North Korea’s illicit revenue streams.
Sources:
https://securitybrief.co.nz/story/cybersecurity-risks-rise-during-mergers-acquisitions
https://www.claimsjournal.com/news/national/2024/12/06/327772.htm
https://securitybrief.co.nz/story/ai-cybersecurity-to-shape-the-tech-landscape-in-2025
https://www.securityweek.com/phishing-the-silent-precursor-to-data-breaches/
https://www.emergingrisks.co.uk/business-cyber-understanding-gap-creates-new-vulnerabilities/
https://www.reinsurancene.ws/cyber-risk-to-intensify-in-2025-as-attackers-switch-tactics-moodys/
https://www.theregister.com/2024/12/13/doj_dpkr_fake_tech_worker_indictment/
Governance, Risk and Compliance
Cyber security risks rise during mergers & acquisitions
Boardroom risks revealed in latest Beazley report | Insurance Business America
Dear CEO: It’s time to rethink security leadership and empower your CISO | CSO Online
Moody's: Hackers Aim for Big Payouts, Supply Chain Attacks
We must adjust expectations for the CISO role - Help Net Security
Cyber defence vs cyber resilience: why it's time to prioritize recovery
Business cyber understanding gap creates new vulnerabilities
Cyber risk to intensify in 2025 as attackers switch tactics: Moody's - Reinsurance News
Cyber Security In The Digital Frontier: Reimagining Organisational Resilience
Charges Against CISOs Create Worries, Hope in Security Industry: Survey - Security Boulevard
The skills that cyber security leaders need
70 percent of cyber security leaders worry about personal liability
CISOs need to consider the personal risks associated with their role - Help Net Security
Cultivating a Hacker Mindset in Cyber Security Defence
Blackbaud Appoints Bradley Pyburn, Former Chief of Staff of US Cyber Command, to Board of Directors
Heed the warnings on cyber security threats - James McGachie
How to Improve Your Cyber Security On a Lower Budget | Mimecast
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Gangs’ Merciless Attacks Bleed Small Companies Dry
Black Basta Ransomware Evolves with Email Bombing, QR Codes, and Social Engineering
Cleo Vulnerability Exploitation Linked to Termite Ransomware Group - SecurityWeek
New Windows Drive-By Security Attack—What You Need To Know
What Do We Know About the New Ransomware Gang Termite?
Ransomware Victims
Blue Yonder SaaS giant breached by Termite ransomware gang
8Base hacked port operating company Luka Rijeka - Help Net Security
Separate ransomware attacks hit Japanese firms’ US subsidiaries | SC Media
Deloitte Responds After Ransomware Group Claims Data Theft - SecurityWeek
Anna Jaques Hospital ransomware breach exposed data of 300K patients
National Museum of the Royal Navy hit by cyber attack - Museums Association
Ransomware Disrupts Operations At Leading Heart Surgery Device Maker
Krispy Kreme admits there's a hole in its security • The Register
Phishing & Email Based Attacks
Businesses plagued by constant stream of malicious emails - Help Net Security
Phishing: The Silent Precursor to Data Breaches - SecurityWeek
A new report shows QR code phishing is on the rise | Security Magazine
Black Basta Ransomware Evolves with Email Bombing, QR Codes, and Social Engineering
Cyber criminals are using virtual hard drives to drop RATs in phishing attacks | TechRadar
European Police Disrupt Phone Phishing Gang with Arrests - Infosecurity Magazine
Eight Suspected Phishers Arrested in Belgium, Netherlands - SecurityWeek
Millionaire Airbnb Phishing Ring Busted Up by Police
Brand Impersonations Surge 2000% During Black Friday
Scam Kit Maker Rebuilding Business After Telegram Channel Shut Down - Security Boulevard
New Advanced Email Attack Warning Issued—5 Things To Know
Email security: Why traditional defences fall short in today's threat landscape
Fake Recruiters Distribute Banking Trojan via Malicious Apps in Phishing Scam
Businesses received over 20 billion spam emails this year | TechRadar
Phishing Scam Targets Ukrainian Defence Companies - Infosecurity Magazine
5 Email Attacks You Need to Know for 2025 | Abnormal
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Understanding the Shifting Anatomy of BEC Attacks
Notorious Nigerian cyber criminal tied to BEC scams extradited to US | CyberScoop
Other Social Engineering
Black Basta Ransomware Evolves with Email Bombing, QR Codes, and Social Engineering
Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion | Trend Micro (US)
Cyber criminals Impersonate Dubai Police to Defraud Consumers in the UAE - Smishing Triad in Action
Spain busts voice phishing ring for defrauding 10,000 bank customers
Fake IT Workers Funnelled Millions to North Korea, DOJ Says - SecurityWeek
Artificial Intelligence
AI & cyber security to shape the tech landscape in 2025
AI is a gamble we cannot afford without cyber security
Compromised AI Library Delivers Cryptocurrency Miner via PyPI - Infosecurity Magazine
AI fakes, cyber attacks threaten German election – DW – 12/06/2024
Researchers Uncover Prompt Injection Vulnerabilities in DeepSeek and Claude AI
2FA/MFA
Microsoft Azure MFA Flaw Allowed Easy Access Bypass - Infosecurity Magazine
Microsoft MFA Bypassed via AuthQuake Attack - SecurityWeek
No User Interaction, No Alerts: Azure MFA Cracked In An Hour
Researchers Crack Microsoft Azure MFA in an Hour
Snowflake Rolls Out Mandatory MFA Plan
Malware
Employee Visits to Adult or Gambling Sites Doubles | Newswise
Windows, macOS users targeted with crypto-and-info-stealing malware - Help Net Security
Cyber criminals are using virtual hard drives to drop RATs in phishing attacks | TechRadar
Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion | Trend Micro (US)
Cleo Patches Exploited Flaw as Security Firms Detail Malware Pushed in Attacks - SecurityWeek
Open source malware surged by 156% in 2024 | ITPro
Fake Recruiters Distribute Banking Trojan via Malicious Apps in Phishing Scam
Remcos RAT Malware Evolves with New Techniques - Infosecurity Magazine
More advanced Zloader malware variant emerges | SC Media
This devious new malware technique looks to hijack Windows itself to avoid detection | TechRadar
New stealthy Pumakit Linux rootkit malware spotted in the wild
RedLine info-stealer campaign targets Russian businesses
Ongoing Phishing and Malware Campaigns in December 2024
Bots/Botnets
It’s Beginning To Look A Lot Like Grinch Bots
Mobile
Lookout Discovers New Spyware Deployed by Russia and China - Infosecurity Magazine
Gamaredon Deploys Android Spyware "BoneSpy" and "PlainGnome" in Former Soviet States
'EagleMsgSpy' Android Spyware Linked to Chinese Police
New Smartphone Warning—Forget What You’ve Been Told About Security
Chinese EagleMsgSpy Spyware Found Exploiting Mobile Devices Since 2017
Experts discovered the first mobile malware families linked to Russia's Gamaredon
Telegram founder Pavel Durov questioned in Paris court for first time: Report
Apple’s iPhone Hit By FBI Warning And Lawsuit Before iOS 18.2 Release
Denial of Service/DoS/DDoS
Europol Dismantles 27 DDoS Attack Platforms Across 15 Nations; Admins Arrested
Internet of Things – IoT
EU cyber security rules for smart devices enter into force | TechCrunch
DoD Digital Forensics: Unlocking Evidence In Cars, Wearables, And IoT
The EU Cyber Resilience Act: Enhancing Digital Security In The AI Era
Vulnerabilities in Skoda & Volkswagen Cars Let Hackers Remotely Track Users
Data Breaches/Leaks
Phishing: The Silent Precursor to Data Breaches - SecurityWeek
Deloitte Denies Breach, Claims Cyber-Attack Targeted Single Client - Infosecurity Magazine
Deloitte sues 3 partners who 'leaked secrets' to rival firm
Public Reprimands, an Effective Deterrent Against Data Breaches - Infosecurity Magazine
Salt Typhoon recorded 'very senior' US officials' calls • The Register
446,000 Impacted by Center for Vein Restoration Data Breach - SecurityWeek
Massive Data Breach Hits Senior Dating Website, Exposing Over 765,000 Users
Cyber security expert Abi Waddell hacked huntsmen to leak their names and addresses
Attackers can abuse the Windows UI Automation framework to steal data from apps | CSO Online
Cyber security Lessons From 3 Public Breaches
Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online
New Atrium Health data breach impacts 585,000 individuals
US Bitcoin ATM operator Byte Federal suffered a data breach
Organised Crime & Criminal Actors
Moody's: Hackers Aim for Big Payouts, Supply Chain Attacks
Recently Charged Scattered Spider Suspect Did Poor Job at Covering Tracks - SecurityWeek
Cyber crime gang arrested after turning Airbnbs into fraud centres
Russian government spies targeted Ukraine using tools developed by cyber criminals | TechCrunch
Emulating the Financially Motivated Criminal Adversary FIN7 – Part 1 - Security Boulevard
Alleged Scattered Spider hacker arrested, indicted | SC Media
Cyber security expert Abi Waddell hacked huntsmen to leak their names and addresses
Scam Kit Maker Rebuilding Business After Telegram Channel Shut Down - Security Boulevard
Cyber criminal marketplace Rydox seized in international law enforcement operation | CyberScoop
FBI Busts Rydox Marketplace with 7,600 PII Sales, Cryptocurrency Worth $225K Seized
He Investigates the Internet’s Most Vicious Hackers—From a Secret Location - WSJ
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Windows, macOS users targeted with crypto-and-info-stealing malware - Help Net Security
Radiant links $50 million crypto heist to North Korean hackers
"CP3O" pleads guilty to multi-million dollar cryptomining scheme
North Korean Group UNC4736 Blamed for Radiant Capital Breach
Compromised AI Library Delivers Cryptocurrency Miner via PyPI - Infosecurity Magazine
US Bitcoin ATM operator Byte Federal suffered a data breach
Insider Risk and Insider Threats
Employee Visits to Adult or Gambling Sites Doubles | Newswise
Deloitte sues 3 partners who 'leaked secrets' to rival firm
How To Flip the Script on the Latest Insider Threat Trends
Insurance Worker Sentenced After Illegally Accessing Claimants’ Data - Infosecurity Magazine
7 types of insider threats | University of Strathclyde
Insurance
How to make your clients less attractive to cyber criminals | Insurance Business America
Supply Chain and Third Parties
Moody's: Hackers Aim for Big Payouts, Supply Chain Attacks
Blue Yonder SaaS giant breached by Termite ransomware gang
Containers are a weak link in supply chain security
Lessons From the Largest Software Supply Chain Incidents
Cloud/SaaS
Blue Yonder SaaS giant breached by Termite ransomware gang
Who handles what? Common misconceptions about SaaS security responsibilities - Help Net Security
Vishing via Microsoft Teams Facilitates DarkGate Malware Intrusion | Trend Micro (US)
Thousands of AWS credentials stolen from misconfigured sites • The Register
Cleo Patches Exploited Flaw as Security Firms Detail Malware Pushed in Attacks - SecurityWeek
Microsoft MFA Bypassed via AuthQuake Attack - SecurityWeek
No User Interaction, No Alerts: Azure MFA Cracked In An Hour
Outages
Microsoft 365 outage takes down Office web apps, admin center
Facebook, Instagram, WhatsApp hit by massive worldwide outage
ChatGPT and Sora experienced a major outage | TechCrunch
Encryption
Telegram founder Pavel Durov questioned in Paris court for first time: Report
Google says its breakthrough Willow quantum chip can’t break modern cryptography - The Verge
Apple’s iPhone Hit By FBI Warning And Lawsuit Before iOS 18.2 Release
Linux and Open Source
Open source malware surged by 156% in 2024 | ITPro
New stealthy Pumakit Linux rootkit malware spotted in the wild
Passwords, Credential Stuffing & Brute Force Attacks
Thousands of AWS credentials stolen from misconfigured sites • The Register
Over 300K Prometheus Instances Exposed: Credentials and API Keys Leaking Online
Hackers Target Global Sporting Events With Fake Domains To Steal Logins
Social Media
The EU Makes an Urgent TikTok Inquiry on Russia's Role in Romanian Election Turmoil - SecurityWeek
Federal Appeals Court Upholds Law Threatening US TikTok Ban - Infosecurity Magazine
Romania Cancels Presidential Election Results After Alleged Russian Meddling on TikTok
Massive Data Breach Hits Senior Dating Website, Exposing Over 765,000 Users
Training, Education and Awareness
Opinion: Why cyber security awareness is everyone's responsibility | Calgary Herald
Regulations, Fines and Legislation
EU cyber security rules for smart devices enter into force | TechCrunch
The EU Makes an Urgent TikTok Inquiry on Russia's Role in Romanian Election Turmoil - SecurityWeek
Federal Appeals Court Upholds Law Threatening US TikTok Ban - Infosecurity Magazine
Why Americans must be prepared for cyber security’s worst | CyberScoop
The EU Cyber Resilience Act: Enhancing Digital Security In The AI Era
US Telco Security Efforts Ramp Up After Salt Typhoon
Experts Call for Overhaul of National Cyber Director Role
Cyprus financial sector gears up for stricter cyber security | Cyprus Mail
Models, Frameworks and Standards
The EU Cyber Resilience Act: Enhancing Digital Security In The AI Era
Understanding ISO 27001: The Backbone of Information Security Management: By Kajal Kashyap
Careers, Working in Cyber and Information Security
HR Magazine - Lock it in: How to close the cyber security training gap
What makes for a fulfilled cyber security career - Help Net Security
Law Enforcement Action and Take Downs
Recently Charged Scattered Spider Suspect Did Poor Job at Covering Tracks - SecurityWeek
Europol Dismantles 27 DDoS Attack Platforms Across 15 Nations; Admins Arrested
European Police Disrupt Phone Phishing Gang with Arrests - Infosecurity Magazine
Eight Suspected Phishers Arrested in Belgium, Netherlands - SecurityWeek
Spain busts voice phishing ring for defrauding 10,000 bank customers
Notorious Nigerian cyber criminal tied to BEC scams extradited to US | CyberScoop
Cyber criminal marketplace Rydox seized in international law enforcement operation | CyberScoop
Millionaire Airbnb Phishing Ring Busted Up by Police
"CP3O" pleads guilty to multi-million dollar cryptomining scheme
Telegram founder Pavel Durov questioned in Paris court for first time: Report
Jersey police help disrupt multi-billion money laundering networks | Bailiwick Express
Misinformation, Disinformation and Propaganda
Romania Cancels Presidential Election Results After Alleged Russian Meddling on TikTok
AI fakes, cyber attacks threaten German election – DW – 12/06/2024
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Keep cash at home due to cyber attack risks, Dutch Central Bank warns – The Irish Times
NATO Offensive cyber operations exercise Crossed Swords gets underway in Tallinn
Nation State Actors
China
Salt Typhoon recorded 'very senior' US officials' calls • The Register
Counterintelligence director reveals extent of damage from China telecom hacks - Washington Times
The EU Makes an Urgent TikTok Inquiry on Russia's Role in Romanian Election Turmoil - SecurityWeek
Federal Appeals Court Upholds Law Threatening US TikTok Ban - Infosecurity Magazine
How Chinese insiders exploit its surveillance state • The Register
Compromised Software Code Poses New Systemic Risk to US Critical Infrastructure
Chinese hackers use Visual Studio Code tunnels for remote access
US Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls
US Telco Security Efforts Ramp Up After Salt Typhoon
Why did China hack the world’s phone networks?
Chinese EagleMsgSpy Spyware Found Exploiting Mobile Devices Since 2017
Romania Cancels Presidential Election Results After Alleged Russian Meddling on TikTok
As US finally details Chinese Salt Typhoon attack, FCC Chair proposes new rules for telcos
'EagleMsgSpy' Android Spyware Linked to Chinese Police
Russia
Lookout Discovers New Spyware Deployed by Russia and China - Infosecurity Magazine
Keep cash at home due to cyber attack risks, Dutch Central Bank warns – The Irish Times
The EU Makes an Urgent TikTok Inquiry on Russia's Role in Romanian Election Turmoil - SecurityWeek
Russian hacktivists target oil, gas and water sectors worldwide | SC Media
Russian government spies targeted Ukraine using tools developed by cyber criminals | TechCrunch
EU envoys to discuss first sanctions targeting Russian hybrid threats
Exploring Cyber-Darkness: How Moscow Undermines the West via the Dark Web | Geopolitical Monitor
NATO Offensive cyber operations exercise Crossed Swords gets underway in Tallinn
Gamaredon Deploys Android Spyware "BoneSpy" and "PlainGnome" in Former Soviet States
Ukraine Weighs Telegram Security Risks Amid War With Russia - The New York Times
Romania Exposes Propaganda Campaign Supporting Pro-Russian Candidate - Infosecurity Magazine
AI fakes, cyber attacks threaten German election – DW – 12/06/2024
Romania Cancels Presidential Election Results After Alleged Russian Meddling on TikTok
Experts discovered the first mobile malware families linked to Russia's Gamaredon
Threat hunting case study: Cozy Bear | Intel 471
Phishing Scam Targets Ukrainian Defence Companies - Infosecurity Magazine
Russia disconnects several regions from the global internet to test its sovereign net | TechRadar
Russia takes unusual route to hack Starlink-connected devices in Ukraine - Ars Technica
RedLine info-stealer campaign targets Russian businesses
North Korea
North Korea's fake IT worker scam hauled in $88 million • The Register
Radiant links $50 million crypto heist to North Korean hackers
North Korean Group UNC4736 Blamed for Radiant Capital Breach
Tools and Controls
Who handles what? Common misconceptions about SaaS security responsibilities - Help Net Security
Security researchers set up an API honeypot to dupe hackers – and the results were startling | ITPro
Neglect of endpoints presents a major security gap for enterprises
Conquering the Complexities of Modern BCDR
Safe Handling of Data: Why Secrets Sprawl is a Risk - Security Boulevard
Why don’t security leaders get the funds they need to succeed? | SC Media
What is Cyber Threat Detection and Response? | UpGuard
US Charges Chinese Hacker for Exploiting Zero-Day in 81,000 Sophos Firewalls
Bug bounty programs: Why companies need them now more than ever | CSO Online
Cyber Security Products or Platforms - Which is More Effective? - Security Boulevard
AI is a gamble we cannot afford without cyber security
Exposed APIs and issues in the world's largest organisations - Help Net Security
WAF Vulnerability in Akamai, Cloudflare, and Imperva Affected 40% of Fortune 100 Companies
Microsoft enforces defences preventing NTLM relay attacks - Help Net Security
Businesses struggle with IT security, Kaspersky reports
Unlocking the Value of DSPM: What You Need to Know - IT Security Guru
7 Must-Know IAM Standards in 2025
Mastering PAM to Guard Against Insider Threats - Security Boulevard
The Future of Network Security: Automated Internal and External Pentesting
How to Make the Case for Network Security Audits - Security Boulevard
Strengthening security posture with comprehensive cyber security assessments - Help Net Security
Three-Quarters of Security Leaders Admit Gaps in Hardware Knowledge - Infosecurity Magazine
TPM 2.0: The new standard for secure firmware - Help Net Security
How to Improve Your Cyber Security On a Lower Budget | Mimecast
Other News
TfL cyber attack cost over £30m to date | Computer Weekly
50% Of M&A Security Issues Are Non-Malicious
Cyber Security In The Digital Frontier: Reimagining Organisational Resilience
Attackers can abuse the Windows UI Automation framework to steal data from apps | CSO Online
Microsoft enforces defences preventing NTLM relay attacks - Help Net Security
Businesses struggle with IT security, Kaspersky reports
IT pros say hackers could compromise device supply chain, firmware security | SC Media
Non-Human Identities: The Silent Threat - InfoRiskToday
The Big Question: Is the UK doing enough when it comes to cyber risks? - Emerging Risks Media Ltd
From Europe to South Africa: Where Is the World on Cyber Defence?
You Don’t Talk to Strangers, So Why Does Your Internet? | SC Media
Drowning in spam? Stop giving out your email address - do this instead | ZDNET
Heed the warnings on cyber security threats - James McGachie
Utility Companies Face 42% Surge in Ransomware Attacks - Infosecurity Magazine
Safeguarding Charities From Cyber Crime l Blog l Nelsons Solicitors
Vulnerability Management
What Is an Application Vulnerability? 8 Common Types - Security Boulevard
Containers have 600+ vulnerabilities on average - Help Net Security
Vulnerabilities
Microsoft Fixes 72 Flaws, Including Patch for Actively Exploited CLFS Vulnerability
SonicWall Patches 6 Vulnerabilities in Secure Access Gateway - SecurityWeek
Cleo Patches Exploited Flaw as Security Firms Detail Malware Pushed in Attacks - SecurityWeek
SAP Patches Critical Vulnerability in NetWeaver - SecurityWeek
Adobe Patches Over 160 Vulnerabilities Across 16 Products - SecurityWeek
Apple Pushes Major iOS, macOS Security Updates - SecurityWeek
Apache issues patches for critical Struts 2 RCE bug • The Register
Security Flaws in WordPress Woffice Theme Prompts Urgent Update - Infosecurity Magazine
New Windows zero-day exposes NTLM credentials, gets unofficial patch
Unauthorized file access possible with chained Mitel MiCollab flaws | SC Media
New Windows Warning As Zero-Day With No Official Fix Confirmed For All Users
Ivanti Issues Critical Security Updates for CSA and Connect Secure Vulnerabilities
Microsoft Azure MFA Flaw Allowed Easy Access Bypass - Infosecurity Magazine
Multiple Ivanti CSA Vulnerabilities Let Attackers Bypass Admin Web Console Remotely
WAF Vulnerability in Akamai, Cloudflare, and Imperva Affected 40% of Fortune 100 Companies
QNAP Patches Vulnerabilities Exploited at Pwn2Own - SecurityWeek
OpenWrt supply chain attack scare prompts urgent upgrades • The Register
Atlassian, Splunk Patch High-Severity Vulnerabilities - SecurityWeek
Hunk Companion WordPress plugin exploited to install vulnerable plugins
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory 11 December 2024 – Microsoft, Ivanti, Adobe, and Chrome Security Updates
Black Arrow Cyber Advisory 11 December 2024 – Microsoft, Ivanti, Adobe, and Chrome Security Updates
Executive summary
In line with Microsoft’s November Patch Tuesday, several vendors, including Ivanti, Adobe, and Google, have released security updates to fix vulnerabilities in their products. Microsoft has addressed 72 security issues, including a critical Windows Common Log File System (CLFS) vulnerability that is being actively exploited. Ivanti’s updates cover its Cloud Services Application (CSA), Connect Secure, Policy Secure, and Sentry products, fixing multiple critical vulnerabilities, one of which has the highest severity rating of 10, allowing unauthorised remote attackers to gain administrative access. Adobe has released patches for 168 security issues across various products, including Experience Manager, Connect, Animate, and InDesign. Google has updated Chrome to fix three high-severity vulnerabilities in the browser.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an attacker to compromise the confidentiality, integrity and availability of the affected applications and the organisations data on the affected systems.
What can I do?
Black Arrow recommends applying the available security updates for all supported versions of products that have been impacted by the various vulnerabilities. The updates should be applied as soon as possible for actively exploited vulnerabilities and all other vulnerabilities that have a critical or high severity ratings.
Microsoft
Further details on specific updates within this Microsoft patch Tuesday can be found here:
https://msrc.microsoft.com/update-guide/releaseNote/2024-Dec
Ivanti
Further details on specific updates across affected Ivanti products can be found here:
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2024-8540?language=en_US
Adobe
Further details of the vulnerabilities in affected Adobe products can be found here under ‘Recent bulletins and advisories’:
https://helpx.adobe.com/security/security-bulletin.html
Chrome
Further details of the vulnerabilities in the Chrome Browser products can be found here:
https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop_10.html
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Intelligence Briefing 06 December 2024
Black Arrow Cyber Threat Intelligence Briefing 06 December 2024:
-Generative AI Makes Phishing Attacks More Believable and Cost-Effective
-Nearly Half a Billion Emails to Businesses Contain Malicious Content
-65% of Office Workers Bypass Cyber Security to Boost Productivity
-Cyber Warfare Rising Across EU in Bid to 'Destabilise' Member States
-INTERPOL Arrests 5,500 in Global Cyber Crime Crackdown, Seizes Over $400 Million
-Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and Email Defences
-Russian Money Laundering Networks Uncovered Linking Narco Traffickers, Ransomware Gangs and Kremlin Spies
-UK Underestimates Threat of Cyber Attacks from Hostile States and Gangs
-Why You Must Beware of Dangerous New Scam-Yourself Cyber Attacks
-Security Must Be Used as a Springboard, Not Just a Shield
-Why Your Cyber Insurance May Not Cover Everything: Finding and Fixing Blind Spots
-Cyber Criminals Already Using AI for Most Types of Scams, FBI Warns
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Generative AI Makes Phishing Attacks More Believable and Cost-Effective
In a survey of 14,500 executives, IT and security professionals, and office workers, Avanti found that phishing is the top threat that is increasing due to generative AI. Training is a vital element of security, and although 57% of organisations say they use anti-phishing training to protect themselves from sophisticated social engineering attacks, only 32% believe that such training is “very effective”. Lack of skills is a major challenge for one in three security professionals. Real-time, accessible data is essential, yet 72% of IT and security data remain siloed.
Nearly Half a Billion Emails to Businesses Contain Malicious Content
A report by Hornetsecurity shows that over a third of all business emails in 2024 were unwanted, with 2.3% (around 427.8 million) containing malicious content. Phishing drove a third of all cyber attacks, while malicious URLs accounted for nearly a quarter. Reverse-proxy credential theft rose, using links instead of file attachments. Shipping brands like DHL and FedEx were the most impersonated. The data underscores the need for a zero-trust mindset and improved user awareness to strengthen defences against increasingly sophisticated threats.
65% of Office Workers Bypass Cyber Security to Boost Productivity
CyberArk found that 65% of office staff circumvent policies to improve their productivity, with half frequently reusing passwords and nearly a third sharing credentials. Over a third ignore important updates, and many use AI tools, often feeding sensitive data without adhering to guidelines. Senior executives are twice as likely to fall victim to phishing. The findings highlight the urgent need for identity-focused security strategies that enable efficient work while reducing risk.
Cyber Warfare Rising Across EU in Bid to 'Destabilise' Member States
EU cyber body ENISA reports a surge in hostile cyber activity across Europe, warning that escalating espionage, sabotage, violence, and disinformation threaten essential services and strategic interests. A successful attack on Europe’s key supply chains could have catastrophic cascading effects. Germany has formed a new task force to counter these threats before the federal election, while the UK’s national cyber agency confirms increased and more sophisticated hostile activity. Russia and China remain prominent cyber espionage threats. ENISA rates the threat to EU entities as “substantial”, as malicious cyber activity is deployed to manipulate events, destabilise societies, and undermine EU democracy and values.
INTERPOL Arrests 5,500 in Global Cyber Crime Crackdown, Seizes Over $400 Million
INTERPOL’s latest global cyber crime crackdown led to over 5,500 arrests and seized more than $400 million in assets. Involving 40 countries, it dismantled a voice phishing operation that stole $1.1 billion from over 1,900 victims. Criminals impersonated law enforcement, exploiting digital currencies and undermining trust in financial systems. INTERPOL also warned of new scams using stablecoins and romance-themed lures to drain victims’ wallets. These results highlight the urgent need for international collaboration to counter large-scale cyber crime and protect individuals, businesses, and the integrity of digital economies.
Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and Email Defences
A new phishing campaign is using corrupted ZIP archives and Office documents to bypass email security measures. Since August 2024, attackers have exploited the built-in recovery features of popular software to open seemingly broken files. Users are tricked by false promises like employee benefits, and once opened, these documents contain QR codes redirecting victims to malicious websites. The files evade most security filters while appearing to function normally. This highlights how attackers continually search for new techniques to slip past cyber security tools and compromise organisations’ systems and data.
Russian Money Laundering Networks Uncovered Linking Narco Traffickers, Ransomware Gangs and Kremlin Spies
British authorities uncovered a vast Russian-linked money laundering system connecting drug traffickers, cyber criminals and sanctioned elites, resulting in over 80 arrests worldwide. This billion-dollar operation relied on two Moscow-based firms to shift value across 30 countries using cryptocurrency, property and other assets. More than £20 million in cash and cryptocurrency has already been seized. New sanctions target senior figures behind the networks, aiming to disrupt their access to global financial systems. The investigation revealed that narcotics gangs, Russian state-linked espionage activities and cyber criminals all benefited, posing a significant threat to global security and financial stability.
UK Underestimates Threat of Cyber Attacks from Hostile States and Gangs
The UK’s National Cyber Security Centre (NCSC) warns organisations are underestimating state and criminal cyber threats. Hostile activities have increased, with severe incidents trebling to 12 last year. Ransomware attacks remain a major concern, targeting sectors from academia to healthcare. The centre responded to 430 serious incidents, up from 371 previously. Russia’s “aggression and recklessness” and China’s “sophisticated” attacks highlight how critical national infrastructure and key services remain vulnerable. The call is clear: organisations must strengthen defences to address these evolving threats, which pose a growing risk to both economic stability and public services.
Why You Must Beware of Dangerous New Scam-Yourself Cyber Attacks
The latest report from cyber security provider Gen shows a 614% quarterly rise in ‘scam-yourself’ cyber attacks, where victims unwittingly paste malicious code themselves. Tactics include fake tutorials, deceptive tech support, false CAPTCHA prompts and bogus updates. This spike coincides with a 39% surge in data-stealing malware and a 1154% increase in a popular information stealer. Such threats are reshaping the landscape, catching millions off-guard and driving urgent attention to robust cyber security solutions. Business leaders must foster greater awareness and invest in proactive, multilayered cyber security strategies to protect their organisations.
Security Must Be Used as a Springboard, Not Just a Shield
Many organisations still view cyber security as a necessary expense rather than a growth catalyst. Research suggests that embracing it as a strategic enabler can boost productivity, build customer trust, and strengthen competitiveness. It found that nearly half of surveyed organisations suffered more than 12 hours of downtime after a cyber attack, with a third experiencing a full day’s disruption. As more connected environments emerge, security leaders must highlight metrics like uptime and customer satisfaction to board members. By doing so, cyber security becomes a driver of operational resilience and long-term success, not just a shield against threats.
Why Your Cyber Insurance May Not Cover Everything: Finding and Fixing Blind Spots
Only 1% of organisations recently surveyed received full reimbursement from their cyber insurance, and the average payout covered just 63% of incurred costs. Nearly half lacked clarity about what their policies covered. Common shortfalls arose when remediation expenses exceeded coverage limits or were not pre-approved, and when required security measures were not fully implemented. Strengthening cyber security practices increased the likelihood of better coverage, with more than three-quarters seeing improved terms after boosting cyber defences. Involving IT and security teams in insurance decisions and improving internal protections can help deliver more comprehensive and cost-effective cyber insurance in the future.
Cyber Criminals Already Using AI for Most Types of Scams, FBI Warns
The FBI warns that cyber criminals increasingly use generative AI to create believable text, images, audio, and video. This allows them to scale their cyber crime operations and trick victims by avoiding usual warning signs. Criminals impersonate trusted individuals, forge identification, and run convincing investment or donation scams. The FBI suggests using a secret word with loved ones, being cautious with personal details, and watching for subtle inconsistencies. Confirm unsolicited calls or messages by independently contacting banks or authorities, and limit sharing personal images or voice recordings online as a precaution.
Sources:
https://www.helpnetsecurity.com/2024/12/06/genai-phishing-attacks-concerns/
https://www.helpnetsecurity.com/2024/12/04/employees-privileged-access-security-risk/
https://www.irishexaminer.com/news/arid-41529398.html
https://thehackernews.com/2024/12/interpol-arrests-5500-in-global.html
https://thehackernews.com/2024/12/hackers-use-corrupted-zips-and-office.html
https://therecord.media/russian-money-laundering-networks-trafficking-cybercrime-kremlin
https://betanews.com/2024/11/29/security-must-be-used-as-a-springboard-not-just-a-shield/
https://cybernews.com/security/cybercriminals-using-ai-for-most-types-of-scams-fbi/
Governance, Risk and Compliance
Many small businesses are falling well short when it comes to cyber security plans | TechRadar
Security must be used as a springboard, not just a shield
NIS2 still a mystery to cyber security bosses, research shows - Data Centre & Network News
6 Considerations to Determine if a Cyber Incident Is Material | Troutman Pepper - JDSupra
CISOs will face growing challenges in 2025 and beyond | Computer Weekly
CISOs in 2025: Evolution of a High-Profile Role
65% of employees bypass cyber security policies, driven by hybrid work and flexible access
Why Operational Risk Planning Is Crucial For Every SME
Large And Small Businesses Face More Serious Repercussions From Cyber Threats | HackerNoon
Incident Response Playbooks: Are You Prepared?
63% of companies plan to pass data breach costs to customers | CSO Online
Why your cyber insurance may not cover everything: Finding and fixing blind spots | SC Media
How to talk to your board about tech debt | CIO
Navigating the Changing Cyber Security Regulations Landscape
The Rising Tide of Cyber Threats: Stay Ahead, Fortify Defences - The Futurum Group
Employees suffering compliance and security fatigue | theHRD
Building a robust security posture with limited resources - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Strikes when Organisations Unknowingly Open the Door | Security Info Watch
Does Cyber Insurance Drive Up Ransom Demands?
Russian Hacker With $10 Million Bounty on His Head Reportedly Arrested - SecurityWeek
No company too small for Phobos ransomware gang, indictment reveals | Malwarebytes
Storm-1811 exploits RMM tools to drop Black Basta ransomware
Ransomware attacks on critical sectors ramped up in November | TechTarget
Hackers are pivoting from data breaches to business shutdowns
Wanted Russian Hacker Linked to Hive and LockBit Ransomware Arrested
Ransomware's Grip on Healthcare
Ransomware Costs Manufacturing Sector $17bn in Downtime - Infosecurity Magazine
Ransomware Victims
UK hospital resorts to paper and postpones procedures after cyber attack
Arrowe Park: 'Longer A&E wait times' continue after cyber attack - BBC News
Cyber attack hits three NHS Liverpool hospitals | UKAuthority
Blue Yonder Confirms Reports of Recent Ransomware Attack | Console and Associates, P.C. - JDSupra
Ransomware Attack Disrupts Operations at US Contractor ENGlobal - Infosecurity Magazine
Bologna FC Hit By 200GB Data Theft and Ransom Demand - Infosecurity Magazine
Stoli Vodka and Kentucky Owl File for Bankruptcy Following Cyber Attack, Russian Seizures | NTD
Vodka maker Stoli files for bankruptcy in US after ransomware attack
Phishing & Email Based Attacks
Novel phising campaign uses corrupted Word documents to evade security
Corrupted Word Files Fuel Sophisticated Phishing Campaign - Infosecurity Magazine
This worrying new phishing attack is going after Microsoft 365 accounts | TechRadar
This New Microsoft 365 Attack Can Break Through Your 2FA: Here's How
Hackers Use Corrupted ZIPs and Office Docs to Evade Antivirus and Email Defences
Nearly half a billion emails to businesses contain malicious content, Hornet Security report finds
KnowBe4 Releases the Latest Phishing Trends Report
GenAI makes phishing attacks more believable and cost-effective - Help Net Security
New Rockstar 2FA phishing service targets Microsoft 365 accounts
North Korean Hacking Group Launches Undected Malwareless URL Phishing Attacks
HR and IT are among top-clicked phishing subjects
Top Five Industries Aggressively Targeted By Phishing Attacks
Don't Fall For This "Sad Announcement" Phishing Scam
Defending Against Email Attachment Scams - Security Boulevard
Widespread RAT compromise via bogus emails, JavaScript payloads detailed | SC Media
This sneaky phishing attack is a new take on a dirty old trick | PCWorld
Phishing attacks rose by more than 600% in the buildup to Black Friday | Security Magazine
Other Social Engineering
Why You Must Beware Of Dangerous New Scam-Yourself Cyber Attacks
North Korea deploying fake IT workers and hackers to target UK firms, cryptocurrency,... - LBC
Spotting the Charlatans: Red Flags for Enterprise Security Teams - SecurityWeek
How North Korean Hackers Pilfered $16 Million From A Crypto Exchange Via LinkedIn
Artificial Intelligence
GenAI makes phishing attacks more believable and cost-effective - Help Net Security
Cyber criminals already using AI for most types of scams, FBI warns | Cybernews
How laws strain to keep pace with AI advances and data theft | ZDNET
FBI Warns GenAI is Boosting Financial Fraud - Infosecurity Magazine
Teenagers leading new wave of cyber crime - Help Net Security
Cyber security professionals call for AI regulations
Cyber security in 2025: AI threats & zero trust focus
Microsoft's Vasu Jakkal on how gen AI is redefining cyber security | VentureBeat
Treat AI like a human: Redefining cyber security - Help Net Security
AI chatbot startup WotNot leaks 346,000 files, including passports and medical records
25% of enterprises using AI will deploy AI agents by 2025 | ZDNET
2FA/MFA
This worrying new phishing attack is going after Microsoft 365 accounts | TechRadar
This New Microsoft 365 Attack Can Break Through Your 2FA: Here's How
Malware
North Korean Hacking Group Launches Undected Malwareless URL Phishing Attacks
Code found online exploits LogoFAIL to install Bootkitty Linux backdoor - Ars Technica
Venom Spider Spins Web of MaaS Malware
Russia's 'BlueAlpha' APT Hides in Cloudflare Tunnels
Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide GammaDrop Malware
New Windows Backdoor Security Warning For Bing, Dropbox, Google Users
More_eggs MaaS Expands Operations with RevC2 Backdoor and Venom Loader
Widespread RAT compromise via bogus emails, JavaScript payloads detailed | SC Media
SmokeLoader Malware Campaign Targets Companies in Taiwan - Infosecurity Magazine
ANEL and NOOPDOOR Backdoors Weaponized in New MirrorFace Campaign Against Japan
Security Bite: Threat actors are widely using AI to build Mac malware - 9to5Mac
'Horns&Hooves' Malware Campaign Hits Over 1,000 Victims
Mobile
8 Million Android Users Hit by SpyLoan Malware in Loan Apps on Google Play
SMEs put at risk by poor mobile security practices
New DroidBot Android malware targets 77 banking, crypto apps
Android's December 2024 Security Update Patches 14 Vulnerabilities - SecurityWeek
FBI and CISA say to use encrypted messengers as Chinese hackers attack networks | Cybernews
The FBI now says encryption is good for you – Computerworld
NSO Group's Pegasus Spyware Detected in New Mobile Devices
Business leaders among Pegasus spyware victims, says security firm | TechCrunch
Smartphone Security Warning—Make Changes Now Or Become A Victim
Many small businesses are falling well short when it comes to cyber security plans | TechRadar
Top 5 Mobile Security Risks for Enterprises - Zimperium
Trojan-as-a-Service Hits Euro Banks, Crypto Exchanges
This is why the FBI is warning iOS users not to text Android users and vice versa - PhoneArena
Banking apps can now require recent Android security updates
Denial of Service/DoS/DDoS
Misconfigured WAFs Heighten DoS, Breach Risks
How DDoS attacks are shaping esports security and risk management | Insurance Business America
Internet of Things – IoT
From Patchwork to Framework: Towards a Global IoT Security Paradigm - Infosecurity Magazine
Chinese LIDAR Dominance a Cyber Security Threat, Warns Think Tank - Infosecurity Magazine
Data Breaches/Leaks
Russian hacking software used to steal hundreds of MoD log-ins
760,000 Employee Records From Several Major Firms Leaked Online - SecurityWeek
Sadiq Khan admits some commuters may never be refunded after TfL cyber attack
Hundreds of UK Ministry of Defence passwords found circulating on the dark web | CSO Online
White FAANG Data Export Attack: A Gold Mine for PII Threats
63% of companies plan to pass data breach costs to customers | CSO Online
Deloitte Hacked - Brain Cipher Group Allegedly Stolen 1 TB of Data
Process over top-down enforcement: prevent data leaks
Lessons in cyber security from the Internet Archive Breaches | TechRadar
AI chatbot startup WotNot leaks 346,000 files, including passports and medical records
Israeli tech firm Silicom denies Iranian claims of Mossad and Unit 8200 links after c | Ctech
Controversial Andrew Tate ‘War Room’ Videos Leaked By Hackers
Organised Crime & Criminal Actors
INTERPOL Arrests 5,500 in Global Cyber Crime Crackdown, Seizes Over $400 Million
How laws strain to keep pace with AI advances and data theft | ZDNET
UK Justice System Failing Cyber Crime Victims, Cyber Helpline Finds - Infosecurity Magazine
Alleged Snowflake Hacker ‘Danger’ to the Public
Russia gives life sentence to Hydra dark web kingpin • The Register
Venom Spider Spins Web of MaaS Malware
Teenagers leading new wave of cyber crime - Help Net Security
Cyber criminals already using AI for most types of scams, FBI warns | Cybernews
German Police Shutter Country’s Largest Dark Web Market - Infosecurity Magazine
Europol Dismantles Criminal Messaging Service MATRIX in Major Global Takedown
Eurocops red pill the Matrix 'secure' criminal chat systems • The Register
Police seizes largest German online crime marketplace, arrests admin
Record-Breaking $2 Million Bounty Offered To Crypto.com Hackers
Scattered Spider Hacking Gang Arrests Mount with California Teen
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Hackers Stole $1.49 Billion in Cryptocurrency to Date in 2024 - SecurityWeek
How North Korean hackers stole billions in crypto while posing as VCs, IT workers – Firstpost
North Korea deploying fake IT workers and hackers to target UK firms, cryptocurrency,... - LBC
New DroidBot Android malware targets 77 banking, crypto apps
How North Korean Hackers Pilfered $16 Million From A Crypto Exchange Via LinkedIn
Record-Breaking $2 Million Bounty Offered To Crypto.com Hackers
Insider Risk and Insider Threats
65% of employees bypass cyber security policies, driven by hybrid work and flexible access
Inside threats: How can companies improve their cyber hygiene?
Insider Threats vs. Privacy: A Dilemma for IT Professionals
Process over top-down enforcement: prevent data leaks
Macy’s found a single employee hid up to $154 million worth of expenses | CNN Business
Insurance
Does Cyber Insurance Drive Up Ransom Demands?
Cyber insurance checklist: 12 must-have security features | SC Media
Why your cyber insurance may not cover everything: Finding and fixing blind spots | SC Media
Supply Chain and Third Parties
Report shows the threat of supply chain vulnerabilities from third-party products | TechRadar
Blue Yonder Confirms Reports of Recent Ransomware Attack | Console and Associates, P.C. - JDSupra
Hardening Links in Supply Chain Security | SC Media UK
Fear of cyber attack outweighs investment in security along the supply chain - The Loadstar
Cloud/SaaS
This worrying new phishing attack is going after Microsoft 365 accounts | TechRadar
This New Microsoft 365 Attack Can Break Through Your 2FA: Here's How
CyberRatings report exposes critical flaws in cloud-native firewalls | SC Media
New Rockstar 2FA phishing service targets Microsoft 365 accounts
5 things you should never back up to the cloud
New Windows Backdoor Security Warning For Bing, Dropbox, Google Users
7 PAM Best Practices to Secure Hybrid and Multi-Cloud Environments
Outages
Identity and Access Management
The New Cyber Frontier: Managing Risks in Distributed Teams - Infosecurity Magazine
7 PAM Best Practices to Secure Hybrid and Multi-Cloud Environments
Encryption
The Growing Quantum Threat to Enterprise Data: What Next?
