Black Arrow Cyber Threat Briefing 01 October 2021
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Cyber Second Only To Climate Change As Biggest Global Risk
Cyber security has been ranked as the second largest threat to our way of life in a major new survey of 23,000 people, comprised of both experts and members of the public. Cyber came second only to climate change on the world stage, but was ranked as the number one risk in the Americas and second in Asia, Africa, and Europe. https://www.infosecurity-magazine.com/news/cyber-second-biggest-global-risk/
Businesses Unsure Which Tech Is Essential Against Ransomware
As ransomware attacks grow in number, a new report finds that many organisations are under the impression they have things in hand but most are unsure what protections they should have in place. The report, based on a survey of 455 business leaders and cyber security professionals, claims businesses are on top of employee training, risk assessments and cyber insurance. Where firms fall flat however is their “clear gap” in thinking, in what many respondents see as “essential tech” in the fight against ransomware – nearly half of respondents (49%) thought paying up was their best option. https://www.techradar.com/news/businesses-unsure-which-tech-is-essential-against-ransomware
Cyber Crime Awareness Heightened, Yet People Still Engage In Risky Online Behaviours
A survey of over 2,000 adults suggests that 76% of respondents recognise the severity of data breaches. This heightened awareness may be driven by constant news of major consumer, enterprise and infrastructural breaches over the last year alone. https://www.helpnetsecurity.com/2021/10/01/risky-online-behaviors/
Attacks Against Remote Desktop Protocol Endpoints Have Exploded This Year
A recent report warns of a huge increase in attacks on the Remote Desktop Protocol (RDP), an almost universal protocol used by nearly every business in operation today. The figures show attacks on RDP have jumped 103.9% since its T1 report in June and represents around 55 billion devices. The RDP protocol is leveraged by threat actors to deploy ransomware and has become a popular target due to both heavy use by IT service providers and common misconfigurations. https://www.theregister.com/2021/09/30/eset_threat_report/
Ransomware Attacks Up 1,070% Year Over Year
The prevalence of ransomware is growing rapidly, according to the 2021 Ransomware Survey Report. The report shockingly found many of the ransom demands are paid, and comes as a result in the rise of “ransomware as-a-service”. The report found 94% of businesses are concerned about ransomware, with 49% stating they would simply pay the ransom outright. Respondents in Europe were more concerned than those in North America, and around 67% felt they had already been the target of ransomware. https://www.msspalert.com/cybersecurity-research/fortinet-report-ransomware-attacks-up-1070-year-over-year/
Baby’s Death Alleged To Be Linked To Ransomware
A US hospital paralyzed by ransomware in 2019 will be defending itself in court this November over the death of a newborn. The baby was born amid the hospital’s eighth day of fending off the attack. Court filings show the hospital – Springhill Medical Center in Alabama – believes wireless tracking systems and heartbeat monitoring equipment were compromised by the ransomware, leading to the death.
https://threatpost.com/babys-death-linked-ransomware/175232/
Ransomware Shame: More Than Half Of Business Owners Conceal Cyber-Breach
Around a third (32%) of enterprises experienced a six-figure breach last year, but well over half (61%) admitted to concealing it. The findings come as a global survey of 1,400 decision makers in cyber is released. https://www.foxbusiness.com/technology/ransomware-cyber-breach-concealed
More Than 90% Of Q2 Malware Was Hidden In Encrypted Traffic
Around 91.5% of malware detections in Q1 2021 were concealed in HTTPS-encrypted connections. A ubiquitous protocol – used to secure traffic any time you open a web page – only 20% of organisations have mechanisms in place to scan the arriving HTTPS traffic. The terrifying result found that most firms are missing over nine-tenths of malware hitting their networks every day. https://www.darkreading.com/perimeter/more-than-90-of-q2-malware-was-hidden-in-encrypted-traffic
