Black Arrow Cyber Threat Briefing 08 April 2022
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Nearly Two-Thirds of Ransomware Victims Paid Ransoms Last Year, Finds "2022 Cyberthreat Defense Report"
CyberEdge Group, a leading research and marketing firm serving the cyber security industry’s top vendors, announced the launch of its ninth annual Cyberthreat Defense Report (CDR). The award-winning CDR is the standard for assessing organisations’ security posture, gauging perceptions of information technology (IT) security professionals, and ascertaining current and planned investments in IT security infrastructure – across all industries and geographic regions.
A record 71% of organisations were impacted by successful ransomware attacks last year, according to the 2022 CDR, up from 55% in 2017. Of those that were victimised, nearly two-thirds (63%) paid the requested ransom, up from 39% in 2017.
New Android Banking Malware Remotely Takes Control of Your Device
A new Android banking malware named Octo has appeared in the wild, featuring remote access capabilities that allow malicious operators to perform on-device fraud.
Octo is an evolved Android malware based on ExoCompact, a malware variant based on the Exo trojan that quit the cyber crime space and had its source code leaked in 2018.
The new variant has been discovered by researchers at ThreatFabric, who observed several users looking to purchase it on darknet forums.
Network Intrusion Detections Skyrocketing
A WatchGuard report shows a record number of evasive network malware detections with advanced threats increasing by 33%, indicating a higher level of zero day threats than ever before.
Researchers detected malware threats in EMEA at a much higher rate than other regions of the world in Q4 2021, with malware detections per Firebox at 49%, compared to Americas at 23% and APAC at 29%. The trajectory of network intrusion detections also continued its upward climb with the largest total detections of any quarter in the last three years and a 39% increase quarter over quarter.
Researchers suggest that this may be due to the continued targeting of old vulnerabilities as well as the growth in organisations’ networks. As new devices come online and old vulnerabilities remain unpatched, network security is becoming more complex.
https://www.helpnetsecurity.com/2022/04/08/network-malware-detections/
Organisations Underestimating the Seriousness of Insider Threats
Imperva releases data that shows organisations are failing to address the issue of insider threats during a time when the risk is at its greatest.
New research, conducted by Forrester, found that 59% of incidents in EMEA organisations that negatively impacted sensitive data in the last 12 months were caused by insider threats, and yet 59% do not prioritise insider threats the way they prioritise external threats. Despite the fact that insider events occur more often than external ones, they receive lower levels of investment.
This approach is at odds with today’s threat landscape where the risk of malicious insiders has never been higher. The rapid shift to remote working means many employees are now outside the typical security controls that organisations employ, making it harder to detect and prevent insider threats.
Further, the Great Resignation is creating an environment where there is a higher risk of employees stealing data. This data could be stolen intentionally by people looking to help themselves in future employment, because they are disgruntled and want revenge, or it could be taken unintentionally when a careless employee leaves the business with important information.
https://www.helpnetsecurity.com/2022/04/08/organizations-insider-threats-issue/
Watch Out for Phishing Emails from Genuine Mailing Lists, Following Mailchimp Hack
A Mailchimp hack means that you’ll want to be even more vigilant than usual about phishing emails. Attackers have taken a clever approach to making their emails appear genuine …
When you subscribe to an email list, there’s a decent chance that the emails you received are actually sent by a company called Mailchimp, rather than directly by the company itself. Mailchimp offers companies a range of tools that make it easy to manage email databases, and send marketing emails and newsletters.
Hackers managed to gain access to more than 100 Mailchimp customer accounts, giving them the ability to send emails that would appear to have come from any one of those businesses.
Users will need to be more vigilant when receiving emails and avoid clicking on links in emails, even if they appear genuine.
https://9to5mac.com/2022/04/05/mailchimp-hack-phishing-alert/
SpringShell Attacks Target About One in Six Vulnerable Orgs
Roughly one out of six organisations worldwide that are impacted by the Spring4Shell zero-day vulnerability have already been targeted by threat actors, according to statistics from one cyber security company.
The exploitation attempts took place in the first four days since the disclosure of the severe remote code execution (RCE) flaw, tracked as CVE-2022-22965, and the associated exploit code.
According to Check Point, who compiled the report based on their telemetry data, 37,000 Spring4Shell attacks were detected over the past weekend alone.
New Threat Group Underscores Mounting Concerns Over Russian Cyber Threats
Crowdstrike says Ember Bear is likely responsible for the wiper attack against Ukrainian networks and that future Russian cyber attacks might target the West.
As fears mount over the prospects of a “cyberwar” initiated by the Russian government, the number of identified Russian threat actors also continues to climb. Last week CrowdStrike publicly revealed a Russia-nexus state-sponsored actor that it tracks as Ember Bear.
CrowdStrike says that Ember Bear (also known as UAC-0056, Lorec53, Lorec Bear, Bleeding Bear, Saint Bear) is likely an intelligence-gathering adversary group that has operated against government and military organisations in eastern Europe since early 2021. The group seems “motivated to weaponize the access and data obtained during their intrusions to support information operations (IO) aimed at creating public mistrust in targeted institutions and degrading government ability to counter Russian cyber operations,” according to CrowdStrike intelligence.