FBI and CISA say to use encrypted messengers as Chinese hackers attack networks | Cybernews
The FBI now says encryption is good for you – Computerworld
This is why the FBI is warning iOS users not to text Android users and vice versa - PhoneArena
Linux and Open Source
70% of open-source components are poorly or no longer maintained - Help Net Security
Code found online exploits LogoFAIL to install Bootkitty Linux backdoor - Ars Technica
New Report Highlights Open Source Trends And Security Challenges
Passwords, Credential Stuffing & Brute Force Attacks
Hundreds of UK Ministry of Defence passwords found circulating on the dark web | CSO Online
North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks
Six password takeaways from the updated NIST cybersecurity framework
Microsoft's Vasu Jakkal on how gen AI is redefining cyber security | VentureBeat
Social Media
Tech Support Scams Exploit Google Ads to Target Users | Tripwire
How North Korean Hackers Pilfered $16 Million From A Crypto Exchange Via LinkedIn
Romania to recount votes as TikTok slammed for election role | Stars and Stripes
Meta says it has taken down about 20 covert influence operations in 2024 | Meta | The Guardian
Malvertising
Tech Support Scams Exploit Google Ads to Target Users | Tripwire
Regulations, Fines and Legislation
How laws strain to keep pace with AI advances and data theft | ZDNET
EC takes action as member states miss NIS2 directive deadline
NIS2 still a mystery to cyber security bosses, research shows - Data Centre & Network News
6 Considerations to Determine if a Cyber Incident Is Material | Troutman Pepper - JDSupra
DORA Demystified: Dispelling 5 Myths for ICT Service Providers | Morrison & Foerster LLP - JDSupra
New EU Regulation Establishes European 'Cyber Security Shield' - SecurityWeek
Cyber Security: Council of EU formally adopts Cybersecurity and Cyber Solidarity Act | Practical Law
Cyber security professionals call for AI regulations
Navigating the Changing Cyber Security Regulations Landscape
Employees suffering compliance and security fatigue | theHRD
Models, Frameworks and Standards
EC takes action as member states miss NIS2 directive deadline
NIS2 still a mystery to cyber security bosses, research shows - Data Centre & Network News
New NIST Guidance Offers Update on Gauging Cyber Performance
DORA Demystified: Dispelling 5 Myths for ICT Service Providers | Morrison & Foerster LLP - JDSupra
Six password takeaways from the updated NIST cybersecurity framework
Careers, Working in Cyber and Information Security
Human Intelligence is the Key to Combating the UK’s Cyber Skills Crisis | SC Media UK
Optimism About Cyber Workforce Advancements | AFCEA International
World Wide Work: Landing a Cyber Security Career Overseas
Law Enforcement Action and Take Downs
INTERPOL Arrests 5,500 in Global Cyber Crime Crackdown, Seizes Over $400 Million
Alleged Snowflake Hacker ‘Danger’ to the Public
Russian Hacker With $10 Million Bounty on His Head Reportedly Arrested - SecurityWeek
German Police Shutter Country’s Largest Dark Web Market - Infosecurity Magazine
Europol Dismantles Criminal Messaging Service MATRIX in Major Global Takedown
US arrests Scattered Spider suspect linked to telecom hacks
UK Justice System Failing Cyber Crime Victims, Cyber Helpline Finds - Infosecurity Magazine
Misinformation, Disinformation and Propaganda
Cyber Attacks Could Impact Romanian Presidential Race, Officials Claim - Infosecurity Magazine
German intelligence agency warns of 'foreign interference' in upcoming elections
Meta says it has taken down about 20 covert influence operations in 2024 | Meta | The Guardian
Romania to recount votes as TikTok slammed for election role | Stars and Stripes
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Cyberwarfare 2025: The rise of AI weapons, zero-days, and state-sponsored chaos
Cyber warfare rising across EU in bid to 'destablise' member states
NATO promises better strategy against cyber attacks and undersea cables – Euractiv
UK Underestimates Threat Of Cyber-Attacks, NCSC | Silicon UK
Nation State Actors
China
Joint Advisory Warns of PRC-Backed Cyber Espionage Targeting Telecom Networks
US government says Salt Typhoon is still in telecom networks | CyberScoop
Microsoft spots another China spy crew stealing US data • The Register
US org suffered four month intrusion by Chinese hackers
FBI and CISA say to use encrypted messengers as Chinese hackers attack networks | Cybernews
Government Guidance on Chinese Telco Hacking Highlights Threat to Cisco Devices - SecurityWeek
The FBI now says encryption is good for you – Computerworld
US shares tips to block hackers behind recent telecom breaches
T-Mobile CSO: Cyber spies' initial access method 'is novel' • The Register
US critical infrastructure, military at risk of Chinese LiDAR tech compromise | SC Media
Finland: Outage reported after fiber optic cable damaged – DW – 12/03/2024
Romania to recount votes as TikTok slammed for election role | Stars and Stripes
SmokeLoader Malware Campaign Targets Companies in Taiwan - Infosecurity Magazine
Russia
NATO promises better strategy against cyber attacks and undersea cables – Euractiv
‘Russia can turn the lights off’: how the UK is preparing for cyberwar | Cyberwar | The Guardian
Hackers Leveraging Cloudflare Tunnels, DNS Fast-Flux to Hide GammaDrop Malware
Germany’s cyber security and infrastructure under attack by Russia, chancellor says – POLITICO
Pro-Russian Hacktivist Group Claims 6600 Attacks Targeting Europe - Infosecurity Magazine
North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks
NCA Disrupts Multi-Billion Dollar Russian Money Laundering Network
She Was a Russian Socialite and Influencer. Cops Say She’s a Crypto Laundering Kingpin | WIRED
Finland: Outage reported after fiber optic cable damaged – DW – 12/03/2024
Russian programmer says FSB agents planted spyware on his Android phone | TechCrunch
Spy v Spy: Russian APT Turla Caught Stealing From Pakistani APT - SecurityWeek
Russian Hacker With $10 Million Bounty on His Head Reportedly Arrested - SecurityWeek
Ransomware suspect Wazawaka reportedly arrested by Russia | The Record from Recorded Future News
Russia gives life sentence to Hydra dark web kingpin • The Register
Putin and ransomware blamed for Stoli US bankruptcy filing • The Register
'Horns&Hooves' Malware Campaign Hits Over 1,000 Victims
Romania's election systems targeted in over 85,000 cyber attacks
Russian hacking software used to steal hundreds of MoD log-ins
Iran
Kash Patel, Trump's pick to lead FBI, hit with Iranian cyber attack, sources say - ABC News
North Korea
North Korean Hacking Group Launches Undected Malwareless URL Phishing Attacks
How North Korean hackers stole billions in crypto while posing as VCs, IT workers – Firstpost
North Korea deploying fake IT workers and hackers to target UK firms, cryptocurrency,... - LBC
How North Korean Hackers Pilfered $16 Million From A Crypto Exchange Via LinkedIn
North Korean Kimsuky Hackers Use Russian Email Addresses for Credential Theft Attacks
Kimsuky Group Adopts New Phishing Tactics to Target Victims - Infosecurity Magazine
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Pro-Russian Hacktivist Group Claims 6600 Attacks Targeting Europe - Infosecurity Magazine
Polish Central Banker Testifies in Pegasus Spyware Case – BNN Bloomberg
How widespread is mercenary spyware? More than you think - Help Net Security
Study shows potentially higher prevalence of spyware infections than previously thought | CyberScoop
NSO Group's Pegasus Spyware Detected in New Mobile Devices
Business leaders among Pegasus spyware victims, says security firm | TechCrunch
A New Phone Scanner That Detects Spyware Has Already Found 7 Pegasus Infections | WIRED
How a Russian man’s harrowing tale shows the physical dangers of spyware | CyberScoop
Tools and Controls
65% of office workers bypass cyber security to boost productivity - Help Net Security
Storm-1811 exploits RMM tools to drop Black Basta ransomware
5 reasons to double down on network security - Help Net Security
Misconfigured WAFs Heighten DoS, Breach Risks
CyberRatings report exposes critical flaws in cloud-native firewalls | SC Media
Incident Response Playbooks: Are You Prepared?
Why your cyber insurance may not cover everything: Finding and fixing blind spots | SC Media
7 PAM Best Practices to Secure Hybrid and Multi-Cloud Environments
Why Robust API Security is a Must for Your Business - Security Boulevard
Many small businesses are falling well short when it comes to cyber security plans | TechRadar
Human Intelligence is the Key to Combating the UK’s Cyber Skills Crisis | SC Media UK
Six password takeaways from the updated NIST cybersecurity framework
Does Cyber Insurance Drive Up Ransom Demands?
Insider Threats vs. Privacy: A Dilemma for IT Professionals
New NIST Guidance Offers Update on Gauging Cyber Performance
Shorter Lifespan Reduces Digital Certificate Vulns
How to talk to your board about tech debt | CIO
Modernizing incident response in the era of cloud and AI - TechTalks
Other News
Hackers Can Access Laptop Webcams Without Activating LED Indicator
Many small businesses are falling well short when it comes to cyber security plans | TechRadar
71% of US Adults Have Dangerous Online Security Habits This Year, CNET Survey Finds - CNET
Sadiq Khan admits some commuters may never be refunded after TfL cyber attack
Your Kids Are Probably Compromising Your Online Security | Next Avenue
As Device Dependency Grows, So Do The Risks
Nordics move to deepen cyber security cooperation | Computer Weekly
Re/insurers’ operations exposed to cyber threats, says S&P - Reinsurance News
The UK’s cyber security strategy is no longer fit for purpose
Christmas is Coming: Cyber Security Lessons from the Holidays - Security Boulevard
In the new space race, hackers are hitching a ride into orbit
SQL Injection Prevention: 6 Strategies - Security Boulevard
The Legal Landscape Of Privacy: Why Lawyers Must Keep Up With Change - Above the Law
Microsoft confirms the Windows 11 TPM security requirement isn't going anywhere
Why OT environments are vulnerable – and what to do about it | SC Media
Almost all top US retailers were hacked in 2024 | Chain Store Age
Data-rich universities are both targets and treasure troves | Times Higher Education (THE)
Vulnerability Management
Microsoft Warns 400 Million PC Owners—This Ends Your Windows Updates
70% of open-source components are poorly or no longer maintained - Help Net Security
Report shows the threat of supply chain vulnerabilities from third-party products | TechRadar
Want to Grow Vulnerability Management into Exposure Management? Start Here!
Vulnerabilities
Cisco ASA flaw CVE-2014-2120 is being exploited in the wild
Android's December 2024 Security Update Patches 14 Vulnerabilities - SecurityWeek
Bootloader Vulnerability Impacts Over 100 Cisco Switches - SecurityWeek
Critical Vulnerability Found in Zabbix Network Monitoring Tool - SecurityWeek
CyberRatings report exposes critical flaws in cloud-native firewalls | SC Media
Cisco Warns of Exploitation of Decade-Old ASA WebVPN Vulnerability
CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel
TP-Link Archer Zero-Day Vulnerability Let Attackers Inject Malicious Commands
Critical SailPoint IdentityIQ Vulnerability Exposes Files to Unauthorized Access
PoC exploit for critical WhatsUp Gold RCE vulnerability released (CVE-2024-8785) - Help Net Security
CISA Warns of Zyxel Firewall Vulnerability Exploited in Attacks - SecurityWeek
CISA Warns of Active Exploitation of Flaws in Zyxel, ProjectSend, and CyberPanel
Japan warns of IO-Data zero-day router flaws exploited in attacks
Rather than fixing its old routers, D-Link is telling customers to upgrade
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 29 November 2024
Black Arrow Cyber Threat Intelligence Briefing 29 November 2024:
-Phishing Attacks Dominate Threat Landscape in Q3 2024
-Rising Cyber Threat Driven by Single Point of Failure Risk
-Cloned Customer Voice Beats Bank Security Checks
-Avoiding Cyber Complacency as a Small Business
-Your IT Infrastructure May Be More Outdated Than You Think
-Cyber Attacks Cost UK Businesses £44 Billion During Past 5 Years, Howden Survey
-83% of Organisations Reported Insider Attacks in 2024
-Blue Yonder Ransomware Attack Disrupts Supply Chains Across UK and US
-North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn
-UK Scam Losses Surge 50% Annually to £11.4bn
-In a Growing Threat Landscape, Companies Must do Three Things to Get Serious About Cyber Security
-Russian Threat Actors Poised to Cripple Power Grid, UK Warns
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Phishing Attacks Dominate Threat Landscape in Q3 2024
ReliaQuest's recent report reveals that spear phishing attacks accounted for 46% of security incidents in Q3 2024, becoming the most prevalent threat. High employee turnover and accessible phishing kits contribute to this trend, with untrained new hires increasing vulnerability. The report also highlights a 20% surge in cloud-based security threats and a 7% rise in insider threat activity, with cyber criminals offering up to $10,000 weekly for insider assistance. Despite awareness of these risks, organisations continue to face significant challenges in mitigating them.
Rising Cyber Threat Driven by Single Point of Failure Risk
CyberCube reports that escalating cloud service provider outages and single point of failure events are significantly increasing the risk of unplanned technology outages for organisations. These disruptions are accelerating, impacting critical services across sectors. The report highlights that the Energy & Utilities industry is highly exposed with varying security levels, while the Transportation & Logistics sector is exposed but more secure. Many US public sector entities are under-secured despite high exposure to cyber threats. It emphasises that insurers must adapt by refining policy language, enhancing threat intelligence, and collaborating with governments to mitigate these evolving risks.
Cloned Customer Voice Beats Bank Security Checks
Recent investigations have revealed that AI-cloned voices can bypass voice recognition security in banking systems. A BBC test showed that cloned voices successfully overcame voice ID checks at major banks, including Santander and Halifax. Despite assurances from banks about the security of voice ID, the ease with which these systems were breached, even using basic equipment, highlights significant vulnerabilities. Cyber security experts warn that the rapid advancement of generative AI presents new risks to biometric authentication methods. This raises concerns about the effectiveness of current security measures and underscores the need for enhanced protections against sophisticated AI-enabled fraud.
Avoiding Cyber Complacency as a Small Business
A recent survey revealed that half of all UK businesses, including many small and medium-sized enterprises, experienced a cyber attack in the past year. Despite this high incidence, only 22% have a formal incident response plan, indicating widespread cyber complacency. With the average cost to remedy an attack estimated at £21,000, small businesses are at significant financial risk. Many maintain outdated security measures and prioritise other concerns due to limited resources. To mitigate these risks, organisations are advised to stay vigilant, educate employees on threats like phishing, implement robust backup solutions, and develop clear disaster recovery plans.
Your IT Infrastructure May Be More Outdated Than You Think
Kyndryl's recent survey reveals a significant disconnect between CEOs and IT leaders regarding IT infrastructure readiness. While about two-thirds of CEOs are concerned their IT systems are outdated or nearing end-of-life, 90% of IT leaders believe their infrastructure is best in class. Contradictorily, only 39% of IT leaders feel prepared to manage future risks and disruptions, and 44% of executives admit their IT systems have aged past expected lifespans. The report underscores the need for continual reassessment of IT tools to balance operational needs with innovation, as outdated systems can quickly hinder an organisation's competitiveness.
Cyber Attacks Cost UK Businesses £44 Billion During Past 5 Years, Howden Survey
Howden's research has revealed that cyber attacks have cost UK businesses £44 billion in lost revenue over the past five years. Over half of these businesses, particularly those with revenues over £100 million, have suffered at least one cyber attack, with compromised emails and data theft being the most common causes. Despite this significant impact, the uptake of basic cyber security measures remains low, with only 61% using antivirus software and 55% employing network firewalls. The report suggests that implementing fundamental cyber security practices could reduce cyber attack costs by up to 75%, saving approximately £30 billion over five years.
83% of Organisations Reported Insider Attacks in 2024
A publication by news site Cybersecurity Insiders reports that 83% of organisations experienced at least one insider attack in the past year. The incidence of insider threats has escalated, with the percentage of organisations facing between 11 to 20 attacks increasing from 4% to 21% in the last 12 months. Despite 93% recognising the importance of strict visibility and control, only 36% have effective solutions in place. Recovery costs are significant, with 32% of organisations spending between $100,000 and $499,000, and 21% facing costs between $1 million and $2 million. Lack of employee awareness is a major factor, with 32% citing it as a contributor to attacks.
Blue Yonder Ransomware Attack Disrupts Supply Chains Across UK and US
Blue Yonder, a supply chain software company, has experienced a ransomware attack that disrupted services for major clients. The incident impacted key customers, including Starbucks and leading UK supermarkets like Morrisons and Sainsbury's, causing operational disruptions and forcing activation of contingency plans. Despite working with external cyber security experts, Blue Yonder has yet to provide a timeline for restoration. This event underscores the increasing vulnerability of supply chains to cyber attacks. A recent survey found that 62% of organisations faced ransomware attacks from software supply chain partners in the past year, highlighting the widespread nature of these threats.
North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn
Microsoft has reported that North Korean hackers have stolen over $10 million in cryptocurrency through sophisticated social engineering campaigns on LinkedIn. These cyber security threats are escalating, with attackers posing as recruiters or venture capitalists to trick targets into downloading malware. Despite increased awareness, organisations remain vulnerable as hackers use artificial intelligence tools to create convincing fake profiles and documents. North Korean IT workers abroad have also generated at least $370,000 through legitimate work, but pose additional risks by abusing access to steal intellectual property and demand ransoms.
UK Scam Losses Surge 50% Annually to £11.4bn
Cifas reports that UK online fraud losses have surged to over £11bn in the past year, a £4bn increase from the previous year. 15% of the 2000 survey participants lost money to scammers in 2024, up from 10% in 2023, with average losses of £1400 per victim. Less than a fifth recovered their money, and only 28% reported the incidents to the police. Email was the most common fraud channel, cited by nearly 70% of respondents. With scams expected to intensify during the holiday season, there is a pressing need for improved security measures and cross-sector collaboration.
In a Growing Threat Landscape, Companies Must do Three Things to Get Serious About Cyber Security
Enterprises are facing a more sophisticated threat landscape due to digital transformation, hybrid work, and AI adoption, making it imperative to prioritise cyber security. Leadership at the C-suite and board level must drive this change by investing appropriately, as underfunded security can lead to lost revenue and legal issues. A strong, empowered CISO is crucial for identifying vulnerabilities and guiding necessary actions. Adopting frameworks like NIST Cybersecurity Framework 2.0 helps organisations manage risks effectively, promoting prevention and response strategies that can also reduce liability in the event of a breach.
Russian Threat Actors Poised to Cripple Power Grid, UK Warns
The UK government warns that Russian cyber threat actors are poised to conduct cyber attacks that could disrupt critical national infrastructure, potentially "turning off the lights for millions". These threats have already targeted UK media, telecoms, and political institutions. However, experts caution that such rhetoric may overstate Russia's actual capabilities and risk causing unnecessary panic. In response, the government is investing £8.22 million in a new AI cyber lab to bolster national security and an additional £1 million to enhance incident response among allies.
Sources:
https://informationsecuritybuzz.com/phishing-attacks-dominate-threat-lands/
https://www.emergingrisks.co.uk/rising-cyber-threat-driven-by-single-point-of-failure-risk/
https://www.bbc.co.uk/news/articles/c1lg3ded6j9o
https://betanews.com/2024/11/28/avoiding-cyber-complacency-as-a-small-business/
https://www.cio.com/article/3610867/your-it-infrastructure-may-be-more-outdated-than-you-think.html
https://www.insurancejournal.com/news/international/2024/11/27/802913.htm
https://securityintelligence.com/articles/83-percent-organizations-reported-insider-threats-2024/
https://thehackernews.com/2024/11/north-korean-hackers-steal-10m-with-ai.html
https://www.infosecurity-magazine.com/news/uk-scam-losses-surge-50-annually/
Governance, Risk and Compliance
Cyber attacks cost British businesses $55 billion in past five years, broker says | Reuters
Beyond the Technical: The Evolving CISO - InfoRiskToday
What Does Enterprise-Wide Cyber Security Culture Look Like?
Cyber Security Under Threat: New Study Exposes 'Security Chaos' | Pressat
What is compliance risk? | Definition from TechTarget
Top challenges holding back CISOs’ agendas | CSO Online
The CISO as a Chess Piece: A Comprehensive Strategic Analysis | Mandelbaum Barrett PC - JDSupra
Cyber Security Toolkit for Boards: updated briefing pack... - NCSC.GOV.UK
Threats
Ransomware, Extortion and Destructive Attacks
Five Ransomware Groups Responsible for 40% of Cyber-Attacks in 2024 - Infosecurity Magazine
One of the nastiest ransomware groups around may have a whole new way of doing things | TechRadar
VPN Vulnerabilities Drive Nearly 30% Of Q3 Ransomware Attacks
CISA says BianLian ransomware now focuses only on data theft
The case for a ransomware payment ban - Tech Monitor
Growth in phishing, changes in ransomware crews mark threat landscape | SC Media
Pro-Russian Hacktivists Launch Branded Ransomware Operations - Infosecurity Magazine
Ransomware payments are now a critical business decision - Help Net Security
Ransomware Groups Targeting VPNs for Initial Access: Report | MSSP Alert
BlackBasta Ransomware Brand Picks Up Where Conti Left Off
CyberVolk analysis explores ransomware, hacktivism interconnections | SC Media
Mimic Ransomware: What You Need To Know | Tripwire
Zyxel firewalls targeted in recent ransomware attacks
Victims Must Disclose Ransom Payments Under Australian Law
Ransomware Victims
Microlise Confirms Data Breach as Ransomware Group Steps Forward - SecurityWeek
Blue Yonder ransomware attack disrupts supply chains across UK and US
Wake Up And Smell The Ransomware—Starbucks Impacted By Cyber Attack
Supply chain vendor Blue Yonder succumbs to ransomware • The Register
NHS declares major cyber incident for third time this year • The Register
Further disruption expected after latest NHS cyber attack | Computer Weekly
Phishing & Email Based Attacks
Phishing Attacks Dominate Threat Landscape In Q3 2024
Email Phishing and DMARC Statistics - Security Boulevard
Growth in phishing, changes in ransomware crews mark threat landscape | SC Media
Hackers Update Tactics to Bypass Multifactor Authentication - Petri IT Knowledgebase
Rise in phishing attacks observed from August to October 2024
Flying Under the Radar - Security Evasion Techniques
Phishing attacks via ‘URL rewriting’ to evade detection escalate | SC Media
Scammers use you're fired lures in phishing campaign • The Register
“Sad announcement” email implies your friend has died | Malwarebytes
OpenSea NFT Phishers Aim to Drain Crypto Wallets
Email Is Insecure: 4 Reasons I Avoid It Like the Plague
Three-Quarters of Black Friday Spam Emails Identified as Scams - Infosecurity Magazine
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Other Social Engineering
North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn
How to recognize employment fraud before it becomes a security issue - Help Net Security
Meta Finally Breaks Its Silence on Pig Butchering | WIRED
Bangkok busts SMS Blaster sending 1 million scam texts from a van
North Korea Deploying Fake IT Workers in China, Russia, Other Countries - SecurityWeek
Artificial Intelligence
Cloned customer voice beats bank security checks - BBC News
North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn
Over a Third of Firms Struggling With Shadow AI - Infosecurity Magazine
AI in cyber security: Not yet autonomous, but the time to prepare is now
British spies to ramp up fight against Russian cyber threats with launch of cutting-edge... - LBC
Britain, NATO must stay ahead in 'new AI arms race', says UK minister | Reuters
Faux ChatGPT, Claude API Packages Deliver JarkaStealer
AI is the latest tool in the cyber security cat-and-mouse game - Fast Company
AI Used for Good and Bad — Like Making Trickier Malware, Says Report
Teaching AI to Hack: Researchers Demonstrate ChatGPT's to Ethically Hack Linux & Windows
Organisations unprepared for the AI onslaught must do these 4 things | ZDNET
'Tis the season for website cloning tools, RCEs and AI phishing lures | SC Media
2FA/MFA
‘Adversary in the middle attacks’ are becoming hackers’ go-to method to bypass MFA | ITPro
Hackers Update Tactics to Bypass Multifactor Authentication - Petri IT Knowledgebase
Malware
North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn
2024 saw a surge in malicious free VPN apps | TechRadar
Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia
Novel WolfsBane backdoor leveraged in Chinese attacks against Linux systems | SC Media
Salt Typhoon hackers backdoor telcos with new GhostSpider malware
What cyber attacks are bots commonly associated with?
Aggressive Chinese APT Group Targets Governments with New Backdoors - Infosecurity Magazine
Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries
Skimmer Malware Targets Magento Sites Ahead of Black Friday
APT-K-47 Uses Hajj-Themed Lures to Deliver Advanced Asyncshell Malware
Hackers abuse Avast anti-rootkit driver to disable defences
Researchers Uncover Malware Using BYOVD to Bypass Antivirus Protections
IoT Device Traffic Up 18% as Malware Attacks Surge 400% - Infosecurity Magazine
The source code of Banshee Stealer leaked online
Faux ChatGPT, Claude API Packages Deliver JarkaStealer
How Facebook and Instagram Malware Works (and How to Spot It Before You Click)
Researchers Discover "Bootkitty" – First UEFI Bootkit Targeting Linux Kernels
AI Used for Good and Bad — Like Making Trickier Malware, Says Report
APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
Gaming Engines: An Undetected Playground for Malware Loaders - Check Point Research
Bots/Botnets
What cyber attacks are bots commonly associated with?
Growing Matrix Botnet Poses Escalating Global Threat
Mobile
Why you should power off your phone once a week - according to the NSA | ZDNET
One Down, Many to Go with Pre-Installed Malware on Android | Electronic Frontier Foundation
Denial of Service/DoS/DDoS
Here’s how simple it is for script kiddies to stand up DDoS services | CyberScoop
Is Your Router In The Matrix—35 Million Devices Under Blue Pill Attack
Internet of Things – IoT
My Car Knows My Secrets, and I'm (Mostly) OK With That
Growing Matrix Botnet Poses Escalating Global Threat
IoT Device Traffic Up 18% as Malware Attacks Surge 400% - Infosecurity Magazine
Data Breaches/Leaks
Prison layouts reportedly leaked on dark web in data breach - BBC News
Data leaks from websites built on Microsoft Power Pages, including 1.1 million NHS records
New York Fines Geico and Travelers $11 Million Over Data Breaches - SecurityWeek
A US soldier is suspected of being behind the massive Snowflake data leak | CSO Online
Data broker leaves 600K+ sensitive files exposed online • The Register
TfL cyber attack: Independent review will examine huge hack and response | The Standard
Military dating site leaves database with 1M records exposed | Biometric Update
HIA: Survivors awarded £30,000 after data breach - BBC News
Zello asks users to reset passwords after security incident
Hack Against Andrew Tate Continues With Leak Of Staff Chats
Hackers Breach Andrew Tate's Online 'University,' Exposing 800,000 Users
Organised Crime & Criminal Actors
The rise and fall of the 'Scattered Spider' hackers | TechCrunch
Major cyber crime crackdowns signal shift in global cyber security strategies
Interpol: Major cyber crime operation nets 1,006 suspects – DataBreaches.Net
Authorities disrupt major cyber crime operation, 1000+ suspects arrested - Help Net Security
US alleges man is cyber crook with distaste for opsec • The Register
DoJ seized credit card marketplace PopeyeTools
DOJ: Man hacked networks to pitch cyber security services
'Hacker' breaks into gym to get hired, gets arrested instead | PCWorld
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Crypto Hacks Drop 15% Year-to-Date, over $70 Million Lost in November
OpenSea NFT Phishers Aim to Drain Crypto Wallets
Insider Risk and Insider Threats
83% of organisations reported insider attacks in 2024
Human Factors in Cyber Security in 2024 | UpGuard
Insurance
Cyber attacks cost British businesses $55 billion in past five years, broker says | Reuters
Supply Chain and Third Parties
Rising cyber threat driven by Single Point of Failure risk
Blue Yonder ransomware attack disrupts supply chains across UK and US
Wake Up And Smell The Ransomware—Starbucks Impacted By Cyber Attack
Supply chain vendor Blue Yonder succumbs to ransomware • The Register
Outages
Microsoft CEO Nadella Calls for 'Culture Change' After Security Lapses - Business Insider
Rising cyber threat driven by Single Point of Failure risk
Microsoft 365 outage impacts Exchange Online, Teams, Sharepoint
Microsoft aims for better Windows security • The Register
CrowdStrike still doesn’t know cost of Falcon flame-out • The Register
Encryption
Albanian Drug Smugglers Busted After Cops Decrypt Comms - Infosecurity Magazine
Linux and Open Source
Novel WolfsBane backdoor leveraged in Chinese attacks against Linux systems | SC Media
Researchers Discover "Bootkitty" – First UEFI Bootkit Targeting Linux Kernels
Passwords, Credential Stuffing & Brute Force Attacks
I Ran a Password Audit and Was Suprised How Many Outdated Passwords I Have
Zello asks users to reset passwords after security incident
Stop Using Your Passwords—1Password And Google Warn
Social Media
North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn
Meta Finally Breaks Its Silence on Pig Butchering | WIRED
Meta Shutters Two Million Scam Accounts in Pig Butchering Crackdown - Infosecurity Magazine
How Facebook and Instagram Malware Works (and How to Spot It Before You Click)
Regulations, Fines and Legislation
The EU Cyber Resilience Act: Implications for Companies | Hogan Lovells - JDSupra
New York Fines Geico and Travelers $11 Million Over Data Breaches - SecurityWeek
EU: Cyber Resilience Act published in EU Official Journal | DLA Piper - JDSupra
HIA: Survivors awarded £30,000 after data breach - BBC News
US senators propose mandated MFA, encryption in healthcare • The Register
Opportunities for Regulatory Harmonization Under Trump's Deregulation Agenda
Telecoms Security Act Compliance... - Analysis - Mobile News
Cyber security bill passes parliament - Security - iTnews
Victims Must Disclose Ransom Payments Under Australian Law
Models, Frameworks and Standards
The EU Cyber Resilience Act: Implications for Companies | Hogan Lovells - JDSupra
EU: Cyber Resilience Act published in EU Official Journal | DLA Piper - JDSupra
Why Cyber Security Leaders Trust the MITRE ATT&CK Evaluations
Careers, Working in Cyber and Information Security
Practical strategies to build an inclusive culture in cyber security - Help Net Security
8 Tips for Hiring Neurodivergent Talent
Why IT Leaders Should Hire Veterans for Cyber Security Roles
How cyber security certification can drive business growth - Digital Journal
The Next Hot Cyber Security Skill for Your Resume? Empathy
Law Enforcement Action and Take Downs
The rise and fall of the 'Scattered Spider' hackers | TechCrunch
Major cyber crime crackdowns signal shift in global cyber security strategies
Interpol: Major cyber crime operation nets 1,006 suspects – DataBreaches.Net
Authorities disrupt major cyber crime operation, 1000+ suspects arrested - Help Net Security
Bangkok busts SMS Blaster sending 1 million scam texts from a van
US alleges man is cyber crook with distaste for opsec • The Register
DoJ seized credit card marketplace PopeyeTools
Telco engineer spying on employer for Beijing gets 4 years • The Register
US Citizen Sentenced for Spying on Behalf of China's Intelligence Agency
Albanian Drug Smugglers Busted After Cops Decrypt Comms - Infosecurity Magazine
DOJ: Man hacked networks to pitch cyber security services
'Hacker' breaks into gym to get hired, gets arrested instead | PCWorld
Police bust pirate streaming service making €250 million per month
Telco engineer spying on employer for Beijing gets 4 years • The Register
Misinformation, Disinformation and Propaganda
Google Deindexes Chinese Propaganda Network - Infosecurity Magazine
Google blocked 1000 pro China websites from services • The Register
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Britain, NATO must stay ahead in 'new AI arms race', says UK minister | Reuters
“Cyber war is now a daily reality”, UK government minister says
UK calls for stronger NATO cyber defences
5th Generation War: A War Without Borders and its Impact on Global Security - Modern Diplomacy
Nation State Actors
China
The Cyberthreats from China are Ongoing: U.S. Officials - Security Boulevard
Chinese Hackers Use GHOSTSPIDER Malware to Hack Telecoms Across 12+ Countries
Chinese vessel 'sabotaged' Baltic deep sea cables and may have been under orders from Russia
Satellite Image Shows Chinese Ship Suspected of Sabotage in 'NATO Lake' - Newsweek
Salt Typhoon’s cyber storm reaches beyond US telcos • The Register
Chinese hackers preparing for conflict, says US cyber official | The Straits Times
Novel WolfsBane backdoor leveraged in Chinese attacks against Linux systems | SC Media
China's Cyber Offensives Helped by Private Firms, Academia
Accident or sabotage? American and European officials disagree as key undersea cables are cut | CNN
Google Deindexes Chinese Propaganda Network - Infosecurity Magazine
China's telco attacks mean 'thousands' of boxes compromised • The Register
Top senator calls Salt Typhoon “worst telecom hack in our nation’s history” - The Washington Post
CrowdStrike identifies new China hackers breaching telecom networks
NSA Director Wants Industry to Disclose Details of Telecom Hacks - Bloomberg
T-Mobile Engineers Spotted Hackers Running Commands on Routers - Bloomberg
Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions | Trend Micro (US)
US must counter new Chinese cyber attacks. Remember how it lost nuclear monopoly?
China Conceling State, Corporate & Academic Assets For Offensive Attacks
China’s Surveillance State Is Selling Citizen Data as a Side Hustle | WIRED
Aggressive Chinese APT Group Targets Governments with New Backdoors - Infosecurity Magazine
Google blocked 1000 pro China websites from services • The Register
Telco engineer spying on employer for Beijing gets 4 years • The Register
US Citizen Sentenced for Spying on Behalf of China's Intelligence Agency
Telco engineer spying on employer for Beijing gets 4 years • The Register
Imagine a land where algorithms don't ruin the Internet • The Register
Russia
Britain should prepare for 'aggressive and reckless' Russian cyber attacks, minister warns
Chinese vessel 'sabotaged' Baltic deep sea cables and may have been under orders from Russia
Russian Cyberespionage Group Hit 60 Victims in Asia, Europe - SecurityWeek
Russian Spies Jumped From One Network to Another Via Wi-Fi in an Unprecedented Hack | WIRED
Nato countries are in a ‘hidden cyber war’ with Russia, says Liz Kendall | The Standard
Britain, NATO must stay ahead in 'new AI arms race', says UK minister | Reuters
Nato countries in 'hidden cyber war' with Russia, minister warns | ITV News
Russian hybrid attacks may lead to NATO invoking Article 5, says German intel chief | Reuters
Accident or sabotage? American and European officials disagree as key undersea cables are cut | CNN
RomCom Exploits Zero-Day Firefox and Windows Flaws in Sophisticated Cyber Attacks
Firefox and Windows zero-days exploited by Russian RomCom hackers
Is Your Router In The Matrix—35 Million Devices Under Blue Pill Attack
Russia-linked APT TAG-110 uses targets Europe and Asia - Security Affairs
'Operation Undercut' Adds to Russia Influence Campaigns
CyberVolk analysis explores ransomware, hacktivism interconnections | SC Media
CISA says BianLian ransomware now focuses only on data theft
Here’s how simple it is for script kiddies to stand up DDoS services | CyberScoop
Pro-Russian Hacktivists Launch Branded Ransomware Operations - Infosecurity Magazine
North Korea
North Korean Hackers Steal $10M with AI-Driven Scams and Malware on LinkedIn
North Korea Deploying Fake IT Workers in China, Russia, Other Countries - SecurityWeek
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
APT-C-60 Hackers Exploit StatCounter and Bitbucket in SpyGlace Malware Campaign
Man warns 'this is just the beginning' after cyber attack on Merseyside Police - Liverpool Echo
Tools and Controls
VPN Vulnerabilities Drive Nearly 30% Of Q3 Ransomware Attacks
2024 saw a surge in malicious free VPN apps | TechRadar
How to recognize employment fraud before it becomes a security issue - Help Net Security
AI in cyber security: Not yet autonomous, but the time to prepare is now
Email Phishing and DMARC Statistics - Security Boulevard
Ransomware Groups Targeting VPNs for Initial Access: Report | MSSP Alert
Microsoft Teams monitoring tips for admins | TechTarget
What is compliance risk? | Definition from TechTarget
Is Cyber Threat Intelligence Worthless? - Security Boulevard
Machine Learning in Cyber Security: Harnessing the Power of Five AI Tribes - Security Boulevard
CIOs warned of AI over-reliance in cyber security defence
AI Used for Good and Bad — Like Making Trickier Malware, Says Report
Modern workplaces increasingly resemble surveillance zones • The Register
The role of data recovery in cyber resilience
AI is the latest tool in the cyber security cat-and-mouse game - Fast Company
Businesses prioritize cyber security in digital transformation: GSMAi
Data Security Best Practices: 7 Tips to Crush Bad Actors | MSSP Alert
Cloudflare says it lost 55% of logs pushed to customers for 3.5 hours
DOJ: Man hacked networks to pitch cyber security services
'Hacker' breaks into gym to get hired, gets arrested instead | PCWorld
The ‘Great IT Rebrand’: Restructuring IT for business success | CIO
Other News
Your beloved old tech is a security risk. It's time to let go | PCWorld
Latest Multi-Stage Attack Scenarios with Real-World Examples
Avoiding cyber complacency as a small business
Will 2025 be the turning point for cyber security in finance? - FinTech Futures: Fintech news
Microsoft CEO Nadella Calls for 'Culture Change' After Security Lapses - Business Insider
Microsoft aims for better Windows security • The Register
The threats of USB-based attacks for critical infrastructure | TechRadar
The industries impacted most by cyber crime in 2024
Cyber Attacks On Healthcare: A Global Threat That Can’t Be Ignored | Scoop News
Six future-proofing strategies family offices need to stay ahead
The rise in public sector cyber attacks and what can be done | London City Hall
TfL cyber attack: Independent review will examine huge hack and response | The Standard
Craigslist founder on his $100M pledge to fight cyber attacks on US
DOJ Will Reportedly Force Google to Sell Off Chrome Browser
10 Of The Worst Cyber Security Mistakes You're Probably Making Right Now
Protect your charity from cyber crime - GOV.UK
Forensic audit of the US election is needed to protect democracy
Vulnerability Management
VPN Vulnerabilities Drive Nearly 30% Of Q3 Ransomware Attacks
400,000 Systems Potentially Exposed to 2023's Most Exploited Flaws - SecurityWeek
Google’s AI-powered fuzzing tool discovers 26 new vulnerabilities | SC Media
How should software producers be held accountable for shoddy cyber security products?
The effect of compliance requirements on vulnerability management strategies - Help Net Security
Vulnerabilities
Researchers reveal exploitable flaws in corporate VPN clients - Help Net Security
Critical 7-Zip Vulnerability Let Attackers Execute Arbitrary Code
Firefox and Windows zero-days exploited by Russian RomCom hackers
Hackers abuse Avast anti-rootkit driver to disable defences
Microsoft Patches Exploited Vulnerability in Partner Network Website - SecurityWeek
WordPress Plugin Flaw Exposes 200,000 WordPress Sites To Hacking
VMware Patches High-Severity Vulnerabilities in Aria Operations - SecurityWeek
Hackers exploit critical bug in Array Networks SSL VPN products
Researchers Uncover Malware Using BYOVD to Bypass Antivirus Protections
Zyxel firewalls targeted in recent ransomware attacks
Malicious Actors Exploit ProjectSend Critical Vulnerability - Infosecurity Magazine
Critical QNAP Vulnerability Let Attackers Execute Remote Code
IBM Patches RCE Vulnerabilities in Data Virtualization Manager, Security SOAR - SecurityWeek
Weekend QNAP, Veritas bugs hit patch pipelines • The Register
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 22 November 2024
Black Arrow Cyber Threat Intelligence Briefing 22 November 2024:
-Cyber Security Dominates Concerns Among the C-Suite, Small Businesses and the Nation
-Cyber Criminals Don’t Take Holidays Warns Expert
-The Urgent and Critical Need to Prioritise Mobile Security
-Companies Take Over Seven Months to Recover from Cyber Incidents
-Data is the New Uranium – Incredibly Powerful and Amazingly Dangerous
-‘Scam Yourself’ Attacks Just Increased Over 600% - Here’s What to Look For
-60% of Emails with QR Codes Classified as Spam or Malicious
-Coalition Highlights 68% Surge in Ransomware Claims Severity, as Active Ransomware Groups Increase 56%
-One Deepfake Digital Identity Attack Strikes Every Five Minutes
-Supply Chain Attacks Up Over 400 Percent Since 2021
-Rethinking Cyber Security from Cost Centre to Value Driver
-Majority of UK Businesses Lack Readiness for Rising AI-Led Phishing Attacks, Reveals Survey
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Cyber Security Dominates Concerns Among the C-Suite, Small Businesses and the Nation
Cyber security is now the top concern for organisations globally, with the 2024 Allianz Risk Barometer naming cyber events as the number one business risk. Gartner forecasts a 15% increase in information security spending by 2025, reaching $212 billion. Small businesses are also vulnerable, with 60% ranking cyber security risks as major concerns. Generative AI introduces new threats, and Gartner predicts that by 2027, 17% of cyber attacks and data leaks will involve generative AI.
Cyber Criminals Don’t Take Holidays Warns Expert
Semperis has found that cyber attacks during holidays and weekends pose a significant risk to businesses because many are underprepared to handle incidents outside of standard working hours. These risks intensify when an organisation’s security capability is reduced on holidays and weekends. The report highlighted that identity-related attacks are a major concern, yet a quarter of respondents feel they lack the expertise to protect against them, and over 22% don't have an identity recovery plan in place.
The Urgent and Critical Need to Prioritise Mobile Security
Recent findings reveal that mobile security threats are a top concern for organisations. With over 55% of organisations increasing their mobile device users and more than 70% of employees using smartphones for work tasks, threats like mobile phishing and malware are intensifying. The report indicates that 82% of phishing websites are designed for mobile users, and 200 malicious apps on Google Play have been downloaded 8 million times. Despite this, many organisations face challenges in mitigating mobile risks due to device diversity and user control, highlighting a critical need for improved mobile security measures.
Companies Take Over Seven Months to Recover from Cyber Incidents
A new report reveals that organisations are underestimating recovery times from cyber incidents, with actual recovery averaging over seven months, 25% longer than anticipated. This gap widens to nearly 11 months for companies reducing cyber security investments. Despite efforts like implementing stronger security measures (43%) and offering additional employee training (41%), nearly half of organisations are rethinking how they use existing cyber security tools. The study also highlights a shift towards shared responsibility, with platform engineering teams and app developers increasingly held accountable alongside traditional roles like Chief Information Security Officers (CISOs) and CIOs.
Data is the New Uranium – Incredibly Powerful and Amazingly Dangerous
Recent insights from Chief Information Security Officers (CISOs) indicate that data-related risks are becoming a primary concern for organisations. The vast and dispersed nature of data storage has led many CISOs to feel that the cost of managing data now outweighs its value. There’s a growing perception that the business proposition of ‘big data’ is shifting from a net positive to a net negative. This underscores the urgent need for organisations to manage data carefully and to be fully aware of the risks and costs associated with potential breaches.
‘Scam Yourself’ Attacks Just Increased Over 600% - Here’s What to Look For
Gen, the company behind Norton and Avast, reports a 614% surge in ‘scam yourself’ cyber attacks in the third quarter compared to the second. These scams leverage social engineering to trick users into downloading malware themselves. Notably, over two million people worldwide were targeted by fake captcha scams in the past quarter. Despite increased vigilance, users remain vulnerable to fake updates, deceptive fixes, and counterfeit tutorials that often instruct them to disable antivirus software or input commands that compromise security.
60% of Emails with QR Codes Classified as Spam or Malicious
Cisco Talos has found that 60% of emails containing QR codes are classified as spam, with some being malicious and targeting users with phishing or credential theft. Despite representing only about one in 500 global emails, these QR code emails effectively bypass security filters. Attackers use deceptive methods like blending QR codes into attractive designs. The report emphasises the importance of ‘defanging’ QR codes to neutralise threats, and advises treating QR codes with the same caution as unknown URLs. Users should be vigilant when scanning QR codes and avoid entering credentials into unknown sites linked via QR codes.
Coalition Highlights 68% Surge in Ransomware Claims Severity, as Active Ransomware Groups Increase 56%
Coalition's latest report reveals a 68% surge in the severity of ransomware claims, with average losses escalating to $353,000. Searchlight Cyber has found a 56% increase in active ransomware groups in the first half of 2024, tracking 73 groups compared to 46 last year. This rise indicates that the fight against ransomware is far from over. The impact of ransomware has intensified, particularly affecting larger companies. Coalition also notes a rise in significant cyber risk aggregation events (which cause widespread loss to other organisations) disrupting a substantial proportion of healthcare firms and auto dealerships with revenues over $100 million. Business email compromise remains the most common cyber incident, increasing by 4% and constituting nearly one-third of all cyber insurance claims. Meanwhile, claims severity overall rose by 14%.
One Deepfake Digital Identity Attack Strikes Every Five Minutes
Entrust has reported that deepfake attacks are occurring every five minutes in 2024, posing a significant threat to digital identity verification systems. The report found that deepfakes account for 24% of fraudulent attempts to bypass motion-based biometric checks used by banks and service providers. In contrast, only 5% of these attacks target basic selfie-based authentication methods. The growing accessibility of generative AI technology is enabling fraudsters to circumvent advanced security measures. Entrust highlighted that organisations must proactively adapt their security strategies, as these evolving threats are pervasive across all sectors.
Supply Chain Attacks Up Over 400% Since 2021
Cowbell Insurance has found that supply chain attacks have surged by 431% since 2021. Large enterprises with over $50 million in revenue are 2.5 times more likely to face cyber incidents. Manufacturing is the most vulnerable sector due to its reliance on automation and exposure to intellectual property threats. Public administration and educational services also face elevated risks, with a 70% increase in attacks on educational institutions over the past year. The report identifies five risky technology categories: operating systems, content management tools, virtualisation technologies, server-side technologies, and business applications. No business is immune to cyber threats and the consequences can be devastating.
Rethinking Cyber Security from Cost Centre to Value Driver
A University of Maryland study found that cyber attacks occur every 39 seconds, amounting to 2,244 attacks daily. Cybersecurity Ventures predicts annual cyber damages will reach $10.5 trillion by 2025. Despite these alarming figures, many organisations treat cyber security as a minimal compliance exercise. Leadership must transform this approach by integrating cyber security into business strategy, fostering a culture of trust and resilience. By prioritising employee training and leveraging technologies like artificial intelligence, companies can enhance customer loyalty, avoid regulatory issues, and shift cyber security from a cost centre to a value driver.
Majority of UK Businesses Lack Readiness for Rising AI-Led Phishing Attacks, Reveals Survey
Vodafone Business has found that most UK businesses are unprepared for the rapid rise in AI-led phishing attacks, which have increased 60% globally over the past year. Despite over three quarters of business leaders expressing confidence in employees' ability to detect scams, only a third could identify fraudulent communications. The report highlighted that over half of UK businesses lack a response plan for AI-driven phishing, and younger employees are particularly susceptible, with nearly half aged 18 to 24 not updating passwords in over a year.
Sources:
https://www.emergingrisks.co.uk/cyber-criminals-dont-take-holidays-warns-expert/
https://www.securityweek.com/the-urgent-and-critical-need-to-prioritize-mobile-security/
https://www.infosecurity-magazine.com/news/companies-seven-months-recover/
https://www.theregister.com/2024/11/20/data_is_the_new_uranium/
https://www.zdnet.com/article/scam-yourself-attacks-just-increased-over-600-heres-what-to-look-for/
https://www.infosecurity-magazine.com/news/60-emails-qr-codes-spam-malicious/
https://www.reinsurancene.ws/coalition-highlights-68-surge-in-ransomware-claims-severity/
https://securityintelligence.com/news/research-finds-56-percent-increase-active-ransomware-groups/
https://www.infosecurity-magazine.com/news/deepfake-identity-attack-every/
https://betanews.com/2024/11/21/supply-chain-attacks-up-over-400-percent-since-2021/
Governance, Risk and Compliance
Cyber security dominates concerns among the C-suite, small businesses and the nation
Rethinking Cyber Security From Cost Center To Value Driver
So, you don’t have a chief information security officer? 9 signs your company needs one | CSO Online
Cyber criminals don’t take holidays warns expert
Chris Inglis: Why cyber security success hinges on strategic choices, not just tech | SC Media
Data is the new uranium – both powerful and dangerous • The Register
Cyber Security is Everyone’s Responsibility - Security Boulevard
Overcoming the cyber paradox: Shrinking budgets – growing threats | Computer Weekly
Hackers Aren’t Cutting Back, Why is Your Security Budget?