Cyber Attack Floors British Payroll Firm
A "sophisticated" cyber attack has forced a British payroll company to shut down its entire network, leaving some contractors without pay. Giant Group confirmed on September 24 that it had taken its network, fully integrated IT infrastructure, phone, and email systems offline last Wednesday after detecting suspicious activity. https://www.infosecurity-magazine.com/news/cyberattack-floors-british-payroll/#.YVQiuXlCjOA.twitter
GriftHorse Malware Infected More Than 10 Million Android Phones From 70 Countries
A malicious trojan has been making its way through the Google Play Store since at least November of 2020. The app, purportedly harmless on the surface, hijacks payments on the victim device, resulting in a series of hidden charges and a nasty surprise at the end of the month. Researchers who discovered the malware estimate its impact to be over 10 million victims in 70 countries, and several hundreds of millions of Euros in losses. https://securityaffairs.co/wordpress/122730/malware/grifthorse-malware-campaign.html
50% Of Servers Have Weak Security Long After Patches Are Released
Over 50% of servers scanned still have weak security, a new study suggests, even after patches have been issued. Researchers found that servers were still vulnerable weeks and even months after critical updates, leaving many businesses wide open to attack. https://www.darkreading.com/vulnerabilities-threats/50-of-servers-have-weak-security-long-after-patches-are-released
Threats
Ransomware
United Health Centres Reportedly Compromised By Ransomware Attack
JVCKenwood Hit By Conti Ransomware Claiming Theft Of 1.5TB Data
Ransomware Gangs Are Complaining That Other Crooks Are Stealing Their Ransoms
United Health Centers Reportedly Compromised By Ransomware Attack
REvil Customers Complain Ransomware Gang Uses Backdoors To Filch Ransoms
The Biggest Problem With Ransomware Is Not Encryption, But Credentials
Phishing
Other Social Engineering
Malware
Thousands Of Online Gaming Accounts Hit In Major Cyber Attack
Microsoft Warns of FoggyWeb Malware Targeting Active Directory FS Servers
New Malware Steals Steam, Epic Games Store, And EA Origin Accounts
Vulnerabilities
Threat Actors Use Recently Discovered CVE-2021-26084 Atlassian Confluence
New Azure AD Bug Lets Hackers Brute-Force Passwords Without Getting Caught
Thousands of University Wi-Fi Networks Expose Log-In Credentials
Exploit Released For VMware Vulnerability After CISA Warning
Outsourced Software Poses Greater Risks to Enterprise Application Security
Working Exploit Is Out for VMware vCenter CVE-2021-22005 Flaw
Apple Responds To Security Researcher Who Found Multiple iOS 15 Zero-Day Flaws
Windows 10 Emergency Update Resolves KB5005565 App Freezes, Crashes
Cyber Security Vulnerability Could Affect Millions Of Hikvision Cameras
Data Breaches/Leaks
Anonymous: We've Leaked Disk Images Stolen From Far-Right-Friendly Web Host Epik
3.8 Billion Users’ Combined Clubhouse, Facebook Data Up for Sale
Emails, Chat Logs, More Leaked Online From Far-Right Militia Linked To US Capitol Riot
Cryptocurrency/Cryptojacking
Ethereum Dev Admits Helping North Korea Mine Crypto-Bucks, Faces 20 Years Jail
China Says All Crypto Currency-Related Transactions Are Illegal And Must Be Banned
Insider Threats
Dark Web
DoS/DDoS
Nation State Actors
APT Focus: ‘Noisy’ Russian Hacking Crews Are Among The World’s Most Sophisticated
APT29 Targets Active Directory Federation Services With Stealthy Backdoor
Nation-State Attacks Fears Grow, Execs Don’t Trust Governments To Protect Them From Cyber Threats
APT focus: ‘Noisy’ Russian hacking crews are among the world’s most sophisticated
Cloud
Huawei Cloud Services: U.S. Lawmakers Express Security Concerns
Why CEOs Should Absolutely Concern Themselves With Cloud Security
Cloud Security: Report Finds 68% of Malware Delivered From Cloud Apps
Privacy
Reports Published in the Last Week
Other News
Revealed: How To Steal Money From Victims' Contactless Apple Pay Wallets
Threat Actors Weaponize Telegram Bots to Compromise PayPal Accounts
Report Highlights Cyber Security Dangers Of Elastic Stack Implementation Mistakes
Russian Authorities Arrest Cyber Security Giant Group-IB’s CEO On Treason Charges
Corporate Attack Surface Exploding As A Result Of Remote Work
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.