Despite its state-sponsored Russia nexus, Ember Bear differs from its better-known kin such as Fancy Bear or Voodoo Bear because CrowdStrike can’t tie it to a specific Russian organisation. Its target profile, assessed intent, and technical tactics, techniques, and procedures (TTPs) are consistent with other Russian GRU cyber operations.
Consumer Fraud Tripled in The Last Two Years
Reported cases of consumer fraud more than tripled in the years 2020-2021 from prior years, finds a new report by Accenture, presenting a growing challenge for public safety agencies to find new strategies to counter the trend.
The report compiled data from eight developed nations (Australia, Canada, France, Germany, Italy, Singapore, the United Kingdom, and the United States) on consumer fraud, defined as any fraud directly targeting citizens and excluding fraud targeting government agencies and companies. Reports of such fraud increased at an estimated 6.8% rate annually during 2013-2019 and then increased to a 22.5% annual growth rate yearly during 2020-2021 in parallel with the large shift of workers and consumers to digital channels and greater use of technology during the pandemic.
https://www.helpnetsecurity.com/2022/04/08/consumer-fraud-tripled/
Borat RAT: Multiple Threat of Ransomware, DDoS and Spyware
A new remote access trojan (RAT) dubbed "Borat" doesn't come with many laughs but offers bad actors a menu of cyberthreats to choose from.
RATs are typically used by cyber criminals to get full control of a victim's system, enabling them to access files and network resources and manipulate the mouse and keyboard. Borat does all this and also delivers features to enable hackers to run ransomware, distributed denial of service attacks (DDoS) and other online assaults and to install spyware, according to researchers at cyber security biz Cyble.
"The Borat RAT provides a dashboard to Threat Actors (TAs) to perform RAT activities and also has an option to compile the malware binary for performing DDoS and ransomware attacks on the victim's machine," the researchers wrote in a blog post, noting the malware is being made available for sale to hackers.
Borat – named after the character made famous by actor Sacha Baron Cohen in two comedy films – comes with the standard requisite of RAT features in a package that includes such functions as builder binary, server certificate and supporting modules.
https://www.theregister.com/2022/04/04/borat-rat-ransomware-ddos/
Bank Had No Firewall License, Intrusion or Phishing Protection – Guess the Rest
An Indian bank that did not have a valid firewall license, had not employed phishing protection, lacked an intrusion detection system and eschewed use of any intrusion prevention system has, shockingly, been compromised by criminals who made off with millions of rupees.
The unfortunate institution is called the Andra Pradesh Mahesh Co-Operative Urban Bank. Its 45 branches and just under $400 million of deposits make it one of India's smaller banks.
It certainly thinks small about security – at least according to Hyderabad City Police, which last week detailed an attack on the Bank that started with over 200 phishing emails being sent across three days in November 2021. At least one of those mails succeeded in fooling staff, resulting in the installation of a Remote Access Trojan (RAT).
Another technology the bank had chosen not to adopt was virtual LANs, so once the RAT went to work the attackers gained entry to the Bank's systems and were able to roam widely – even in its core banking application
https://www.theregister.com/2022/04/05/mahesh_bank_no_firewall_attack/
Global APT Groups Use Ukraine War for Phishing Lures
Security researchers have detected multiple APT campaigns leveraging Ukraine war-themed documents and news sources to lure victims into clicking on spear-phishing links.
Check Point Research said victim locations ranged from South America to the Middle East, with malware downloads designed to perform keylogging and screenshotting and execute commands.
The threat groups in question include El Machete, which is targeting the financial and government sectors in Nicaragua and Venezuela with malicious macro-laden Word documents containing articles on the war.
One of the docs was an article written by the Russian ambassador to Nicaragua titled: “Dark plans of the neo-Nazi regime in Ukraine.”
Another is Lyceum, an Iranian state-linked group targeting the energy sector with emails about war crimes in Ukraine that link to a malicious document hosted elsewhere. Its victims so far have been in Israel and Saudi Arabia, according to Check Point.
One email contained a link to an article from The Guardian hosted on the news-spot[.]live domain, alongside several malicious docs about the war.
https://www.infosecurity-magazine.com/news/global-apt-ukraine-war-phishing/
Paying Ransom Doesn’t Guarantee Data Recovery
OwnBackup announced the findings of a global survey conducted by Enterprise Strategy Group (ESG) that reveals a staggering 79% of respondent organisations have been targeted by ransomware within the past 12 months. Of those organisations, nearly three quarters said the attack was successful, meaning that it disrupted business operations.
Other key findings
· Of the respondents that said their organisation paid a cyber ransom to regain access to data, applications, and/or systems after an attack, only 14% were able to recover all of their data.
· 87% of respondents who made ransom payments said that they experienced additional extortion attempts beyond the initial ransomware demand.
· 31% of respondent organisations targeted by ransomware indicated that application user and permission misconfigurations were the initial point of compromise.