Full recovery from breaches takes longer than expected - Help Net Security
Google report shows CISOs must embrace change to stay secure - Help Net Security
Soaring cyber risks: Large enterprises, supply chains and key industries in the crosshairs
Emerging Security Practices in Digital Finance: By Shiv Nanda
Poor cyber hygiene enabled nearly 30% of cyber attacks last quarter | StateScoop
Insights from Cohesity on cyber resilience as a technical team sport - SiliconANGLE
Interconnectivity and cyber risk: A double-edged sword - IT Security Guru
We Can Do Better Than Free Credit Monitoring After a Breach
Breaches Don't Have to Be Disasters
CISOs can now obtain professional liability insurance | CyberScoop
Experts warn businesses of escalating cyber security threats
CISOs Look to Establish Additional Leadership Roles - Security Boulevard
Threats
Ransomware, Extortion and Destructive Attacks
Armis: Triple Extortion Attacks Becoming More Common | SC Media UK
Research finds 56% increase in active ransomware groups
Ransomware gang Akira leaks unprecedented number of victims’ data in one day
Ransomware is doubling down—What you need to know about the recent surge - Security Boulevard
Akira Ransomware Racks Up 30+ Victims in a Single Day
Cloud ransomware threats rise, targeting S3 & Azure
FBI says BianLian based in Russia, moving from ransomware attacks to extortion
Ransomware Evolution: From Triple-Quadruple Extortion to RaaS - Security Boulevard
Coalition highlights 68% surge in ransomware claims severity - Reinsurance News
Ransomware Groups Use Cloud Services For Data Exfiltration - Infosecurity Magazine
Hibernation is Over? Akira Ransomware: Published Over 30 New Victims on their DLS – DataBreaches.Net
Ransomware attacks primarily caused by poor cyber hygiene | SC Media
Cyber insurers address ransom reimbursement policy concerns | TechTarget
Ransomware Gangs on Recruitment Drive for Pen Testers - Infosecurity Magazine
Trellix report reveals evolving ransomware ecosystem trends
Security Bite: Ransomware groups surge in Q3 2024, with shifting dominance - 9to5Mac
Ransomware Attacks On Healthcare Sector Surge In 2024
Linux Variant of Helldown Ransomware Targets VMware
Helldown ransomware exploits Zyxel VPN flaw to breach networks
Alleged Russian Phobos ransomware administrator extradited to U.S., in custody | CyberScoop
Threat Landscape: Corporate Japan Its Own Worst Enemy in the Ransomware War | Nippon.com
Ransomware Victims
How the British Library hack has caused havoc for UK research
SafePay ransomware gang claims attack on UK's Microlise • The Register
Ransomware Attack on Oklahoma Medical Center Impacts 133,000 - SecurityWeek
Change Healthcare’s clearing house restored after 9 months • The Register
Phishing & Email Based Attacks
Phishing emails increasingly use SVG attachments to evade detection
Communication platforms play a major role in data breach risks
You're Not Imagining It: Phishing Attacks Are Rampant
Why email security is still so bad today - 9to5Mac
Why AI alone can't protect you from sophisticated email threats - Help Net Security
Phishing Decoded: How Cyber Criminals Target You And How To Fight Back
Majority of UK businesses lack readiness for rising AI-led phishing attacks, reveals survey
60% of Emails with QR Codes Classified as Spam or Malicious - Infosecurity Magazine
What is a whaling attack (whaling phishing)? | Definition from TechTarget
Job termination scam warns staff of phony Employment Tribunal decision | CSO Online
'Scattered Spider' scammers charged in sophisticated, million-dollar phishing scheme | Mashable
Microsoft Takes Phishing-as-a-Service Platform to Court
Fake Donald Trump Assassination Story Used in Phishing Scam - Infosecurity Magazine
No, Microsoft doesn't have dirt on you, it's just a sextortion scam - Neowin
Microsoft 365 Admin portal abused to send sextortion emails
North Korean IT Worker Network Tied to BeaverTail Phishing Campaign - Infosecurity Magazine
New phishing scam targeting companies with fake gov’t requests: What FBI says to do
Other Social Engineering
60% of Emails with QR Codes Classified as Spam or Malicious - Infosecurity Magazine
NCSC Warns UK Shoppers Lost £11.5m Last Christmas - Infosecurity Magazine
6 Reasons Social Engineering Is More Successful in Holiday Seasons | Mimecast
'Scam yourself' attacks just increased over 600% - here's what to look for | ZDNET
Malicious QR codes sent in the mail deliver malware | Malwarebytes
UK consumers losing more than ever to holiday scams | Computer Weekly
Fake Discount Sites Exploit Black Friday to Hijack Shopper Information
Security Alert: Fake Accounts Threaten Black Friday Gaming Sales - Security Boulevard
‘ClickFix’ Cyber-Attacks for Malware Deployment on the Rise - Infosecurity Magazine
Meta cracks down on millions of accounts it tied to pig-butchering scams | CyberScoop
Watch Out for Malicious QR Codes Sent Through the Mail
Cyber security chief warns Black Friday shoppers to be alert to scams | The Standard
Don't Fall for This Fake Image Generator and Its Political AI Slop
No, Microsoft doesn't have dirt on you, it's just a sextortion scam - Neowin
Active network of North Korean IT front companies exposed - Help Net Security
You Can Prevent Smishing Scams With These Features and Tricks
Artificial Intelligence
AI fuels 244% surge in digital forgeries, says new study
97% of organisations hit by Gen AI-related security breaches, survey finds
One Deepfake Digital Identity Attack Hits Every Five Minutes - Infosecurity Magazine
Google Issues New Security Cloaking Warning As Attackers Use AI In Attacks
Majority of UK businesses lack readiness for rising AI-led phishing attacks, reveals survey
Largest Companies View AI as a Risk Multiplier
Don't Fall for This Fake Image Generator and Its Political AI Slop
Phishing on the Rise: CUJO AI Blocks Over 12,000 Attacks per Minute
The limits of AI-based deepfake detection - Help Net Security
OWASP Warns of Growing Data Exposure Risk from AI in New Top 10 List - Infosecurity Magazine
Supply chain threats highlight security gaps in LLMs and AI | TechRadar
AI in Cyber Crime: Hackers Exploiting OpenAI - Security Boulevard
Fake AI video generators infect Windows, macOS with infostealers
AI About-Face: 'Mantis' Turns LLM Attackers Into Prey
Artificial intelligence, international security, and the risk of war
Did you play Pokémon Go? You didn't know it, but you were training AI to map the world | ZDNET
Malware
Phishing emails increasingly use SVG attachments to evade detection
Don’t Hold Down The Ctrl Key—New Warning As Cyber Attacks Confirmed
Malicious QR codes sent in the mail deliver malware | Malwarebytes
Fortinet VPN Zero-Day Exploited in Malware Attacks Remains Unpatched: Report - SecurityWeek
‘ClickFix’ Cyber-Attacks for Malware Deployment on the Rise - Infosecurity Magazine
Watch Out for Malicious QR Codes Sent Through the Mail
New Stealthy BabbleLoader Malware Spotted Delivering WhiteSnake and Meduza Stealers
Scammers resort to physical Swiss post to spread malware • The Register
Fake Bitwarden ads on Facebook push info-stealing Chrome extension
Don't Fall for This Fake Image Generator and Its Political AI Slop
Fake AI video generators infect Windows, macOS with infostealers
NodeStealer Malware Targets Facebook Ad Accounts, Harvesting Credit Card Data
Warning: DEEPDATA Malware Exploiting Unpatched Fortinet Flaw to Steal VPN Credentials
Botnet exploits GeoVision zero-day to install Mirai malware
Researchers unearth two previously unknown Linux backdoors - Help Net Security
Lumma Stealer Proliferation Fueled by Telegram Activity - Infosecurity Magazine
Black Lotus, Emotet, Beep, and Dark Pink, still the top malware threats of 2024 | SC Media
Microsoft accused of Malware-like Bing Wallpaper app - gHacks Tech News
Bots/Botnets
'Water Barghest' Sells Hijacked IoT Devices for Proxy Botnet Misuse
Dangerous global botnet fueling residential proxies is being hit in major crackdown | TechRadar
Botnet serving as ‘backbone’ of malicious proxy network taken offline | CyberScoop
Mobile
The Urgent And Critical Need To Prioritize Mobile Security - SecurityWeek
No work phone? Companies tell staff to bring their own
Mobile UK on fraud ahead of Reeves' Mansion House speech
Google Issues New Security Cloaking Warning As Attackers Use AI In Attacks
Protect Your Phone From Juice Jacking: Public Charging Risks Explained
New Ghost Tap attack abuses NFC mobile payments to steal money
NSO Group used another WhatsApp zero-day after being sued, court docs say
LightSpy Spyware Operation Expands to Windows - SecurityWeek
It’s Time to Get Paranoid About Your Phone, Says This Security Expert | KQED
iOS 18 reboots iThings after 72 hours - secretly and smartly • The Register
This hacking tool can unlock an iPhone 16. Here's how it works | Digital Trends
You Can Prevent Smishing Scams With These Features and Tricks
Denial of Service/DoS/DDoS
DDoS Attack Growing Bigger & Dangerous, New Report Reveals
Internet of Things – IoT
Threat Actor Turns Thousands of IoT Devices Into Residential Proxies - SecurityWeek
'Water Barghest' Sells Hijacked IoT Devices for Proxy Botnet Misuse
Eken hit with $700K fine for putting an inactive address on FCC filings - The Verge
Data Breaches/Leaks
Ten Lessons Learned from The Mother of All Breaches Data Leak - Security Boulevard
97% of organisations hit by Gen AI-related security breaches, survey finds
Fintech giant Finastra confirms it's investigating a data breach | TechCrunch
Equinox discloses data breach involving health info of clients, staff | Reuters
T-Mobile confirms it was hacked in recent wave of telecom breaches
What is Data Egress? How It Works and How to Manage Costs | Definition from TechTarget
Threat actor sells data of +750,000 patients from a French hospital
US-UK Armed Forces Dating Service Exposes Over 1 Million Records Online
We Can Do Better Than Free Credit Monitoring After a Breach
Breaches Don't Have to Be Disasters
The Crucial Influence of Human Factors in Security Breaches - Security Boulevard
171K AnnieMac customers informed of data breach • The Register
Space tech giant Maxar confirms hacker accessed employees' personal data | TechCrunch
Ford 'actively investigating' breach claims • The Register
Ford rejects breach allegations, says customer data not impacted
Helpline for Yakuza victims fears it leaked personal info • The Register
Andrew Tate Hack: Online Course Data Breached
Organised Crime & Criminal Actors
Cyber criminals don’t take holidays warns expert
Microsoft killed 240 sites selling ONNX phishing kits
5 Scattered Spider Gang Members Indicted in Multi-Million Dollar Cyber Crime Scheme
Threat Actor Turns Thousands of IoT Devices Into Residential Proxies - SecurityWeek
Zimbabwe police arrest 1,000 cyber criminals - Bulawayo24 News
Targeting the Cyber Crime Supply Chain - Microsoft On the Issues
US seizes PopeyeTools cyber crime marketplace, charges administrators
AI in Cyber Crime: Hackers Exploiting OpenAI - Security Boulevard
Russian women stepping up for cyber crime outfits | SC Media
UK supports Nigeria to tackle cyber threats
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Man Who Stole and Laundered Roughly $1B in Bitcoin Is Sentenced to 5 Years in Prison - SecurityWeek
Now BlueSky hit with crypto scams as it crosses 20 million users
Insider Risk and Insider Threats
The Crucial Influence of Human Factors in Security Breaches - Security Boulevard
Insurance
Coalition highlights 68% surge in ransomware claims severity - Reinsurance News
Cyber insurers address ransom reimbursement policy concerns | TechTarget
Marsh launches cyber security compliance program | Insurance Business America
CISOs can now obtain professional liability insurance | CyberScoop
Supply Chain and Third Parties
Supply chain attacks up over 400 percent since 2021
Soaring cyber risks: Large enterprises, supply chains and key industries in the crosshairs
IT pros revise pipelines for software supply chain security | TechTarget
Gatwick Airport's Cyber Security Chief on Supply Chain Risks - Infosecurity Magazine
Cloud/SaaS
Cloud ransomware threats rise, targeting S3 & Azure
Cracking the Code: Tackling the Top 5 Cloud Security Challenges - Security Boulevard
Ransomware Groups Use Cloud Services For Data Exfiltration - Infosecurity Magazine
Outages
After the CrowdStrike disaster, Microsoft is improving Windows security to avoid outages
Identity and Access Management
One Deepfake Digital Identity Attack Hits Every Five Minutes - Infosecurity Magazine
The trouble with identity in an increasingly fake world | SC Media
Privileged Accounts, Hidden Threats: Why Privileged Access Security Must Be a Top Priority
10 Most Impactful PAM Use Cases for Enhancing Organisational Security
Encryption
Now Online Safety Act is law, UK outlines 'priorities' • The Register
NIST Publishes Draft Strategy For Post-Quantum Cryptography Transition
Linux and Open Source
Ubuntu Linux impacted by decade-old 'needrestart' flaw that gives root
Debunking myths about open-source security - Help Net Security
Linux Variant of Helldown Ransomware Targets VMware
Researchers unearth two previously unknown Linux backdoors - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
123456 is the world's most popular password – again | Tom's Guide
Research Highlights SHA256 Password Security Strengths and Risks - IT Security Guru
700,000 passengers suffered delays after password of engineer allowed to work remotely... - LBC
Navigating NIST’s updated password rotation guidelines | TechRadar
More than 200 major companies already support passkeys
Put your usernames and passwords in your will, Japan advises • The Register
Social Media
Ireland orders X, TikTok and Instagram to curb terrorist content | Ireland | The Guardian
Fake Bitwarden ads on Facebook push info-stealing Chrome extension
Meta cracks down on millions of accounts it tied to pig-butchering scams | CyberScoop
NodeStealer Malware Targets Facebook Ad Accounts, Harvesting Credit Card Data
Canada Shuts Down TikTok Office Over National Security Risks
Now BlueSky hit with crypto scams as it crosses 20 million users
Malvertising
Fake Bitwarden ads on Facebook push info-stealing Chrome extension
NodeStealer Malware Targets Facebook Ad Accounts, Harvesting Credit Card Data
How does malvertising work? | TechTarget
Training, Education and Awareness
Cyber Awareness Is a Joke: Here’s How to Actually Prepare for Attacks
New educational campaign "Flex Your Cyber" launched - IT Security Guru
KnowBe4 Releases 2024 Holiday Kit to Boost Cyber Resilience - IT Security Guru
Regulations, Fines and Legislation
The SEC Cyber Security Rule: Awareness Rises, Compliance Lags - Security Boulevard
The Cyber Resilience Act published
NIS 2 Directive: Transposition Period is Up for EU Member States | Jones Day - JDSupra
ENISA's Draft NIS2 Guidance Consultation for Industry
Beyond The EU: How British Businesses Can Prepare For NIS2
EU Council approves declaration on international law in cyber space - JURIST - News
Preparing for DORA Compliance in 2025 - Financial News
Increased GDPR Enforcement Highlights the Need for Data Security
A Fifth of UK Enterprises “Not Sure” If NIS 2 Applies - Infosecurity Magazine
Now Online Safety Act is law, UK outlines 'priorities' • The Register
What CISOs need to know about the SEC’s breach disclosure rules | CSO Online
CISA no more? Rand Paul has a plan, and it’s not good for US cyber defenders | Cybernews
Trump 2.0 May Mean Fewer Cyber Security Regs
The Accountability Dilemma: Civilian Cyber Vigilantism and International Law | directions blog
What a second Trump term means for the future of ransomware | TechCrunch
Why the NIS2 Directive causes growing pains for businesses - Help Net Security
CISA Dir. Jen Easterly to Resign on Inauguration Day
With Tech Considerations for Securities Lawyers | Mayer Brown Free Writings + Perspectives - JDSupra
Models, Frameworks and Standards
A Fifth of UK Enterprises “Not Sure” If NIS 2 Applies - Infosecurity Magazine
The Cyber Resilience Act published
NIS 2 Directive: Transposition Period is Up for EU Member States | Jones Day - JDSupra
ENISA's Draft NIS2 Guidance Consultation for Industry
Beyond The EU: How British Businesses Can Prepare For NIS2
Preparing for DORA Compliance in 2025 - Financial News
Increased GDPR Enforcement Highlights the Need for Data Security
NIST Publishes Draft Strategy For Post-Quantum Cryptography Transition
Backup and Recovery
Five backup lessons learned from the UnitedHealth ransomware attack - Help Net Security
Law Enforcement Action and Take Downs
5 Scattered Spider Gang Members Indicted in Multi-Million Dollar Cyber Crime Scheme
Brit charged in US over Scattered Spider cyber attacks | Computer Weekly
Man Who Stole and Laundered Roughly $1B in Bitcoin Is Sentenced to 5 Years in Prison - SecurityWeek
US seizes PopeyeTools cyber crime marketplace, charges administrators
Zimbabwe police arrest 1,000 cyber criminals - Bulawayo24 News
Alleged Russian Phobos ransomware administrator extradited to U.S., in custody | CyberScoop
UK supports Nigeria to tackle cyber threats
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Artificial intelligence, international security, and the risk of war
Sweden, Finland and Norway release new advice on surviving war - BBC News
Nation State Actors
China
A Look at Trending Chinese APT Techniques | Intel 471
UK warned of cyber threats from China-backed Volt Typhoon
China Espionage Soon ‘the Number 1 Issue’ for US Security Community: Cyber Security Expert | NTD
Chinese hackers are using this open-source VPN to mask spying activities | TechRadar
T-Mobile confirms it was hacked in recent wave of telecom breaches
Chinese Hackers Exploit T-Mobile and Other U.S. Telecoms in Broader Espionage Campaign
Cyber-espionage group Volt Typhoon resurfaces globally
LightSpy Spyware Operation Expands to Windows - SecurityWeek
China-Backed Hackers Leverage SIGTRAN, GSM Protocols to Infiltrate Telecom Networks
Chinese APT Group Targets Telecom Firms Linked to BRI - Infosecurity Magazine
Chinese spies, Musk’s biz ties, ‘a real risk’ to US security • The Register
Chinese spies and the security of America's networks
China's Liminal Panda APT Attacks Telcos, Steals Data
Chinese ship casts shadow over Baltic subsea cable snipfest • The Register
Canada Shuts Down TikTok Office Over National Security Risks
Lithuania bans remote Chinese access to solar, wind, storage devices – pv magazine International
Coast Guard Warns of Continued Risks in Chinese Port Cranes
Russia
Severed subsea internet cables raise network security questions | ITPro
Sweden, Finland and Norway release new advice on surviving war - BBC News
Russian women stepping up for cyber crime outfits | SC Media
FBI says BianLian based in Russia, moving from ransomware attacks to extortion
BianLian Ransomware Group Adopts New Tactics, Posing Significant Risk - Infosecurity Magazine
Russian sanctions busting linked to British Overseas Territories
Undersea cable between Germany and Finland severed - BBC News
Finland and Lithuania Report Severed Undersea Data Cables - Bloomberg
Fears of sabotage rise after Baltic cable disruptions
North Korea
North Korean Front Companies Impersonate US IT Firms to Fund Missile Programs
Active network of North Korean IT front companies exposed - Help Net Security
North Korean IT Worker Network Tied to BeaverTail Phishing Campaign - Infosecurity Magazine
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
LightSpy Spyware Operation Expands to Windows - SecurityWeek
NSO Group used another WhatsApp zero-day after being sued, court docs say
The Accountability Dilemma: Civilian Cyber Vigilantism and International Law | directions blog
Tools and Controls
The Urgent And Critical Need To Prioritize Mobile Security - SecurityWeek
No work phone? Companies tell staff to bring their own
Rethinking Cyber Security From Cost Center To Value Driver
Companies Take Over Seven Months to Recover From Cyber Incidents - Infosecurity Magazine
State of SIEM Detection Risk: A Wake-Up Call for Enterprise Security Teams - Security Boulevard
Why Custom IOCs Are Necessary for Advanced Threat Hunting and Detection - SecurityWeek
5 Threat Intel Tricks MSSPs Can Use to Thwart Adversaries | MSSP Alert
Underfunded, under pressure: We must act to support cyber teams | Computer Weekly
Overcoming the cyber paradox: Shrinking budgets – growing threats | Computer Weekly
Chris Inglis: Why cyber security success hinges on strategic choices, not just tech | SC Media
The trouble with identity in an increasingly fake world | SC Media
How Cloud Security Advances Help Future-Proof Resilience
Privileged Accounts, Hidden Threats: Why Privileged Access Security Must Be a Top Priority
Avoiding Common API Security Mistakes
Hackers Aren’t Cutting Back, Why is Your Security Budget?
Cross-Site Scripting: 2024's Most Dangerous Software
Cyber criminals hijack DNS to build stealth attack networks - Help Net Security
Unlocking the power of public data to make your security team faster and more effective | SC Media
Safeguarding the DNS through registries - Help Net Security
Red red team team: threat actors hire pentesters to test out ransomware effectiveness | SC Media
Weaponized pen testers are becoming a new hacker staple | CSO Online
5 Questions CISOs Should Be Asking Regarding DSPM
8 Security Risks Of Shared Email Accounts - Security Boulevard
Insights from Cohesity on cyber resilience as a technical team sport - SiliconANGLE
Eight essential steps to fortify cyber security after a breach | SC Media
The limits of AI-based deepfake detection - Help Net Security
Navigating NIST’s updated password rotation guidelines | TechRadar
How Can PR Protect Companies During a Cyber Attack?
We Need to Talk: Breaking up With Your SIEM Vendor | MSSP Alert
Other News
Severed subsea internet cables raise network security questions | ITPro
Cyber Security is Everyone’s Responsibility - Security Boulevard
8 Security Risks Of Shared Email Accounts - Security Boulevard
300 Drinking Water Systems in US Exposed to Disruptive, Damaging Hacker Attacks - SecurityWeek
Cross-Site Scripting: 2024's Most Dangerous Software
Weaponized pen testers are becoming a new hacker staple | CSO Online
Eight essential steps to fortify cyber security after a breach | SC Media
Telecom Cable Disruption Reported Between Finland and Germany - Nord News
Poor cyber hygiene enabled nearly 30% of cyber attacks last quarter | StateScoop
Cyber attack leaves Stop & Shop shelves empty 10 days before Thanksgiving - CBS News
6 Ways Your Computer Isn't as Secure as You Think
The rising tide of maritime cyberthreats in global trade | TechRadar
Nearly 90% of UK industrial firms hit by cyber attacks in past year - Drives&Controls
ICS Security: 145,000 Systems Exposed to Web, Many Industrial Firms Hit by Attacks - SecurityWeek
5 alarming Windows cyber security facts you probably don’t know
Cisco reveals top cyber security threats trends
Expert warns construction industry on costly ransomware attacks | Project Scotland
Australian government cyber security falls in global ranking | The Canberra Times | Canberra, ACT
Cyber security tips for the education sector | Education Business
Navigating the surge of cyber threats in global maritime
Thames Water Dismisses Claims on Cyber-Attacks | SC Media UK
Fortra Reports Alarming Increase In Abuse Of Cloudflare Services
Airplane cyber security: Past, present, future
70% of Hong Kong companies saw cyber attacks in 2024
Gambling and lottery giant disrupted by cyber attack, working to bring systems back online
CISA Director Jen Easterly to depart agency on January 20 | TechCrunch
Vulnerability Management
Microsoft beefs up Windows security with new recovery and patching features | TechCrunch
CWE top 25 most dangerous software weaknesses - Help Net Security
MITRE shares 2024's top 25 most dangerous software weaknesses
Vulnerabilities
Critical 9.8-rated VMware vCenter RCE bug under exploit • The Register
Warning: VMware vCenter and Kemp LoadMaster Flaws Under Active Exploitation
Microsoft Vulnerability Poses Risk To Domain Control
Critical RCE bug in VMware vCenter Server now exploited in attacks
Mystery Palo Alto Networks 0-day RCE now actively exploited • The Register
PAN-OS Firewall Vulnerability Under Active Exploitation – IoCs Released
Fortinet VPN Zero-Day Exploited in Malware Attacks Remains Unpatched: Report - SecurityWeek
Millions of WordPress sites potentially hijackable due to critical plugin bug | SC Media
Apple Releases Urgent Updates to Patch Actively Exploited Zero-Day Vulnerabilities
Chrome Security Update, Fix For Multiple Vulnerabilities
Ubuntu Linux impacted by decade-old 'needrestart' flaw that gives root
Fortinet VPN design flaw hides successful brute-force attacks
Microsoft pauses Exchange security updates over buggy patch • The Register
Microsoft Pulls Exchange Patches Amid Mail Flow Issues
Security plugin flaw in millions of WordPress sites gives admin access
Oracle patches exploited Agile PLM vulnerability (CVE-2024-21287) - Help Net Security
Linux Variant of Helldown Ransomware Targets VMware
Exploitation Attempts Target Citrix Session Recording Vulnerabilities - SecurityWeek
Helldown ransomware exploits Zyxel VPN flaw to breach networks
NSO Group used another WhatsApp zero-day after being sued, court docs say
D-Link urges users to retire VPN routers impacted by unfixed RCE flaw
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 15 November 2024
Black Arrow Cyber Threat Intelligence Briefing 15 November 2024:
-Massive MOVEit Vulnerability Breach: Hacker Leaks Employee Data from Amazon, McDonald’s, HSBC, HP, and Potentially 1000+ Other Companies
-Phishing Attacks Surge in 2024 as Cyber Criminals Adopt AI Tools and Multi-Channel Tactics
-Critical Vulnerabilities Persist in Finance and Insurance Sectors
-AI-Based Attacks Top Gartner’s List of Emerging Threats – Again
-Here Are the Top 10 Passwords for 2024, and They're All Embarrassing
-Mishing: The Rising Mobile Attack Vector Facing Every Organisation
-80% Of Surveyed Businesses Don’t Have Plans for an AI-Related Crisis
-BoE and Regulators Set Out Digital Rules to Cut Cyber Attack Risks
-Employees Are Hiding Their AI Use from Their Managers. Here's Why
-CISOs in 2025: Balancing Security, Compliance, and Accountability
-48% of Small Businesses Don’t Offer Cyber Security Training
-Thousands of Employees Could be Falling Victim to Obvious Phishing Scams Every Month
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Massive MOVEit Vulnerability Breach: Hacker Leaks Employee Data from Amazon, McDonald’s, HSBC, HP, and Potentially 1000+ Other Companies
A recent massive data breach exploiting a vulnerability in MOVEit file transfer software has exposed sensitive employee data from major companies globally. This incident is one of the largest corporate information leaks, affecting sectors such as finance, healthcare, technology, and retail. The breach resulted in detailed employee records being stolen from 25 leading organisations, including Amazon with over 2.8 million records and MetLife with over 585,000 records. The leaked data includes names, email addresses, phone numbers, and organisational structures, posing significant risks for phishing and identity theft. This incident highlights the critical importance of promptly applying security patches and reinforces the need for robust cyber security measures to protect sensitive corporate data.
Phishing Attacks Surge in 2024 as Cyber Criminals Adopt AI Tools and Multi-Channel Tactics
A recent report has found that phishing attacks surged by 28% in Q2 2024, with cybercriminals adopting AI tools and multi-channel tactics. Organisations with over 2,000 employees now face approximately 36 phishing emails per day, overwhelming security systems. There was a 52.2% increase in phishing attacks that bypass secure email gateways, using techniques like QR codes, deepfakes, and HTML smuggling. Payloadless attacks (phishing without links or attachments, instead using social engineering to deceive victims) have risen to nearly 19% of phishing attempts in 2024, up from 5.4% in 2021. Businesses must enhance security measures and foster awareness to combat these sophisticated threats.
Critical Vulnerabilities Persist in Finance and Insurance Sectors
Cyber security provider Black Duck has found that the finance and insurance sectors have the highest number of critical vulnerabilities, with small sites averaging 565 and medium sites 580. Healthcare and social assistance follow closely behind. The most critical issues identified were cryptographic failures and injection vulnerabilities, totalling over 34,800 instances. These weaknesses threaten sensitive data like personally identifiable information and financial records, posing significant business risks. The mean time to remediate varies, with finance addressing issues in 28 days due to strict regulations, while utilities take up to 107 days. Widespread security misconfigurations affect 98% of applications, endangering business continuity and service availability.
AI-Based Attacks Top Gartner’s List of Emerging Threats – Again
Gartner reports that AI-based threats remain the top emerging cyber risks for organisations, with 80% of surveyed executives highlighting AI-enhanced malicious attacks as a major concern. This marks the third consecutive quarter where AI leads in risk rankings. The difficulty in finding skilled AI and cyber security talent is prompting companies to turn to Managed Security Service Providers (MSSPs) for assistance. MSSPs are leveraging AI to combat sophisticated cyber attacks, and over 80% now offer AI-related security services. This represents a significant shift as enterprises struggle to protect themselves against increasingly complex AI-driven threats.
Here Are the Top 10 Passwords for 2024, and They're All Embarrassing
NordPass, in collaboration with NordStellar, has found that weak passwords remain a significant security risk for organisations and individuals alike. Their sixth annual report revealed that '123456' is the most common password globally, used by over 3 million personal users and more than 1.2 million corporate users. The report highlighted that despite increased awareness of password security, it takes less than a second to crack these widely used passwords. Nearly all organisations still face password management challenges, with many employees reusing simple passwords across accounts. The study underscores the need for stronger password practices, including adopting password managers.
Mishing: The Rising Mobile Attack Vector Facing Every Organisation
Recent research highlights that mobile-targeted phishing attacks, collectively termed "mishing", are an escalating threat to organisations. The widespread use of mobile devices for accessing sensitive data has made them prime targets for cyber criminals employing tactics like smishing, vishing and quishing. These attacks exploit unique mobile features, increasing user vulnerability. Despite this rising threat, many organisations lack adequate mobile security measures and underestimate the associated risks. To combat mishing, it is imperative for organisations to implement comprehensive mobile threat defences and educate employees on recognising and avoiding such attacks.
80% Of Surveyed Businesses Don’t Have Plans for an AI-Related Crisis
Riskonnect's recent report highlights that 80% of organisations lack a dedicated plan to address generative AI risks, including AI-driven fraud attacks. Among surveyed professionals, 72% reported that cyber security risks are having a significant or severe impact on their organisations (an increase from last year's 47%) and 24% believe AI-powered cyber security threats will have the biggest impact over the next 12 months. Despite growing concerns over AI ethics, privacy, and security, 65% of companies have not established policies governing the use of generative AI by partners and suppliers, leaving critical risk management gaps unaddressed.
BoE and Regulators Set Out Digital Rules to Cut Cyber Attack Risks
The Bank of England and UK financial regulators have introduced new rules to enhance IT resilience in financial firms, aiming to reduce risks from cyber attacks and power outages. Effective from 1 January next year, these measures require critical third-party providers to report major incidents and conduct resilience testing. While these providers boost competitiveness, reliance on a few increases systemic risk, potentially affecting consumers and the UK's financial stability. Regulators stress that firms remain accountable for operational resilience, underscoring the need to manage disruption risks to uphold the UK's reputation for stable financial services.
Employees Are Hiding Their AI Use from Their Managers. Here's Why
New research from Slack reveals that enthusiasm for artificial intelligence among employees is waning, with excitement dropping from 47% to 41% globally. Nearly half of desk workers feel uncomfortable with their managers knowing they use AI for common tasks, fearing perceptions of laziness or incompetence. Despite 99% of executives planning to invest in AI this year, a significant skills gap persists, with 61% of employees spending less than five hours learning to use AI tools. The report highlights the need for clear policies and training to address uncertainties and fully harness AI's potential.
CISOs in 2025: Balancing Security, Compliance, and Accountability
Recent regulatory changes, including new SEC and NYDFS rules in the US, have heightened CISO accountability by requiring rapid incident disclosures and increasing personal liability. This intensifies pressures on CISOs, making the role less attractive due to potential legal repercussions and heightened stress. Looking ahead to 2025, CISOs will need advanced skills in strategic communication, risk management, and understanding emerging technologies like AI. Top priorities now include optimising existing security investments, enhancing defences against AI-driven cyber attacks, and investing in advanced cloud security capabilities.
48% of Small Businesses Don’t Offer Cyber Security Training
Recent research has revealed that 48% of UK small businesses do not provide cyber security awareness training to employees. Cyber threats are increasing in volume and complexity, particularly with the rise of AI, yet nearly half (47%) lack up-to-date anti-virus software and 15% have no firewall protection. 81% do not have a valid disaster recovery plan, and 29% have no patch management in place. With 2.39 million businesses experiencing cyber crime in the last 12 months, there is a clear need for businesses to improve their cyber security stance, both technologically and through employee awareness.
Thousands of Employees Could be Falling Victim to Obvious Phishing Scams Every Month
Cyber security provider Netskope has found that phishing attacks are a significant threat in the banking sector, with three in every 1,000 employees clicking on phishing links each month. This equates to over 1,000 banking workers in the UK potentially compromising security monthly. Russian criminal groups are identified as the most active attackers.
Sources:
https://www.helpnetsecurity.com/2024/11/15/finance-industry-vulnerabilities/
https://www.msspalert.com/news/ai-based-attacks-top-gartners-list-of-emerging-threats-again
https://www.zimperium.com/blog/mishing-the-rising-mobile-attack-vector-facing-every-organization/
https://www.zdnet.com/article/employees-are-hiding-their-ai-use-from-their-managers-heres-why/
https://www.helpnetsecurity.com/2024/11/13/daniel-schwalbe-domaintools-cisos-2025/
Governance, Risk and Compliance
48% of small businesses don’t offer cyber security training
Failed security controls cost businesses billions
BoE and regulators set out digital rules to cut cyber-attack risks – Mortgage Strategy
CISOs in 2025: Balancing security, compliance, and accountability - Help Net Security
Steps Organisations Can Take to Improve Cyber Resilience - Security Boulevard
It’s a Hard Time to Be a CISO. Transformational Leadership Is More Imp - Infosecurity Magazine
How cyber security failures are draining business budgets - Help Net Security
The ROI of Security Investments: How Cyber Security Leaders Prove It
Maximizing cyber security ROI: Best practices for CISOs today | TechRadar
Crum & Forster Introduces Professional Liability Insurance for Chief Information Security Officers
Why Future-proofing Cyber Security Regulatory Frameworks Is Essential
Ambitious cyber security regulations leave companies in compliance chaos - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
Scattered Spider, BlackCat criminals claw back • The Register
Critical Veeam RCE bug now used in Frag ransomware attacks
Tackling ransomware without banning ransom payments | TechRadar
The Role of Threat Intelligence in Preventing Ransomware - Security Boulevard
To Pay or Not to Pay: The Ransomware Dilemma - Security Boulevard
OpenText reveals 2024 nastiest malware, LockBit leads list
WHO, 50 countries warn United Nations of increasing ransomware attacks against hospitals - The Hindu
New Ymir ransomware partners with RustyStealer in attacks
5 BCDR Oversights That Leave You Exposed to Ransomware
Cloud Ransomware Flexes Fresh Scripts Against Web Apps
New ShrinkLocker ransomware decryptor recovers BitLocker password
Idaho Man Turns to RaaS to Extort Orthodontist
Ransomware Victims
Cyber Attack Cost Oil Giant Halliburton $35 Million - SecurityWeek
Embargo ransomware claims breach of US pharmacy network • The Register
Phishing & Email Based Attacks
Thousands of employees could be falling victim to obvious phishing scams every month | TechRadar
Mishing: The Rising Mobile Attack Vector Facing Every Organisation - Zimperium
Man gets 10 years for stealing $20M in nest eggs from 400 US home buyers - Ars Technica
New Wave Of Phishing Attacks Exploits Microsoft Visio Files For Two-Step Credential Theft
Most prolific phishing campaign of 2024 | Professional Security Magazine
This new phishing strategy utilizes GitHub comments to distribute malware | TechRadar
This new phishing strategy utilizes GitHub comments to distribute malware | TechRadar
Microsoft Exchange adds warning to emails abusing spoofing flaw
If You Fall for a Phishing Email, Here’s What Happens Next
I Almost Fell For a Phishing Scam: Here’s What Happened
Other Social Engineering
Mishing: The Rising Mobile Attack Vector Facing Every Organisation - Zimperium
Winter Fuel Payment Scam Targets UK Citizens Via SMS | Tripwire
Scammers target UK senior citizens with Winter Fuel Payment texts
Pensioners Warned Over Winter Fuel Payment Scam Texts - Infosecurity Magazine
Malware being delivered by mail, warns Swiss cyber agency
North America sees social engineering scams multiply by a factor of 10
The terrifying Google Maps tactic now used by email scammers | Tech News | Metro News
Artificial Intelligence
AI-Based Attacks Top Gartner’s List of Emerging Threats – Again | MSSP Alert
Execs identify AI-driven cyber attacks as top security threat | SC Media
Employees are hiding their AI use from their managers. Here's why | ZDNET
HackerOne: 48% of Security Professionals Believe AI Is Risky
Hackers Are Using AI Against You: Here Is How To Protect Yourself
3 key generative AI data privacy and security concerns | TechTarget
80% Of Surveyed Businesses Don’t Have Plans For An AI-Related Crisis
Risk of AI in CIISec survey | Professional Security Magazine
AI Threat to Escalate in 2025, Google Cloud Warns - Infosecurity Magazine
Inside The Duality of AI's Superpowers
Enterprises look to AI to bridge cyber skills gap — but will still fall short | CSO Online
How CISOs Can Lead the Responsible AI Charge
Organisations face mounting pressure to accelerate AI plans, despite lack of ROI | ZDNET
Google Warns of Rising Cloaking Scams, AI-Driven Fraud, and Crypto Schemes
How to ward-off fraudulent job seekers propped up by AI | SC Media
Sticker shock: Are enterprises growing disillusioned with AI? | ZDNET
Malware
AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
ESET shines light on cyber criminal RedLine empire | Computer Weekly
Cyber Criminals Use Excel Exploit to Spread Fileless Remcos RAT Malware
Hackers now use ZIP file concatenation to evade detection
Hackers Abusing Google Ads To Deliver Fakebat Malware
Sophisticated Infostealers Top Malware Rankings
Hive0145 Targets Europe with Advanced Strela Stealer Campaigns - Infosecurity Magazine
New Glove Stealer malware bypasses Chrome's cookie encryption
This devious new malware is going after macOS users with a whole barrel of tricks | TechRadar
Hello again, FakeBat: popular loader returns after months-long hiatus | Malwarebytes
OpenText reveals 2024 nastiest malware, LockBit leads list
Watch out, that Excel document could be infected with dangerous malware | TechRadar
‘Top 10’ malware strain, Remcos RAT, now exploiting Microsoft Excel files | SC Media
Volt Typhoon rebuilds malware botnet following FBI disruption
North Korean hackers create Flutter apps to bypass macOS security
Malware being delivered by mail, warns Swiss cyber agency
This new phishing strategy utilizes GitHub comments to distribute malware | TechRadar
MacBook Pro Owners Warned As 99 New Security Problems Reported
New Ymir ransomware partners with RustyStealer in attacks
TA455’s Iranian Dream Job Campaign Targets Aerospace with Malware - Infosecurity Magazine
Bots/Botnets
AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
Volt Typhoon rebuilds malware botnet following FBI disruption
Mobile
Mishing: The Rising Mobile Attack Vector Facing Every Organisation - Zimperium
Apple indeed added a feature called "inactivity reboot" in iOS 18.1 that reboots locked devices
6 telltale signs that your Android phone has malware
US Gov Agency Urges Employees to Limit Phone Use After China ‘Salt Typhoon’ Hack - SecurityWeek
NatWest blocks bevy of messenger apps on staff devices • The Register
Google Confirms $1 Trillion AI Security Protection For Pixel Users
This Pixel phone feature listens in on calls to protect you from scams | ZDNET
Denial of Service/DoS/DDoS
Credit cards readers across Israeli stores crash in DDoS cyber attack - The Jerusalem Post
DDoS Attacks Targeting ISPs are Different – Here’s How - Security Boulevard
'Cyber attack' council in Tewkesbury working to ease backlog - BBC News
What will carpet bomb attacks mean for security teams in 2025? - Tech Monitor
Internet of Things – IoT
AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
Burglars are jamming Wi-Fi security cameras. Here's what you can do | PCWorld
Unpatched Vulnerabilities Allow Hacking of Mazda Cars: ZDI - SecurityWeek
Data Breaches/Leaks
Here's what we know about the Snowflake data theft suspects • The Register
Amazon MOVEit Leaker Claims to Be Ethical Hacker - Infosecurity Magazine
Major cyber attacks and data breaches of 2024 - Security Boulevard
Debt Relief Firm Forth Discloses Data Breach Impacting 1.5 Million People - SecurityWeek
200,000 SelectBlinds customers have their cards skimmed in malware attack
Not to alarm you, but your Social Security number is already leaked | The Independent
300,000 Patients Impacted By Law Firm Data Breach
Business records on 100M+ people swiped, put up for sale • The Register
Leaked info of 122 million linked to B2B data aggregator breach
Embargo ransomware claims breach of US pharmacy network • The Register
Misconfigured Microsoft Power Pages could lead to data breaches
HIBP notifies 57 million people of Hot Topic data breach
Organised Crime & Criminal Actors
Scattered Spider, BlackCat criminals claw back • The Register
US Prison Sentences for Nigerian Cyber Criminals Surge in Recent Months - SecurityWeek
How Global Threat Actors May Respond to a Second Trump Term
Here's what we know about the Snowflake data theft suspects • The Register
ESET shines light on cyber criminal RedLine empire | Computer Weekly
Crypto CEO safe after being kidnapped and held for $1 million ransom | Fortune Crypto
Charges Unsealed for Alleged Hackers of Snowflake Customers
World Economic Forum calls for joint efforts to counter cyber threats - World - DAWN.COM
WEF Launches New Framework to Combat Cyber Crime - Infosecurity Magazine
Cyber crook devoid of boundaries gets 10-year prison stint • The Register
Bitfinex Hacker Sentenced to 5 Years, Guilty of Laundering $10.5 Billion in Bitcoin
What To Know About Cyber Criminal Ross Ulbricht And His Possible Release Under Trump
FBI Warns US Organisations of Fake Emergency Data Requests Made by Cyber Criminals - SecurityWeek
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Bitcoin Fog Founder Sentenced to 12 Years for Cryptocurrency Money Laundering
Criminal crypto launderer gets 12.5 years in prison • The Register
Crypto CEO safe after being kidnapped and held for $1 million ransom | Fortune Crypto
Bitfinex Hacker Sentenced to 5 Years, Guilty of Laundering $10.5 Billion in Bitcoin
Google Warns of Rising Cloaking Scams, AI-Driven Fraud, and Crypto Schemes
Insider Risk and Insider Threats
Guardsman gets 15 years after leaking secret info on Discord • The Register
Redefining Cyber Resilience: Calculating the Human Factor | MSSP Alert
Insurance
Crum & Forster Introduces Professional Liability Insurance for Chief Information Security Officers
Supply Chain and Third Parties
BoE and regulators set out digital rules to cut cyber-attack risks – Mortgage Strategy
NIST publishes guide on due diligence for cyber supply chain risk management – DataBreaches.Net
Millions of records from MOVEit hack released on dark web | SC Media
Amazon MOVEit Leaker Claims to Be Ethical Hacker - Infosecurity Magazine
Single points of failure breed systemic risk to national security | SC Media
300,000 Patients Impacted By Law Firm Data Breach
Bank of England U-turns on Vulnerability Disclosure Rules - Infosecurity Magazine
Cloud/SaaS
AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services
5 Ways to Save Your Organisation From Cloud Security Threats
Strategies for CISOs navigating hybrid and multi-cloud security - Help Net Security
Outages
Single points of failure breed systemic risk to national security | SC Media
Microsoft investigates OneDrive issue causing macOS app freezes
Identity and Access Management
Identity Security Is The Cornerstone Of Modern Cyber Defence
Machine Identities Outnumber Human Ones: 69% Of Companies Face Rising Security Risks"
Embracing The Future Of Cryptography And Identity Management
Encryption
Quantum cyber risk – securing tomorrow | BCS
Embracing The Future Of Cryptography And Identity Management
Linux and Open Source
Open Source Security Incidents Aren't Going Away
Passwords, Credential Stuffing & Brute Force Attacks
Here Are the Top 10 Passwords for 2024, and They're All Embarrassing - CNET
The true (and surprising) cost of forgotten passwords
Social Media
TikTok Pixel Privacy Nightmare: A New Case Study
Instagram purportedly subjected to widespread data scraping | SC Media
South Korea Fines Meta $15.7 Million For Collecting User Data - IT Security Guru
Malvertising
Hackers Abusing Google Ads To Deliver Fakebat Malware
Training, Education and Awareness
48% of small businesses don’t offer cyber security training
Cyber Security Education Needs a Team: Better Partner Up!
Regulations, Fines and Legislation
BoE and regulators set out digital rules to cut cyber-attack risks – Mortgage Strategy
CISOs in 2025: Balancing security, compliance, and accountability - Help Net Security
Preparing for DORA Amidst Technical Controls Ambiguity
GDPR landscape | Professional Security Magazine
More Spyware, Fewer Rules: What Trump’s Return Means for US Cyber Security | WIRED
How the Trump Administration May Reshape Security, Privacy
US doubles down support for UN cyber crime treaty | SC Media
Will cyber suffer under Trump’s goal to slash federal budgets? - Government Executive
Why Future-proofing Cyber Security Regulatory Frameworks Is Essential
Bank of England U-turns on Vulnerability Disclosure Rules - Infosecurity Magazine
Ambitious cyber security regulations leave companies in compliance chaos - Help Net Security
Washington's Cyber Security Storm of Complacency
Models, Frameworks and Standards
Preparing for DORA Amidst Technical Controls Ambiguity
NIST publishes guide on due diligence for cyber supply chain risk management – DataBreaches.Net
GDPR landscape | Professional Security Magazine
NIST says exploited vulnerability backlog cleared but end-of-year goal for full list unlikely
Data Protection
South Korea Fines Meta $15.7 Million For Collecting User Data - IT Security Guru
Careers, Working in Cyber and Information Security
Veterans’ military skills can help them fill cyber vacancies, State official says - Nextgov/FCW
Has the Cyber Security Workforce Peaked?
4 reasons why veterans thrive as cyber security professionals - Help Net Security
How Generative AI Will Change Jobs In Cyber Security
Tips for a successful cyber security job interview - Help Net Security
Law Enforcement Action and Take Downs
Scattered Spider, BlackCat criminals claw back • The Register
Bitcoin Fog Founder Sentenced to 12 Years for Cryptocurrency Money Laundering
Here's what we know about the Snowflake data theft suspects • The Register
iPhones Seized by Cops Are Rebooting, and No One’s Sure Why
Man gets 10 years for stealing $20M in nest eggs from 400 US home buyers - Ars Technica
Charges Unsealed for Alleged Hackers of Snowflake Customers
Apple indeed added a feature called "inactivity reboot" in iOS 18.1 that reboots locked devices
New iOS Security Feature Reboots Devices to Protect User Data: Reports - SecurityWeek
Cyber crook devoid of boundaries gets 10-year prison stint • The Register
Bitfinex Hacker Sentenced to 5 Years, Guilty of Laundering $10.5 Billion in Bitcoin
Misinformation, Disinformation and Propaganda
German interior minister warns of cyber threat ahead of elections
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
China’s Hacker Army Outshines America | Miami Herald
CISA, FBI Confirm China Hacked Telecoms Providers for Spying - SecurityWeek
Massive Telecom Hack Exposes US Officials to Chinese Espionage - Infosecurity Magazine
China-linked hackers stole surveillance data from telecom companies, US says | Reuters
Toolkit Vastly Expands APT41's Surveillance Powers
Nation State Actors
China
China’s Hacker Army Outshines America | Miami Herald
Chinese hacking effort is far more pervasive than previously reported, sources say - ABC News
US Gov Agency Urges Employees to Limit Phone Use After China ‘Salt Typhoon’ Hack - SecurityWeek
Volt Typhoon rebuilds malware botnet following FBI disruption
CISA, FBI Confirm China Hacked Telecoms Providers for Spying - SecurityWeek
Massive Telecom Hack Exposes US Officials to Chinese Espionage - Infosecurity Magazine
Breaking Down Earth Estries Persistent TTPs in Prolonged Cyber Operations | Trend Micro (US)
Toolkit Vastly Expands APT41's Surveillance Powers
TikTok Pixel Privacy Nightmare: A New Case Study
Russia
How a Windows zero-day was exploited in the wild for months (CVE-2024-43451) - Help Net Security
German interior minister warns of cyber threat ahead of elections
Households should keep enough cash on hand for three days, BoF says | Yle News | Yle
Pro-Russia Hackers Ramp Up Cyber Attacks on South Korea, Presidential Office Says - The Moscow Times
Iran
Adversarial advantage: Using nation-state threat analysis to strengthen US cyber security
TA455’s Iranian Dream Job Campaign Targets Aerospace with Malware - Infosecurity Magazine
Credit cards readers across Israeli stores crash in DDoS cyber attack - The Jerusalem Post
North Korea
North Korean hackers create Flutter apps to bypass macOS security
Lazarus Group Uses Extended Attributes for Code Smuggling in macOS - Infosecurity Magazine
Pro-Russian Groups Target South Korea as North Korea Joins Ukraine - Infosecurity Magazine
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
1,400 Pegasus spyware infections detailed in WhatsApp’s lawsuit filings
More Spyware, Fewer Rules: What Trump’s Return Means for US Cyber Security | WIRED
Tools and Controls
48% of small businesses don’t offer cyber security training
Failed security controls cost businesses billions
The Role of Threat Intelligence in Preventing Ransomware - Security Boulevard
Identity Security Is The Cornerstone Of Modern Cyber Defence
Steps Organisations Can Take to Improve Cyber Resilience - Security Boulevard
How cyber security failures are draining business budgets - Help Net Security
Maximizing cyber security ROI: Best practices for CISOs today | TechRadar
API Security in Peril as 83% of Firms Suffer Incidents - Infosecurity Magazine
Machine Identities Outnumber Human Ones: 69% Of Companies Face Rising Security Risks"
Improve Your Organisation’s Data Security Posture- IT Security Guru
New iOS Security Feature Reboots Devices to Protect User Data: Reports - SecurityWeek
Cyber security network to make the UK safer and more resilient – UKRI
How Generative AI Will Change Jobs In Cyber Security
The ROI of Security Investments: How Cyber Security Leaders Prove It
Leveraging Threat Intelligence Feeds for Proactive Cyber Defence
80% Of Surveyed Businesses Don’t Have Plans For An AI-Related Crisis
Embracing The Future Of Cryptography And Identity Management
Redefining Cyber Resilience: Calculating the Human Factor | MSSP Alert
Experts Uncover 70,000 Hijacked Domains in Widespread 'Sitting Ducks' Attack Scheme
How Developers Drive Security Professionals Crazy
EU Ramps Up Cyber Resilience with Major Crisis Simulation Exercise - Infosecurity Magazine
Adversarial advantage: Using nation-state threat analysis to strengthen US cyber security
Enterprises look to AI to bridge cyber skills gap — but will still fall short | CSO Online
Dependency Management is Critical for Disaster Recovery After a Security Incident | HackerNoon
5 BCDR Oversights That Leave You Exposed to Ransomware
Half of businesses now using AI for cyber security | theHRD
Bank of England U-turns on Vulnerability Disclosure Rules - Infosecurity Magazine
O2’s AI Granny Outsmarts Scam Callers with Knitting Tales - Infosecurity Magazine
This Pixel phone feature listens in on calls to protect you from scams | ZDNET
Other News
Moody's Rating adds telecoms, airlines, utilities to highest risk category | CyberScoop
Ticketmaster Hackers Are Stealing Tickets Out of Customers' Accounts - Business Insider
Households should keep enough cash on hand for three days, BoF says | Yle News | Yle
More Spyware, Fewer Rules: What Trump’s Return Means for US Cyber Security | WIRED
These three critical sectors are riddled with high-risk vulnerabilities | ITPro
NIST report on hardware security risks reveals 98 failure scenarios - Help Net Security
Google Chrome Warning—New Drive-By Cyber Attack, No 0-Day Needed
Council Cyber Attacks: A Growing Issue | SC Media UK
How Global Threat Actors May Respond to a Second Trump Term
How Fintechs and Financial Institutions Can Demonstrate Resiliency: By Prakash Pattni
5 Must-Have Cyber Security Best Practices for Fintech Startups: By Sheza Gary
Looking to the skies: The importance of satellite cyber security | United States Studies Centre
Cyber security network to make the UK safer and more resilient – UKRI
Understanding the Cyber Criminal Mindset: Protecting Your School’s Data | Edexec
Could Cyber Expertise Aid Education in the Form of Governors? | SC Media UK
Automotive Safety and Security from the Bottom of the Stack
Cyber resilience takes centre stage at rail industry conference in London - Global Railway Review
Spray and pray: the cyber criminal tactic hurting shipping | TradeWinds
Vulnerability Management
Zero-days dominate top frequently exploited vulnerabilities - Help Net Security
Five Eyes nations reveal the top 15 most exploited flaws • The Register
NIST says exploited vulnerability backlog cleared but end-of-year goal for full list unlikely
NCSC on cyber threat landscape | Professional Security Magazine
Outdated PCs are Holes in Your Cyber Security Armor | Dell USA
Vulnerabilities
Microsoft Patch Tuesday security updates for November 2024 fix two actively exploited zero-days
HPE Patches Critical Vulnerabilities in Aruba Access Points - SecurityWeek
Veeam Patches High-Severity Vulnerability as Exploitation of Previous Flaw Expands - SecurityWeek
Patch Tuesday: Critical Flaws in Adobe Commerce, Photoshop, InDesign, Illustrator - SecurityWeek
Citrix Issues Patches for Zero-Day Recording Manager Bugs
Exploit code released for RCE attack on Citrix VDI solution • The Register
Palo Alto Advises Securing PAN-OS Interface Amid Potential RCE Threat Concerns
Critical Veeam RCE bug now used in Frag ransomware attacks
Fortinet Releases Security Updates for Multiple Products | CISA
Ivanti Patches 50 Vulnerabilities Across Several Products - SecurityWeek
High-Severity Vulnerabilities Patched in Zoom, Chrome - SecurityWeek
Citrix, Fortinet Patch High-Severity Vulnerabilities - SecurityWeek
WordPress Security Plugin Vulnerability Endangers 4 Million+ Sites
High-severity Fortinet VPN flaw allows privilege escalation • The Register
CISA Flags Two Actively Exploited Palo Alto Flaws; New RCE Attack Confirmed
D-Link won’t fix critical flaw affecting 60,000 older NAS devices
Google Chrome Warning—New Drive-By Cyber Attack, No 0-Day Needed
Chipmaker Patch Tuesday: Intel Publishes 44 and AMD Publishes 8 New Advisories - SecurityWeek
High-Severity Flaw in PostgreSQL Allows Hackers to Exploit Environment Variables
Unpatched Flaw in Legacy D-Link NAS Devices Exploited Days After Disclosure - SecurityWeek
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory 13 November 2024 – Microsoft, Ivanti, Adobe, Fortinet, Citrix, AMD, Intel, Chrome and Zoom Security Updates
Black Arrow Cyber Advisory 13 November 2024 – Microsoft, Ivanti, Adobe, Fortinet, Citrix, AMD, Intel, Chrome and Zoom Security Updates
Executive summary
Alongside Microsoft's November Patch Tuesday, several vendors—including Ivanti, Adobe, Fortinet, Citrix, Intel, AMD, Google, and Zoom—have released security updates to address vulnerabilities across their product ranges. Microsoft's updates rectify 91 security issues, including four zero-day vulnerabilities, with two actively being exploited. Ivanti has issued updates for Endpoint Manager, Avalanche, Connect Secure, and Security Access Client, addressing multiple vulnerabilities rated as 'critical', 'high', and 'medium'. Adobe's patches tackle 48 security issues affecting Commerce, InDesign, Photoshop, Illustrator, and Substance 3D Painter. Fortinet has released updates for several products, including FortiOS, to remediate 'high' rated vulnerabilities. Citrix has provided security updates for various products such as Virtual Apps, Desktops, and Netscaler. Intel has issued 44 security advisories covering a variety of products. AMD has released eight advisories relating to incorrect default permissions in various software utilities. Lastly, Google has updated Chrome, and Zoom has released updates, both addressing multiple 'high' severity security issues.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an attacker to compromise the confidentiality, integrity and availability of the affected applications and the organisations data on the affected systems.
What can I do?
Black Arrow recommends applying the available security updates for all supported versions of products that have been impacted by the various vulnerabilities. The updates should be applied as soon as possible for actively exploited vulnerabilities and all other vulnerabilities that have a critical or high severity ratings.
Microsoft
Further details on specific updates within this Microsoft patch Tuesday can be found here:
https://msrc.microsoft.com/update-guide/releaseNote/2024-Nov
Ivanti
Further details on specific updates across affected Ivanti products can be found here:
Adobe
Further details of the vulnerabilities in affected Adobe products can be found here under ‘Recent bulletins and advisories’:
https://helpx.adobe.com/security/security-bulletin.html
Fortinet
Further details of the vulnerabilities in affected Fortinet products can be found here:
https://www.fortiguard.com/psirt/FG-IR-23-396
https://www.fortiguard.com/psirt/FG-IR-23-475
https://www.fortiguard.com/psirt/FG-IR-24-144
https://www.fortiguard.com/psirt/FG-IR-24-199
Citrix
Further details of the vulnerabilities in affected Citrix products can be found here:
Intel
Further details of the vulnerabilities in affected Intel products can be found here:
https://www.intel.com/content/www/us/en/security-center/default.html
AMD
Further details of the vulnerabilities in affected AMD products can be found here:
https://www.amd.com/en/resources/product-security.html
Chrome
Further details of the vulnerabilities in Google Chrome can be found here:
https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop_12.html
Zoom
Further details of the vulnerabilities in Zoom can be found here:
https://www.zoom.com/en/trust/security-bulletin/?cms_guid=false&lang=en-US
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Intelligence Briefing 08 November 2024
Black Arrow Cyber Threat Intelligence Briefing 08 November 2024:
-Fake Copyright Infringement Emails Spread Rhadamanthys Malware
-Use Public Wi-Fi? You Might Not Want to After You Read This
-New MacOS Malware Linked to North Korean Hackers
-Disaster Recovery Planning is Key in the Modern-Day Business Environment
-The Biggest Underestimated Security Threat of Today? Advanced Persistent Teenagers
-Ransomware Attacks Hit Record Levels in 2024 Despite Law Enforcement Crackdowns
-The West Must Respond to Russia’s Rapidly Escalating Hybrid Warfare
-China’s Elite Hackers Expand Target List to European Union
-How Early-Stage Companies Can Go Beyond Cyber Security Basics
-How AI Will Shape the Next Generation of Cyber Threats
-Cyber Security Trends and Tips for Small and Medium Businesses to Stay Protected
-What are the key Threats to Global National Security?
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Fake Copyright Infringement Emails Spread Rhadamanthys Malware
Check Point Research has identified a widespread phishing campaign targeting hundreds of organisations globally with fake copyright infringement emails. These emails deploy Rhadamanthys, a sophisticated cyber security threat that steals sensitive data, including cryptocurrency wallet information. The attackers impersonate brands mainly from the technology and media sectors, with nearly 70% of fake emails appearing to come from these industries. They exploit fears of copyright violation to prompt downloads of malicious files. The malware uses advanced techniques, such as embedding itself in large files to evade detection. Organisations are advised to strengthen phishing defences and monitor for unusual file downloads to mitigate this risk.
Use Public Wi-Fi? You Might Not Want to After You Read This
A recent survey found that nearly half of internet users connect to public Wi-Fi networks without verifying their legitimacy, with one in four experiencing security issues as a result. Cyber criminals exploit these unsecured networks to steal sensitive data like passwords and banking information. Experts highlight that despite warnings, convenience often outweighs caution, putting both individuals and organisations at risk of data breaches and identity theft. The report underscores the need for businesses to educate employees on the dangers of public Wi-Fi and to adopt secure practices such as using VPNs to protect sensitive information.
New MacOS Malware Linked to North Korean Hackers
Security researchers have identified new macOS malware linked to a North Korean hacking group targeting cryptocurrency businesses. The malware, named "Hidden Risk", is distributed through phishing emails masquerading as cryptocurrency news articles. Recipients are tricked into downloading a malicious program that runs on both Intel and Apple silicon Macs. The program was mistakenly notarised by Apple, allowing it to bypass security measures, but this approval has since been revoked. The malware creates a backdoor into the system, enabling hackers to execute commands and install additional payloads. The campaign is believed to have started in July and is attributed to the BlueNoroff group.
Disaster Recovery Planning is Key in the Modern-Day Business Environment
A recent survey has found that 78% of senior IT professionals reported data loss due to system failure, human error, or cyber attack in the past year, highlighting that protective measures are often breached. Yet only 54% are confident in their ability to recover data and minimise downtime after a disaster. Nearly 40% cite a lack of in-house technical expertise, 29% point to insufficient investment, and 28% note a lack of senior support as barriers to recovery planning. With incidents including a recent global outage costing businesses up to $1.5 billion, prioritising disaster recovery planning is critical for organisational resilience.
The Biggest Underestimated Security Threat of Today? Advanced Persistent Teenagers
Security experts have identified that financially motivated teenage hackers, termed "advanced persistent teenagers", are emerging as a significant cyber security threat. Organisations have suffered major data breaches and paid substantial ransoms due to these attacks, which often exploit social engineering tactics like phishing emails and impersonating helpdesk staff. Despite their youth, these hackers demonstrate capabilities once limited to nation states. Experts emphasise that insider threats and identity-related vulnerabilities are now among the biggest concerns, highlighting the need for improved identity and access management and a better understanding of the human element in cyber security.
Ransomware Attacks Hit Record Levels in 2024 Despite Law Enforcement Crackdowns
A cyber security expert noted that this year saw four eight-figure payments due to successful ransomware attacks, including a $22 million payment by a major health tech company. Data-theft-only attacks have risen by 30%, as some threat actors decide to not encrypt their victim’s systems and instead focus only on data theft. While authorities have disrupted significant ransomware operations, active groups have increased by 30% year-over-year, with 31 new groups emerging. There is a growing debate on banning ransom payments to deter these escalating cyber attacks.
The West Must Respond to Russia’s Rapidly Escalating Hybrid Warfare
Recent reports reveal that Russia is intensifying its hybrid warfare against the West. NATO Secretary General Mark Rutte highlighted a surge in cyber attacks, disinformation campaigns, and industrial sabotage across allied territories. These threats have expanded beyond Ukraine, affecting Western Europe and even the Arctic region. Despite reduced reliance on Russian energy, several EU countries remain vulnerable due to ongoing dependencies. The Kremlin is also exploiting non-traditional media and supporting populist movements to destabilise democracies. This escalating situation underscores the urgent need for Western governments and security services to collaborate in countering these multifaceted threats.
China’s Elite Hackers Expand Target List to European Union
Cyber security software provider ESET reports that China's elite government-backed hackers are expanding their targets to include the European Union. The report highlights that groups like MirrorFace, traditionally focused on Japan, are now targeting EU organisations. Despite this shift, motivations may remain Japan-centric, as spearphishing emails relate to events like EXPO 2025 in Osaka. The use of legitimate tools such as SoftEther VPN by these hackers is a growing concern, allowing them to blend into normal network traffic. ESET advises organisations to treat unexpected deployments of such tools as suspicious, emphasising the need for heightened vigilance.
How Early-Stage Companies Can Go Beyond Cyber Security Basics
Businesses are confronting increasingly sophisticated cyber threats, with phishing scams, zero-day vulnerabilities, and ransomware attacks on the rise. While compliance frameworks like GDPR and PCIDSS provide a foundation, they are insufficient alone as they may not keep pace with evolving cyber criminal tactics. Many organisations risk a false sense of security by focusing solely on compliance, often engaging in procedural tick-box exercises rather than enhancing their security posture. To mitigate risks, organisations must adopt proactive, dynamic, risk-based security strategies, including layered defences, employee training, and robust incident response plans.
How AI Will Shape the Next Generation of Cyber Threats
Advancements in AI are significantly lowering the barrier to entry for cyber attackers. As AI-powered attack tools become accessible and packaged as user-friendly products on the dark web, even those without technical expertise can launch sophisticated cyber attacks. This shift greatly widens the pool of potential attackers beyond traditional threats, and highlights that organisations must adopt AI-powered defences to stay ahead. Ethical concerns also arise in deploying AI for cyber security, especially regarding data privacy and automated responses. Over the next five to ten years, AI-driven threats are expected to evolve significantly, introducing entirely new types of attacks.
Cyber Security Trends and Tips for Small and Medium Businesses to Stay Protected
Microsoft highlights that cyber attacks are increasingly affecting SMBs, with 31% having experienced incidents like ransomware and phishing. These attacks cost SMBs up to $7 million, impacting finances and reputation. 94% recognise cyber security’s importance, and over 70% work with specialists to manage their security. AI’s rise increases security needs, with 81% of SMBs acknowledging this. Many SMBs plan to boost cyber security spending; hybrid work also poses challenges, with 68% finding secure data access difficult for remote workers.
What are the key Threats to Global National Security?
A recent analysis identifies cyber security threats as the foremost concern for nations leveraging digital technologies, with cyber attacks increasingly targeting critical infrastructure. Climate change is another pressing issue, causing resource shortages and contributing to conflicts, with over two in five regions facing climate-induced migration. Bioterrorism also poses significant risks, yet nearly a third of countries have not invested adequately in public health preparedness. Economic espionage is impacting key sectors like technology and defence, and the ongoing threat of nuclear proliferation remains a major global security challenge.
Sources:
https://inews.co.uk/inews-lifestyle/public-wifi-wont-want-to-read-3348687
https://uk.pcmag.com/security/155250/new-macos-malware-linked-to-north-korean-hackers
https://www.techspot.com/news/105399-ransomware-attacks-set-rise-record-levels-2024-despite.html
https://cyberscoop.com/china-apt-eset-target-typhoon-mirrorface/
https://cyberscoop.com/cybersecurity-for-startups-early-stage-companies/
https://www.helpnetsecurity.com/2024/11/07/buzz-hillestad-prismatic-ai-driven-attacks/
https://www.itsecurityguru.org/2024/11/01/what-are-the-key-threats-to-global-national-security/
Governance, Risk and Compliance
7 cyber security trends for small and medium businesses | Microsoft Security Blog
CISO Top 10 Priorities for Q3 2024: Navigating Cyber Security's Evolving Challenges | SC Media
Disaster recovery planning is key in the modern-day business environment
Cyber security in crisis: Are we ready for what's coming? - Help Net Security
IT Security Centralization Makes Industrial Spies Profitable
How Cyber Security Training Must Adapt to a New Era of Threats - Security Boulevard
Chief risk storyteller: How CISOs are developing yet another skill | CSO Online
Threats
Ransomware, Extortion and Destructive Attacks
Cyber insurers would not welcome ban on ransomware payments :: Insurance Day
GoZone ransomware accuses and threatens victims - Help Net Security
RansomHub dethrones LockBit as top ransomware cartel | Cybernews
Iranian Threat Actors Ramp Up Ransomware, Cyber Activity
Ransomware attacks caused prolonged disruptions in October | TechTarget
Police Doxing of Criminals Raising Ransomware-Attack Stakes
Meet Interlock — The new ransomware targeting FreeBSD servers
Cyber attack disrupts classes at Irish technology university
Ransomware Victims
Devon school 'blackmailed' by hackers in cyber-attack - BBC News
Schneider Electric attackers demand ransom paid in baguettes • The Register
Ransomware Group Demands Payment in French Baguettes
Ransomware Attack Disrupts Georgia Hospital's Access to Health Records - SecurityWeek
Hacker Claims to Leak Nokia Source Code - InfoRiskToday
California court suffering from tech outages after cyber attack
Ransomware attack costs Microchip Technology over $21M | SC Media
Phishing & Email Based Attacks
Businesses Worldwide Targeted in Large-Scale ChatGPT Phishing Campaign - SecurityWeek
Dangerous new phishing campaign infects Windows devices with malicious Linux VM | TechRadar
Beware of phishing emails delivering backdoored Linux VMs! - Help Net Security
Fake Copyright Infringement Emails Spread Rhadamanthys
US Sentences Nigerian to 26 Years in Prison for Stealing Millions Through Phishing - SecurityWeek
DocuSign's Envelopes API abused to send realistic fake invoices
Cyber Criminals Exploit DocuSign APIs to Send Fake Invoices - Infosecurity Magazine
Large-Scale Phishing Campaign Exposed Using New Version Of Rhadamanthys Malware
Phishing Emails and Spam Are Similar, but There Are 5 Key Differences
Gmail Users Beware—Link Hovering Attacks On The Up
Gmail 2FA Cyber Attacks—Open Another Account Before It’s Too Late
Scammers Target Starlink Users With Elaborate Phishing Scheme
Other Social Engineering
LastPass warns of fake support centers trying to steal customer data
Fake Copyright Infringement Emails Spread Rhadamanthys
Malware operators use copyright notices to lure in businesses | SC Media
Advanced Variant Of FakeCall Malware Targets Mobile Users
FBI recovers just $8M after crypto scam crashes Kansas bank • The Register
Things you should know about ‘digital arrest’ scams! - The Hindu BusinessLine
Artificial Intelligence
The deepfake threat to CEOs | Fortune
How AI will shape the next generation of cyber threats - Help Net Security
Businesses Worldwide Targeted in Large-Scale ChatGPT Phishing Campaign - SecurityWeek
Experts warn some ChatGPT models can be hacked to launch deepfake scams | TechRadar
ChatGPT-4o can be used for autonomous voice-based scams
AI threats dictate a return to Human Intelligence | Cybernews
Defenders Outpace Attackers in AI Adoption - Infosecurity Magazine
OWASP Releases AI Security Guidance
Why Cyber Criminals Are Not Necessarily Embracing AI | HackerNoon
Inside Iran's Cyber Playbook: AI, Fake Hosting, and Psychological Warfare
Trump plans to dismantle Biden AI safeguards after victory - Ars Technica
2FA/MFA
Google Cloud to Mandate Multifactor Authentication by 2025 - Infosecurity Magazine
Gmail 2FA Cyber Attacks—Open Another Account Before It’s Too Late
Malware
New Malware Campaign Targets Windows Users Through Gaming Apps
Hackers increasingly use Winos4.0 post-exploitation kit in attacks
Industrial companies in Europe targeted with GuLoader - Help Net Security
5 Most Common Malware Techniques in 2024
MacOS under attack by crypto thieves: malicious app disguises itself as PDF | Cybernews
New SteelFox malware hijacks Windows PCs using vulnerable driver
New MacOS Malware Linked to North Korean Hackers
Microsoft services exploited for stealthy malware deployment | SC Media
Large-Scale Phishing Campaign Exposed Using New Version Of Rhadamanthys Malware
Typosquat campaign impersonates 287+ popular npm packages • The Register
Cloudy With a Chance of RATs: Unveiling APT36 and the Evolution of ElizaRAT - Check Point Research
Bots/Botnets
Microsoft reveals major Chinese botnet is attacking users across the world | TechRadar
Microsoft credentials pilfered by APT Storm via botnet spray-and-pray router attack | SC Media
Organisations are fighting a losing battle against advanced bots | TechRadar
Mobile
Advanced Variant Of FakeCall Malware Targets Mobile Users
New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers
Dangerous Android banking malware looks to trick victims with fake money transfers | TechRadar
Here's What I Do Whenever I Receive a Scam Message on WhatsApp
What Telegram’s recent policy shift means for cyber crime
Mobile & IoT Security Requires More Industry Attention
How I Spot Smishing Texts Easily (and You Can, Too)
Denial of Service/DoS/DDoS
UK Council Sites Recover Following Russian DDoS Blitz - Infosecurity Magazine
DDoS site Dstat.cc seized and two suspects arrested in Germany
UK councils bat away DDoS barrage from Putin fanboys • The Register
Cyber attack disrupts classes at Irish technology university
Internet of Things – IoT
IoT Security Failures Can Be Sh*tty - Security Boulevard
Iranian APT Targets IP Cameras, Extends Attacks Beyond Israel
Chinese Air Fryers May Be Spying on Consumers, Which? Warns - Infosecurity Magazine
Mobile & IoT Security Requires More Industry Attention
Data Breaches/Leaks
Recovering From a Breach: 4 Steps Every Organisation Should Take - Security Boulevard
Telecoms company Magnet+ investigating possible cyber attack – The Irish Times
Identity-related data breaches cost more than average incidents - Help Net Security
Nokia investigates breach after hacker claims to steal source code
Scissor-maker Fiskars sliced by hackers | Cybernews
Domestic abuse victim’s home address leaked to ex-partner after data breach | The Independent
210,000 Impacted by Saint Xavier University Data Breach - SecurityWeek
Organised Crime & Criminal Actors
Operation Synergia II sees Interpol swoop on cyber crims • The Register
Massive Nigerian Cyber Crime Bust Sees 130 Arrested - Infosecurity Magazine
Interpol operation nets 41 arrests, takedown of 22,000 malicious IPs
Cyber Threats Increase as Russia, China Train New Criminals - Africa Defense Forum
The biggest underestimated security threat of today? Advanced persistent teenagers | TechCrunch
Inside the Massive Crime Industry That’s Hacking Billion-Dollar Companies | WIRED
Hacker Said to Be Behind Breach of Snowflake (SNOW) Customers Arrested - Bloomberg
How to Defend Against Alleged Snowflake Attacker… | Intel 471
What Telegram’s recent policy shift means for cyber crime
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
MacOS under attack by crypto thieves: malicious app disguises itself as PDF | Cybernews
FBI recovers just $8M after crypto scam crashes Kansas bank • The Register
Insider Risk and Insider Threats
FBI arrested former Disney World employee for hacking computer menus and mislabeling allergy info
Oh, the Humanity! How to Make Humans Part of Cyber Security
Insurance
Cyber insurers would not welcome ban on ransomware payments :: Insurance Day
Supply Chain and Third Parties
Banks urged to improve resilience to IT meltdowns • The Register
Supply Chain Attack Uses Smart Contracts for C2 Ops - Infosecurity Magazine
New Report from BlueVoyant Shows Progress in Third-Party Cyber Risk Management, But Breaches Persist
The State of Supply Chain Defence in 2024 Report
Serco, DHL among firms affected by Microlise cyber attack | ITPro
Cloud/SaaS
The future of cloud computing: Top trends and predictions | TechTarget
5 SaaS Misconfigurations Leading to Major Fu*%@ Ups
Google Cloud to Mandate Multifactor Authentication by 2025 - Infosecurity Magazine
Microsoft 365 security blind spots: Is your business exposed? - Partner Content - Security - iTnews
Outages
Banks urged to improve resilience to IT meltdowns • The Register
Identity and Access Management
Identity-related data breaches cost more than average incidents - Help Net Security
Encryption
“Q Day” Is Coming: Is the World Prepared? - Centre for International Governance Innovation
Quantum Has Landed, So Now What?
Linux and Open Source
Dangerous new phishing campaign infects Windows devices with malicious Linux VM | TechRadar
Beware of phishing emails delivering backdoored Linux VMs! - Help Net Security
Meet Interlock — The new ransomware targeting FreeBSD servers
Passwords, Credential Stuffing & Brute Force Attacks
Microsoft Warns of Chinese Botnet Exploiting Router Flaws for Credential Theft
Microsoft credentials pilfered by APT Storm via botnet spray-and-pray router attack | SC Media
A Hacker's Guide to Password Cracking
Okta’s ‘secure by design’ pledge suffers a buggy setback | CSO Online
Social Media
South Korea fines Meta about $15 mln over collection of user data | Reuters
Canada Orders TikTok to Shut Down Canadian Operations Over Security Concerns
Malvertising
NCSC Publishes Tips to Tackle Malvertising Threat - Infosecurity Magazine
Training, Education and Awareness
How Cyber Security Training Must Adapt to a New Era of Threats - Security Boulevard
Regulations, Fines and Legislation
Banks urged to improve resilience to IT meltdowns • The Register
The NIS 2 Era Is Here: Are You Compliance-Ready? | Goodwin - JDSupra
Government-backed cyber security has a long way to go, warns Arctic Wolf
Apple could face EU's first-ever DMA fine as soon as this month - 9to5Mac
Exploring DORA: How to manage ICT incidents and minimize cyber threat risks
HIPAA Not ‘Strong Enough’ for Health Care’s Cyber Security Needs
South Korea fines Meta about $15 mln over collection of user data | Reuters
Biden administration prepares second executive order on cyber security | SC Media
Germany drafts law to protect researchers who find security flaws
Trump plans to dismantle Biden AI safeguards after victory - Ars Technica
Combating Cyber Crime: What to Expect From Trump Presidency?
Models, Frameworks and Standards
The NIS 2 Era Is Here: Are You Compliance-Ready? | Goodwin - JDSupra
Exploring DORA: How to manage ICT incidents and minimize cyber threat risks
OWASP Releases AI Security Guidance
NIST CSF 2.0 Critical - Security Boulevard
Data Protection
Consumer privacy risks of data aggregation: What should organisations do? - Help Net Security
South Korea fines Meta about $15 mln over collection of user data | Reuters
Careers, Working in Cyber and Information Security
24% of CISOs actively looking to leave their jobs | CSO Online
A grassroots movement to tackle cyber skills gap | Professional Security Magazine
UK Cyber Security Wages Soar Above Inflation as Stress Levels Rise - Infosecurity Magazine
Proactive Ways To Bridge The Cyber Security Talent Gap
How Playing Cyber Games Can Help You Get Hired
Keep Learning or Keep Losing: There's No Finish Line
US Coast Guard's New Cyber Units: A Game Changer for National Security - ClearanceJobs
Want to attract diverse cyber talent? Go beyond the same-old recruiting techniques | SC Media
MoD seeks leader for ‘defensive cyber operations’ – PublicTechnology
How CISOs can turn around low-performing cyber pros | CSO Online
Law Enforcement Action and Take Downs
FBI arrested former Disney World employee for hacking computer menus and mislabeling allergy info
Operation Synergia II sees Interpol swoop on cyber crims • The Register
Massive Nigerian Cyber Crime Bust Sees 130 Arrested - Infosecurity Magazine
Interpol operation nets 41 arrests, takedown of 22,000 malicious IPs
DDoS site Dstat.cc seized and two suspects arrested in Germany
FBI Seeks Public Help to Identify Chinese Hackers Behind Global Cyber Intrusions
Hacker Said to Be Behind Breach of Snowflake (SNOW) Customers Arrested - Bloomberg
How to Defend Against Alleged Snowflake Attacker… | Intel 471
Gov't IT contractors arrested for defrauding the feds • The Register
US Sentences Nigerian to 26 Years in Prison for Stealing Millions Through Phishing - SecurityWeek
FBI recovers just $8M after crypto scam crashes Kansas bank • The Register
Police Doxing of Criminals Raising Ransomware-Attack Stakes
Misinformation, Disinformation and Propaganda
Russian disinformation campaign active ahead of 2024 US election
US Says Russia Behind Fake Haitian Voters Video - Infosecurity Magazine
CISA: U.S. election disinformation peddled at massive scale | TechTarget
Misinformation is Ruining our Elections. Here’s How we can Rescue Them. - Security Boulevard
US warns of Russia and Iran’s disinformation campaigns as election day unfolds
False bomb threats only blemish on Election Day voting process
Russian Fake News and Bomb Threats Target Election Day Votes
Here are the post-election disinfo threats experts are watching for
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
IT Security Centralization Makes Industrial Spies Profitable
The West must respond to Russia’s rapidly escalating hybrid warfare - Atlantic Council
What are the key Threats to Global National Security? - IT Security Guru
Lord Harries links nuclear to cyber threats
Nation State Actors
Cyber Threats Increase as Russia, China Train New Criminals - Africa Defense Forum
China
Microsoft reveals major Chinese botnet is attacking users across the world | TechRadar
Microsoft Warns of Chinese Botnet Exploiting Router Flaws for Credential Theft
Chinese APTs Cash In on Years of Edge Device Attacks
Thousands of hacked TP-Link routers used in years-long account takeover attacks - Ars Technica
Sophos Warns Chinese Hackers Are Becoming Stealthier - Infosecurity Magazine
NCSC Details ‘Pygmy Goat’ Backdoor Planted on Hacked Sophos Firewall Devices - SecurityWeek
Microsoft credentials pilfered by APT Storm via botnet spray-and-pray router attack | SC Media
China's elite hackers expand target list to European Union | CyberScoop
China-Aligned MirrorFace Hackers Target EU Diplomats with World Expo 2025 Bait
Misinformation is Ruining our Elections. Here’s How we can Rescue Them. - Security Boulevard
China's Volt Typhoon breached Singtel, reports say • The Register
Chinese Group Accused of Hacking Singtel in Telecom Attacks - Bloomberg
FBI Seeks Public Help to Identify Chinese Hackers Behind Global Cyber Intrusions
Chinese Air Fryers May Be Spying on Consumers, Which? Warns - Infosecurity Magazine
Canada Orders TikTok to Shut Down Canadian Operations Over Security Concerns
Russia
The West must respond to Russia’s rapidly escalating hybrid warfare - Atlantic Council
N Korea may receive tech in exchange for military support • The Register
CISA: US election disinformation peddled at massive scale | TechTarget
Misinformation is Ruining our Elections. Here’s How we can Rescue Them. - Security Boulevard
Cyber attack sparks extra security at Portsmouth council - BBC News
UK Council Sites Recover Following Russian DDoS Blitz - Infosecurity Magazine
Russian disinformation campaign active ahead of 2024 US election
US Says Russia Behind Fake Haitian Voters Video - Infosecurity Magazine
False bomb threats only blemish on Election Day voting process
Russian Fake News and Bomb Threats Target Election Day Votes
Here are the post-election disinfo threats experts are watching for
Cyber Threats Increase as Russia, China Train New Criminals - Africa Defense Forum
1 Million Cyber Attacks Made On Montco Election, Mainly From Russia | Norristown, PA Patch
Iran
CISA: U.S. election disinformation peddled at massive scale | TechTarget
Misinformation is Ruining our Elections. Here’s How we can Rescue Them. - Security Boulevard
Iranian Threat Actors Ramp Up Ransomware, Cyber Activity
Iranian APT Targets IP Cameras, Extends Attacks Beyond Israel
Here are the post-election disinfo threats experts are watching for
Inside Iran's Cyber Playbook: AI, Fake Hosting, and Psychological Warfare
North Korea
N Korea may receive tech in exchange for military support • The Register
Tools and Controls
Banks urged to improve resilience to IT meltdowns • The Register
Disaster recovery planning is key in the modern-day business environment
AI threats dictate a return to Human Intelligence | Cybernews
What is Unified Threat Management (UTM)? | Definition from TechTarget
Recovering From a Breach: 4 Steps Every Organisation Should Take - Security Boulevard
Google Says Its AI Found SQLite Vulnerability That Fuzzing Missed - SecurityWeek
Google Cloud to Mandate Multifactor Authentication by 2025 - Infosecurity Magazine
New cyber security advisory highlights defence-in-depth strategies
Oh, the Humanity! How to Make Humans Part of Cyber Security
How to Win at Cyber by Influencing People
Security Assessment Reports: A Complete Overview - Security Boulevard
The human factor in cyber resilience | UKAuthority
Typosquat campaign impersonates 287+ popular npm packages • The Register
Scotland’s Digital Office highlights tabletop cyber security exercises | UKAuthority
Defenders Outpace Attackers in AI Adoption - Infosecurity Magazine
4 Main API Security Risks Organisations Need to Address
The ins and outs of threat emulation | TechRadar
Navigating the evolving landscape of cyber risk management
Germany drafts law to protect researchers who find security flaws
What is a Cyber Range? - Security Boulevard
Okta’s ‘secure by design’ pledge suffers a buggy setback | CSO Online
Effective Phishing Exercises: How To Plan, Execute And Follow Up
Microsoft 365 security blind spots: Is your business exposed? - Partner Content - Security - iTnews
Other News
Cyber security in crisis: Are we ready for what's coming? - Help Net Security
CISO Top 10 Priorities for Q3 2024: Navigating Cyber Security's Evolving Challenges | SC Media
The ironic vulnerability: why insurers are prime targets for cyber attacks
Cyber attack disrupts classes at Irish technology university
Public sector cyber break-ins: Our money, our right to know • The Register
'Unauthorized activity' downs Washington's court systems • The Register
The Internet's Defenders Are Running Out of Money—And We're All at Risk | IBTimes
How to Win at Cyber by Influencing People
Scotland’s Digital Office highlights tabletop cyber security exercises | UKAuthority
How early-stage companies can go beyond cyber security basics | CyberScoop
How to Outsmart Stealthy E-Crime and Nation-State Threats
Cyber Trends: Keep an Eye on Critical Infrastructure Sectors
Five ways cyber criminals target healthcare and how to stop them | ITPro
JPMorgan CISO says three trends play a role in how he protects the banking giant | Fortune
Attackers Breach IT-Based Networks Before Jumping to ICS/OT Systems
Don't search for information on cats at work — you could be at risk of being hacked | TechRadar
Combating Cyber Crime: What to Expect From Trump Presidency?
Facing Growing Threats, Space Industry Expands Its Cyber Warning Center
Governments are facing a huge surge in cyber attacks | TechRadar
Cyber Threats That Could Impact the Retail Industry This Holiday Season (and What to Do About It)
Cyber attack on American Water: A warning to critical infrastructure
Vulnerability Management
Vulnerabilities
Microsoft SharePoint RCE bug exploited to breach corporate network
Worrying WordPress plugin security flaw could let hackers hijack your site | TechRadar
Okta vulnerability allowed accounts with long usernames to log in without a password
New SteelFox malware hijacks Windows PCs using vulnerable driver
Sophos Firewall hack on government network used an all-new custom malware | TechRadar
Cisco scores an (im)perfect CVSS 10 with critical Wi-Fi flaw • The Register
CISA warns of critical Palo Alto Networks bug exploited in attacks
Zero-Click Flaw Exposes Potentially Millions of Popular Storage Devices to Attack | WIRED
PfSense Stored XSS Vulnerability Leads To RCE Attacks, PoC Published
Synology Urges Patch for Critical Zero-Click RCE Flaw Affecting Millions of NAS Devices
Google Patches Two Android Vulnerabilities Exploited in Targeted Attacks - SecurityWeek
Okta’s ‘secure by design’ pledge suffers a buggy setback | CSO Online
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 01 November 2024
Black Arrow Cyber Threat Intelligence Briefing 01 November 2024:
-Banks and Regulators Warn of Rise in ‘Quishing’ QR Code Scams
-Russia Carrying Out Targeted Attacks In UK, Microsoft Warns
-Spoof Eventbrite Phishing Emails Lure in Victims in Major Attack
-Business Email Compromise Scams Dominate Q3 2024 Threats
-This Nasty Android Trojan is Hijacking Calls to Your Bank and Sending Them to Hackers
-What Military Wargames Can Teach About Cyber Security
-Businesses Expect Cyber Threats to Rise, but Aren’t Ready for Them
-The Overlooked Importance of Identifying the Riskiest Users
-Hackers Targeted a $12 Billion Cyber Security Company with a Deepfake of Its CEO. Here's Why Small Details Made It Unsuccessful.
-Small Businesses Boosting Cyber Security as Threats Grow
-The Rise of the vCISO: From Niche to Necessity?
-Five Eyes Agencies Offer Security Advice for Small Businesses
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Banks and Regulators Warn of Rise in ‘Quishing’ QR Code Scams
Banks and regulators have flagged a concerning rise in "quishing" scams, where fraudsters use QR codes in emails to bypass corporate cyber security. This technique, involving QR codes in PDF attachments, often evades standard security filters, tricking recipients into disclosing financial details. Increased during the pandemic, such scams now represent over 20% of UK online scams, with reports doubling in the past year. While these scams frequently occur via email, they also target public QR code installations, from parking meters to EV chargers. As quishing continues to evolve, organisations may need to enhance detection capabilities to counter this growing threat.
Russia Carrying Out Targeted Attacks In UK, Microsoft Warns
Microsoft and AWS have issued warnings about targeted cyber attacks by a Russian-backed group, aimed primarily at the UK and other countries. Known as Midnight Blizzard or APT29, this group has been using highly targeted spear-phishing emails since October to infiltrate government, defence, academic, and non-profit sectors. Posing as Microsoft or AWS staff, attackers use social engineering techniques involving remote access protocol attachments that create direct connections to attacker-controlled servers. This method can expose user credentials and facilitate unauthorised access to sensitive information, including device resources, potentially allowing attackers to install persistent malware on compromised systems.
Spoof Eventbrite Phishing Emails Lure in Victims in Major Attack
Cyber criminals have increasingly exploited Eventbrite’s platform, with a 900% surge in phishing attacks using this trusted event management service. Hackers create fake events under familiar brand names, leveraging Eventbrite's built-in mailing system to distribute phishing emails that bypass common security filters due to the trusted domain of ‘noreply@events.eventbrite.com’. Through these messages, victims are urged to take immediate action, often leading to the disclosure of sensitive data like login credentials, tax identification numbers, and payment details. This method has proven effective, highlighting the need for heightened vigilance around trusted online platforms.
Business Email Compromise Scams Dominate Q3 2024 Threats
The VIPRE Security Group’s recent report highlights the increasing sophistication of Business Email Compromise (BEC) scams, which accounted for 58% of phishing attempts and heavily relied on impersonating authority figures such as CEOs and IT staff, representing 89% of these attacks. Techniques like URL redirection and harmful attachments disguised as critical documents have increased, underscoring the need for robust cyber security measures and employee awareness, especially approaching the holiday season.
This Nasty Android Trojan is Hijacking Calls to Your Bank and Sending Them to Hackers
A recent report highlights a sophisticated threat from the Android-based FakeCall trojan, which intercepts sensitive calls by replacing the phone’s default dialler. This malicious software enables hackers to hijack both incoming and outgoing calls, allowing them to impersonate bank staff and gather sensitive data from unsuspecting users. FakeCall is distributed through malicious apps that exploit Android’s accessibility features. Since its detection in 2022, FakeCall has expanded its reach, now able to mimic over 20 financial organisations. This trojan's continuous development, including screen streaming and screenshot capabilities, points to its evolving potency.
What Military Wargames Can Teach About Cyber Security
Tabletop wargaming has become an essential tool in cyber security, helping organisations prepare for the swift, critical decisions required in the first 24-48 hours of a ransomware attack. Despite the widespread use of technologies to prevent cyber attacks, 2024 has seen an increase in ransomware and data breaches, exposing gaps in many companies' response capabilities. By simulating realistic ransomware scenarios, tabletop exercises enable organisations to stress-test response strategies, address compliance gaps, and refine their disaster recovery plans. This hands-on approach enhances organisational resilience, ensuring leadership and cross-functional teams are equipped for effective incident response and secure recovery. Black Arrow Cyber Consulting provides proctored tabletop cyber incident response exercises, enabling firms to better handle and recover from cyber incidents.
Businesses Expect Cyber Threats to Rise, but Aren’t Ready for Them
Recent research indicates UK businesses are increasingly concerned about cyber threats, with 75% of companies reporting a rise in attempted attacks and nearly 40% experiencing a successful breach. Despite these concerns, only 35% of leaders feel adequately prepared to handle cyber incidents. This gap between awareness and readiness highlights the need for robust, proactive security measures, especially as the UK emerges as the most targeted country in Europe. As organisations recognise the strategic value of cyber security, embedding it into decision-making becomes essential to protect against evolving digital risks and ensure future resilience.
The Overlooked Importance of Identifying the Riskiest Users
Reach Security highlights the significance of identifying and managing the riskiest users within an organisation. Their findings indicate that 80% to 90% of cyber security threats are linked to just 3% to 5% of users, with 20% of these high-risk individuals changing each month. Implementing a "see one, do one, teach one" model, similar to healthcare’s incremental learning, can empower high-risk users to understand and mitigate specific threats. This approach helps organisations allocate resources more effectively, reduce dependency on numerous security tools, and foster a more resilient cyber security culture by enabling high-risk users to act as advocates within the organisation.
Hackers Targeted a $12 Billion Cyber Security Company with a Deepfake of Its CEO. Here's Why Small Details Made It Unsuccessful.
A recent incident involving $12 billion cyber security firm Wiz highlights the growing threat of deepfake scams targeting top executives. Hackers attempted to use an audio deepfake of Wiz’s CEO, Assaf Rappaport, to steal employee credentials, aiming to access the firm’s internal systems and data. The attempt failed because employees recognised the CEO’s distinct speech patterns. Deepfake scams are increasingly sophisticated, with recent reports indicating that half of global companies have faced such attacks, and 66% of business leaders see deepfakes as a serious risk to their organisations.
Small Businesses Boosting Cyber Security as Threats Grow
The Identity Theft Resource Center’s latest report highlights that small businesses are increasingly bolstering their cyber security efforts in response to growing identity-related cyber attacks. Over 80% of small businesses reported experiencing a cyber attack or data breach in the past year with financial losses exceeding $500,000, in some cases doubling. In response, many small businesses are ramping up investment in security tools, staff training, and vendor checks. Additionally, as new state privacy laws emerge, over 75% of small business leaders express concern about compliance, spurring increased focus on data protection practices.
The Rise of the vCISO: From Niche to Necessity?
The rise of virtual Chief Information Security Officers (vCISOs) highlights a shift in cyber security for small and medium-sized businesses (SMBs). With cyber threats evolving rapidly, vCISOs offer flexible, high-level security expertise that strengthens defences while remaining cost-effective. vCISOs help organisations navigate complex regulatory requirements and manage emerging technologies, such as IoT and machine learning, ensuring a tailored security approach that promotes resilience and business growth. Speak to Black Arrow about our fully scalable and flexible vCISO service to help organisations of all sizes and sectors.
Five Eyes Agencies Offer Security Advice for Small Businesses
The Five Eyes alliance, composed of intelligence agencies from the US, UK, Canada, Australia, and New Zealand, has issued new security guidelines to support small businesses, especially tech firms, in defending against cyber attacks. These guidelines focus on safeguarding intellectual property from sophisticated state-backed actors, such as China, as well as criminal groups and competitors. Recommendations include appointing dedicated security managers, keeping a comprehensive asset inventory, and managing data access with third-party partners. This coordinated effort aims to strengthen business security globally, reducing vulnerabilities across both private and public sectors.
Sources:
https://www.ft.com/content/8aca741e-6448-4511-a54d-64f3a97747b1
https://www.silicon.co.uk/security/microsoft-aws-attacks-russia-586762
https://securitybrief.co.nz/story/business-email-compromise-scams-dominate-q3-2024-threats
https://www.techradar.com/pro/businesses-expect-cyber-threats-to-rise-but-arent-ready-for-them
https://securityboulevard.com/2024/10/small-businesses-boosting-cybersecurity-as-threats-grow-itrc/
https://www.csoonline.com/article/3595617/the-rise-of-the-vciso-from-niche-to-necessity.html
https://www.scworld.com/news/five-eyes-agencies-offers-security-advice-for-small-businesses
Governance, Risk and Compliance
The 10 biggest issues CISOs and cyber teams face today | CSO Online
Businesses expect cyber threats to rise, but aren’t ready for them | TechRadar
Most companies are bracing for a cyber attack within a year
For a Stronger Security Culture, Replace Sticks With Carrots
The rise of the vCISO: From niche to necessity? | CSO Online
Security outsourcing on the rise as CISOs seek cyber relief | CSO Online
Small Businesses Boosting Cyber Security as Threats Grow: ITRC - Security Boulevard
The State of Cyber Security: Challenges, Priorities and Insights - Infosecurity Magazine
CISOs as Organisational Bridge Builders for Cyber Security Culture | HackerNoon
13 Cyber Crime Facts That Will Give You Chills | HackerNoon
A Halloween Haunting: Unveiling Cyber Security’s Scary Stats
Terrifying Trends in the 2024 Cyber Threat Landscape - Security Boulevard
Spooky Cyber Stats and Trends in Time for Halloween
Five Eyes agencies offer security advice for small businesses | SC Media
Security priorities emphasize CISO role on the rise | CSO Online
Three quarters of businesses report rise in cyber attacks
Is Your Business Truly Safe From Risk? | Entrepreneur
What Military Wargames Can Teach Us About Cyber Security
NCSC warns of gap between threats and defence capabilities
99% of CISOs work extra hours every week - Help Net Security
How CIOs and CISOs can partner to improve workforce productivity and security | CIO
The Power of Proactive Risk Assessments in Cyber Security - Security Boulevard
Threats
Ransomware, Extortion and Destructive Attacks
Black Basta ransomware poses as IT support on Microsoft Teams to breach networks
In legal first, Japan convicts man of abusing AI to generate ransomware | Malay Mail
Black Basta Ransomware Operators Using Microsoft Teams To Breach Organisations
Fog ransomware targets SonicWall VPNs to breach corporate networks
Patched SonicWall critical vulnerability still used in several ransomware attacks | CSO Online
Black Basta operators phish employees via Microsoft Teams - Help Net Security
North Korean govt hackers linked to Play ransomware attack
Three common privilege access mistakes that can lead to a ransomware incident | SC Media
Russia sentences REvil ransomware members to over 4 years in prison
Massive PSAUX ransomware attack targets 22,000 CyberPanel instances
REvil convictions unlikely to curb Russian cyber crime | TechTarget
Ransomware hits web hosting servers via vulnerable CyberPanel instances - Help Net Security
The ransomware negotiation playbook adds new chapters | CSO Online
Ransomware Victims
OnePoint Patient Care Data Breach Exposes 795,000 Records
Atende refused to pay the ransom, and now pays the price | CSO Online
Interbank confirms data breach following failed extortion, data leak
Ransomware hits web hosting servers via vulnerable CyberPanel instances - Help Net Security
Phishing & Email Based Attacks
Cyber Scams & Why We Fall for Them - Security Boulevard
BEC cyber attacks have the highest financial impact - Digital Journal
Business Email Compromise scams dominate Q3 2024 threats
The Weapon of Choice of Cyber Criminals: BEC Impersonation
Spoof Eventbrite phishing emails look to lure in victims in major attack | TechRadar
Threat actors are stepping up their tactics to bypass email protections - Help Net Security
Black Basta operators phish employees via Microsoft Teams - Help Net Security
Phishers reach targets via Eventbrite services - Help Net Security
Spooky Spam, Scary Scams: Halloween Threats Rise - Security Boulevard
Microsoft Warns of Russian Spear-Phishing Attacks Targeting Over 100 Organisations - SecurityWeek
Russian Hackers Pose as Microsoft Employees in Email Phishing Attacks
Facebook Businesses Targeted in Infostealer Phishing Campaign
Cyber criminals are leveraging big retail names in attacks this holiday season | TechRadar
Over a thousand online shops hacked to show fake product listings
Russian spies using remote desktop protocol files to phish • The Register
New Xiu Gou Phishing Kit Targets US, Other Countries with Mascot - Infosecurity Magazine
Hackers are swiping cookies to bypass email security, FBI says - UPI.com
APT29 Spearphishing Campaign Targets Thousands with RDP Files - Infosecurity Magazine
German MPs and their staff fail simple phishing attack test | Tom's Hardware
Russia Is Targeting US Officials in Email Phishing Campaign: Microsoft - Bloomberg
Ukraine Warns of Mass Phishing Campaign Targeting Citizens Data - Infosecurity Magazine
Business Email Compromise (BEC)/Email Account Compromise (EAC)
BEC cyber attacks have the highest financial impact - Digital Journal
Business email compromise scams dominate Q3 2024 threats
The Weapon of Choice of Cyber Criminals: BEC Impersonation
Phishers reach targets via Eventbrite services - Help Net Security
AI-Powered BEC Scams Zero in on Manufacturers - Infosecurity Magazine
Other Social Engineering
Cyber Scams & Why We Fall for Them - Security Boulevard
BEC cyber attacks have the highest financial impact - Digital Journal
Banks and regulators warn of rise in ‘quishing’ QR code scams
Hackers Sent a Deepfake of Wiz CEO to Dozens of Employees | Entrepreneur
Fraudsters revive old tactics mixed with modern technology - Help Net Security
How Hackers Exploit Google To Target You
Mishing in Motion: Uncovering the Evolving Functionality of FakeCall Malware - Zimperium
Artificial Intelligence
In legal first, Japan convicts man of abusing AI to generate ransomware | Malay Mail
Hackers Sent a Deepfake of Wiz CEO to Dozens of Employees | Entrepreneur
Mozilla: ChatGPT Can Be Manipulated Using Hex Code
AI Cyber Attacks Rise but Businesses Still Lack Insurance - Security Boulevard
Future capabilities of AI-powered threats
How artificial intelligence is lowering the barrier to cyber crime
Trust and risk in the AI era - Help Net Security
White House Issues New Directive on AI and National Security | UC Berkeley School of Information
Apple is challenging hackers to break into the company's servers | Fortune
Regulators Combat Deepfakes With Anti-Fraud Rules
80 percent believe cyber security skills will be vital in AI environments
2FA/MFA
New Windows Warning As Hacker Breaks Google Chrome 2FA Security Encryption
Malware
New Windows Driver Signature bypass allows kernel rootkit installs
Police hacks, disrupts Redline, Meta infostealer operations - Help Net Security
'All servers' for Redline and Meta infostealers hacked by Dutch police and FBI
Malvertising Campaign Hijacks Facebook Accounts to Spread SYS01stealer Malware
New Xiu Gou Phishing Kit Targets US, Other Countries with Mascot - Infosecurity Magazine
BeaverTail Malware Resurfaces in Malicious npm Packages Targeting Developers
Kremlin-backed hackers have new Windows and Android malware to foist on Ukrainian foes
Why Wiping Your Hard Drive Doesn't Always Remove Malware
Mishing in Motion: Uncovering the Evolving Functionality of FakeCall Malware - Zimperium
Government Sector Suffers 236% Surge in Malware Attacks - Infosecurity Magazine
Bots/Botnets
Microsoft: Chinese hackers use Quad7 botnet to steal credentials
Mobile
Macron's bodyguards show his location by sharing Strava data • The Register
Google Warns Of New Android And Windows Cyber Attack—1 Thing Stops It
Android malware "FakeCall" now reroutes bank calls to attackers
These Samsung phones are at risk for a big security vulnerability | Digital Trends
Russia Targets Ukraine Army via Spoofed Recruitment App
Denial of Service/DoS/DDoS
DDoS attacks surge to unprecedented levels, bombarding servers with 4.2Tbps | Cybernews
Is DDoS being left out in the cold by regulations? | TechFinitive
Russia arrests hacker accused of preventing electronic voting during local election
Internet of Things – IoT
Government Warns Foreign Tech In Cars Is Vulnerable To Hackers, Proposes Ban
IoT needs more respect for its consumers, creations, and itself - Help Net Security
Hackers target critical zero-day vulnerability in PTZ cameras
Data Breaches/Leaks
Free, France’s second largest ISP, confirms data breach after leak
ICO: 55% of UK Adults Have Had Data Lost or Stolen - Infosecurity Magazine
Hacker claims to have data linked to 19 million French mobile and internet customers | ITPro
Over 80% of US Small Businesses Have Been Breached - Infosecurity Magazine
OnePoint Patient Care Data Breach Exposes 795,000 Records
Cyber security Breaches Survey 2024: Impact of Cyber Crime | SC Media UK
Combatting Human Error: How To Safeguard Your Business Against Costly Data Breaches
Organised Crime & Criminal Actors
Russia sentences REvil ransomware members to over 4 years in prison
How artificial intelligence is lowering the barrier to cyber crime
REvil convictions unlikely to curb Russian cyber crime | TechTarget
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Insider Risk and Insider Threats
Ex-Disney techie arrested for potentially deadly menu hacks • The Register
The Overlooked Importance of Identifying Riskiest Users
Combatting Human Error: How To Safeguard Your Business Against Costly Data Breaches
Insider threat hunting best practices and tools | TechTarget
Insurance
AI Cyber Attacks Rise but Businesses Still Lack Insurance - Security Boulevard
Supply Chain and Third Parties
Third-Party Identities: The Weakest Link in Your Cyber Security Supply Chain
How the NIS2 Directive Impacts Supply Chain Cyber Security
Cloud/SaaS
AWS CDK flaw exposed accounts to full takeover • The Register
Black Basta Ransomware Operators Using Microsoft Teams To Breach Organisations
Adversarial groups adapt to exploit systems in new ways - Help Net Security
The SaaS Governance Gap | Grip Security - Security Boulevard
NIS2 Arrives with Major Changes to EU SaaS Cyber Security - Security Boulevard
What the CrowdStrike outage teaches us about cloud security | SC Media
China's 'Evasive Panda' APT Debuts High-End Cloud Hijacking
Black Basta operators phish employees via Microsoft Teams - Help Net Security
Hackers find 15,000 credentials by scanning for git configuration | CyberScoop
Chinese Hackers Use CloudScout Toolset to Steal Session Cookies from Cloud Services
New Details Emerge About Expansive TeamTNT Attacks | MSSP Alert
Outages
Delta Sues CrowdStrike Over ‘Catastrophic’ Software Glitch – BNN Bloomberg
What the CrowdStrike outage teaches us about cloud security | SC Media
When Cyber Security Tools Backfire
The Case Against Abandoning CrowdStrike Post-Outage
Identity and Access Management
Third-Party Identities: The Weakest Link in Your Cyber Security Supply Chain
Three common privilege access mistakes that can lead to a ransomware incident | SC Media
Encryption
Quantum Computing and Cyber Security – Preparing for a New Age of Threats | MSSP Alert
How to achieve crypto-agility and future-proof security | TechTarget
Linux and Open Source
Admins Spring into action over latest open source vuln • The Register
Hardening Linux Servers Against Threats and Attacks | Linux Journal
Passwords, Credential Stuffing & Brute Force Attacks
The state of password security in 2024 - Help Net Security
Hackers find 15,000 credentials by scanning for git configuration | CyberScoop
Microsoft: Chinese hackers use Quad7 botnet to steal credentials
Social Media
Malvertising Campaign Hijacks Facebook Accounts to Spread SYS01stealer Malware
Stolen credit cards up for grabs on Meta’s Threads • The Register
Facebook Businesses Targeted in Infostealer Phishing Campaign
Malicious Ads Are Flooding Facebook: Here's How to Stay Safe
Malvertising
Malvertising Campaign Hijacks Facebook Accounts to Spread SYS01stealer Malware
Malicious Ads Are Flooding Facebook: Here's How to Stay Safe
Training, Education and Awareness
For a Stronger Security Culture, Replace Sticks With Carrots
3 crucial considerations for your security awareness and training program | CSO Online
Regulations, Fines and Legislation
NIS2 Arrives with Major Changes to EU SaaS Cyber Security - Security Boulevard
NIS2 directive impact | Professional Security Magazine
NIS2 Compliance Puts Strain on Business Budgets - Infosecurity Magazine
Cyber Security | UK Regulatory Outlook October 2024 - Osborne Clarke | Osborne Clarke
UK organisations scrambling to divert funds for NIS2 compliance spending | ITPro
The SEC is Cracking Down on Misleading Cyber Security Disclosure | Fenwick & West LLP - JDSupra
Industry trade groups still have ‘concerns’ with cyber reporting mandate | CyberScoop
Is DDoS being left out in the cold by regulations? | TechFinitive
Regulators Combat Deepfakes With Anti-Fraud Rules
Models, Frameworks and Standards
NIS2 Arrives with Major Changes to EU SaaS Cyber Security - Security Boulevard
NIS2 directive impact | Professional Security Magazine
UK organisations scrambling to divert funds for NIS2 compliance spending | ITPro
Backup and Recovery
Is Backup Testing Part of Your Security Strategy? | HackerNoon
Data Protection
ICO: 55% of UK Adults Have Had Data Lost or Stolen - Infosecurity Magazine
Careers, Working in Cyber and Information Security
99% of CISOs work extra hours every week - Help Net Security
Mastering Cyber Security: A Comprehensive Guide to Self-Learning - Security Boulevard
Aldi managers paid more than government cyber security expert
UK needs cyber security professionals, but won't pay up • The Register
80 percent believe cyber security skills will be vital in AI environments
The Government Wants You to Fight Cyber Crime. Do You Have What It Takes?
Cyber security Awareness Month: 5 new AI skills cyber pros need
Law Enforcement Action and Take Downs
In legal first, Japan convicts man of abusing AI to generate ransomware | Malay Mail
Alexander McCartney: Catfish killer brought down by one phone call - BBC News
Police hacks, disrupts Redline, Meta infostealer operations - Help Net Security
'All servers' for Redline and Meta infostealers hacked by Dutch police and FBI
Two notorious infostealer malware operations were just knocked offline | ITPro
FBI has conducted more than 30 disruption operations in 2024 | CyberScoop
REvil convictions unlikely to curb Russian cyber crime | TechTarget
Russia arrests hacker accused of preventing electronic voting during local election
Misinformation, Disinformation and Propaganda
Senator says domain reg firms aiding Russian disinfo spread • The Register
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
What can businesses learn from the rise of cyber espionage?
Nation State Actors
Cyber threats surge from state-sponsored and criminal actors
China
China's 'Evasive Panda' APT Debuts High-End Cloud Hijacking
US says Chinese hackers breached multiple telecom providers
Microsoft: Chinese hackers use Quad7 botnet to steal credentials
Government Warns Foreign Tech In Cars Is Vulnerable To Hackers, Proposes Ban
Chinese Hackers Use CloudScout Toolset to Steal Session Cookies from Cloud Services
Inside Sophos' 5-Year War With the Chinese Hackers Hijacking Its Devices | WIRED
Chinese hackers targeted phones used by Trump and Vance, New York Times reports - The Hindu
Donald Trump and JD Vance potential targets of China cyber attack - BBC News
Chinese Hackers Reportedly Targeted Trump, Vance Phones
China's Elite Cyber Corps Hone Skills on Virtual Battlefields
Russia and China-linked state hackers intensify attacks on Netherlands, security officials warn
Beijing claims its found spy devices at sea • The Register
Canada Faces 'Second-to-None' PRC-Backed Threat Actors
Russia
Russia Carrying Out Targeted Attacks In UK, Microsoft Warns
Amazon seizes domains used in rogue Remote Desktop campaign to steal data
New Cyber Attack Warning—Confirming You Are Not A Robot Can Be Dangerous
APT29 Spearphishing Campaign Targets Thousands with RDP Files - Infosecurity Magazine
Google Warns Of New Android And Windows Cyber Attack—1 Thing Stops It
Microsoft Warns of Russian Spear-Phishing Attacks Targeting Over 100 Organisations - SecurityWeek
Russian Hackers Pose as Microsoft Employees in Email Phishing Attacks
Russian spies using remote desktop protocol files to phish • The Register
Senator says domain reg firms aiding Russian disinfo spread • The Register
Russia’s ‘Midnight Blizzard’ hackers target government workers in novel info-stealing campaign
Kremlin-backed hackers have new Windows and Android malware to foist on Ukrainian foes
Sweden and Norway rethink cashless society plans over Russia security fears | Sweden | The Guardian
Pro-Russia hackers claim Greater Manchester council cyber attacks - BBC News
Kremlin-linked hackers target Ukraine’s state, military agencies in new espionage campaign
Russia and China-linked state hackers intensify attacks on Netherlands, security officials warn
Russia Targets Ukraine Army via Spoofed Recruitment App
Russia Is Targeting US Officials in Email Phishing Campaign: Microsoft - Bloomberg
Ukraine Warns of Mass Phishing Campaign Targeting Citizens Data - Infosecurity Magazine
REvil convictions unlikely to curb Russian cyber crime | TechTarget
Russia sentences REvil ransomware members to over 4 years in prison
Iran
Cyber threats surge from state-sponsored and criminal actors
Iran Hackers Peddle Stolen Trump Emails
North Korea
Cyber threats surge from state-sponsored and criminal actors
Tools and Controls
For a Stronger Security Culture, Replace Sticks With Carrots
Threat actors are stepping up their tactics to bypass email protections - Help Net Security
The Overlooked Importance of Identifying Riskiest Users
Is Backup Testing Part of Your Security Strategy? | HackerNoon
The SaaS Governance Gap | Grip Security - Security Boulevard
Proactive and responsible disclosure | Professional Security Magazine
When Cyber Security Tools Backfire
What Military Wargames Can Teach Us About Cyber Security
Attack surface management: The key to securing expanding digital frontiers | SC Media
New report reveals persistent API security breaches risk
Hackers are swiping cookies to bypass email security, FBI says - UPI.com
US, Australia Release New Security Guide for Software Makers - SecurityWeek
More Than Just a Corporate Wiki? How Threat Actors are Exploiting Confluence - Security Boulevard
Why cyber tools fail SOC teams - Help Net Security
Into the Wild: Using Public Data for Cyber Risk Hunting
API Security Matters: The Risks of Turning a Blind Eye - SecurityWeek
Designing a Future-focused Cyber Security Investment Strategy - SecurityWeek
The Power of Proactive Risk Assessments in Cyber Security - Security Boulevard
Risk hunting: A proactive approach to cyber threats - Help Net Security
Top 10 Cyber Security Metrics and KPIs | Mimecast
Apple opens Private Cloud Compute to public scrutiny • The Register
German MPs and their staff fail simple phishing attack test | Tom's Hardware
Insider threat hunting best practices and tools | TechTarget
How IT leaders can assess “secure-by-design” software claims | CIO
Companies are spending barely any IT budget on security | TechRadar
Reports Published in the Last Week
Other News
Small Businesses Boosting Cyber Security as Threats Grow: ITRC - Security Boulevard
13 Cyber Crime Facts That Will Give You Chills | HackerNoon
Spooky Cyber Stats and Trends in Time for Halloween
Five Eyes Agencies Launch Startup Security Initiative - Infosecurity Magazine
Five Eyes tell tech startups to take infosec seriously • The Register
Terrifying Trends in the 2024 Cyber Threat Landscape - Security Boulevard
Stop being a sitting target for cyber threats! | TechRadar
Healthcare Breaches Costliest for 12 Years Running, Hit New $10.1M Record High
Irish businesses now facing more than one cyber attack per week
Funding crisis ‘puts universities at higher risk of cyber attacks’
CISA Launches First International Cyber Security Plan - Infosecurity Magazine
Lateral Movement in Recent Cyber Security Breaches - Security Boulevard
Government Sector Suffers 236% Surge in Malware Attacks - Infosecurity Magazine
US, Australia Release New Security Guide for Software Makers - SecurityWeek
Proactive & Preventative Cyber Defence - DevX
OT security becoming a mainstream concern | CSO Online
Microsoft delays its troubled AI-powered Recall feature yet again | ZDNET
Vulnerability Management
Many financial firms have high-severity software security flaws over a year old | TechRadar
Put End-of-Life Software to Rest
Microsoft Update Warning—400 Million Windows PCs Now At Risk
A Sherlock Holmes Approach to Cyber Security: Eliminate the Impossible with Exposure Validation
Microsoft will charge Windows 10 users $30 per year for security updates | Tom's Hardware
Vulnerabilities
Apple Patches Over 70 Vulnerabilities Across iOS, macOS, Other Products - SecurityWeek
New tool bypasses Google Chrome’s new cookie encryption system
AWS CDK flaw exposed accounts to full takeover • The Register
New Cisco ASA and FTD features block VPN brute-force password attacks
New Windows Driver Signature bypass allows kernel rootkit installs
Fog ransomware targets SonicWall VPNs to breach corporate networks
Patched SonicWall critical vulnerability still used in several ransomware attacks | CSO Online
Researchers Uncover OS Downgrade Vulnerability Targeting Microsoft Windows Kernel
New Research Reveals Spectre Vulnerability Persists in Latest AMD and Intel Processors
Wi-Fi Alliance test suite has a worrying security flaw | TechRadar
New Windows Warning As Hacker Breaks Google Chrome 2FA Security Encryption
Synology, QNAP, TrueNAS Address Vulnerabilities Exploited at Pwn2Own Ireland - SecurityWeek
Google Patches Critical Chrome Vulnerability Reported by Apple - SecurityWeek
LiteSpeed Cache Plugin Vulnerability Poses Admin Access Risk - Infosecurity Magazine
Admins Spring into action over latest open source vuln • The Register
Opera Browser Fixes Big Security Hole That Could Have Exposed Your Information
These Samsung phones are at risk for a big security vulnerability | Digital Trends
CVE-2024-9680 – Mozilla Firefox Security Vulnerability – October 2024 - Security Boulevard
Hackers target critical zero-day vulnerability in PTZ cameras
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Intelligence Briefing 25 October 2024
Black Arrow Cyber Threat Intelligence Briefing 25 October 2024:
-Overconfidence in Cyber Security: A Hidden Risk
-Gallagher Re Study Links Cyber Security Gaps to Higher Insurance Claims
-AI and Deepfakes Fuel Phishing Scams, Making Detection Harder
-AI-Generated Cyber Threats Have C-Suite Leaders on Edge
-The Single Biggest Vulnerability in Your Cyber Security Is You
-Why Cyber Security Acumen Matters in the C-Suite
-Cyber Incidents Surge, Damaging Brand Trust and Business Relationships – Hiscox
-Cyber Resilience vs Cyber Security: Which is More Critical?
-Phishing Attacks Snare Security and IT Leaders
-CISO Role Gaining Influence as 20% Report Directly to CEOs, Finds Survey
-Threat Actors Are Exploiting Vulnerabilities Faster Than Ever
-Employees Lack Fundamental Security Awareness
Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Overconfidence in Cyber Security: A Hidden Risk
Organisations often assume that adding more cyber security tools equates to better protection, yet this overconfidence can lead to blind spots. Companies with fragmented solutions are 3.5 times more likely to face major security incidents. The Uber data breach in 2022 illustrated how alert fatigue—where excessive notifications overwhelm teams—can lead to overlooked threats, even with advanced tools in place. To counter this, experts recommend streamlining cyber security systems, prioritising critical alerts, and regularly auditing security processes. Building a resilient defence isn’t about quantity but the strategic use of technology paired with continuous training and monitoring.
Gallagher Re Study Links Cyber Security Gaps to Higher Insurance Claims
Gallagher Re's recent study, using data from Bitsight and its own cyber incident records, highlights that gaps in cyber security increase the risk of incidents and insurance claims. Organisations with larger cyber footprints, such as extensive IP address networks, are particularly vulnerable, pointing to a need for insurers to consider technographic data alongside traditional metrics. The study suggests that targeted use of external scanning data could help insurers lower loss ratios by up to 16.4%, focusing on the most damaging risks. Basic cyber hygiene, including rapid patching and endpoint management, remains essential for mitigating incidents and reducing potential claims.
AI and Deepfakes Fuel Phishing Scams, Making Detection Harder
Teleport's study highlights that AI-powered impersonation and deepfake-driven phishing are now the hardest cyber threats for businesses to defend against, with 52% of respondents marking these as particularly challenging. AI has enabled cyber criminals to create highly convincing phishing scams targeting credentials, significantly lowering both the cost and skill needed to launch attacks. Despite the adoption of AI tools by 68% of organisations to combat these threats, overconfidence in AI's protective capabilities may be risky.
AI-Generated Cyber Threats Have C-Suite Leaders on Edge
AI-driven cyber attacks are becoming a major concern for senior executives, as sophisticated deepfakes and AI phishing scams pose evolving risks. A recent gathering of over 100 cyber security leaders in Silicon Valley highlighted the growing difficulty in combating AI-powered phishing attacks, with three-quarters of surveyed Fortune 500 security officers reporting significant challenges. Additionally, over half noted the increasing prevalence of deepfake audio and video impersonations. The threat is amplified by AI tools that often lack proper data governance, potentially exposing organisations to heightened risks from third-party suppliers, with predicted fraud losses in the US expected to climb to $40 billion by 2027.
The Single Biggest Vulnerability in Your Cyber Security Is You
A recent report highlights that human error accounts for 68% of successful cyber attacks, indicating it as a significant vulnerability within cyber security. Despite advances in technical defences, human-centric errors, such as skills-based and knowledge-based mistakes, persist as weak points. Current cyber security education and policy efforts focus largely on technical defences, but often overlook the psychological aspects of behaviour. Experts suggest that minimising cognitive load, fostering a positive cyber security culture, and adopting long-term strategies for behavioural change are crucial to reducing human error and building a more resilient cyber security posture.
Why Cyber Security Acumen Matters in the C-Suite
As generative AI and sophisticated cyber threats rise, the need for cyber security expertise within the C-suite has become critical. Effective leaders must balance AI-driven innovations with a strong cyber security framework to prevent potential breaches. This alignment is essential for strategic decision-making, resource allocation, and collaborative crisis response. Boards and CEOs who understand these risks are better positioned to safeguard data, intellectual property, and reputation. Regulatory expectations are increasing, and companies that prioritise cyber security acumen are better prepared to handle compliance challenges and adapt swiftly to evolving threats.
Cyber Incidents Surge, Damaging Brand Trust and Business Relationships – Hiscox
The latest Hiscox Cyber Readiness Report reveals a surge in cyber incidents, with 70% of UK organisations and 67% globally experiencing increased attacks over the past year. This rise in cyber threats is eroding brand trust and impacting business relationships. Nearly half of affected firms face challenges in attracting new customers, a sharp rise from 20% last year, with 43% reporting a loss of existing customers. Additionally, many organisations have integrated Generative AI, with over half acknowledging heightened cyber risk. Yet, a lack of expertise remains, with 37% of UK businesses underprepared to address these evolving risks.
Cyber Resilience vs Cyber Security: Which is More Critical?
Focusing on cyber resilience is increasingly essential for organisations today. Unlike traditional cyber security, which aims to prevent breaches, cyber resilience emphasises an organisation’s ability to continue operating amidst an incident. By adopting a culture of resilience, organisations can safeguard their operations, data, and reputation—even in the face of a cyber attack. Investing in resilience, beginning with people and culture, offers a strong return as it prepares businesses to adapt quickly to adversities. Moreover, in an era of heightened threats, cyber resilience is becoming a competitive advantage, enhancing trust with customers, stakeholders, and insurers.
Phishing Attacks Snare Security and IT Leaders
A recent survey by Arctic Wolf and Sapio Research highlights persistent vulnerabilities in cyber security culture, despite IT leaders’ high confidence levels. While 80% of leaders feel prepared against phishing, nearly two-thirds admitted to clicking on phishing links themselves. Moreover, 36% of IT leaders have bypassed their own security protocols, exposing organisations to heightened risks. In addition, 68% of security professionals reuse passwords, a significant lapse in cyber hygiene. To address these issues, experts advocate for personalised, behaviour-based training and a proactive reporting culture. Only 60% of firms have adopted AI policies, with just 29% of end users aware of these policies, underscoring a need for clearer communication.
CISO Role Gaining Influence as 20% Report Directly to CEOs, Finds Survey
A recent Deloitte Global survey highlights the increasing strategic importance of cyber security in business, with 20% of chief information security officers (CISOs) now reporting directly to CEOs. Covering responses from nearly 1,200 cyber leaders worldwide, the report shows CISOs are evolving from technical experts to key advisers on cross-business risk and resilience, a role intensified by the rise in AI-driven cyber threats. High-performing organisations lead in integrating AI into cyber defence, aiming for 27% better outcomes. Nearly 60% plan to increase cyber budgets, emphasising the alignment of security initiatives with broader digital investments and strategic growth.
Threat Actors Are Exploiting Vulnerabilities Faster Than Ever
Mandiant’s recent research highlights the urgent need for rapid patching as attackers are now exploiting vulnerabilities within just five days on average, a steep drop from 63 days in 2018. The study, based on 138 vulnerabilities disclosed in 2023, reveals a significant shift toward zero-day exploits, now outpacing N-day vulnerabilities. Zero-day vulnerabilities are unknown to vendors and lack available patches at the time of disclosure; N-day vulnerabilities are security flaws that have already been publicly disclosed and typically have a patch available but may remain unaddressed on systems, creating opportunities for cyber attacks. The report underscores that while patching is essential, implementation can be slow, particularly across large systems, mobile devices, or critical infrastructure where operational disruptions pose serious risks.
Employees Lack Fundamental Security Awareness
A recent Fortinet survey highlights growing concern among executives regarding employee cyber security awareness, with 70% stating their teams lack essential knowledge – a significant increase from last year. Over 60% expect a rise in employee-targeted cyber attacks leveraging AI. Positively, 80% of organisations are now more open to implementing security awareness initiatives. Nearly half of these leaders deliver training content quarterly, with phishing prevention as a top focus. The findings underline the necessity of a strong first line of defence, with targeted campaigns and accessible training vital to enhancing organisational cyber resilience.
Sources:
https://www.helpnetsecurity.com/2024/10/24/ai-impersonation-cyberattack-vector/
https://fortune.com/2024/10/24/ai-generated-cyber-threats-c-suite-cfo-leaders-edge/
https://www.sciencealert.com/the-single-biggest-vulnerability-in-your-cyber-security-is-you
https://www.darkreading.com/vulnerabilities-threats/why-cybersecurity-acumen-matters-c-suite
https://betanews.com/2024/10/18/cyber-resilience-vs-cybersecurity-which-is-more-critical/
https://securityboulevard.com/2024/10/phishing-attacks-snare-security-it-leaders/
https://www.techrepublic.com/article/threat-actors-mandiant-report-2024/
https://betanews.com/2024/10/23/employees-lack-fundamental-security-awareness/
Governance, Risk and Compliance
CISOs Concerned Over Growing Demands of Role - Security Boulevard
Lack of investment leaving firms open to cyber attack - PwC – The Irish Times
AI-generated cyber threats have C-suite leaders on edge | Fortune
Poor MFA, identity attacks dominate threat landscape in Q3 2024 | SC Media
Why Cyber Security Acumen Matters in the C-Suite
Overconfidence in Cyber Security: A Hidden Risk
Call for cyber security sea change as world looks to meet rising threats
Joe Sullivan: CEOs must be held accountable for security too | TechTarget
Cyber resilience vs. cybersecurity: Which is more critical? (betanews.com)
CISOs: Throwing Cash at Tools Isn't Helping Detect Breaches (darkreading.com)
CISO role gaining influence as 20% report directly to CEOs, finds survey
CISOs respond: 49% of CISOs plan to leave role without industry action | Security Magazine
In 2025 Security And Risk Pros Will Brace For Regulations And Resilience (forbes.com)
Gartner's 2025 tech trends show how your business needs to adapt - and fast | ZDNET
Effective strategies for measuring and testing cyber resilience - Help Net Security
Why strong cyber security means we must reduce complexity | World Economic Forum
Is the future of tech roles fractional? - BusinessCloud
Achieving peak cyber resilience - Help Net Security
68% of directors don't have a board-approved AI policy - IoD Ireland
Board Members Should Review Cyber Risk Disclosure Procedures Following SEC Enforcement
Best Cyber Security Metrics to Use in the Boardroom | Kovrr - Security Boulevard
CISO Insights: 10 modern capabilities to revamp your security | Fastly
What CIOs Must Consider With Sophos Buying Secureworks
Unclear pricing for GRC tools creates market confusion - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
The evolution of cyber crime: How ransomware became the weapon of choice | TechRadar
Healthcare Sees 300% Surge in Ransomware Attacks
ESET partner breached to send data wipers to Israeli orgs (bleepingcomputer.com)
Ransomware Rising – Understanding, Preventing and Surviving Cyber Extortion - Security Boulevard
Akira is encrypting again after abandoning double extortion • The Register
Ransomware Gangs Use LockBit's Fame to Intimidate Victims in Latest Attacks
NotLockBit: Ransomware Discovery Serves As Wake-Up Call For Mac Users | Tripwire
A Dangerous Alliance: Scattered Spider, RansomHub Join Forces
CISA confirms Veeam vulnerability is being used in ransomware attacks (therecord.media)
NotLockBit Ransomware Can Target macOS Devices - SecurityWeek
New Qilin.B Ransomware Variant Emerges with Improved Encryption and Evasion Tactics
Government is fed up with ransomware payments fueling cyber attacks (cnbc.com)
Has BlackCat returned as Cicada3301? Maybe.
Chinese trader laundered more than $17M for Lazarus Group in 25 hacks (cointelegraph.com)
Ransomware protection: AI and strategies to combat rising threats - SiliconANGLE
Ransomware attacks against healthcare orgs is on the rise, Microsoft says (qz.com)
Ransomware is driving an increase in emergency patient care (cyberscoop.com)
Ransomware's ripples felt across ERs as care suffers • The Register
Russia recommends prison sentence for REvil hackers | SC Media
Are Leaders Ready to Break the Ransomware Cycle - Security Boulevard
What's behind the 51% drop in ransomware attacks? (securityintelligence.com)
Organisations Paying Fewer Ransoms, Building Resilience: Kaseya | MSSP Alert
Ransomware Victims
How the ransomware attack at Change Healthcare went down: A timeline | TechCrunch
Radisson’s Country Inn and Suites Allegedly Hit by Ransomware | MSSP Alert
Ransomware's ripples felt across ERs as care suffers • The Register
Henry Schein discloses data breach a year after ransomware attack
50,000 Files Exposed in Nidec Ransomware Attack - Infosecurity Magazine (infosecurity-magazine.com)
Ransomware gang stoops to new low, targets prominent nonprofit for disabled people (therecord.media)
Spate of ransomware attacks on German-speaking schools hits another in Switzerland
Crypt Ghouls Targets Russian Firms with LockBit 3.0 and Babuk Ransomware Attacks (thehackernews.com)
Phishing & Email Based Attacks
Cyber criminal underground “thriving” as weekly attacks surge by 75% in Q3 2024 | ITPro
Evolving cyber criminal tactics targeting SMBs - Help Net Security
Latrodectus Malware Increasingly Used by Cyber Criminals - SecurityWeek
Bumblebee and Latrodectus Malware Return with Sophisticated Phishing Strategies
Top open source email platform hacked to steal user details | TechRadar
AI and deepfakes fuel phishing scams, making detection harder - Help Net Security
Evolving Email Threats and How to Protect Against Them - IT Security Guru
Unknown threat actors exploit Roundcube Webmail flaw in phishing campaign (securityaffairs.com)
Threat actors increasingly using malicious virtual hard drives in phishing attacks | CSO Online
LinkedIn bots and spear phishers target job seekers | Malwarebytes
75% of US Senate Campaign Websites Fail to Implement DMARC - Infosecurity Magazine
Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans (thehackernews.com)
Why Phishing-Resistant MFA Is No Longer Optional: The Hidden Risks of Legacy MFA
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Evolving cyber criminal tactics targeting SMBs - Help Net Security
Other Social Engineering
Experts warn North Koreans are posing as IT workers in the West
'Pig butchering': How cyber criminals target investors with fake trading apps
LinkedIn bots and spear phishers target job seekers | Malwarebytes
HYPR is latest firm to reveal hiring of fraudulent IT worker overseas | CyberScoop
Artificial Intelligence
AI-generated cyber threats have C-suite leaders on edge | Fortune
55% Of Employees Using AI At Work Have No Training On Its Risks (forbes.com)
Hackers are finding new ways to leverage AI - Help Net Security
OpenAI’s voice API can build AI agents for phone scams • The Register
New Cyber Security Warning As 1,000 Elite Hackers Embrace AI
AI and deepfakes fuel phishing scams, making detection harder - Help Net Security
AI tools are being increasingly abused to launch cyber attacks | TechRadar
AI hack: Do not give chatbots your personal data
Cyber Security Teams Largely Ignored in AI Policy Development - Infosecurity Magazine
This new AI jailbreaking technique lets hackers crack models in just three interactions | ITPro
In 2025 Security And Risk Pros Will Brace For Regulations And Resilience (forbes.com)
The rise of the machines and the growing AI identity attack surface | CSO Online
68% of directors don't have a board-approved AI policy - IoD Ireland
AI-Powered Attacks Flood Retail Websites - Infosecurity Magazine
AI honeypot hit 800K times | Cybernews
CIOs under pressure to deliver AI outcomes faster | CIO
2FA/MFA
Poor MFA, identity attacks dominate threat landscape in Q3 2024 | SC Media
Understanding the Importance of MFA: A Comprehensive Guide - Security Boulevard
QR codes are being hijacked to bypass MFA protections | TechRadar
Why Phishing-Resistant MFA Is No Longer Optional: The Hidden Risks of Legacy MFA
Malware
HM Surf macOS vuln potentially exploited by Adloader malware • The Register
Latrodectus Malware Increasingly Used by Cyber Criminals - SecurityWeek
Bumblebee and Latrodectus Malware Return with Sophisticated Phishing Strategies
Over 6,000 WordPress hacked to install plugins pushing infostealers
Over 10M+ Personal And Corporate Devices Infected By Information Stealers (cybersecuritynews.com)
Modern Malware Is Stealthier Than Older Attacks: This Is How It Stays Hidden
Netskope Reports Possible Bumblebee Loader Resurgence - Infosecurity Magazine
Sneaky Ghostpulse malware loader hides inside PNG pixels • The Register
Hackers infect thousands of WordPress sites with malware plugins | PCWorld
Perfctl malware strikes again via Docker Remote API servers • The Register
'Prometei' Botnet Spreads its Cryptojacker Worldwide (darkreading.com)
Gophish Framework Used in Phishing Campaigns to Deploy Remote Access Trojans (thehackernews.com)
Bots/Botnets
Anti-Bot Services Help Cyber Crooks Bypass Google 'Red Page' (darkreading.com)
'Prometei' Botnet Spreads its Cryptojacker Worldwide (darkreading.com)
Mobile
Google Warns of Samsung Zero-Day Exploited in the Wild - SecurityWeek
Why you should power off your phone at least once a week - according to the NSA | ZDNET
Millions of mobile app users at risk from hardcoded creds • The Register
Location tracking of phones is out of control. Here’s how to fight back. - Ars Technica
Denial of Service/DoS/DDoS
How to detect DDoS attacks | TechTarget
Military Exercises Trigger Russian DDoS Attacks on Japan (govinfosecurity.com)
Russia-Linked Hacktivists Attack Japan's Govt, Ports (darkreading.com)
Data Breaches/Leaks
Internet Archive Breached Again, Hackers Exploited Unrotated API Tokens (cybersecuritynews.com)
Cisco Confirms Security Incident After Hacker Offers to Sell Data - SecurityWeek
Insurance admin Landmark says data breach impacts 800,000 people
Cisco takes DevHub portal offline after hacker publishes stolen data (bleepingcomputer.com)
Henry Schein discloses data breach a year after ransomware attack
Millions affected in major health data breach caused by a missing password | TechRadar
Data Breach Impacts Insurer Johnson and Johnson | MSSP Alert
Omni Family Health Data Breach Impacts 470,000 Individuals - SecurityWeek
Dance Apparel Company Sued After 65,000 Customers' Data Exposed
Organised Crime & Criminal Actors
Cyber criminal underground “thriving” as weekly attacks surge by 75% in Q3 2024 | ITPro
The evolution of cyber crime: How ransomware became the weapon of choice | TechRadar
'Pig butchering': How cyber criminals target investors with fake trading apps
Russia recommends prison sentence for REvil hackers | SC Media
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Cyber Criminals Exploiting Docker API Servers for SRBMiner Crypto Mining Attacks
Chinese trader laundered more than $17M for Lazarus Group in 25 hacks (cointelegraph.com)
'Prometei' Botnet Spreads its Cryptojacker Worldwide (darkreading.com)
Fraudulent DeFi game leveraged in new crypto investor-targeted Lazarus attack | SC Media
Insider Risk and Insider Threats
The Single Biggest Vulnerability in Your Cyber Security Is You : ScienceAlert
The Enemy Within: Navigating the Evolving Landscape of (globenewswire.com)
Fortinet report: 70% of staff lack cyber security awareness
Human error is the weakest link in the cyber security chain. Here are 3 ways to fix it
Insurance
Gallagher leader warns cyber is still an emerging risk | Insurance Times
Facing the uncertainty of cyber insurance claims - Help Net Security
The future of cyber insurance: Meeting the demand for non-attack coverage - Help Net Security
Supply Chain and Third Parties
Can the cyber security industry stop history repeating? | TechRadar
Cloud/SaaS
Think You're Secure? 49% of Enterprises Underestimate SaaS Risks
Microsoft lost some customers' cloud security logs - Help Net Security
Researchers Discover Severe Security Flaws in Major E2EE Cloud Storage Providers (thehackernews.com)
Half of Organisations Have Unmanaged Long-Lived Cloud Credentials - Infosecurity Magazine
Unmanaged Cloud Credentials Pose Risk to Half of Orgs (darkreading.com)
Top open source email platform hacked to steal user details | TechRadar
Navigating the Complexities & Security Risks of Multi-cloud Management
Evolving cloud threats: Insights and recommendations - Help Net Security
Grip Security Releases 2025 SaaS Security Risks Report
Microsoft creates fake Azure tenants to pull phishers into honeypots (bleepingcomputer.com)
Outages
Can the cyber security industry stop history repeating? | TechRadar
Identity and Access Management
Poor MFA, identity attacks dominate threat landscape in Q3 2024 | SC Media
A Comprehensive Guide to Finding Service Accounts in Active Directory
What is step-up authentication & how can it help prevent financial fraud? (businesscloud.co.uk)
Encryption
What NIST's post-quantum cryptography standards mean for data security
How to fend off a quantum computer attack - Help Net Security
Linux and Open Source
Intel, AMD CPUs on Linux impacted by newly disclosed Spectre bypass (bleepingcomputer.com)
Why remove Russian maintainers of Linux kernel? Here's what Torvalds says | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
Half of Organisations Have Unmanaged Long-Lived Cloud Credentials - Infosecurity Magazine
Unmanaged Cloud Credentials Pose Risk to Half of Orgs (darkreading.com)
Top open source email platform hacked to steal user details | TechRadar
Millions of mobile app users at risk from hardcoded creds • The Register
The Key Components For a Secure Password Policy - Infosecurity Magazine (infosecurity-magazine.com)
Cisco fixes bug under exploit in brute-force attacks • The Register
Millions affected in major health data breach caused by a missing password | TechRadar
Social Media
LinkedIn bots and spear phishers target job seekers | Malwarebytes
Irish Watchdog Imposes Record €310 Million Fine on LinkedIn for GDPR Violations
What to Know About Meta’s Facial Recognition Plans | TIME
Training, Education and Awareness
55% Of Employees Using AI At Work Have No Training On Its Risks (forbes.com)
Fortinet report: 70% of staff lack cyber security awareness
Employees lack fundamental security awareness (betanews.com)
Regulations, Fines and Legislation
EU’s NIS2 Directive for cyber security resilience enters full enforcement | CSO Online
How can businesses comply with EU’s new cyber law?
NIS2’s cyber security value spreads beyond its expanded scope | CSO Online
EU’s NIS2 Directive for cyber security resilience enters full enforcement | CSO Online
SEC.gov | SEC Charges Four Companies With Misleading Cyber Disclosures
EU’s NIS 2 enters into force: compliance is now mandatory
SEC charges tech companies for downplaying SolarWinds breaches (bleepingcomputer.com)
Irish Watchdog Imposes Record €310 Million Fine on LinkedIn for GDPR Violations
SEC is Not Accepting Half-Truths - Security Boulevard
UK Government Introduces New Data Governance Legislation - Infosecurity Magazine
SEC SolarWinds Fines a Warning to Organisations, MSSPs | MSSP Alert
Cyber Incident Response Checklist for SEC Compliance | Troutman Pepper - JDSupra
The struggle for software liability: Inside a ‘very, very, very hard problem’ (therecord.media)
In 2025 Security And Risk Pros Will Brace For Regulations And Resilience (forbes.com)
OODA Loop - Board Members Should Review Cyber Risk Disclosure Procedures Following SEC Enforcement
Models, Frameworks and Standards
EU’s NIS2 Directive for cyber security resilience enters full enforcement | CSO Online
How can businesses comply with EU’s new cyber law?
How can businesses comply with EU’s new cyber law?
NIS2’s cyber security value spreads beyond its expanded scope | CSO Online
EU’s NIS 2 enters into force: compliance is now mandatory
EU Adopts Cyber Resilience Act For Connected Devices
What NIST's post-quantum cryptography standards mean for data security
What is DORA – and how can Proton help with compliance? | Proton
Data Protection
Irish Watchdog Imposes Record €310 Million Fine on LinkedIn for GDPR Violations
Careers, Working in Cyber and Information Security
What even is a ‘cyber security profession’?
CISOs Concerned Over Growing Demands of Role - Security Boulevard
Cyber security leaders struggle with job stress (devx.com)
Joe Sullivan: CEOs must be held accountable for security too | TechTarget
CISOs respond: 49% of CISOs plan to leave role without industry action | Security Magazine
Making Cyber Security Accessible For Neurodiverse Talent (darkreading.com)
What's more important when hiring for cyber security roles? - Help Net Security
What I’ve learned in my first 7-ish years in cyber security
Law Enforcement Action and Take Downs
Bumblebee malware returns after recent law enforcement disruption (bleepingcomputer.com)
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
CISA proposes new security requirements for businesses exposed to cyber espionage | CSO Online
Nation State Actors
China
Chinese Nation-State Hackers APT41 Hit Gambling Sector for Financial Gain
Gambling sector subjected to APT41 intrusions | SC Media
Russia
Russian Intelligence Ramps Up Global Cyber Campaign, Says Western Intelligence
Former UK special forces director warns of Russian cyber-security threat - Jersey Evening Post
Russian Trolls Sow US Election Chaos (darkreading.com)
Military Exercises Trigger Russian DDoS Attacks on Japan (govinfosecurity.com)
How Russia’s Spies Hacked the Entire Nation of Georgia – BNN Bloomberg
Russian Strategic Information Attack for Catastrophic Effect
Russia-Linked Hacktivists Attack Japan's Govt, Ports (darkreading.com)
Why remove Russian maintainers of Linux kernel? Here's what Torvalds says | ZDNET
Crypt Ghouls Targets Russian Firms with LockBit 3.0 and Babuk Ransomware Attacks (thehackernews.com)
Russian Foreign Ministry reports 'large-scale' cyber attack on its resources
Russia recommends prison sentence for REvil hackers | SC Media
Iran
Iranian hackers act as brokers selling critical infrastructure access (bleepingcomputer.com)
North Korea
Experts warn North Koreans are posing as IT workers in the West
Lazarus Group Exploits Google Chrome Vulnerability to Control Infected Devices
Chinese trader laundered more than $17M for Lazarus Group in 25 hacks (cointelegraph.com)
HYPR is latest firm to reveal hiring of fraudulent IT worker overseas | CyberScoop
Cyber firm launches free tool to weed out hackers in hiring process
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Sidewinder APT Deploying Expanded Attacks | MSSP Alert
Think Tanks Urge Action to Curb Misuse of Spyware and Hack-for-Hire - Infosecurity Magazine
Tools and Controls
Understanding the Importance of MFA: A Comprehensive Guide - Security Boulevard
Time to Get Strict With DMARC (darkreading.com)
55% Of Employees Using AI At Work Have No Training On Its Risks (forbes.com)
Microsoft lost some customers' cloud security logs - Help Net Security
A Business Continuity Cheat Sheet - Compare the Cloud
Can the cyber security industry stop history repeating? | TechRadar
A Comprehensive Guide to Finding Service Accounts in Active Directory
Call for cyber security sea change as world looks to meet rising threats
Fortinet report: 70% of staff lack cyber security awareness
Cyber resilience vs. cyber security: Which is more critical? (betanews.com)
CISOs: Throwing Cash at Tools Isn't Helping Detect Breaches (darkreading.com)
Multi-layered security is the key to keeping data safe – here’s why | ITPro
Effective strategies for measuring and testing cyber resilience - Help Net Security
New Research Underscores the Growing Security Risk Due to Hybrid Work Environments | Business Wire
Negating AI cyber attacks with defence in depth | TechRadar
Threat intelligence vs. threat hunting: Better together | TechTarget
API Vulnerabilities Jump 21% in Third Quarter - Security Boulevard
In 2025 Security And Risk Pros Will Brace For Regulations And Resilience (forbes.com)
68% of directors don't have a board-approved AI policy - IoD Ireland
Why Phishing-Resistant MFA Is No Longer Optional: The Hidden Risks of Legacy MFA
Achieving peak cyber resilience - Help Net Security
Cyber security incident response: Is your business prepared? | Proton
Microsoft creates fake Azure tenants to pull phishers into honeypots (bleepingcomputer.com)
Unclear pricing for GRC tools creates market confusion - Help Net Security
Five Ways To Improve Your Security Posture, Fast
Enhancing Cyber Security Post-Breach: A Comprehensive Guide - Security Boulevard
What is Third-Party Risk Monitoring in Cyber Security? | UpGuard
Other News
Acronym Overdose – Navigating the Complex Data Security Landscape (thehackernews.com)
The Rise of Cyber Attacks on Critical Infrastructure: Are You Prepared? - Security Boulevard
Why Cyber Security Should Be at the Top of the Agenda for the Utilities Sector (thefastmode.com)
The American Water cyber attack: Explaining how it happened (techtarget.com)
Security Checks: 85% of Online Shoppers Make Security a Top Priority
IT security and government services: Balancing transparency and security - Help Net Security
Vulnerability Management
Threat actors exploit zero days within 5 days, says Google's Mandiant | SC Media (scworld.com)
What is Vulnerability Management? Compliance, Challenges, & Solutions - Security Boulevard
Threat Actors Are Exploiting Vulnerabilities Faster Than Ever (techrepublic.com)
Vulnerabilities
Intel, AMD CPUs on Linux impacted by newly disclosed Spectre bypass (bleepingcomputer.com)
Microsoft launches Edge 130 with lots of security patches and feature changes - gHacks Tech News
MacOS Safari Exploit Exposes Camera, Mic, Browser Data (darkreading.com)
Researchers Discover Severe Security Flaws in Major E2EE Cloud Storage Providers (thehackernews.com)
Lazarus Group Exploits Google Chrome Vulnerability to Control Infected Devices
Atlassian Patches Vulnerabilities in Bitbucket, Confluence, Jira - SecurityWeek
Fortinet releases patches for undisclosed critical FortiManager vulnerability - Help Net Security
HM Surf macOS vuln potentially exploited by Adloader malware • The Register
Google Warns of Samsung Zero-Day Exploited in the Wild - SecurityWeek
VMware fixes critical vCenter Server RCE bug - again! (CVE-2024-38812) - Help Net Security
CISA confirms Veeam vulnerability is being used in ransomware attacks (therecord.media)
Unknown threat actors exploit Roundcube Webmail flaw in phishing campaign (securityaffairs.com)
Samsung phone users exposed to EoP attacks, Google warns • The Register
High-risk vulnerability affecting UniFi Network Server | Cybernews
CISA Warns Recent Microsoft SharePoint RCE Flaw Exploited in Attacks - SecurityWeek
Microsoft SharePoint RCE under active exploit • The Register
Cisco fixed tens of vulnerabilities, including an actively exploited one
Cisco fixes VPN DoS flaw discovered in password spray attacks
Hackers infect thousands of WordPress sites with malware plugins | PCWorld
Nvidia Patches High-Severity Flaws in Windows, Linux Graphics Drivers - SecurityWeek
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 18 October 2024
Black Arrow Cyber Threat Intelligence Briefing 18 October 2024:
-70% of Senior Executives Targeted by Cyber Attack in Past 18 Months, New Study Reveals
-Defenders Must Adapt to Shrinking Exploitation Timelines
-Supply Chain Vulnerabilities are Facilitating a Surge in Ransomware
-Limited Visibility and Tool Proliferation Prevent CISOs from Detecting Breaches
-Organisations Need to Better Prepare Swiftly from Cyber Attacks, New NCSC Head Warns
-Microsoft Logs 600 million Identity Attacks Per Day as Nation-States Team Up with Cyber Criminals for Attacks
-Over 90% of Phishing Campaigns Lead Victims to Malware
-Here’s How Attackers Are Getting Around Phishing Defences
-Firm Hacked After Accidentally Hiring North Korean Cyber Criminal
-Rampant Ransom Payments Highlight Need for Urgent Action on Cyber Resiliency
-October is Cyber Security Awareness Month – It’s a Good Time to Update Your Training Programme
-Phishing Tactics: The Top Attacks Trends in 2024
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
70% of Senior Executives Targeted by Cyber Attack in Past 18 Months, New Study Reveals
A recent report from GetApp highlights that 70% of senior executives have been targeted by cyber attacks in the last 18 months, with AI-driven deepfakes contributing to 22% of attacks. 42% of companies overlook the risks of unsecured communication channels, and 41% fail to regularly update systems. Additionally, 28% of organisations globally do not provide specialised cyber security training for executives, leaving businesses vulnerable to evolving threats.
Defenders Must Adapt to Shrinking Exploitation Timelines
A Mandiant report reveals that the time for attackers to exploit vulnerabilities has dropped sharply to just five days in 2023, down from 32 days in 2022. Zero-day vulnerabilities, which are unknown to vendors, have been favoured over publicly known (n-day) flaws, accounting for 70% of first exploits. Despite media attention, only a portion of vulnerabilities are actively exploited. The findings emphasise the importance of rapid patching and segmented network architectures to reduce risk, as threat actors increasingly exploit vulnerabilities across diverse technologies. Effective prioritisation of patching is now more critical than ever.
Supply Chain Vulnerabilities are Facilitating a Surge in Ransomware
A new report highlights the rising threat of ransomware attacks stemming from software supply chain vulnerabilities, with 62% of small and medium-sized businesses impacted. The findings reveal that 91% of businesses are concerned about ransomware affecting their downstream partners, with nearly half considering changing vendors. The role of AI in cyber attacks is also increasing, with 55% of businesses feeling more at risk due to AI-enhanced threats. Despite the challenges, 97% of those affected managed to restore their data, though 46% had to pay a ransom, with 31% paying over $1 million.
Limited Visibility and Tool Proliferation Prevent CISOs from Detecting Breaches
Despite global security spending set to reach $215 billion in 2024, 44% of CISOs reported failing to detect data breaches over the past year. A key issue is limited visibility, with 70% acknowledging their tools fall short in identifying breaches across hybrid cloud infrastructure. Gaining full visibility into encrypted and lateral traffic is critical, as 93% of malware hides there. CISOs are also overwhelmed by tool proliferation, with 60% prioritising tool consolidation. Concerns around AI-driven cyber attacks are rising, and 46% plan to implement AI to address visibility gaps and improve detection capabilities.
Organisations Need to Better Prepare to Recover Swiftly from Cyber Attacks, New NCSC Head Warns
The new head of the UK’s National Cyber Security Centre, Dr Richard Horne, has warned of escalating cyber threats, and the importance of preparing organisations to recover swiftly from cyber attacks. In 2024 alone, the NCSC responded to 50% more major incidents compared to the previous year, with severe attacks tripling. This rise in threats is driven by the expanding cyber crime marketplace, lowering the barriers for attackers. Horne stressed the need for global collaboration and for security to be embedded in technology from the start.
Microsoft Logs 600 million Identity Attacks Per Day as Nation-States Team Up with Cyber Criminals for Attacks
Microsoft’s 2024 Digital Defence Report reveals a significant rise in identity-based cyber attacks, tracking 600 million attacks over the fiscal year. Despite 41% of enterprises adopting multi-factor authentication (MFA), attackers bypass MFA through infrastructure vulnerabilities. Password attacks, such as phishing and brute force methods, still account for over 99% of these incidents. Although attempted ransomware attacks surged by 2.75 times, successful data encryption fell by threefold. Notably, state-backed cyber criminal collaborations are growing, complicating attack attribution, while AI and passwordless authentication are highlighted as essential for future protection.
Over 90% of Phishing Campaigns Lead Victims to Malware
A recent Comcast Business report highlights phishing as the top cyber security threat in 2023, with over 2.6 billion interactions detected. More than 90% of these phishing attempts aimed to direct victims to sites hosting malware, emphasising the need for stronger anti-phishing measures and staff education. Remote services were the primary method for lateral movement, with over 409 million events detected. The report recommends adopting tools like endpoint detection and response (EDR) and managed detection and response (MDR) to help IT teams detect and respond to early-stage threats through real-time network monitoring.
Here’s How Attackers Are Getting Around Phishing Defences
Email security provider Egress' latest report reveals that cyber attackers are bypassing phishing defences by manipulating natural language processing (NLP) technologies used in email filters. They achieve this by inserting benign text, links, and other obfuscation techniques, allowing malicious emails to pass through undetected. Notably, 78% of malicious emails incorporate multiple evasion tactics. Attackers exploit weaknesses in email security systems, including slow processing times that may cause incomplete scans. This trend is concerning, as phishing remains a significant threat, contributing to 31% of all security incidents according to Verizon’s 2024 breach report.
Firm Hacked After Accidentally Hiring North Korean Cyber Criminal
A company was hacked after unknowingly hiring a North Korean cyber criminal as a remote IT worker. The individual, who falsified employment history and personal details, gained access to the company’s network, stole sensitive data, and later demanded a ransom in cryptocurrency. This incident highlights an increasing threat of North Korean workers infiltrating Western firms to fund their regime, with many cases emerging since 2022. While most of these workers are after steady income, this case marks a significant shift towards data theft and extortion from within company defences.
Rampant Ransom Payments Highlight Need for Urgent Action on Cyber Resiliency
According to the Global Cyber Resilience Report 2024, 69% of organisations have paid ransoms this year, despite 77% having a 'do not pay' policy. Only 2% of firms can recover data within 24 hours, despite 98% setting that as their target. This highlights a major gap between perceived and actual cyber resilience. Organisations are unprepared for modern threats, with fewer than half implementing essential security measures like multi-factor authentication. To reduce risks, businesses must adopt modern data security practices, engage in realistic threat simulations, and invest in automated recovery systems to mitigate the growing threat of AI-driven cyber attacks.
October is Cyber Security Awareness Month – It’s a Good Time to Update Your Training Programme
October marks the 21st annual Cyber Security Awareness Month, highlighting the importance of user awareness in defending against cyber attacks. The US Cyber Security and Infrastructure Security Agency (CISA) reports that 90% of successful cyber attacks start with phishing, and Verizon notes that human factors are involved in 68% of breaches. This underscores the need for continuous training across all levels of an organisation. Key actions include using strong passwords, enabling multi-factor authentication, and maintaining up-to-date systems. It’s a good time to review or implement training programmes, ensuring they meet current standards and promote security awareness both at work and home.
Phishing Tactics: The Top Attacks Trends in 2024
Phishing attacks have evolved beyond email, with AI enabling more personalised and sophisticated tactics, such as voice cloning and deepfakes. Attackers increasingly combine phishing with other cyber attacks, like ransomware, to compromise entire networks. This can lead to data breaches, financial losses, and legal consequences under regulations like GDPR. Organisations must adopt a multi-layered defence strategy, combining employee training, multi-factor authentication, and advanced filtering tools. Regular incident response planning is also crucial to minimise the impact of phishing attacks, as techniques continue to grow more complex and harder to detect.
Sources:
https://www.helpnetsecurity.com/2024/10/16/time-to-exploit-vulnerabilities-2023/
https://www.techradar.com/pro/supply-chain-vulnerabilities-are-facilitating-a-surge-in-ransomware
https://www.helpnetsecurity.com/2024/10/18/cisos-security-tools/
https://www.infosecurity-magazine.com/news/cyber-threats-defend-ncsc-head/
https://cyberscoop.com/email-natural-language-obfuscation-phishing-egress/
https://www.bbc.co.uk/news/articles/ce8vedz4yk7o
https://www.jdsupra.com/legalnews/october-is-cybersecurity-awareness-5531410/
https://www.itpro.com/security/cyber-attacks/phishing-tactics-the-top-attacks-trends-in-year
Governance, Risk and Compliance
Gap Between Cyber Threats And Defences ‘Widening’, Cyber Security Chief Warns - PM Today
UK Reports 50% Spike in 'Nationally Significant' Incidents (inforisktoday.com)
'Nationally significant' cyber attacks are surging, warns the UK's new cyber chief (therecord.media)
Despite massive security spending, 44% of CISOs fail to detect breaches - Help Net Security
Cyber crime's constant rise is becoming everyone's problem - Help Net Security
The Cyber Security Burnout Crisis Is Reaching The Breaking Point (forbes.com)
A quarter of cyber security leaders are ready to quit (betanews.com)
Most businesses “overconfident and underprepared” for 2025 cyber threats – PCR (pcr-online.biz)
Why Cyber Security’s Core Focus Should Be Defending Data (govinfosecurity.com)
Cyber security compliance: the heavy burden of regulations on IT leaders - Raconteur
Return on cyber investment | Professional Security Magazine
What Cyber Security Leaders Can Learn From Golf (darkreading.com)
Cyber Security Awareness Month: How CISOs can engage, educate, and empower - Security Boulevard
CISOs' Privacy Responsibilities Keep Growing (darkreading.com)
What Is the ‘Most Pressing Concern’ for Cyber Professionals? (techrepublic.com)
While Cyber Attacks Are Inevitable, Resilience Is Vital (automation.com)
Helping Your Team Cope With the Stress of a Cyber Incident (inforisktoday.com)
Threats
Ransomware, Extortion and Destructive Attacks
More Ransoms Being Paid and More Data Being Lost: Hornetsecurity - Security Boulevard
RansomHub becomes dominant ransomware group in Q3 2024 (securitybrief.co.nz)
Basic cyber hygiene still offers the best defence against ransomware | SC Media (scworld.com)
53% of survey respondents admit to paying over $500,000 ransom | Security Magazine
Are You Prepared for Ransomware IRL? - Security Boulevard
Ransomware Attacks Tripled for Microsoft Customers Last Year (tech.co)
Supply chain vulnerabilities are facilitating a surge in ransomware | TechRadar
Would banning ransomware insurance stop the scourge? • The Register
Schools under siege: from nation-states to ransomware gangs • The Register
99% of UK Businesses Faced Cyber Attacks in the Last Year (techrepublic.com)
Ransomware Threats Surge with 31 New Groups in 2024 (techinformed.com)
Ransomware still a major threat despite disruption to RaaS groups (betanews.com)
Rampant ransom payments highlight need for urgent action on cyber resiliency | TechRadar
Akira, Fog Ransomware Leverages Critical Veeam RCE | MSSP Alert
INC ransomware rebranded to Lynx, say security researchers • The Register
Ransomware Victims
53% of survey respondents admit to paying over $500,000 ransom | Security Magazine
How Russian cyber attack on NHS harmed patients and halved blood test capacity (inews.co.uk)
Casio Confirms Ransomware Outage and Data Breach - Infosecurity Magazine (infosecurity-magazine.com)
Schools under siege: from nation-states to ransomware gangs • The Register
Casio says 'no prospect of recovery yet' after ransomware attack | TechCrunch
India’s biggest health insurer gets ransomware following data breach | TechRadar
Hackers blackmail Globe Life after stealing customer data (bleepingcomputer.com)
BianLian ransomware claims attack on Boston Children's Health Physicians (bleepingcomputer.com)
Phishing & Email Based Attacks
How AI created an email security gap | SC Media (scworld.com)
Attackers are using QR codes sneakily crafted in ASCII and blob URLs in phishing emails | CSO Online
Here’s how attackers are getting around phishing defences | CyberScoop
Phishing tactics: The top attacks trends in 2024 | ITPro
Over 90% of phishing campaigns lead victims to malware | Security Magazine
Phishing tactics: The top attacks trends in 2024 | ITPro
99% of UK Businesses Faced Cyber Attacks in the Last Year (techrepublic.com)
Be Aware of These Eight Underrated Phishing Techniques - SecurityWeek
Someone Just Lost $35 Million Worth of Crypto After Falling for This Phishing Scam
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Other Social Engineering
Firm hacked after accidentally hiring North Korean cyber criminal - BBC News
99% of UK Businesses Faced Cyber Attacks in the Last Year (techrepublic.com)
Scammers use AI to create convincing Gmail phishing calls (appleinsider.com)
What is tailgating (piggybacking) and how to prevent it? | Definition from TechTarget
Alabama man arrested for role in SEC Twitter account hijacking | CyberScoop
Verified Influencer Accounts Are Being Hijacked to Spread Scams and Malicious Software — FBI
Artificial Intelligence
How AI created an email security gap | SC Media (scworld.com)
From Misuse to Abuse: AI Risks and Attacks (thehackernews.com)
World Economic Forum: AI, Quantum Require ‘Paradigm Shift’ in Security - Security Boulevard
What Is Deepfake Technology? Ultimate Guide To AI Manipulation (eweek.com)
AI is bringing XSS vulnerabilities back to the spotlight | CSO Online
Navigating the Cyber Security Risks of Shadow & Open-Source GenAI - Security Boulevard
LLMs Are a New Type of Insider Adversary (darkreading.com)
Anthropic flags AI's potential to 'automate sophisticated destructive cyber attacks' | ZDNET
Deepfake lovers swindle victims out of $46M in Hong Kong AI scam - Ars Technica
AI Report Finds 74% of Cyber Security Leaders Aware of Sensitive Data Risks | Business Wire
AI data collection under fire - Help Net Security
4 Frightening Things Coming For Security This Season (informationsecuritybuzz.com)
How to Mitigate the Impact of Rogue AI Risks | Trend Micro (US)
NY's Financial Regulator Releases AI Cyber Security Guidance - Law360
AI Companies Are Not Meeting EU AI Act Standards (informationsecuritybuzz.com)
2FA/MFA
Cyber Crime Agency Issues New 2FA Warning For Gmail, Outlook, Facebook And X Users (forbes.com)
Malware
Over 90% of phishing campaigns lead victims to malware | Security Magazine
OpenAI confirms threat actors use ChatGPT to write malware (bleepingcomputer.com)
New Malware Campaign Uses PureCrypter Loader to Deliver DarkVision RAT (thehackernews.com)
New Threat Actor Tool EDRSilencer Repurposed For Malicious Use (informationsecuritybuzz.com)
Malicious ads exploited Internet Explorer zero day to drop malware (bleepingcomputer.com)
North Korean ScarCruft Exploits Windows Zero-Day to Spread RokRAT Malware (thehackernews.com)
Researchers Uncover Hijack Loader Malware Using Stolen Code-Signing Certificates (thehackernews.com)
New FASTCash malware Linux variant helps steal money from ATMs (bleepingcomputer.com)
Astaroth Banking Malware Resurfaces in Brazil via Spear-Phishing Attack (thehackernews.com)
Fake Google Meet pages deliver infostealers - Help Net Security
Verified Influencer Accounts Are Being Hijacked to Spread Scams and Malicious Software — FBI
Researchers Uncover Hijack Loader Malware Using Stolen Code-Signing Certificates (thehackernews.com)
Bots/Botnets
How DDoS Botent is used to Infect your Network? - Security Boulevard
Mobile
Over 200 malicious apps on Google Play downloaded millions of times (bleepingcomputer.com)
Which? warns UK users to keep mobile numbers to avoid security risks - Neowin
TrickMo’s Latest Trick - Stealing PINs And Unlock Patterns (informationsecuritybuzz.com)
The hidden risks of IoT: Why businesses need to modernize mobile security | TechRadar
Android banking trojan stealing money: no antivirus software can detect it | Cybernews
What to do if your iPhone or Android smartphone gets stolen? - Help Net Security
Not iPhones, but secure Android phones: that's what Trump's campaign uses - PhoneArena
Trump campaign gets 'unhackable' phones • The Register
Denial of Service/DoS/DDoS
A Deep Dive into DDoS Carpet-Bombing Attacks - Security Boulevard
How DDoS Botent is used to Infect your Network? - Security Boulevard
Independent Russian news site rides out a week of DDoS incidents (therecord.media)
Largest DDoS Cloudflare Attack On Global Sectors Mitigated - Security Boulevard
Internet of Things – IoT
Hackers took over robovacs to chase pets and yell slurs - The Verge
Hackers Made Robot Vacuums Shout Racist Slurs in Their Owners’ Homes (pcmag.com)
The hidden risks of IoT: Why businesses need to modernize mobile security | TechRadar
Organisations Slow to Protect Doors Against Hackers: Researcher - SecurityWeek
Data Breaches/Leaks
Data breaches trigger increase in cyber insurance claims - Help Net Security
Cisco investigates breach after stolen data for sale on hacking forum (bleepingcomputer.com)
Data Breaches: The Not-So-Hidden Cost of Doing Business | Baker Donelson - JDSupra
Fidelity Investments Data Breach Impacts 77,000 Customers - SecurityWeek
US healthcare org admits up to 400k people's data stolen • The Register
Cisco confirms ongoing probe into alleged data breach • The Register
Contractor pays $300K to settle Medicare data breach • The Register
Casio confirms customer data stolen in a ransomware attack (bleepingcomputer.com)
Hackers blackmail Globe Life after stealing customer data (bleepingcomputer.com)
Game Freak Confirms 1TB Data Leaked in Breach | MSSP Alert
Hundreds of thousands of CVs leaked - here's what we know | TechRadar
Organised Crime & Criminal Actors
Microsoft wants tougher punishments for cyber criminals • The Register
Cyber crime's constant rise is becoming everyone's problem - Help Net Security
Southeast Asian Cyber Crime Profits Fuel Shadow Economy (darkreading.com)
Microsoft logs 600 million identity attacks per day as threat actors collaborate more | ITPro
Escalating Cyber Threats Demand Stronger Global Defence and Cooperation - Microsoft On the Issues
The Wiretap: Microsoft Says Kremlin Is Working With Cyber Criminals To Spy On Ukraine (forbes.com)
Cyber Gangs Aren't Afraid of Prosecution (darkreading.com)
Brazilian Police Arrest Notorious Hacker USDoD - SecurityWeek
Two alleged operators of Anonymous Sudan named, charged • The Register
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Someone Just Lost $35 Million Worth of Crypto After Falling for This Phishing Scam
North Korean hackers steal $3B in crypto since 2017: report | Invezz
Radiant Capital Suffers $50M Loss in Second Major Hack - DailyCoin
Insider Risk and Insider Threats
The NHI management challenge: When employees leave - Help Net Security
LLMs Are a New Type of Insider Adversary (darkreading.com)
Insurance
Would banning ransomware insurance stop the scourge? • The Register
Data breaches trigger increase in cyber insurance claims - Help Net Security
Supply Chain and Third Parties
Supply chain vulnerabilities are facilitating a surge in ransomware | TechRadar
How Russian cyber attack on NHS harmed patients and halved blood test capacity (inews.co.uk)
Cyber Security Experts Brace for the Next Crisis After the CrowdStrike Near-Disaster - ClearanceJobs
UK Public sector at risk from supply chain attacks, new report warns | ITPro
Cloud/SaaS
Why are we still confused about cloud security? | InfoWorld
Why companies are struggling to keep up with SaaS data protection - Help Net Security
Tenable releases report on cloud security (devx.com)
38% of organisations are at risk of critical exposures | Security Magazine
Cyber Crime Agency Issues New 2FA Warning For Gmail, Outlook, Facebook And X Users (forbes.com)
Outages
Cyber Security Experts Brace for the Next Crisis After the CrowdStrike Near-Disaster - ClearanceJobs
Identity and Access Management
The Invisible Army of Non-Human Identities (darkreading.com)
Microsoft's guidance to help mitigate Kerberoasting | Microsoft Security Blog
Kerberoasting: A Gateway to Privilege Escalation in Enterprise Networks | HackerNoon
The NHI management challenge: When employees leave - Help Net Security
NHIs may be your biggest — and most neglected — security hole | CSO Online
Orgs With SSO Are Vulnerable to Identity-Based Attacks (darkreading.com)
Encryption
The CISO’s guide to establishing quantum resilience | CSO Online
The quantum dilemma: Game-changer or game-ender - Help Net Security
Chinese researchers claim quantum encryption attack • The Register
Linux and Open Source
New FASTCash malware Linux variant helps steal money from ATMs (bleepingcomputer.com)
Passwords, Credential Stuffing & Brute Force Attacks
How Hybrid Password Attacks Work and How to Defend Against Them (thehackernews.com)
The War on Passwords Is One Step Closer to Being Over | WIRED
FIDO Alliance is Standardizing Passkey Portability - Thurrott.com
Understand these seven password attacks and how to stop them (bleepingcomputer.com)
Are Password Managers Safe to Use? (Benefits, Risks & Best Practices) (techrepublic.com)
Social Media
Verified Influencer Accounts Are Being Hijacked to Spread Scams and Malicious Software — FBI
Training, Education and Awareness
Regulations, Fines and Legislation
NIS2: Most EU countries miss deadline to meet new cyber security rules (cnbc.com)
EU cyber security bill NIS2 hits compliance deadline | Computer Weekly
European companies anxious over non-implementation of EU cyber rules | Euronews
What is the NIS2 Directive and Why Now? - Infosecurity Magazine (infosecurity-magazine.com)
NIS 2 Compliance Deadline Approaches: What You Need To Know (techrepublic.com)
Huge number of businesses not ready for new EU cyber security laws (businessplus.ie)
Ireland to miss EU cyber security deadline (rte.ie)
Are Irish businesses ready for new cyber security rules? (rte.ie)
Only two EU countries meet NIS2 deadline - TechCentral.ie
Is your organisation ready for NIS2? | Intel 471
How NIS2 will impact sectors from healthcare to energy - Help Net Security
Ex-NCSC Chief: UK Cyber Incident Reporting a 'Good Step' (govinfosecurity.com)
Contractor pays $300K to settle Medicare data breach • The Register
AI Companies Are Not Meeting EU AI Act Standards (informationsecuritybuzz.com)
New Cyber Security Rules Threaten Defence Industrial Base - Law360
NY's Financial Regulator Releases AI Cyber Security Guidance - Law360
Models, Frameworks and Standards
EU cyber security bill NIS2 hits compliance deadline | Computer Weekly
European companies anxious over non-implementation of EU cyber rules | Euronews
What is the NIS2 Directive and Why Now? - Infosecurity Magazine (infosecurity-magazine.com)
NIS2: Most EU countries miss deadline to meet new cyber security rules (cnbc.com)
Huge number of businesses not ready for new EU cyber security laws (businessplus.ie)
Only two EU countries meet NIS2 deadline - TechCentral.ie
Is your organisation ready for NIS2? | Intel 471
NIS2 Directive: Experts share their views on the cyber security law (telecomstechnews.com)
How NIS2 will impact sectors from healthcare to energy - Help Net Security
Data Protection
CISOs' Privacy Responsibilities Keep Growing (darkreading.com)
Is a CPO Still a CPO? Privacy Leadership's Evolving Role (darkreading.com)
Careers, Working in Cyber and Information Security
CISSP and CompTIA Security+ lead as most desired security credentials - Help Net Security
The Cyber Security Burnout Crisis Is Reaching The Breaking Point (forbes.com)
Breaking into Cyber Security: It's Never Too Late- IT Security Guru
A quarter of cyber security leaders are ready to quit (betanews.com)
Stagnant salaries risk growth of infosec sector | The Global Recruiter
Security leaders can't catch a break, with many on the verge of quitting | TechRadar
Five alternative paths to the CISO chair | SC Media (scworld.com)
Helping Your Team Cope With the Stress of a Cyber Incident (inforisktoday.com)
Cyber Security Careers Go Beyond Coding | NIST
SMBs are being hit hardest by cyber security skills gap | TechRadar
Law Enforcement Action and Take Downs
Dutch police dismantled dual dark web market 'Bohemia/Cannabia' (securityaffairs.com)
Cyber Gangs Aren't Afraid of Prosecution (darkreading.com)
Brazilian Police Arrest Notorious Hacker USDoD - SecurityWeek
Two alleged operators of Anonymous Sudan named, charged • The Register
Alabama man arrested for role in SEC Twitter account hijacking | CyberScoop
Microsoft wants tougher punishments for cyber criminals • The Register
Misinformation, Disinformation and Propaganda
How nation-states exploit political instability to launch cyber operations - Help Net Security
Flood of Election-Related Cyber Activity Unleashed (darkreading.com)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Nation-State Cyber Threats: The Hidden War on Infrastructure - Security Boulevard
Nation State Actors
How nation-states exploit political instability to launch cyber operations - Help Net Security
Gap Between Cyber Threats And Defences ‘Widening’, Cyber Security Chief Warns - PM Today
UK Reports 50% Spike in 'Nationally Significant' Incidents (inforisktoday.com)
'Nationally significant' cyber attacks are surging, warns the UK's new cyber chief (therecord.media)
Schools under siege: from nation-states to ransomware gangs • The Register
China
Meet the Chinese 'Typhoon' hackers preparing for war | TechCrunch
China Accuses US of Fabricating Volt Typhoon to Hide Its Own Hacking Campaigns (thehackernews.com)
US lawmakers demand probe into China's Salt Typhoon hacks • The Register
White House forms emergency team to deal with China espionage hack | Stars and Stripes
Serious Adversaries Circle Ivanti CSA Zero-Day Flaws (darkreading.com)
UK Fears Chinese Hackers Compromised Critical Infrastructure (bloomberglaw.com)
Chinese State Hackers Main Suspect in Recent Ivanti CSA Zero-Day Attacks - SecurityWeek
Chinese researchers claim quantum encryption attack • The Register
Intel denies Chinese claims it helps US intelligence orgs • The Register
China trade group claims Intel ignore... - Mobile World Live
China infosec body slams Intel over chip security • The Register
Russia
Agencies warn about Russian government hackers going after unpatched vulnerabilities | CyberScoop
How Russian cyber attack on NHS harmed patients and halved blood test capacity (inews.co.uk)
Russia is actively scanning everything for known vulns • The Register
The Wiretap: Microsoft Says Kremlin Is Working With Cyber Criminals To Spy On Ukraine (forbes.com)
Uncle Sam puts $10M bounty on Russian troll farm Rybar • The Register
Independent Russian news site rides out a week of DDoS incidents (therecord.media)
The Door Closes on Kaspersky: Russia’s Tech World-Beater - CEPA
Russian court websites down after breach claimed by pro-Ukraine hackers (therecord.media)
Iran
Report: Iran cyber attacks against Israel surge after Gaza war (voanews.com)
Iran's APT34 Abuses MS Exchange (darkreading.com)
A cyber attack hit Iranian government sites and nuclear facilities (securityaffairs.com)
North Korea
Firm hacked after accidentally hiring North Korean cyber criminal - BBC News
North Korean hackers steal $3B in crypto since 2017: report | Invezz
Malicious ads exploited Internet Explorer zero day to drop malware (bleepingcomputer.com)
North Korean ScarCruft Exploits Windows Zero-Day to Spread RokRAT Malware (thehackernews.com)
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Tools and Controls
Despite massive security spending, 44% of CISOs fail to detect breaches - Help Net Security
The Invisible Army of Non-Human Identities (darkreading.com)
SOC Teams: Threat Detection Tools Are Stifling Us (darkreading.com)
Microsoft's guidance to help mitigate Kerberoasting | Microsoft Security Blog
Kerberoasting: A Gateway to Privilege Escalation in Enterprise Networks | HackerNoon
The dark side of API security - Help Net Security
Organisations Slow to Protect Doors Against Hackers: Researcher - SecurityWeek
FIDO Alliance is Standardizing Passkey Portability - Thurrott.com
New Threat Actor Tool EDRSilencer Repurposed For Malicious Use (informationsecuritybuzz.com)
CIOs want a platform that combines AI, networking, and security - Help Net Security
Why Continuous API Security is Essential for Modern Businesses - Security Boulevard
NHIs may be your biggest — and most neglected — security hole | CSO Online
Why companies are struggling to keep up with SaaS data protection - Help Net Security
Rampant ransom payments highlight need for urgent action on cyber resiliency | TechRadar
Return on cyber investment | Professional Security Magazine
Orgs With SSO Are Vulnerable to Identity-Based Attacks (darkreading.com)
Hybrid Work Exposes New Vulnerabilities in Print Security (darkreading.com)
Helping Your Team Cope With the Stress of a Cyber Incident (inforisktoday.com)
What is Business Continuity Plan? How it Works! (cybersecuritynews.com)
Secure by Design: The (Necessary) Future of Hardware and Software - IT Security Guru
Finance and Insurance API Security: A Critical Imperative - Security Boulevard
While Cyber Attacks Are Inevitable, Resilience Is Vital (automation.com)
CISOs' strategies for managing a growing attack surface - Help Net Security
Reports Published in the Last Week
Other News
Microsoft wants tougher punishments for cyber criminals • The Register
Defenders must adapt to shrinking exploitation timelines - Help Net Security
The Lingering Beige Desktop Paradox (darkreading.com)
New Threat Actor Tool EDRSilencer Repurposed For Malicious Use (informationsecuritybuzz.com)
Most businesses “overconfident and underprepared” for 2025 cyber threats – PCR (pcr-online.biz)
Microsoft: K-12, Universities Face Thousands of Attacks (darkreading.com)
Breaking down government hacks: The rise of the modern kill chain (federalnewsnetwork.com)
British intelligence services to protect all UK schools from ransomware attacks (therecord.media)
Top 10 Countries with Best Cyber Security, Finland Ranked First - Life En.tempo.co
6 biggest healthcare security threats | CSO Online
Retail CISOs Take on More Risk to Foster Innovation (darkreading.com)
Marlink reports increase in maritime cyber threats - Port Technology International
Vulnerability Management
Agencies warn about Russian government hackers going after unpatched vulnerabilities | CyberScoop
Google: 70% of exploited flaws disclosed in 2023 were zero-days (bleepingcomputer.com)
Russia is actively scanning everything for known vulns • The Register
Patch-22: The Catch of Waiting to Fix Cyber Security Vulnerabilities - Security Boulevard
How to defend against zero-day vulnerabilities | TechRadar
Secure by Design: The (Necessary) Future of Hardware and Software - IT Security Guru
Zero-Days Account for Most Exploited Bugs in 2023 | MSSP Alert
Vulnerabilities
86k Fortinet devices still vulnerable to active exploits • The Register
WordPress Plugin Jetpack Patches Major Vulnerability Affecting 27 Million Sites (thehackernews.com)
Oracle Patches Over 200 Vulnerabilities With October 2024 CPU - SecurityWeek
Windows 11 bug steals 8.63GB of storage space that you can't get back | Windows Central
Windows 11's 2024 update is now also killing internet connections | PCWorld
Juniper Networks Patches Dozens of Vulnerabilities - SecurityWeek
Serious Adversaries Circle Ivanti CSA Zero-Day Flaws (darkreading.com)
Akira, Fog Ransomware Leverages Critical Veeam RCE | MSSP Alert
Splunk Enterprise Update Patches Remote Code Execution Vulnerabilities - SecurityWeek
Vulnerable instances of Log4j still being used nearly 3 years later | SC Media (scworld.com)
Microsoft Patches Vulnerabilities in Power Platform, Imagine Cup Site - SecurityWeek
VMware fixes high-severity SQL injection CVE-2024-38814 in HCX (securityaffairs.com)
SolarWinds hardcoded credential now exploited in the wild • The Register
Fortinet Edge Devices Under Attack - Again - InfoRiskToday
Malicious ads exploited Internet Explorer zero day to drop malware (bleepingcomputer.com)
Cisco Patches High-Severity Vulnerabilities in Analog Telephone Adapters - SecurityWeek
F5 BIG-IP Updates Patch High-Severity Elevation of Privilege Vulnerability - SecurityWeek
North Korean ScarCruft Exploits Windows Zero-Day to Spread RokRAT Malware (thehackernews.com)
Mozilla releases second Firefox 131 security update - gHacks Tech News
Recent Firefox Zero-Day Exploited Against Tor Browser Users - SecurityWeek
Chrome 130 Released with Fix for 17 Security Flaws (cybersecuritynews.com)
CISA Warns of Active Exploitation in SolarWinds Help Desk Software Vulnerability (thehackernews.com)
Chinese State Hackers Main Suspect in Recent Ivanti CSA Zero-Day Attacks - SecurityWeek
Iran's APT34 Abuses MS Exchange (darkreading.com)
Netgear WiFi Extender Vulnerability Let Attackers Inject Malicious Commands - Cyber Security News
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 11 October 2024
Black Arrow Cyber Threat Intelligence Briefing 11 October 2024:
-Your IT Systems Are Being Attacked. Are You Prepared?
-Board-CISO Mismatch on Cyber Responsibility, NCSC Research Finds
-Mounting Phishing Attacks Enabled by AI, Deepfakes
-AI is Most Serious Threat to Orgs, According to Security Professionals
-MI5 Chief Warns of Cyber Threats to the UK
-Walking the Tightrope Between Innovation and Risk
-Ransomware Severity Up 68% in First Half of 2024
-31 New Ransomware Groups in 12 Months
-Lack of Cyber Risk Quantification Leaves Companies Financially Exposed: PwC Report
-Software Supply Chain Weaknesses are Increasingly Putting Businesses at Risk
-UK Businesses Cite Economic Risks and Cyber Crime as Top 2024 Concerns: Marsh McLennan
-Cloud Security Risks Surge as 38% of Firms Face Exposures
-Insider Threat Damage Balloons as Visibility Gaps Widen
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Your IT Systems Are Being Attacked. Are You Prepared?
Recent cyber attacks are becoming more frequent and sophisticated, emphasising the need for executive-level engagement in cyber security. Yet many organisations remain unprepared, with CEOs often delegating responsibility to IT departments. A survey revealed that while increasing AI use is expected to lead to more breaches, four in five security officers plan to use AI for defence. Experts advise that CEOs should actively participate in cyber security planning, ask critical questions like 'What are we doing? Is it enough? How do we know?', and regularly review measures to avoid significant business disruptions and regulatory penalties.
Board-CISO Mismatch on Cyber Responsibility, NCSC Research Finds
The UK's National Cyber Security Centre (NCSC) has found that 80% of board members and security leaders are uncertain about who holds responsibility for cyber security in their organisations. This confusion stems from CISOs believing accountability lies with the board, while board members think it rests with CISOs. The NCSC's research highlighted that many board members lack in-depth cyber knowledge, leading to gaps in oversight. In response, the NCSC has published new guidance to help CISOs effectively communicate with boards, aiming to bridge this gap and reduce cyber risk across organisations.
Mounting Phishing Attacks Enabled by AI, Deepfakes
A recent report has found that phishing attacks increased by 28% between the first and second quarters of 2024. Of the phishing kits used, 75% leveraged artificial intelligence and 82% incorporated deepfake capabilities. 44% of the attacks between April and June exploited compromised email accounts, with 8% originating from supply chain accounts. Hyperlinks were identified as the most common attack payload, followed by attachments. The report highlighted that attackers' use of AI in phishing toolkits lowers the barrier to entry for cyber attacks. It emphasised the need for organisations to adopt advanced AI defences without introducing new vulnerabilities by using AI unnecessarily.
AI is Most Serious Threat to Orgs, According to Security Professionals
Keeper Security has found that AI-driven cyber threats are now the most serious concern for organisations, with 51% of security leaders identifying them as such. Despite 81% of organisations implementing AI usage policies and 77% of leaders being familiar with AI security best practices, 35% feel least prepared to combat AI-powered attacks compared to other cyber threats. The survey also highlighted that 84% of IT and security leaders find AI-powered tools have made phishing and smishing attacks harder to detect. Organisations are prioritising data encryption, employee training, and advanced threat detection systems to counter these evolving threats.
MI5 Chief Warns of Cyber Threats to the UK
MI5 has warned that cyber threats from Russia, China, and Iran are a growing concern for the UK. Director General Ken McCallum highlighted that these nations are heavily investing in human intelligence and advanced cyber operations targeting government information, technology, and democratic institutions. Despite expelling over 750 Russian diplomats since early 2022—the majority being spies—cyber espionage activities have intensified. MI5 and the National Cyber Security Centre anticipate increased cyber attacks on Western cyber defences, particularly from Russian state actors. McCallum also emphasised the distinct threat posed by China, urging a comprehensive response to build resilience.
Walking the Tightrope Between Innovation and Risk
A recent analysis revealed that early engagement with CISOs in innovation projects leads to proactive security measures, building trust and ensuring innovation and security can coexist. Interestingly, organisations using older operational systems were shielded from recent security incidents, highlighting the inevitable trade-off between innovation and risk. The report suggests reframing the conversation to 'secure innovation' and emphasises fostering a security-first culture where employees are the first line of defence. Additionally, it stresses the importance of ensuring third-party vendors are secure, as a single compromised user could trigger a company-wide incident.
Ransomware Severity Up 68% in First Half of 2024
Cyber Insurer Coalition has found that while cyber insurance claims frequency decreased slightly in the first half of 2024, ransomware severity surged by 68%, with average losses per incident reaching $353,000. Businesses with over $100 million in revenue saw a 140% increase in claims severity, averaging losses of $307,000. Ransomware, though accounting for 18% of claims, heavily drove overall severity. The report also highlighted that 40% of policyholders paid ransom demands. Additionally, organisations using outdated technologies were 2.5 times more likely to experience a claim, underscoring the need for updated security measures.
31 New Ransomware Groups in 12 Months
There has been a 30% increase in active ransomware groups over the past year, with 31 new ransomware groups identified in the last twelve months. Despite intensified law enforcement efforts, the ransomware landscape has become more fragmented. LockBit remained the most active group, accounting for 17% of victims but down 8% from the previous year due to law enforcement operations. The cyber criminal group Play doubled its victim count to become the second most active, while newcomer RansomHub accounted for 7%.
Lack of Cyber Risk Quantification Leaves Companies Financially Exposed: PwC Report
PwC's latest report reveals a significant gap in how organisations quantify cyber risks financially. Despite 89% of executives agreeing on the importance of measuring cyber risk for investment prioritisation, only 15% effectively do so. This disconnect leaves many companies financially vulnerable, with only 21% allocating cyber budgets to top risks. While 77% of executives expect cyber security budgets to increase next year, without proper quantification, funds may not address the most pressing threats. The report highlights that over half of executives see cyber security as a differentiator influencing customer trust and brand loyalty, yet a lack of effective measurement persists.
Software Supply Chain Weaknesses are Increasingly Putting Businesses at Risk
BlackBerry reports that software supply chain weaknesses are increasingly putting businesses at risk of cyber attacks, with 51% of UK IT leaders receiving notifications of attacks or vulnerabilities in the past year. Despite this, 58% trust their suppliers' cyber security policies are comparable or stronger than their own, yet less than half requested compliance confirmations. Additionally, 51% found unknown participants in their software supply chain. The consequences are significant: 71% suffered financial loss, 67% faced data and reputational damage, and 42% took over a week to recover from such attacks.
UK Businesses Cite Economic Risks and Cyber Crime as Top 2024 Concerns: Marsh McLennan
Marsh McLennan has found that economic risks and financial challenges are the top concern for UK businesses over the next 12 months, with 43% of leaders citing these issues. Cyber threats take the number two spot, where the sharp rise in attacks is seen as a growing concern, jumping from 20% in 2023 to 39% in 2024. The report highlights that business leaders plan to prioritise strengthening cyber security measures, including assessing supply chain risks and customer relationships.
Cloud Security Risks Surge as 38% of Firms Face Exposures
Cloud security risks are surging, with 38% of organisations globally facing critical exposures from a combination of security gaps. These security concerns intensify due to the "toxic cloud triad" of publicly exposed, critically vulnerable, and highly privileged cloud workloads, leaving firms vulnerable to cyber attacks resulting in disruptions, system takeovers, and data breaches. Despite the average cost of a data breach in 2024 nearing $5 million, many organisations have misconfigurations and excessive permissions; 84% possess unused or long-standing access keys; and 74% have publicly exposed storage.
Insider Threat Damage Balloons as Visibility Gaps Widen
Recent research indicates that insider threats have led to a sharp increase in cyber attacks, with 83% of organisations experiencing such incidents in 2024, up from 60% the previous year. The growing complexity of IT systems and the adoption of technologies like AI and cloud services are creating visibility gaps and escalating risks. Nearly half of the organisations reported more frequent insider attacks, with remediation costs ranging from $100,000 to $2 million per incident. Additionally, 45% take a week or longer to recover, underscoring the need for improved policies, staff training, and advanced incident-response solutions.
Sources:
https://www.darkreading.com/cyberattacks-data-breaches/it-systems-being-attacked-prepared
https://www.infosecurity-magazine.com/news/boardciso-mismatch-on-cyber/
https://www.msspalert.com/brief/mounting-phishing-attacks-enabled-by-ai-deepfakes
https://www.inforisktoday.com/mi5-chief-warns-cyberthreats-to-uk-a-26483
https://www.darkreading.com/vulnerabilities-threats/walking-tightrope-innovation-risk
https://www.infosecurity-magazine.com/news/new-ransomware-groups-emerge-2024/
https://www.infosecurity-magazine.com/news/cloud-security-risks-surge-38/
Governance, Risk and Compliance
Board-CISO Mismatch on Cyber Responsibility - Infosecurity Magazine (infosecurity-magazine.com)
Walking the Tightrope Between Innovation & Risk (darkreading.com)
Warning over cyber security gap in the HR sector | theHRD (thehrdirector.com)
Your IT Systems Are Being Attacked. Are You Prepared? (darkreading.com)
US CISO Compensation on the Rise, Report Finds | MSSP Alert
45% of cyber security leaders are stressed about budget restraints | Security Magazine
The three qualities modern CISOs must have today to succeed | SC Media (scworld.com)
CISO Paychecks: Worth the Growing Security Headaches? (darkreading.com)
From IT to Boardroom: NIS2 Reshapes Cyber Security Roles (databreachtoday.co.uk)
Organisations are taking action towards cyber resilience: PwC - Reinsurance News
Cyber risk advice for boards | Professional Security Magazine
How the increasing demand for cyber insurance is changing the role of the CISO | CSO Online
Chief risk storyteller: How CISOs are developing yet another skill | CSO Online
Ex-Uber CISO Requests New, 'Fair' Trial (darkreading.com)
Cultivating a security-first mindset: Key leadership actions - Help Net Security
What is OPSEC (operations security)? | Definition from TechTarget
Widening talent pool in cyber with on-demand contractors - Help Net Security
Cyber Accountability Building • Stimson Center
Facts and Stats about Cyber Security and Compliance - Security Boulevard
Many C-suite execs have lost confidence in IT, including CIOs | CIO
Threats
Ransomware, Extortion and Destructive Attacks
Why evolving cyber threats mean small businesses are ransomware targets – Computerworld
Secureworks: Ransomware takedowns didn’t put off cyber criminals | Computer Weekly
Guidance for ransomware incidents | Professional Security Magazine
Ransomware double-extortion group listings peaked in 2024, report finds | SC Media (scworld.com)
Criminals Are Testing Their Ransomware in Africa (darkreading.com)
Homeland Security Blocked 500+ Ransomware Attacks Since 2021 (pymnts.com)
US agency warns against crypto-hungry Trinity ransomware (cointelegraph.com)
Hackers Exploiting Veeam RCE Vulnerability to Deploy Ransomware (cybersecuritynews.com)
Ransomware Victims
Study: 92% of Healthcare Firms Hit by Cyber Attacks This Year (inforisktoday.com)
American Water shut down some of its systems following a cyber attack (securityaffairs.com)
Casio reports IT systems failure after weekend network breach (bleepingcomputer.com)
Credit monitoring and supply chain risk company hacked | CyberScoop
Medical Group Pays $240K Fine for 3 Ransomware Attacks (govinfosecurity.com)
MoneyGram: No evidence ransomware is behind recent cyber attack (bleepingcomputer.com)
Cyber expert suggests American Water cyber incident was a ransomware attack | ITPro
Phishing & Email Based Attacks
Mounting Phishing Attacks Enabled by AI, Deepfakes | MSSP Alert
Commodity and Bulk Phishing Attacks See Huge Rise | SC Media UK (scmagazineuk.com)
Microsoft: Creative Abuse of Cloud Files Bolsters BEC Attacks (darkreading.com)
Cyber crooks abuse stolen SharePoint, OneDrive, and Dropbox accounts for phishing | Cybernews
Mamba 2FA Cyber Crime Kit Strikes Microsoft Users (darkreading.com)
9 types of phishing attacks and how to identify them | CSO Online
Microsoft 365 accounts targeted by dangerous new phishing scam | TechRadar
62% of observed finance domains involved in phishing attacks | Security Magazine
Scarlett Johansson tops McAfee 2024 Celebrity Hacker Hotlist (betanews.com)
Despite Online Threats, Users Aren’t Changing Behavior (darkreading.com)
Today’s “Good Enough MFA” Should Be Phishing-Resistant - Security Boulevard
OpenAI says Chinese gang tried to phish its staff • The Register
Hurricane Helene exploited in FEMA scams, phishing | SC Media (scworld.com)
Business Email Compromise (BEC)/Email Account Compromise (EAC)
Microsoft: Creative Abuse of Cloud Files Bolsters BEC Attacks (darkreading.com)
Cyber crooks abuse stolen SharePoint, OneDrive, and Dropbox accounts for phishing | Cybernews
9 types of phishing attacks and how to identify them | CSO Online
Other Social Engineering
9 types of phishing attacks and how to identify them | CSO Online
To Deliver Malware, Attackers Use the Phone | Intel 471
Despite Online Threats, Users Aren’t Changing Behavior (darkreading.com)
Scarlett Johansson tops McAfee 2024 Celebrity Hacker Hotlist (betanews.com)
Hurricane Helene exploited in FEMA scams, phishing | SC Media (scworld.com)
Attackers Using VSCode to Remotely Compromise Systems | MSSP Alert
Artificial Intelligence
42.5% of fraud attempts are now driven by AI - TechCentral.ie
AI anxiety afflicts 90% of consumers and businesses - see what worries them most | ZDNET
AI Most Serious Threat to Orgs, According to Security Professionals - IT Security Guru
Mounting Phishing Attacks Enabled by AI, Deepfakes | MSSP Alert
Three key strategies for organisations to protect themselves from deepfakes - IT Security Guru
OpenAI details how threat actors are abusing ChatGPT | TechTarget
Hacked ‘AI Girlfriend’ Data Shows Prompts Describing Child Sexual Abuse (404media.co)
Risk Strategies Drawn From the EU AI Act (darkreading.com)
2FA/MFA
Today’s “Good Enough MFA” Should Be Phishing-Resistant - Security Boulevard
Why are we still talking about cyber security basics after all these years? - Security Boulevard
Malware
How Malware is Evolving: Sandbox Evasion and Brand Impersonation - Security Boulevard
Ukrainian pleads guilty to operating Raccoon Stealer malware (bleepingcomputer.com)
Malicious Chrome Add-ons Evade Google's Updated Security (darkreading.com)
To Deliver Malware, Attackers Use the Phone | Intel 471
Two never-before-seen tools, from same group, infect air-gapped devices - Ars Technica
The “Mongolian Skimmer” Uses Unicode To Conceal Its Malicious Intent (informationsecuritybuzz.com)
Malicious packages in open-source repositories are surging | CyberScoop
Crypto-stealing malware campaign infects 28,000 people (bleepingcomputer.com)
How macOS malware works and how to secure your Mac
Attackers Using VSCode to Remotely Compromise Systems | MSSP Alert
Bots/Botnets
New Gorilla Botnet Launches Over 300,000 DDoS Attacks Across 100 Countries (thehackernews.com)
Vulnerable APIs and Bot Attacks Costing Businesses Up to $186 Billion Annually (thehackernews.com)
Websites are losing the fight against bot attacks - Help Net Security
Unseen Threats: 95% of Advanced Bots Escape Detection on Websites | HackerNoon
Why Web Application Firewalls Are an Indispensable Part of the Security Stack (thefastmode.com)
Gorilla Botnet Launches Over 300,000 DDoS Attacks (informationsecuritybuzz.com)
Mobile
Apple iOS 18.0.1 and iPadOS 18.0.1 fix media session and passwords bugs (securityaffairs.com)
This Trojan disguises as Google Chrome or NordVPN to wipe out your accounts | Cybernews
Android 16 could let you lock your phone down even tighter with new security features | TechRadar
Google officially kicks Kaspersky antivirus software app off the Play Store | TechRadar
Google brings better bricking to Androids, to curtail crims • The Register
3 iPhone settings I changed to thwart thieves - and what to do if your phone is stolen | ZDNET
Don’t use iPhone Mirroring at work, experts warn • The Register
Denial of Service/DoS/DDoS
Cloudflare Thwarts Largest-Ever 3.8 Tbps DDoS Attack Targeting Global Sectors (thehackernews.com)
New Gorilla Botnet Launches Over 300,000 DDoS Attacks Across 100 Countries (thehackernews.com)
DDoS attacks are on the rise, and are increasingly politically-motivated | TechRadar
Internet of Things – IoT
How smart TVs spy on you and harvest data • The Register
You Need a Separate Network To Protect Yourself From Your Smart Devices (howtogeek.com)
New EU law touts strict cyber security requirements for all connected and IoT devices | Cybernews
14,000 medical devices are online, unsecured and vulnerable | CyberScoop
Data Breaches/Leaks
National Public Data files for bankruptcy after info leak • The Register
90% of Successful Attacks Result in Leaked Data (darkreading.com)
MoneyGram says hackers stole customers' personal information and transaction data | TechCrunch
Internet Archive hacked, data breach impacts 31 million users (bleepingcomputer.com)
Marriott settles for $52M after years-long breaches • The Register
Comcast confirms 237K affected in feisty breach notification • The Register
ADT discloses second breach in 2 months, hacked via stolen credentials (bleepingcomputer.com)
MoneyGram Breach: Social Security Numbers, Bank Account Details Looted (pcmag.com)
FCC Fines T-Mobile $31.5 Million After Carrier Was Hacked 8 Times In 5 Years | Techdirt
Major breach exposes every Dutch police officer: state-sponsored actor suspected | Cybernews
Leaked documents reveal British military’s secret assistance to Israeli army | Al Bawaba
Data loss incidents impact patient care - Help Net Security
Organised Crime & Criminal Actors
British man arrested over hack-to-trade scheme using email password resets | ITPro
Cyber crime and harm - POST (parliament.uk)
Man pleads guilty to stealing over $37M worth of cryptocurrency (securityaffairs.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Lego's website was hacked to promote a crypto scam (engadget.com)
Crypto-stealing malware campaign infects 28,000 people (bleepingcomputer.com)
Man pleads guilty to stealing over $37M worth of cryptocurrency (securityaffairs.com)
FBI created a crypto token so it could watch it being abused • The Register
US agency warns against crypto-hungry Trinity ransomware (cointelegraph.com)
Insider Risk and Insider Threats
Insider Threat Damage Balloons as Visibility Gaps Widen (darkreading.com)
Despite Online Threats, Users Aren’t Changing Behaviour (darkreading.com)
Insurance
Severity of Ransomware Attacks Rose 68% in First Half of 2024, Report Shows (claimsjournal.com)
Cyber insurance demand to rise as new threats emerge, says Bloomberg Intelligence - Reinsurance News
How the increasing demand for cyber insurance is changing the role of the CISO | CSO Online
Supply Chain and Third Parties
Software supply chain weaknesses are increasingly putting businesses at risk | TechRadar
The CrowdStrike bug and the risk of cascading failures - SiliconANGLE
What The SolarWinds Case Means For CISOs And Corporate Cyber Security (forbes.com)
Credit monitoring and supply chain risk company hacked | CyberScoop
Cloud/SaaS
Microsoft: Creative Abuse of Cloud Files Bolsters BEC Attacks (darkreading.com)
Cyber crooks abuse stolen SharePoint, OneDrive, and Dropbox accounts for phishing | Cybernews
Mamba 2FA Cyber Crime Kit Strikes Microsoft Users (darkreading.com)
Cloud Security Challenges in the Modern Era - Compare the Cloud
Hackers still prefer credentials-based techniques in cloud attacks | SC Media (scworld.com)
Microsoft 365 accounts targeted by dangerous new phishing scam | TechRadar
Social Media Accounts: The Weak Link in Organisational SaaS Security (thehackernews.com)
Outages
The CrowdStrike bug and the risk of cascading failures - SiliconANGLE
What The SolarWinds Case Means For CISOs And Corporate Cyber Security (forbes.com)
MoneyGram: No evidence ransomware is behind recent cyber attack (bleepingcomputer.com)
Encryption
Chinese hack shows why Apple is right about security backdoors (9to5mac.com)
The Wiretap: China Has Infiltrated Police Wiretap Systems (forbes.com)
The 30-year-old internet backdoor law that came back to bite | TechCrunch
Massive US security breach highlights danger of weakening encryption | Proton
Linux and Open Source
CUPS could be abused to launch massive DDoS attack • The Register
Malicious packages in open-source repositories are surging | CyberScoop
Passwords, Credential Stuffing & Brute Force Attacks
There was a 12% increase in brute force cyber attack techniques in 2024 | Security Magazine
This Popular Security Method Doesn't Actually Stop Hackers (makeuseof.com)
Hackers still prefer credentials-based techniques in cloud attacks | SC Media (scworld.com)
Password Basics: Why Mastering Fundamentals Is Crucial (informationsecuritybuzz.com)
Why are we still talking about cyber security basics after all these years? - Security Boulevard
ADT discloses second breach in 2 months, hacked via stolen credentials (bleepingcomputer.com)
Social Media
EU Court Limits Meta's Use of Personal Facebook Data for Targeted Ads (thehackernews.com)
Social Media Accounts: The Weak Link in Organisational SaaS Security (thehackernews.com)
The Social Media Moral Panic Is All About Confusing Risks & Harms | Techdirt
Training, Education and Awareness
Cyber security Is Serious — but It Doesn't Have to Be Boring (darkreading.com)
Regulations, Fines and Legislation
From IT to Boardroom: NIS2 Reshapes Cyber Security Roles (databreachtoday.co.uk)
Marriott settles for $52M after years-long breaches • The Register
Cyber Security and Resilience Bill Update (techuk.org)
UK’s cyber incident reporting law to move forward in 2025 | Computer Weekly
Influential resource on international cyber law updated for 2024 (techxplore.com)
New EU law touts strict cyber security requirements for all connected and IoT devices | Cybernews
How to secure your business before new Cyber Security and Resilience Bill (businesscloud.co.uk)
NIS2 & DORA: Staying ahead of the curve | TechRadar
Risk managers call for EU cyber consistency (emergingrisks.co.uk)
EU retaliates against Russian ‘hybrid warfare’ with new regulations (brusselssignal.eu)
FCC Fines T-Mobile $31.5 Million After Carrier Was Hacked 8 Times In 5 Years | Techdirt
Balancing legal frameworks and enterprise security governance - Help Net Security
Risk Strategies Drawn From the EU AI Act (darkreading.com)
Medical Group Pays $240K Fine for 3 Ransomware Attacks (govinfosecurity.com)
Models, Frameworks and Standards
Meet the shared responsibility model with new CIS resources - Help Net Security
From IT to Boardroom: NIS2 Reshapes Cyber Security Roles (databreachtoday.co.uk)
NIS2 & DORA: Staying ahead of the curve | TechRadar
NIS2 & DORA: Staying ahead of the curve | TechRadar
DORA regulation's nuts and bolts - Help Net Security
Data Protection
Careers, Working in Cyber and Information Security
US CISO Compensation on the Rise, Report Finds | MSSP Alert
Banishing Burnout: Data Security Hangs in Balance in Cyber Wellbeing Crisis - IT Security Guru
CISO Paychecks: Worth the Growing Security Headaches? (darkreading.com)
Widening talent pool in cyber with on-demand contractors - Help Net Security
Imposter syndrome in cyber security | Pen Test Partners
Cyber security careers - BBC News
Career Spotlight: The Growing Demand for OT Security Experts (databreachtoday.co.uk)
6 Simple Steps to Eliminate SOC Analyst Burnout (thehackernews.com)
UK Cyber Team seeks future security professionals | Computer Weekly
Law Enforcement Action and Take Downs
British man arrested over hack-to-trade scheme using email password resets | ITPro
Ukrainian pleads guilty to operating Raccoon Stealer malware (bleepingcomputer.com)
Dutch cops reveal takedown of 'largest dark web market' • The Register
Homeland Security Blocked 500+ Ransomware Attacks Since 2021 (pymnts.com)
UK to Continue Disruptive Actions Targeting Cyber Crime (databreachtoday.co.uk)
Man pleads guilty to stealing over $37M worth of cryptocurrency (securityaffairs.com)
FBI created a crypto token so it could watch it being abused • The Register
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
MI5 Chief Warns of Cyber Threats to the UK - InfoRiskToday
DDoS attacks are on the rise, and are increasingly politically-motivated | TechRadar
Nation State Actors
China
MI5 Chief Warns of Cyber Threats to the UK - InfoRiskToday
The 30-year-old internet backdoor law that came back to bite | TechCrunch
Massive US security breach highlights danger of weakening encryption | Proton
Chinese cyber spies reportedly breached Verizon, AT&T • The Register
Illegal donations: how does dark money get into UK politics? | TBIJ (thebureauinvestigates.com)
OpenAI says it has disrupted 20-plus foreign influence networks in past year | CyberScoop
OpenAI says Chinese gang tried to phish its staff • The Register
Russia
MI5 Chief Warns of Cyber Threats to the UK - InfoRiskToday
DOJ seizes 41 Russian-controlled domains in cyber-espionage crackdown | CSO Online
European govt air-gapped systems breached using custom malware (bleepingcomputer.com)
NCSC issues fresh alert over wave of Cozy Bear activity | Computer Weekly
Microsoft: ‘relentless’ Russia-sponsored hacking group has been disrupted - Security - CRN Australia
Russia and Iran want ‘sustained mayhem’ in UK, MI5 warns
Major breach exposes every Dutch police officer: state-sponsored actor suspected | Cybernews
EU retaliates against Russian ‘hybrid warfare’ with new regulations (brusselssignal.eu)
US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers (bleepingcomputer.com)
Illegal donations: how does dark money get into UK politics? | TBIJ (thebureauinvestigates.com)
Google officially kicks Kaspersky antivirus software app off the Play Store | TechRadar
Pro-Russian cyber attacks hit Belgium for fourth consecutive day (belganewsagency.eu)
Kaspersky says it's closing down its UK office and laying off dozens | TechCrunch
Pro-Ukrainian Hackers Strike Russian State TV on Putin's Birthday (thehackernews.com)
Cyber Attack Group 'Awaken Likho' Targets Russian Government with Advanced Tools (thehackernews.com)
Iran
MI5 Chief Warns of Cyber Threats to the UK - InfoRiskToday
Russia and Iran want ‘sustained mayhem’ in UK, MI5 warns
Illegal donations: how does dark money get into UK politics? | TBIJ (thebureauinvestigates.com)
Earth Simnavaz Levies Advanced Cyber Attacks Against UAE and Gulf Regions | Trend Micro (US)
North Korea
North Korean Hackers Attacking US Organisations With Unique Hacking Tools (cybersecuritynews.com)
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
DDoS attacks are on the rise, and are increasingly politically-motivated | TechRadar
Leaked documents reveal British military’s secret assistance to Israeli army | Al Bawaba
What is spyware? And how do you protect yourself from it? | TechRadar
Tools and Controls
MSSP Market News: Survey Shows 62% of SOC Alerts are Ignored | MSSP Alert
How to protect data centres as Critical National Infrastructure (networkingplus.co.uk)
Cyber insurance demand to rise as new threats emerge, says Bloomberg Intelligence - Reinsurance News
45% of cyber security leaders are stressed about budget restraints | Security Magazine
Organisations are taking action towards cyber resilience: PwC - Reinsurance News
How the increasing demand for cyber insurance is changing the role of the CISO | CSO Online
Hackers Exploiting DNS Tunneling Service To Bypass Network Firewalls (cybersecuritynews.com)
Strengthening Cyber Security with NDR and EDR integration - SiliconANGLE
Setting Up Your Network Security? Avoid These 4 Mistakes (techrepublic.com)
Cyber security professionals are turning to AI as more lose control of detection tools | ZDNET
SOC teams are frustrated with their security tools - Help Net Security
Why Web Application Firewalls Are an Indispensable Part of the Security Stack (thefastmode.com)
Cyber security leaders still shaky about post-attack recovery, reports show | Healthcare IT News
How to Get Going with CTEM When You Don't Know Where to Start (thehackernews.com)
Cyber Security Is Serious — but It Doesn't Have to Be Boring (darkreading.com)
Other News
Study: 92% of Healthcare Firms Hit by Cyber Attacks This Year (inforisktoday.com)
Five percent of all Adobe Commerce and Magento stores hacked, researchers say | Cybernews
NCSC celebrates eight years as Horne blows in | Computer Weekly
Cyber security in an age of terror
Almost half of UK higher education institutions experience a cyber attack every week | TechRadar
London Fire Brigade block almost 340,000 cyber attacks (verdict.co.uk)
Healthcare's Grim Cyber Prognosis Requires Security Booster (darkreading.com)
Kaspersky says it's closing down its UK office and laying off dozens | TechCrunch
Building Cyber Resilience in SMBs With Limited Resources (darkreading.com)
Middle East, Turkey See Cyber Threats Rise (darkreading.com)
Modern payment systems: An effective way to reduce your attack surface | ITPro
Illegal donations: how does dark money get into UK politics? | TBIJ (thebureauinvestigates.com)
Cyber security tips for barristers, solicitors and legal... - NCSC.GOV.UK
Government launches cyber standard for local authorities | Computer Weekly
Reasons why MSPs are the future | Microscope (computerweekly.com)
Vulnerability Management
Vulnerabilities
Microsoft: Windows 11 22H2 Home and Pro reached end of servicing (bleepingcomputer.com)
CISA says critical Fortinet RCE flaw now exploited in attacks (bleepingcomputer.com)
Hackers Exploiting Veeam RCE Vulnerability to Deploy Ransomware (cybersecuritynews.com)
Five percent of all Adobe Commerce and Magento stores hacked, researchers say | Cybernews
UK telcos including BT at risk from DrayTek router vulnerabilities | Computer Weekly
Critical Apache Avro SDK RCE flaw impacts Java applications (securityaffairs.com)
PoC Exploit Released for Microsoft Office 0-day Flaw - CVE-2024-38200 (cybersecuritynews.com)
Single HTTP Request Can Exploit 6M WordPress Sites (darkreading.com)
Okta Classic customers told to check logs for sign-on bypass | SC Media (scworld.com)
Adobe Releases Security Updates for Multiple Products | CISA
Three new Ivanti CSA zero-day actively exploited in attacks (securityaffairs.com)
US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers (bleepingcomputer.com)
VMware NSX Vulnerabilities Allow Hackers To Execute Arbitrary Commands (cybersecuritynews.com)
Researchers discover 14 new DrayTek vulnerabilities | Security Magazine
WordPress LiteSpeed Cache plugin flaw could allow site takeover (securityaffairs.com)
Still running Windows 11 22H2? No more security fixes from Microsoft for you! (betanews.com)
Exploit code for critical GitLab auth bypass flaw released (CVE-2024-45409) - Help Net Security
Firefox Zero-Day Under Attack: Update Your Browser Immediately (thehackernews.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory 09 October 2024 – Microsoft and Adobe Security Updates
Black Arrow Cyber Advisory 09 October 2024 – Microsoft Patch Tuesday and Adobe Security Updates
Executive summary
Microsoft’s October Patch Tuesday provides updates to address 117 security issues across its product range, including two actively exploited vulnerabilities and three publicly disclosed bugs. In addition to the Microsoft updates this week also saw Adobe fix 52 vulnerabilities across various products.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an attacker to compromise the confidentiality, integrity and availability of the affected applications and the organisations data on the affected systems.
What can I do?
Black Arrow recommends applying the available security updates for all supported versions of Windows, and all affected Adobe products as soon as possible. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating.
Microsoft
Further details on other specific updates within this Microsoft patch Tuesday can be found here:
https://msrc.microsoft.com/update-guide/releaseNote/2024-Oct
Adobe
Further details of the vulnerabilities in Adobe products can be found here under ‘Recent bulletins and advisories’:
https://helpx.adobe.com/security/security-bulletin.html
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Briefing 04 October 2024
Black Arrow Cyber Threat Intelligence Briefing 04 October 2024:
-How Snoozing on Cyber Security Fails Modern Businesses
-Cyber Criminals Capitalise on Poorly Configured Cloud Environments
-90% of Cyber Security Incidents Could Be Avoided, Survey Reveals
-The Cyber Industry Needs to Accept It Can't Eliminate Risk
-Cyber Teams Say They Can’t Keep Up with Attack Volumes
-C-Level Executives are a Weak Point for Cyber Security
-Email Phishing Attacks Surge as Attackers Bypass Security Controls
-Security Threats Are More Pressing Than Ever for Business Leaders, With Cloud Worries Taking Top Spot
-Ten Million Brits Hit by Fraud in Just Three Years
-Is the Weakest Link in Cyber Security Becoming Even Weaker?
-Cyber Incidents are the Achilles Heel for Major UK CEOs, Report Finds
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
How Snoozing on Cyber Security Fails Modern Businesses
A recent study has found that many organisations are delaying crucial data security updates, likened to hitting the snooze button on an alarm. This reluctance to modernise security measures leaves businesses vulnerable to evolving threats as technologies like cloud and AI are integrated into operations. The report highlights that clinging to legacy security systems can lead to significant financial and reputational damage. Despite the ever-present threat of cyber attacks, many organisations hesitate to upgrade due to comfort with existing systems and perceived cost implications. The adoption of modern security practices like Zero Trust models and AI-driven tools is essential to mitigate these risks.
Cyber Criminals Capitalise on Poorly Configured Cloud Environments
According to the 2024 Elastic Global Threat Report, cyber criminals are exploiting poorly configured cloud environments and leveraging off-the-shelf offensive security tools, which account for approximately 54% of observed malware alerts, with one tool responsible for over 27% of infections. Misconfigurations are widespread: 47% of Microsoft Azure failures are tied to storage issues, and 30% of AWS failures result from the lack of multi-factor authentication. There has been a 12% increase in brute-force techniques, particularly in Azure environments. While defence technologies are making progress, the report emphasises the need for enterprises to enhance cloud configurations and enforce security measures like multi-factor authentication.
90% of Cyber Security Incidents Could Be Avoided, Survey Reveals
Veeam Software has found that only 43% of EMEA IT decision-makers believe the forthcoming NIS2 directive will significantly enhance EU cyber security. This scepticism persists despite 90% of respondents reporting at least one security incident in the past year that NIS2 could have prevented. While nearly 80% are confident they will eventually comply with NIS2, up to two-thirds expect to miss the October 2024 deadline. The report highlights barriers to compliance, including technical debt (24%), lack of leadership understanding (23%), and insufficient budget (21%). Additionally, 40% have experienced decreased IT budgets since NIS2 was announced, with many organisations ranking it lower in urgency than other business priorities.
The Cyber Industry Needs to Accept It Can't Eliminate Risk
A recent analysis highlights that striving for zero risk in cyber security is unattainable for organisations. The reliance on large technology providers like CrowdStrike exposes systemic risks, where an incident can have widespread impact across dependent businesses. The article emphasises that instead of pursuing perfection, organisations should focus on reducing risks to a manageable level. Transparency with stakeholders about residual risks is crucial to set realistic expectations and maintain trust. It also suggests diversifying technology stacks to avoid overloading risk onto a few providers, and implementing practical security measures that can be consistently followed to manage risks effectively.
Cyber Teams Say They Can’t Keep Up with Attack Volumes
ISACA has found that understaffing and underfunding are major concerns for cyber security professionals in Europe, with 61% reporting understaffed teams and 52% citing underfunding despite predicted spending increases. The report highlighted that 68% feel their work is more stressful now than in 2019 due to a complex threat landscape. Nearly 58% expect to face a cyber attack in the next 12 months, up six percentage points from 2023. Additionally, 52% pointed to a lack of soft skills among cyber pros, especially communication, exacerbating the skills gap in the industry.
C-Level Executives are a Weak Point for Cyber Security
Research indicates that 72% of US senior executives have been targeted by cyber attacks in the past 18 months, highlighting the C-suite as a key security vulnerability. Attacks have grown in frequency and sophistication, with impersonation scams up by 26%, and 27% involving AI-assisted deepfakes. Despite this, many organisations have not prioritised executive security training, though 87% of IT professionals believe senior executives require more training than other staff. As cyber security remains a top concern, companies must enhance security measures to protect their data.
Email Phishing Attacks Surge as Attackers Bypass Security Controls
Egress has reported a 28% rise in email phishing attacks in Q2 2024 compared to Q1, highlighting attackers' effective methods to bypass security controls. These threats intensify as 44% of attacks originated from internally compromised accounts and 8% from supply chain accounts. The report found that 89% of phishing emails involved impersonation, often targeting HR, IT and finance departments. Additionally, commodity attacks have surged, causing a 2700% increase in phishing volumes during such campaigns. Emerging trends also show attackers using multi-channel approaches, leveraging platforms like MS Teams and WhatsApp to exploit vulnerabilities.
Security Threats Are More Pressing Than Ever for Business Leaders, With Cloud Worries Taking Top Spot
PwC has found that cloud-related threats are now the top concern for executives, with 42% ranking them as their primary worry. Despite this focus, 34% admit they are least prepared to address these issues. Hack-and-leak operations and third-party breaches are also significant concerns, cited by 38% and 35% of respondents respectively. Interestingly, Chief Information Security Officers place ransomware among their top three worries, with 42% feeling underprepared to tackle it. The expanding attack surface from increased reliance on cloud, AI, and connected devices underscores the need for an agile, enterprise-wide approach to resilience.
Ten Million Brits Hit by Fraud in Just Three Years
A recent study sponsored by Santander UK and conducted by the Social Market Foundation (SMF) revealed that 21% of respondents across 15 European countries experienced fraud between 2021 and 2023, at a direct cost of £168bn. However, the SMF estimated the total cost of such incidents at £420bn; this includes productivity losses from having to spend time reporting and recovering from the fraud incident. In the UK alone, victims lost an average of £907 each, amounting to a total direct cost of around £9bn. The report highlights that while most believe banks should lead in compensating victims, many also see digital platforms and telecom providers as responsible. Both SMF and Santander are calling on the British government to spearhead a global initiative to combat fraud, including international agreements and enhanced law enforcement.
Is the Weakest Link in Cyber Security Becoming Even Weaker?
Human error is the leading cause of cyber security breaches, with Cybint reporting that 95% result from human mistakes. Verizon's 2023 Data Breach Investigations Report highlights that 74% of incidents involve a human element, such as clicking on phishing links. The rise of deepfakes and increased exposure of personal information have intensified these risks, making attacks more sophisticated. Despite awareness training, prominent organisations continue to face breaches. Notably, Gen Z is over three times more likely to fall for online fraud compared to baby boomers. Remote working has further blurred boundaries, increasing vulnerability to cyber attacks.
Cyber Incidents are the Achilles Heel for Major UK CEOs, Report Finds
FGS Global has found that cyber attacks are the top concern for UK businesses, with 36% of senior leaders reporting cyber incidents in the past year. Despite 85% of firms experiencing a crisis, only 36% feel highly prepared to handle ransomware attacks, which over half fear facing. The report highlights a lack of understanding around cyber security and cyber crime, intensified by AI risks.
Sources:
https://votiro.com/blog/how-snoozing-on-cybersecurity-fails-modern-businesses/
https://www.helpnetsecurity.com/2024/10/04/cloud-environments-attack-surface/
https://dcnnmagazine.com/security/90-of-cybersecurity-incidents-could-be-avoided-survey-reveals/
https://www.computerweekly.com/opinion/The-cyber-industry-needs-to-accept-it-cant-eliminate-risk
https://www.computerweekly.com/news/366612212/Cyber-teams-say-they-cant-keep-up-with-attack-volumes
https://www.techradar.com/pro/c-level-executives-are-a-weak-point-for-cybersecurity-research-says
https://www.infosecurity-magazine.com/news/email-phishing-surge-bypass/
https://www.infosecurity-magazine.com/news/ten-million-brits-hit-fraud-three/
https://hackernoon.com/is-the-weakest-link-in-cybersecurity-becoming-even-weaker
https://www.cityam.com/cyber-incidents-are-the-achilles-heel-for-major-uk-ceos-report-finds/
Governance, Risk and Compliance
CFOs Suit Up for Cyber War as Risk Management Evolves (pymnts.com)
Allies to Leverage During a Cyber Crisis (darkreading.com)
The cyber industry needs to accept it can't eliminate risk | Computer Weekly
Cyber incidents are the Achilles Heel for major UK CEOs, report finds (cityam.com)
As CISO roles expand, so should cyber budgets, says NASCIO 2024 cyber security report | StateScoop
Human Capital and Risk Governance: Insider Threats To Cyber Security (forbes.com)
Global cyber threat to double predicts new report (emergingrisks.co.uk)
Over Half of Cyber Professionals Feel Their Budget is Underfunded - IT Security Guru
C-level executives are a weak point for cyber security | TechRadar
Average North American CISO salary now $565,000 • The Register
BlackBerry report: Cyber threats up 53%, critical sectors hit (securitybrief.co.nz)
Cyber teams say they can’t keep up with attack volumes | Computer Weekly
Watch out, CFOs: cyber crime is booming, says former White House advisor | Fortune
Normalizing Security Culture: Stay Ready (darkreading.com)
Cyber attacks causing reputational damages: CIRA – BNN Bloomberg
Security spending signals major role change for CISOs and their teams | CSO Online
Strengthening Security Posture Through People-First Engagement (informationsecuritybuzz.com)
Forrester's CISO Budget Planning Guide for 2025: Prioritize API Security - Security Boulevard
Gartner: CISOs should ditch ‘zero tolerance’ prevention (techinformed.com)
How to Enlist the CFO as a Cyber Security Budget Ally | Mimecast
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware gangs are using stolen data to threaten CEOs | Fortune
Embargo ransomware escalates attacks to cloud environments (bleepingcomputer.com)
Microsoft: Cloud Environments of US Organisations Targeted in Ransomware Attacks - SecurityWeek
Multinational police effort hits sections of Lockbit ransomware operation | CyberScoop
Russia’s FSB protected Evil Corp gang that carried out NATO cyber-attacks (yahoo.com)
US charges Joker's Stash and Rescator money launderers (bleepingcomputer.com)
More frequent disruption operations needed to dent ransomware gangs, officials say | CyberScoop
Ransomware activity shows no signs of slowing down - Help Net Security
International Counter Ransomware Initiative 2024 Joint Statement | The White House
Ransomware crew infects 100+ orgs monthly with BabyLockerKZ • The Register
Cyber Crime is Still Evil Corp, But Disruptions Are Helping (inforisktoday.com)
Healthcare organisations are having to pay millions to solve ransomware attacks | TechRadar
Here's what to expect from the Counter Ransomware Initiative meeting this week (therecord.media)
JPCERT shares Windows Event Log tips to detect ransomware attacks (bleepingcomputer.com)
Some of the world's biggest countries are teaming up to tackle ransomware scams | TechRadar
Ransomware August 2024 round-up: fools, rules and tools | TechFinitive
Ransomware Victims
Patelco Credit Union Data Breach Impacts Over 1 Million People - SecurityWeek
Ransomware forces Texas hospital to turn away ambulances • The Register
Agence France-Presse says cyber attack targeted IT systems (therecord.media)
Dermatology Practice Sued After Ransomware Attack Exposed Data (bloomberglaw.com)
Phishing & Email Based Attacks
UK on high alert over Iranian spear-phishing attacks, says NCSC | Computer Weekly
New report reveals a rise in phishing attacks, as commodity (globenewswire.com)
Beyond Phishing: AI's New Tricks for Cyber Attacks (govinfosecurity.com)
UK issues alert over threat from cyber attackers working for Iranian state | Evening Standard
iPhone, Android Users Warned After 50,000 Message Email Bomb Attack (forbes.com)
Common Words in Email Scams: Money, Income, Investment, More | Entrepreneur
QR Code phishing is advancing to a new level, so be on your guard | TechRadar
Attackers Targeting Recruiters With More_Eggs Backdoor (darkreading.com)
“Gone Phishing”—Every Cyber Attacker’s Favorite Phrase - Gigaom
IBM X-Force: Hackers Using Phishing, BEC to Steal Cloud Credentials | MSSP Alert
INTERPOL Arrests 8 in Major Phishing and Romance Fraud Crackdown in West Africa (thehackernews.com)
Ireland is the most phished country in the world, says survey (siliconrepublic.com)
Business Email Compromise (BEC)/Email Account Compromise (EAC)
IBM X-Force: Hackers Using Phishing, BEC to Steal Cloud Credentials | MSSP Alert
Other Social Engineering
QR Code phishing is advancing to a new level, so be on your guard | TechRadar
Students Add Facial Recognition to Meta Smart Glasses to Identify Strangers in Real-Time - MacRumors
INTERPOL Arrests 8 in Major Phishing and Romance Fraud Crackdown in West Africa (thehackernews.com)
Physical Security Is a Big Part of Staying Digitally Safe: My 5 Top Tips (makeuseof.com)
Meet the people hacker trying to improve cyber security (siliconrepublic.com)
Artificial Intelligence
AI-related cyber crime sparks concern among 65% of global survey participants (techmonitor.ai)
New report reveals a rise in phishing attacks, as commodity (globenewswire.com)
Is the Weakest Link in Cyber Security Becoming Even Weaker? | HackerNoon
Three essential steps for organisations to safeguard against deepfakes | TechRadar
Beyond Phishing: AI's New Tricks for Cyber Attacks (govinfosecurity.com)
Putting an end to the AI cyber responsibility turf wars | CyberScoop
Shadow AI, Data Exposure Plague Workplace Chatbot Use (darkreading.com)
FIN7 Gang Hides Malware in AI “Deepnude” Sites - Infosecurity Magazine (infosecurity-magazine.com)
Ukraine-Russia Cyber Battles Have Real-World Impact (darkreading.com)
Deepfake Ukrainian diplomat targeted US senator on Zoom call (bitdefender.com)
Could APIs be the undoing of AI? - Help Net Security
AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition (thehackernews.com)
1 in 4 people have experienced identity fraud - and most of them blame AI | ZDNET
Rogue AI: What the Security Community is Missing | Trend Micro (US)
Spotting AI-generated scams: Red flags to watch for - Help Net Security
Cyber security experts praise veto of California's AI safety bill | SC Media (scworld.com)
2FA/MFA
The most common authentication method is also the least secure - Help Net Security
Session Hijacking 2.0 — The Latest Way That Attackers are Bypassing MFA (thehackernews.com)
Malware
FIN7 Gang Hides Malware in AI “Deepnude” Sites - Infosecurity Magazine (infosecurity-magazine.com)
New Fin7 Hacker’s AI Naked Image Generator Serves Up More Than Nudes (forbes.com)
DCRat Malware Spreads via HTML Smuggling | MSSP Alert
Attackers Targeting Recruiters With More_Eggs Backdoor (darkreading.com)
Thousands of Linux systems infected by stealthy malware since 2021 (arstechnica.com)
Microsoft reveals how Windows 10 and Windows 11 block keyloggers - Neowin
AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition (thehackernews.com)
Here's How Criminals Use CAPTCHAs to Help Spread Malware (makeuseof.com)
North Korean Hackers Using New VeilShell Backdoor in Stealthy Cyber Attacks (thehackernews.com)
Bots/Botnets
New Cryptojacking Attack Targets Docker API to Create Malicious Swarm Botnet (thehackernews.com)
What bots mean for businesses and consumers - Help Net Security
Mobile
iPhone, Android Users Warned After 50,000 Message Email Bomb Attack (forbes.com)
This nasty Android adware is making phones unusable — how to stay safe | Tom's Guide (tomsguide.com)
‘Pig butchering’ trading apps found on Google Play, App Store (bleepingcomputer.com)
Verizon outage: iPhones, Android devices stuck in SOS mode (bleepingcomputer.com)
Denial of Service/DoS/DDoS
Record-Breaking DDoS Attack Peaked at 3.8 Tbps, 2.14 Billion Pps - SecurityWeek
After Code Execution, Researchers Show How CUPS Can Be Abused for DDoS Attacks - SecurityWeek
Hacktivist activity drives a rise in DDoS attacks (betanews.com)
Telcos face increasing frequency and sophistication of DDoS attacks - Nokia (telecoms.com)
Cloudflare mitigated new record-breaking DDoS attack of 3.8 Tbps (securityaffairs.com)
Wave of record-breaking DDoS attacks originating from compromised WiFi routers | Cybernews
Internet of Things – IoT
Trojan cars: Why the US fears Chinese cyber attacks on electric vehicles (france24.com)
Students Add Facial Recognition to Meta Smart Glasses to Identify Strangers in Real-Time - MacRumors
Data Breaches/Leaks
Transport for London (TfL) cyber attack: What you need to know - BBC News
43% of data breaches target small businesses in 5 industries | Retail Technology Review
UK data watchdog confirms it's investigating MoneyGram data breach | TechCrunch
Patelco Credit Union Data Breach Impacts Over 1 Million People - SecurityWeek
T-Mobile US agrees to $31.5M settlement after IT breaches • The Register
Dutch police breached by a state actor (securityaffairs.com)
Louisiana Accounting Firm Breach Impacts More Than 127K Customers | MSSP Alert
Organised Crime & Criminal Actors
UK man allegedly used genealogy sites to hack execs’ email accounts | Fortune
Cyber Crime is Still Evil Corp, But Disruptions Are Helping (inforisktoday.com)
How the FBI and Mandiant caught a 'serial hacker' who tried to fake his own death | TechCrunch
UK reveals father and son at heart of Evil Corp hacking group - BBC News
Man charged for selling forged license keys for network switches (bleepingcomputer.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Linux malware “perfctl” behind years-long cryptomining campaign (bleepingcomputer.com)
Over $750 Million Stolen in Crypto Last Quarter Despite Drop in Hacks: CertiK - Decrypt
New Cryptojacking Attack Targets Docker API to Create Malicious Swarm Botnet (thehackernews.com)
AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition (thehackernews.com)
Insider Risk and Insider Threats
Is the Weakest Link in Cyber Security Becoming Even Weaker? | HackerNoon
Insider Threats: Are Disgruntled Employees a Cyber Security Risk? | PLANSPONSOR
Insurance
A Guide to Buying and Maintaining Cyberinsurance | PLANSPONSOR
Beazley forecasts cyber insurance market to grow to $40bn by 2030 - Reinsurance News
Munich Re’s HSB launches comprehensive cyber insurance solution for SMBs - Reinsurance News
Supply Chain and Third Parties
Cyber companies need a best practice approach to major incidents. | Computer Weekly
Digital twins are optimizing supply chains and more. Here's why enterprises should care | ZDNET
Cloud/SaaS
Embargo ransomware escalates attacks to cloud environments (bleepingcomputer.com)
Microsoft: Cloud Environments of US Organisations Targeted in Ransomware Attacks - SecurityWeek
Cloud threats top execs' list of cyber nightmares • The Register
Cyber criminals capitalize on poorly configured cloud environments - Help Net Security
The top enterprise cloud threats of 2024 (betanews.com)
Hackers Breach Hybrid Cloud with Stolen Entra ID Credentials (petri.com)
IBM X-Force: Hackers Using Phishing, BEC to Steal Cloud Credentials | MSSP Alert
Hacker made millions from breaking into business Office 365 accounts | TechRadar
Navigating the Security Risks of Multicloud Management (darkreading.com)
Top 6 Cloud Security Threats to Watch Out For - Security Boulevard
The End of The SaaS Era: Rethinking Software’s Role In Business
Outages
Cyber companies need a best practice approach to major incidents. | Computer Weekly
UK Post Office axes MoneyGram services in wake of cyber attack (finextra.com)
Verizon outage: iPhones, Android devices stuck in SOS mode (bleepingcomputer.com)
The Playstation Network is down in a global outage (bleepingcomputer.com)
Identity and Access Management
Five Eyes Agencies Release Guidance on Detecting Active Directory Intrusions - SecurityWeek
Active Directory attack guidance issued by Five Eyes | SC Media (scworld.com)
Encryption
The fix for BGP’s weaknesses – RPKI – has issues of its own • The Register
Linux and Open Source
Worried about that critical RCE Linux bug? Here's why you can relax | ZDNET
After Code Execution, Researchers Show How CUPS Can Be Abused for DDoS Attacks - SecurityWeek
Thousands of Linux systems infected by stealthy malware since 2021 (arstechnica.com)
Passwords, Credential Stuffing & Brute Force Attacks
The most common authentication method is also the least secure - Help Net Security
Up to 600 million Facebook and Instagram passwords stored in plain text (9to5mac.com)
IBM X-Force: Hackers Using Phishing, BEC to Steal Cloud Credentials | MSSP Alert
Passkeys and Cyber Security Awareness: A New Era Of Business Security (informationsecuritybuzz.com)
Poor password habits still an issue worldwide (betanews.com)
Complicated Passwords Make You Less Safe, Experts Now Say (forbes.com)
Why your password policy should include a custom dictionary (bleepingcomputer.com)
Social Media
Up to 600 million Facebook and Instagram passwords stored in plain text (9to5mac.com)
Students Add Facial Recognition to Meta Smart Glasses to Identify Strangers in Real-Time - MacRumors
UK regulator preparing for ‘strong action’ against tech giants
Are social media influencers equipped to dodge cyber attacks? | Mint (livemint.com)
Brits bemoan personal data practices but do little about it • The Register
Training, Education and Awareness
Is the Weakest Link in Cyber Security Becoming Even Weaker? | HackerNoon
One-Third of UK Teachers Do Not Have Cyber Security Training (techrepublic.com)
Regulations, Fines and Legislation
NIS2 could prevent cyber security incidents but many businesses aren't ready (betanews.com)
Up to 600 million Facebook and Instagram passwords stored in plain text (9to5mac.com)
SolarWinds CISO: World's Cyber Regulations Still 'In Flux' (pymnts.com)
Sellafield nuclear site in Cumbria fined for IT security breaches - BBC News
Government outlines plan for Cyber Security and Resilience Bill | UKAuthority
How Should CISOs Navigate the SEC Cyber Security Rules? (darkreading.com)
Ireland to grant National Cyber Security Centre emergency powers (finextra.com)
Opinion: How to design a US data privacy law | Ars Technica
UK data watchdog confirms it's investigating MoneyGram data breach | TechCrunch
T-Mobile US agrees to $31.5M settlement after IT breaches • The Register
Opinion | Artificial Intelligence Requires Specific Safety Rules - The New York Times (nytimes.com)
Minimum Healthcare Cyber Standards Called by New Legislation | MSSP Alert
UK regulator preparing for ‘strong action’ against tech giants
Cyber Security in the European Union | Cooley LLP - JDSupra
Financial regulatory agencies are sunsetting a tool to assess cyber risks | FedScoop
Cyber security experts praise veto of California's AI safety bill | SC Media (scworld.com)
Models, Frameworks and Standards
NIS2 could prevent cyber security incidents but many businesses aren't ready (betanews.com)
Could Security Misconfigurations Top OWASP List? (darkreading.com)
Government outlines plan for Cyber Security and Resilience Bill | UKAuthority
Data Protection
Opinion: How to design a US data privacy law | Ars Technica
Brits bemoan personal data practices but do little about it • The Register
Careers, Working in Cyber and Information Security
Average North American CISO salary now $565,000 • The Register
Cyber UK's quickest growing tech field, but skills gap remains | Computer Weekly
Cyber security Professionals Operate Under Increased Stress Levels - Security Boulevard
How Are We Going to Fill 4.8 Million Cyber Security Jobs? (inforisktoday.com)
Cyber security hiring slows, pros' stress levels rise - Help Net Security
Share of Women in UK Cyber Roles Now Just 17% - Infosecurity Magazine (infosecurity-magazine.com)
Law Enforcement Action and Take Downs
Russia exploited Evil Corp relationship for NATO attacks • The Register
Unmasked: The Evil Corp cyber gangster who worked for LockBit | Computer Weekly
More LockBit Hackers Arrested, Unmasked as Law Enforcement Seizes Servers - SecurityWeek
Iranian hackers charged over Trump campaign disruption | TechRadar
U.S. charges Joker's Stash and Rescator money launderers (bleepingcomputer.com)
Law enforcement arrests vacationing LockBit developer in ongoing operation | TechSpot
Cyber Crime is Still Evil Corp, But Disruptions Are Helping (inforisktoday.com)
How the FBI and Mandiant caught a 'serial hacker' who tried to fake his own death | TechCrunch
UK reveals father and son at heart of Evil Corp hacking group - BBC News
INTERPOL Arrests 8 in Major Phishing and Romance Fraud Crackdown in West Africa (thehackernews.com)
Iranian hackers charged for ‘hack-and-leak’ plot to influence election (bleepingcomputer.com)
More frequent disruption operations needed to dent ransomware gangs, officials say | CyberScoop
Telegram revealed it shared U.S. user data with law enforcement (securityaffairs.com)
Man charged for selling forged license keys for network switches (bleepingcomputer.com)
Misinformation, Disinformation and Propaganda
Intel agencies warn of Iran's ongoing phishy behavior • The Register
Iranian hackers charged over Trump campaign disruption | TechRadar
Microsoft cracks down further on Russian hackers looking to disrupt elections | TechRadar
Deepfake Ukrainian diplomat targeted US senator on Zoom call (bitdefender.com)
Iranian hackers charged for ‘hack-and-leak’ plot to influence election (bleepingcomputer.com)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
CFOs Suit Up for Cyber War as Risk Management Evolves (pymnts.com)
Protecting Democratic Institutions from Cyber Threats - Microsoft On the Issues
Cyber Warfare and Cyber Espionage
Nation State Actors
China
Trojan cars: Why the US fears Chinese cyber attacks on electric vehicles (france24.com)
China-Linked CeranaKeeper Targeting Southeast Asia with Data Exfiltration (thehackernews.com)
Russia
Russia exploited Evil Corp relationship for NATO attacks • The Register
Multinational police effort hits sections of Lockbit ransomware operation | CyberScoop
Police arrest four suspects linked to LockBit ransomware gang (bleepingcomputer.com)
More LockBit Hackers Arrested, Unmasked as Law Enforcement Seizes Servers - SecurityWeek
Russia’s FSB protected Evil Corp gang that carried out Nato cyber-attacks (yahoo.com)
Trojan cars: Why the US fears Chinese cyber attacks on electric vehicles (france24.com)
Ukraine-Russia Cyber Battles Have Real-World Impact (darkreading.com)
Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure (bleepingcomputer.com)
Microsoft cracks down further on Russian hackers looking to disrupt elections | TechRadar
Deepfake Ukrainian diplomat targeted US senator on Zoom call (bitdefender.com)
bne IntelliNews - Russian tech startups, cyber security firms flourish amid sanctions
Russian authorities arrest nearly 100 in raids tied to cyber criminal money laundering | CyberScoop
Dutch police breached by a state actor (securityaffairs.com)
Law enforcement arrests vacationing LockBit developer in ongoing operation | TechSpot
Iran
UK on high alert over Iranian spear-phishing attacks, says NCSC | Computer Weekly
Intel agencies warn of Iran's ongoing phishy behaviour • The Register
Iranian hackers charged over Trump campaign disruption | TechRadar
Iranian hackers charged for ‘hack-and-leak’ plot to influence election (bleepingcomputer.com)
North Korea
North Korean Hackers Using New VeilShell Backdoor in Stealthy Cyber Attacks (thehackernews.com)
North Korea Profits as 'Stonefly' APT Swarms US Co's. (darkreading.com)
North Korean hackers attack Diehl Defence company - Militarnyi
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Hacktivist activity drives a rise in DDoS attacks (betanews.com)
ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions | WIRED
Tools and Controls
Is the Weakest Link in Cyber Security Becoming Even Weaker? | HackerNoon
CFOs Suit Up for Cyber War as Risk Management Evolves (pymnts.com)
Cyber companies need a best practice approach to major incidents. | Computer Weekly
Allies to Leverage During a Cyber Crisis (darkreading.com)
The cyber industry needs to accept it can't eliminate risk | Computer Weekly
As CISO roles expand, so should cyber budgets, says NASCIO 2024 cyber security report | StateScoop
Over Half of Cyber Professionals Feel Their Budget is Underfunded - IT Security Guru
Five Eyes Agencies Release Guidance on Detecting Active Directory Intrusions - SecurityWeek
How to Plan and Prepare for Penetration Testing (thehackernews.com)
Session Hijacking 2.0 — The Latest Way That Attackers are Bypassing MFA (thehackernews.com)
Moving DevOps Security Out of 'the Stone Age' (darkreading.com)
Security spending signals major role change for CISOs and their teams | CSO Online
Three hard truths hindering cloud-native detection and response - Help Net Security
Forrester's CISO Budget Planning Guide for 2025: Prioritize API Security - Security Boulevard
Gartner: CISOs should ditch ‘zero tolerance’ prevention (techinformed.com)
API security maturity model to assess API security posture | TechTarget
Top 6 Cloud Security Threats to Watch Out For - Security Boulevard
JPCERT shares Windows Event Log tips to detect ransomware attacks (bleepingcomputer.com)
The Silent Epidemic: Uncovering the Dangers of Alert Fatigue and How to Overcome It (cybereason.com)
Top 5 Myths of AI & Cyber Security (darkreading.com)
How organisations can derive value from security investments and enable business growth | ITPro
How to balance your understanding of threats and how you respond to them | ITPro
Does your security strategy show continuous improvement? | ITPro
The convergence of network and security – how it helps achieve business outcomes | ITPro
Other News
The cyber industry needs to accept it can't eliminate risk | Computer Weekly
Cyber incidents are the Achilles Heel for major UK CEOs, report finds (cityam.com)
Global cyber threat to double predicts new report (emergingrisks.co.uk)
Cyber teams say they can’t keep up with attack volumes | Computer Weekly
How Snoozing on Cyber Security Fails Modern Businesses - Security Boulevard
UK man allegedly used genealogy sites to hack execs’ email accounts | Fortune
UK Post Office axes MoneyGram services in wake of cyber attack (finextra.com)
Feds say Microsoft security ‘requires an overhaul’ — but will it listen? – Computerworld
Global cyber attacks will more than double this year to 211, says QBE - Reinsurance News
Critical Infrastructure: The latest target for cyber criminals? | TechRadar
When Innovation Outpaces Financial Services Cyber Security - Security Boulevard
Securing Space in the Age of Advanced Cyber Threats (eetimes.eu)
Schools reminded to maintain cyber hygiene by Ofqual | Education Business (educationbusinessuk.net)
America's policy in cyber space is about persistence, not deterrence (cyberscoop.com)
One-Third of UK Teachers Do Not Have Cyber Security Training (techrepublic.com)
Global Cyber Security Agencies Release OT Security Guidelines (inforisktoday.com)
Vulnerability Management
Could Security Misconfigurations Top OWASP List? (darkreading.com)
What are zero-day vulnerabilities? | TechRadar
NVD still backlogged with 17K+ unprocessed bugs • The Register
Systems used by courts and governments across the US riddled with vulnerabilities | Ars Technica
Vulnerabilities
Thousands of Adobe Commerce e-stores hacked by exploiting CosmicSting bug (securityaffairs.com)
Worried about that critical RCE Linux bug? Here's why you can relax | ZDNET
Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to Patch (thehackernews.com)
Progress Software Releases Patches for 6 Flaws in WhatsUp Gold – Patch Now (thehackernews.com)
New Chrome Security Warning For 3 Billion Windows, Mac, Linux, Android Users (forbes.com)
Rackspace systems hit by zero-day exploit of third-party app • The Register
Organisations Warned of Exploited SAP, Gpac and D-Link Vulnerabilities - SecurityWeek
Zimbra RCE Vuln Under Attack Needs Immediate Patching (darkreading.com)
700K+ DrayTek routers are sitting ducks on the internet • The Register
Critical flaw in NVIDIA Container Toolkit allows full host takeover (bleepingcomputer.com)
Microsoft fixes Windows KB5043145 reboot loops, USB and Bluetooth issues (bleepingcomputer.com)
VLC Player Vulnerability Let Attackers Execute Malicious Code (cybersecuritynews.com)
Arc browser adds security bulletins and bug bounties - The Verge
The fix for BGP’s weaknesses – RPKI – has issues of its own • The Register
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 27 September 2024
Black Arrow Cyber Threat Intelligence Briefing 27 September 2024:
-Cyber Threats Top the 2024 Travelers Risk Index, Fourth Time in Six Years
-Preparing for the Cyber Security and Fraud Risks of Deepfakes: What Executive Teams Need to Know
-Organisation Data on Dark Web Increases Cyber Attack Risk: Marsh McLennan
-84 Percent of Enterprises Suffered Security Incidents in the Last Year
-It's Estimated That 91% of Cyber Attacks Begin with Phishing Emails
-82% of Phishing Sites Now Target Mobile Devices
-UK Firms Are Dangerously Overconfident About Paying Ransoms to Cyber Criminals
-Preparing To Fail is a Vital Part of Cyber Security
-Over a Third of Employees Secretly Sharing Work Info with AI
-Fortifying the Weakest Link: How to Safeguard Against Supply Chain Cyber Attacks
-Underfunding and Leadership Gaps Weaken Cyber Security Defences
-Racist Network Rail Wi-Fi Hack was Work of Malicious Insider
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Cyber Threats Top the 2024 Travelers Risk Index, Fourth Time in Six Years
The 2024 Travelers Risk Index shows cyber threats as the top concern for 62% of businesses, surpassing medical cost inflation, employee benefits costs, and economic uncertainty (all at 59%). Despite increased awareness, 30% of over 1,200 respondents lack cyber insurance, though coverage rose to 65% from 60% last year. Cyber incidents rose for the eighth time in nine years, with 24% experiencing breaches. Key concerns include security breaches (57%), ransomware (54%), unsafe employee practices (53%), and system glitches (53%).
Preparing for the Cyber Security and Fraud Risks of Deepfakes: What Executive Teams Need to Know
Reports from the US National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the FBI highlight deepfake technology as a major concern due to the availability of AI tools. Deepfakes can replicate voices and likenesses, making impersonations undetectable. One company lost $25 million to deepfake fraud. Organisations are advised to implement response plans and detection technologies as they become more available, as well as shared phrases to validate identity, but many lack comprehensive strategies, leaving them vulnerable to deepfake-enabled fraud and reputational damage.
Organisation Data on Dark Web Increases Cyber Attack Risk: Marsh McLennan
Searchlight Cyber and the Marsh McLennan Cyber Risk Intelligence Center have found that the presence of any data related to an organisation on the dark web significantly increases the risk of cyber attacks. Despite this, many organisations lack visibility into their dark web exposure. The report emphasises that proactively monitoring the dark web can enable organisations to adjust their defences and effectively stop attacks before they occur.
84 Percent of Enterprises Suffered Security Incidents in the Last Year
Netwrix research shows 84% of enterprises experienced cyber attacks in the past year, up from 65% in 2023. AI automation increases attack frequency and sophistication. Over half of large organisations faced unexpected expenses to fix security gaps. Additionally, 22% faced compliance fines, and 21% suffered reduced competitive edge. Nearly 30% estimate financial damage from cyber threats of at least $50,000.
It's Estimated That 91% of Cyber Attacks Begin with Phishing Emails
Phishing emails cause significant disruption, with 91% of cyber attacks starting this way. Larger companies are vulnerable to lateral phishing (from internal compromised email accounts), while smaller businesses face frequent external phishing and extortion schemes. Smaller businesses experience nearly three times more extortion attacks than larger firms. Many organisations lack tailored security measures to combat evolving email risks, highlighting the need to prioritise email security.
82% of Phishing Sites Now Target Mobile Devices
Zimperium’s 2024 zLabs Global Mobile Threat Report finds 82% of phishing sites target mobile devices, with 76% using HTTPS to appear secure. Unique malware samples increased by 13% year-on-year, with riskware and trojans making up 80% of threats. Healthcare is the most affected industry, with 39% of mobile threats from phishing. Sideloaded apps (installed on a device through unofficial means, bypassing the standard app store) pose significant risks, especially in financial services where 68% of threats are linked to them. Advanced security solutions are essential to protect mobile endpoints.
UK Firms Are Dangerously Overconfident About Paying Ransoms to Cyber Criminals
Cohesity found that ransomware is a top concern for UK organisations, with over half experiencing attacks in 2023. Three-quarters would pay a ransom to recover data, despite only 4% fully recovering after payment. Costs averaged £870,000 per incident, with some reaching £20 million. Fewer than 2% restored operations within 24 hours, and one in five took up to two months. This highlights the need for resilience and robust recovery processes over ransom payments.
Preparing To Fail is a Vital Part of Cyber Security
The UK Government reports that 50% of businesses suffered cyber attacks in 2023. The Synnovis ransomware attack disrupted NHS services, highlighting unpreparedness for worst-case scenarios including when organisations rely on other organisations in their supply chain. Few organisations plan for high-impact risks or supply chain attacks. The report stresses the need for pre-assigned roles and responsibilities to ensure swift remediation. Preparing for the most damaging incidents is essential for organisational survival.
Over a Third of Employees Secretly Sharing Work Info with AI
CybSafe and the National Cyber Security Alliance found that employees sharing sensitive work information with AI tools without permission is a major concern. This behaviour is prevalent among Gen Z (46%) and millennials (43%). Despite awareness of AI risks, over half of employees lack training on safe AI use. Two-thirds of survey respondents worry AI will make scams harder to detect and increase cyber crime. Trust in companies’ AI implementation is low, with 35% expressing low trust. Organisations need training and robust policies to mitigate AI-related risks.
Fortifying the Weakest Link: How to Safeguard Against Supply Chain Cyber Attacks
Recent incidents have highlighted that vulnerabilities in widely-used IT and security tools are a top concern for organisations, with supply chain cyber attacks rising significantly between 2022 and 2023. Despite strengthening direct network defences, many organisations have yet to safeguard against third-party control failures. Key strategies include advanced supplier risk management, securing the software development pipeline, and implementing strong access controls. Adopting frameworks like the NIST cyber security framework and incorporating cyber security requirements into vendor contracts are essential. Without proactive measures, organisations remain vulnerable to significant reputational and operational damage from supply chain cyber attacks.
Underfunding and Leadership Gaps Weaken Cyber Security Defences
Trend Micro found that cyber security threats are the top concern for organisations, but many lack strategic leadership and investment. With 96% of IT leaders worried about the expanding attack surface, the report noted that despite blocking 161 billion threats in 2023, —a 10% increase from the previous year—nearly half of respondents said their leadership did not consider cyber security their responsibility. Only 36% can afford 24/7 coverage, leading to fragmented approaches. Over half believe their organisation’s attitude towards cyber security varies monthly, highlighting inconsistency in risk management. Cyber security is a boardroom issue, and neglecting it could have disastrous consequences.
Racist Network Rail Wi-Fi Hack was Work of Malicious Insider
A cyber attack on public Wi-Fi at 19 UK railway stations on 25 September blocked passengers from accessing the service, receiving racist and Islamophobic messages instead. The British Transport Police arrested an employee of GlobalReach Technology, the Wi-Fi provider, for suspected involvement. Although no personal data was compromised, the incident underscores the significant risks posed by malicious insiders. Telent, responsible for the network, aims to restore services by the weekend. This event highlights the need for robust insider threat mitigation strategies.
Sources:
https://www.jdsupra.com/legalnews/preparing-for-the-cybersecurity-and-3002248/
https://hackernoon.com/its-estimated-that-91percent-of-cyber-attacks-begin-with-phishing-emails
https://www.infosecurity-magazine.com/news/82-phishing-target-mobile-devices/
https://www.infosecurity-magazine.com/news/third-employees-sharing-work-info/
https://informationsecuritybuzz.com/underfunding-and-leadership-gaps-weaken-cybersecurity-defenses/
Governance, Risk and Compliance
84 percent of enterprises suffered security incidents in the last year (betanews.com)
AI threats pushing cyber pros to seek legal safeguards | Cybernews
Preparing to fail is a vital part of cyber security - Ian McGowan (scotsman.com)
AI Adoption Set to Unravel Years of Cyber Resilience - IT Security Guru
Brands are changing cyber security strategies due to AI threats (securityintelligence.com)
Underfunding And Leadership Gaps Weaken Cyber Security Defences (informationsecuritybuzz.com)
How Cyber-Risk & Business Risk Are the Same (darkreading.com)
Cyber threats top the 2024 Travelers Risk Index, fourth time in six years - Reinsurance News
New cyber security advisory highlights defence-in-depth strategies (securityintelligence.com)
How cyber compliance helps minimize the risk of ransomware infections - Help Net Security
What to do - and not to do - when you suffer a cyber-attack (businesscloud.co.uk)
Reporting cyber security posture and systemic risk to the board | CIO
How to give cyber security the priority treatment it deserves (moneymarketing.co.uk)
Balancing Risk and Innovation - A CISO Perspective | Security Magazine
Digital security is everyone's concern – Daily Business Magazine (dailybusinessgroup.co.uk)
Are You Sabotaging Your Cyber Security Posture? - Security Boulevard
Round-the-Clock Cyber Coverage Lacking in Many Orgs | MSSP Alert
Threats
Ransomware, Extortion and Destructive Attacks
Companies Often Pay Ransomware Attackers Multiple Times - Security Boulevard
Cyber security experts urge a stronger security posture in response to AI attacks - SiliconANGLE
ENISA Warns About Hacktivist, Ransomware Crossover (databreachtoday.co.uk)
UK firms are dangerously overconfident about paying ransoms to cyber criminals | ITPro
MFA bypass becomes a critical security issue as ransomware tactics advance - Help Net Security
Ransomware Task Force finds 73% attack increase in 2023 | TechTarget
How cyber compliance helps minimize the risk of ransomware infections - Help Net Security
Warnings After New Valencia Ransomware Group Strikes Businesses and Leaks Data | Tripwire
Two-Thirds of Healthcare Organisations Hit by Ransomware – (globenewswire.com)
Ransomware Victims
ICO Fine Software Provider £6M Following Ransomware Attack (nelsonslaw.co.uk)
Two-Thirds of Healthcare Organisations Hit by Ransomware – (globenewswire.com)
Cyber attack could cost Western Isles council more than £1m - BBC News
Lancaster Royal Grammar targeted by cyber ransom hackers - BBC News
AutoCanada says ransomware attack "may" impact employee data (bleepingcomputer.com)
US government agency confirms it was hit by major ransomware attack | TechRadar
Delaware Libraries confirms RansomHub cyber attack • The Register
Phishing & Email Based Attacks
It's Estimated That 91% Of Cyber Attacks Begin With Phishing Emails | HackerNoon
Phishing and deepfakes are leading AI-powered threats (betanews.com)
82% of Phishing Sites Now Target Mobile Devices - Infosecurity Magazine (infosecurity-magazine.com)
Enterprises suffer surge in mobile phishing attacks (betanews.com)
Europol Shuts Down Major Phishing Scheme Targeting Mobile Phone Credentials (thehackernews.com)
This Phishing Service Helped Criminals Break Into 1 Million+ Stolen Phones (pcmag.com)
Marko Polo hackers found to be running dozens of scams | SC Media (scmagazine.com)
One quarter of small business owners have been targeted by AI-driven scams (prnewswire.com)
75% of organisations say phishing poses the greatest AI risk | Security Magazine
Microsoft 365 Credentials Targeted by TikTok URL-Based Phishing | MSSP Alert
Other Social Engineering
Beware: fraud and smishing scams targeting students | Bournemouth University
US indicts two over socially engineered $230M+ crypto heist • The Register
How to Stop Getting Spam Calls? This Expert Weighs In. (dailydot.com)
Artificial Intelligence
These Are Cyber Chiefs' Biggest Fears About AI (investopedia.com)
Phishing and deepfakes are leading AI-powered threats (betanews.com)
AI threats pushing cyber pros to seek legal safeguards | Cybernews
AI Adoption Set to Unravel Years of Cyber Resilience - IT Security Guru
Brands are changing cybersecurity strategies due to AI threats (securityintelligence.com)
Less Than Half of AI Users Trained on Security and (globenewswire.com)
HackerOne: 48% of Security Professionals Believe AI Is Risky (techrepublic.com)
Hackers deploy AI-written malware in targeted attacks (bleepingcomputer.com)
One quarter of small business owners have been targeted by AI-driven scams (prnewswire.com)
Hacker plants false memories in ChatGPT to steal user data in perpetuity | Ars Technica
Are new gen AI tools putting your business at additional risk? (securityintelligence.com)
SANS Institute: Top 5 dangerous cyber attack techniques in 2024 (securityintelligence.com)
LinkedIn Halts AI Data Processing in UK Amid Privacy Concerns Raised by ICO (thehackernews.com)
Police are using AI to write crime reports. What could go wrong? | ZDNET
2FA/MFA
MFA bypass becomes a critical security issue as ransomware tactics advance - Help Net Security
New Chrome Alert After Hackers Claim 2FA Security Cracked In 10 Minutes (forbes.com)
Malware
AI’s Influence on Malware Attacks Tops IT Pros’ Concerns | MSSP Alert
Unique malware sample volumes seen surging | Computer Weekly
New MacOS Malware Let Attackers Control The Device Remotely (cybersecuritynews.com)
HP Spots a Malware Attack That Was Likely Built With Generative AI (pcmag.com)
RomCom Malware Resurfaces With SnipBot Variant (darkreading.com)
Infostealer malware bypasses Chrome’s new cookie-theft defences (bleepingcomputer.com)
This Windows malware is now evolving to target Linux systems | TechRadar
Move over, Cobalt Strike, there's a new post-exploit tool • The Register
Global infostealer malware operation targets crypto users, gamers (bleepingcomputer.com)
New PondRAT Malware Hidden in Python Packages Targets Software Developers (thehackernews.com)
Russia clings to malware as attacks on Ukraine persist • The Register
Bots/Botnets
65% of websites are unprotected against simple bot attacks - Help Net Security
Mobile
82% of Phishing Sites Now Target Mobile Devices - Infosecurity Magazine (infosecurity-magazine.com)
Mobile Phishing Attacks Targeting Enterprises Surge, Zimperium Researchers Find (prnewswire.com)
The NSA advises you to turn off your phone once a week - here's why | ZDNET
Europol Shuts Down Major Phishing Scheme Targeting Mobile Phone Credentials (thehackernews.com)
New Octo Android malware version impersonates NordVPN, Google Chrome (bleepingcomputer.com)
This Phishing Service Helped Criminals Break Into 1 Million+ Stolen Phones (pcmag.com)
New Android banking trojan Octo2 targets European banks (securityaffairs.com)
Victims lose $70k to Play Store wallet-draining app • The Register
Opinion | Israel’s Pager Attacks Have Changed the World - The New York Times (nytimes.com)
How Digital Forensics Experts Read Your Encrypted WhatsApp Messages (forbes.com)
Denial of Service/DoS/DDoS
DDoS overtakes ransomware as most active cyber threat in Europe | Cybernews
Austria subjected to pro-Russian DDoS intrusions | SC Media (scworld.com)
Internet of Things – IoT
3 tips for securing IoT devices in a connected world - Help Net Security
Hacking Kia cars made after 2013 using just their license plate (securityaffairs.com)
Data Breaches/Leaks
TfL sends letters to 5,000 cyber attack customers whose details were hacked | Evening Standard
'Harvest now, decrypt later': Why hackers are waiting for quantum computing | VentureBeat
Dell's Security Woes Deepen: Attackers Strike Twice In One Week (informationsecuritybuzz.com)
Harvey Nichols confirms cyber attack, says customer data leaked | TechRadar
Twilio Call Data Exposed | MSSP Alert
Over 90 million French records exposed: mysterious data hoarder leaves instances open | Cybernews
Data of 3,191 congressional staffers leaked in the dark web (securityaffairs.com)
Threat Actor IntelBroker Allegedly Claims Leak of Deloitte Data (cybersecuritynews.com)
US Capitol Hit by Massive Dark Web Cyber Attack - Newsweek
Hacker uses Telegram chatbots to leak data - Security - iTnews
AutoCanada says ransomware attack "may" impact employee data (bleepingcomputer.com)
Organised Crime & Criminal Actors
ENISA Warns About Hacktivist, Ransomware Crossover (databreachtoday.co.uk)
Why so many hackers are Russian | Cybernews
Why so many hackers are Russian: Vol 2 | Cybernews
Life imitates xkcd comic as Florida gang beats crypto password from retiree | Ars Technica
Cybersecurity Experts Closing in on Ticketmaster Hacker (digitalmusicnews.com)
Risk & Repeat: What's next for Telegram and Pavel Durov? | TechTarget
Telegram CEO Pavel Durov will hand over data to government (nypost.com)
Shocking poll: Half the world has fallen victim to cyber attacks (studyfinds.org)
Why Russia is a Hotbed of Cyber Crime | Intel471
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Life imitates xkcd comic as Florida gang beats crypto password from retiree | Ars Technica
Hackers stole over $44 million from Asian crypto platform BingX (securityaffairs.com)
Marko Polo hackers found to be running dozens of scams | SC Media (scmagazine.com)
An official OpenAI X account just got hacked by crypto scammers | Mashable
US indicts two over socially engineered $230M+ crypto heist • The Register
Global infostealer malware operation targets crypto users, gamers (bleepingcomputer.com)
Insider Risk and Insider Threats
Racist Network Rail Wi-Fi hack was work of malicious insider | Computer Weekly
Mandiant gives tips on catching North Korean IT operatives • The Register
The Importance of Cyber Security Awareness and Insider Threat Management - Security Boulevard
Why insider threats are cyber security’s next big challenge - Hindustan Times
Insurance
Cyber insurance price hikes stabilize as insurers expect more from CISOs | CSO Online
The surge in cyber insurance and what it means for your business - Help Net Security
Cyber Insurers Owe Millions for Attack, Transcription Firm Says (bloomberglaw.com)
Supply Chain and Third Parties
China's 'Salt Typhoon' Cooks Up Cyber Attacks on US ISPs (darkreading.com)
Cyber security: Remember, We Are All Connected (epsnews.com)
Evaluating embedded vulnerabilities and cyber security risks in procurement | TechRadar
CrowdStrike to Congress: 'Perfect storm' led to IT outage • The Register
Fortifying the Weakest Link: How to Safeguard Against Supply Chain Cyber Attacks - SecurityWeek
Cloud/SaaS
AWS says customers are turning back to on-prem | TechRadar
Microsoft Trims Cloud Cyber Attack Surface (darkreading.com)
Microsoft 365 Credentials Targeted by TikTok URL-Based Phishing | MSSP Alert
Ivanti's Cloud Service Attacked via Second Vuln (darkreading.com)
Outages
'Cyber security issue' blamed for MoneyGram's ongoing outage • The Register
CrowdStrike exec to apologize for faulty update that caused global IT outage (yahoo.com)
CrowdStrike to Congress: 'Perfect storm' led to IT outage • The Register
Identity and Access Management
Securing non-human identities: Why fragmented strategies fail - Help Net Security
Active Directory compromise: Cyber security agencies provide guidance - Help Net Security
Encryption
How to prepare for post-quantum computing security | TechTarget
'Harvest now, decrypt later': Why hackers are waiting for quantum computing | VentureBeat
G7 Cyber Expert Group warns financial sector of quantum computing | SC Media (scworld.com)
How Digital Forensics Experts Read Your Encrypted WhatsApp Messages (forbes.com)
Linux and Open Source
Doomsday 9.9 unauthenticated RCE bug affects 'all Linux' • The Register
Printer bug sends researchers into uproar, affects major Linux distros | CyberScoop
This Windows malware is now evolving to target Linux systems | TechRadar
New Mallox ransomware Linux variant based on leaked Kryptina code (bleepingcomputer.com)
Paid open-source maintainers spend more time on security - Help Net Security
FreeBSD Hypervisor Vulnerability Lets Attackers Execute Malicious Code (cybersecuritynews.com)
Passwords, Credential Stuffing & Brute Force Attacks
Why You Need a Longer Password (howtogeek.com)
Public Sector Compliance: Passwords and Credentials Matter - Security Boulevard
Social Media
Microsoft 365 Credentials Targeted by TikTok URL-Based Phishing | MSSP Alert
An official OpenAI X account just got hacked by crypto scammers | Mashable
LinkedIn Halts AI Data Processing in UK Amid Privacy Concerns Raised by ICO (thehackernews.com)
42% of daily X users have a negative view of it - losing the block feature won't help | ZDNET
X's first transparency report since Musk reveals a surprising contradiction | ZDNET
Malvertising
Training, Education and Awareness
STUDY: Less Than Half of AI Users Trained on Security and (globenewswire.com)
Combating phishing attacks through awareness and simulation | Cybernews
The Importance of Cyber Security Awareness and Insider Threat Management - Security Boulevard
Regulations, Fines and Legislation
ICO Fine Software Provider £6M Following Ransomware Attack (nelsonslaw.co.uk)
Rethinking the United Nations Cybercrime Treaty (justsecurity.org)
Cyber Security | UK Regulatory Outlook September 2024 - Osborne Clarke | Osborne Clarke
UK government's bank data sharing plan blasted by critics • The Register
Models, Frameworks and Standards
New NIST program focuses on AI cyber security and privacy | SC Media (scmagazine.com)
Backup and Recovery
Isolated Cyber Vaults: The last line of defence against billions of attacks | TechRadar
Data Protection
LinkedIn Halts AI Data Processing in UK Amid Privacy Concerns Raised by ICO (thehackernews.com)
Careers, Working in Cyber and Information Security
It’s Never Too Late: Transitioning to a Career in Cyber Security - IT Security Guru
Future-proofing cyber security: Why talent development is key - Help Net Security
Round-the-Clock Cyber Coverage Lacking in Many Orgs | MSSP Alert
Law Enforcement Action and Take Downs
Europol Shuts Down Major Phishing Scheme Targeting Mobile Phone Credentials (thehackernews.com)
This Phishing Service Helped Criminals Break Into 1 Million+ Stolen Phones (pcmag.com)
Telegram Agrees to Share User Data with Authorities for Criminal Investigations (thehackernews.com)
US indicts two over socially engineered $230M+ crypto heist • The Register
Risk & Repeat: What's next for Telegram and Pavel Durov? | TechTarget
Telegram CEO Pavel Durov will hand over data to government (nypost.com)
FBI raids government IT and cyber contractor Carahsoft - Nextgov/FCW
Misinformation, Disinformation and Propaganda
Fake UK news sites ‘spreading false stories’ about western firms in Ukraine | Russia | The Guardian
How Russia, China & Iran Are Targeting US Elections (darkreading.com)
China are the real hackers not us, Taiwan says after cyber accusations, Asia News - AsiaOne
Iranian-linked election interference operation shows signs of recent access | CyberScoop
Officials: Fake Kamala Harris Videos Part of Russian Influence Operations | MSSP Alert
China urges vigilance against Taiwanese cyber attacks - CNA (channelnewsasia.com)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Developing an effective cyber warfare response plan - Help Net Security
Volt Typhoon: The real end game of evolving nation-state threats - SiliconANGLE
The Supply Chain Conspiracy: Cyber Attacks Behind the Lebanon Explosions - Security Boulevard
Nation State Actors
Bulk of data centre cyber attacks coming from hostile states, warn EU experts (irishexaminer.com)
How Russia, China & Iran Are Targeting US Elections (darkreading.com)
China
US ISPs targeted by new Chinese cyber espionage gang | SC Media (scworld.com)
China's Salt Typhoon cyber spies spotted deep inside US ISPs • The Register
Chinese hackers allegedly hacked US ISPs for cyber espionage | CSO Online
Noise Storms: Massive Amounts of Spoofed Web Traffic Linked to China - SecurityWeek
China's 'Salt Typhoon' Cooks Up Cyber Attacks on US ISPs (darkreading.com)
Chinese APT Earth Baxia target APAC by exploiting GeoServer flaw (securityaffairs.com)
Noise Storms: Mysterious massive waves of spoofed traffic observed since 2020 (securityaffairs.com)
China are the real hackers not us, Taiwan says after cyber accusations, Asia News - AsiaOne
China urges vigilance against Taiwanese cyber attacks - CNA (channelnewsasia.com)
Russia
Fake UK news sites ‘spreading false stories’ about western firms in Ukraine | Russia | The Guardian
Russia-backed Gamaredon still ‘most engaged’ hacker group in Ukraine (therecord.media)
Ukraine sees shift in Russian hacking tactics: more widespread, less severe | Cybernews
Officials: Fake Kamala Harris Videos Part of Russian Influence Operations | MSSP Alert
Why so many hackers are Russian | Cybernews
Why so many hackers are Russian: Vol 2 | Cybernews
Russia clings to malware as attacks on Ukraine persist • The Register
Why Russia is a Hotbed of Cyber Crime | Intel471
Hacktivist Group Twelve Targets Russian Entities with Destructive Cyber Attacks (thehackernews.com)
Kaspersky deletes itself, installs UltraAV antivirus without warning (bleepingcomputer.com)
Austria subjected to pro-Russian DDoS intrusions | SC Media (scworld.com)
Iran
UNC1860 provides Iran-linked APTs with access to Middle Eastern networks (securityaffairs.com)
Bulk of data centre cyber attacks coming from hostile states, warn EU experts (irishexaminer.com)
Concealed Fox Kitten infrastructure exposed | SC Media (scworld.com)
Sweden blames Iran for cyber-attack after Quran-burnings - BBC News
Iranian-linked election interference operation shows signs of recent access | CyberScoop
North Korea
Mandiant gives tips on catching North Korean IT operatives • The Register
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Did Israel infiltrate Lebanese telecoms networks? (securityaffairs.com)
ENISA Warns About Hacktivist, Ransomware Crossover (databreachtoday.co.uk)
Tools and Controls
Preparing to fail is a vital part of cyber security - Ian McGowan (scotsman.com)
AI Adoption Set to Unravel Years of Cyber Resilience - IT Security Guru
Less Than Half of AI Users Trained on Security and (globenewswire.com)
MFA bypass becomes a critical security issue as ransomware tactics advance - Help Net Security
Cloud Exit: 42% of Companies Move Data Back On-Premises - Techopedia
Why threat intelligence is essential to consolidated security | SC Media (scmagazine.com)
Mastercard's Bet on Recorded Future a Win for CTI (darkreading.com)
New cyber security advisory highlights defence-in-depth strategies (securityintelligence.com)
Combating phishing attacks through awareness and simulation | Cybernews
Developing an effective cyber warfare response plan - Help Net Security
Active Directory compromise: Cyber Security agencies provide guidance - Help Net Security
Keep Tier-One Applications Out of Virtual Environments (darkreading.com)
Boredom Is the Silent Killer in Your IT Systems (darkreading.com)
When technical debt strikes the security stack | CSO Online
What Does Platformization Mean for MSSPs and MDRs? | MSSP Alert
What Is Cyber Threat Hunting? (techrepublic.com)
Bulk of data centre cyber attacks coming from hostile states, warn EU experts (irishexaminer.com)
65% of websites are unprotected against simple bot attacks - Help Net Security
CrowdStrike exec to apologize for faulty update that caused global IT outage (yahoo.com)
Securing non-human identities: Why fragmented strategies fail - Help Net Security
Kaspersky users shocked by automatic antivirus replacement without explicit permission | Cybernews
Offensive cyber operations are more than just attacks - Help Net Security
Privacy And API Security: What’s At Stake? (informationsecuritybuzz.com)
How automated red teaming can improve your cyber security | Tech Donut
Move over, Cobalt Strike, there's a new post-exploit tool • The Register
Other News
Small doesn’t mean safe: how SMEs are under attack (smh.com.au)
Digital security is everyone's concern – Daily Business Magazine (dailybusinessgroup.co.uk)
Microsoft Trims Cloud Cyber Attack Surface (darkreading.com)
How Microsoft Is Beefing Up Security With 34,000 Engineers (databreachtoday.co.uk)
Microsoft CEO to cyber team: Don’t tell me how great everything is | The Seattle Times
Are You Sabotaging Your Cyber Security Posture? - Security Boulevard
Cyber security threats target healthcare - SiliconANGLE
ISO - Healthcare cyber security: Diagnosing risks, prescribing solutions
5 Cyber Security Threats Every Startup Should Know | LevelBlue (att.com)
Google, Apple and the antitrust tipping point (ft.com)
10 security bugs put fuel storage tanks at risk of attacks • The Register
6 Cyber Security Headaches Sporting Events Suffer (darkreading.com)
A lesson in cyber threats: Building resilient networks in education | theHRD (thehrdirector.com)
Vulnerability Management
Microsoft ends development of Windows Server Update Services (WSUS) (bleepingcomputer.com)
Windows Server 2025 gets hotpatching option, without reboots - Help Net Security
Boredom Is the Silent Killer in Your IT Systems (darkreading.com)
When technical debt strikes the security stack | CSO Online
EPSS vs. CVSS: What's the Best Approach to Vulnerability Prioritization? (thehackernews.com)
60% of vulnerabilities were leveraged against Microsoft Exchange | Security Magazine
Vulnerabilities
Zero-Click MediaTek Bug Opens Phones, Wi-Fi to Takeover (darkreading.com)
Doomsday 9.9 unauthenticated RCE bug affects 'all Linux' • The Register
Critical Linux bug is CUPS-based remote-code execution hole • The Register
Cisco Patches High-Severity Vulnerabilities in IOS Software - SecurityWeek
Critical Ivanti vTM auth bypass bug now exploited in attacks (bleepingcomputer.com)
Third Recent Ivanti Vulnerability Exploited in the Wild - SecurityWeek
Citrix Releases Security Updates for XenServer and Citrix Hypervisor | CISA
HPE patches three critical flaws in Aruba software • The Register
Researcher reveals ‘catastrophic’ security flaw in the Arc browser - The Verge
Versa Networks Releases Advisory for a Vulnerability in Versa Director, CVE-2024-45229 | CISA
CERT/CC Warns of Unpatched Critical Vulnerability in Microchip ASF - SecurityWeek
ESET Patches Privilege Escalation Vulnerabilities in Windows, macOS Products - SecurityWeek
FreeBSD Hypervisor Vulnerability Lets Attackers Execute Malicious Code (cybersecuritynews.com)
60% of vulnerabilities were leveraged against Microsoft Exchange | Security Magazine
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime & Shipping
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.