· 87% of respondents are very or somewhat concerned about their backups being infected by ransomware attacks.
https://www.helpnetsecurity.com/2022/04/07/organizations-targeted-by-ransomware/
Threats
Ransomware
March Ransomware Attacks Strike Finance, Government Targets (techtarget.com)
Why Paying The Ransom Isn’t The Answer For Ransomware Victims - Information Security Buzz
Companies Are More Prepared to Pay Ransoms Than Ever Before (tripwire.com)
Conti Ransomware Deployed in IcedID Banking Trojan Attack (techtarget.com)
Researchers Connect BlackCat Ransomware with Past BlackMatter Malware Activity (thehackernews.com)
Notorious Hacking Group FIN7 Adds Ransomware to Its Repertoire - CyberScoop
BlackCat Purveyor Shows Ransomware Operators Have 9 Lives (darkreading.com)
FIN7 Hackers Evolve Toolset, Work with Multiple Ransomware Gangs (bleepingcomputer.com)
LockBit Ransomware Attack Costs CRM Services Provider Over $42 Million - MSSP Alert
Snap-on Discloses Data Breach Claimed by Conti Ransomware Gang (bleepingcomputer.com)
Phishing & Email Based Attacks
Other Social Engineering
Malware
Borat RAT Malware: A 'Unique' Triple Threat That Is Far from Funny | ZDNet
Multiple Hacker Groups Capitalizing on Ukraine Conflict for Distributing Malware (thehackernews.com)
Malicious Web Redirect Service Infects 16,500 Sites to Push Malware (bleepingcomputer.com)
Researchers Uncover How Colibri Malware Stays Persistent on Hacked Systems (thehackernews.com)
Mobile
44 Vulnerabilities Patched in Android With April 2022 Security Updates | SecurityWeek.Com
Samsung Security Flaw Left Phones Exposed for Years (androidpolice.com)
SharkBot Android Malware Continues Popping Up on Google Play | SecurityWeek.Com
Android Apps With 45 Million Installs Used Data Harvesting SDK (bleepingcomputer.com)
New Android Spyware Uses Turla-Linked Infrastructure | SecurityWeek.Com
Organised Crime & Criminal Actors
Cryptocurrency/Cryptomining/Cryptojacking
Crypto 2022: Hackers Have Nabbed $1.22 Billion Already (yahoo.com)
Malicious Crypto Miners Can Make A Profit In A Few Hours - Help Net Security
Malicious Actors Targeting the Cloud For Cryptocurrency-Mining Activities - Help Net Security
Cryptocurrency-Mining AWS Lambda-Specific Malware Spotted • The Register
MailChimp Breached, Intruders Conducted Phishing Attacks Against Crypto Customers - Security Affairs
Turkey Seeks 40,000-Year Sentences for Alleged Cryptocurrency Exit Scammers | ZDNet
Insider Risk and Insider Threats
Fraud, Scams & Financial Crime
Traditional Identity Fraud Losses Soar, Totalling $52 Billion in 2021 - Help Net Security
South African and US Officers Swoop on Fraud Gang - Infosecurity Magazine
Insurance
Supply Chain
Cloud
The Importance of Understanding Cloud Native Security Risks - Help Net Security
15 Cyber Security Measures for the Cloud Era - Security Affairs
Privacy
How You’re Still Being Tracked on the Internet - The New York Times (nytimes.com)
Using Google's Chrome Browser? This New Feature Will Help You Fix Your Security Settings | ZDNet
Passwords & Credential Stuffing
Travel
Spyware, Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Nation State Actors
Nation State Actors – Russia
The Russian Cyber Attack Threat Might Force a New IT Stance | Computerworld
FBI Operation Aims to Take Down Massive Russian GRU Botnet | TechCrunch
Microsoft Sinkholes Russian Hacking Group's Domains Targeting Ukraine (darkreading.com)
FBI Disrupts Russian Military Hackers, Preventing Botnet Amid Ukraine War | Fox News
Russia (still) Trying To Weaponize Facebook Amid Ukraine War • The Register
Nation State Actors – China
Symantec: Chinese APT Group Targeting Global MSPs | SecurityWeek.Com
Chinese Hackers Are Using VLC Media Player to Launch Malware Attacks (androidpolice.com)
Hacked: Inside the US-China Cyberwar | Cybersecurity | Al Jazeera
China Uses AI Software to Improve Its Surveillance Capabilities | Reuters
Nation State Actors – Misc
Vulnerabilities
CISA Warns of Active Exploitation of Critical Spring4Shell Vulnerability (thehackernews.com)
Palo Alto Networks firewalls, VPNs vulnerable to OpenSSL bug (bleepingcomputer.com)
A Vulnerability in Zyxel Firewall Could Allow for Authentication Bypass (cisecurity.org)
Spring4Shell Patching Is Going Slow but Risk Not Comparable To Log4Shell | CSO Online
Apple Leaves Big Sur, Catalina Exposed to Critical Flaws: Intego | SecurityWeek.Com
A Mirai-Based Botnet Is Exploiting the Spring4Shell Vulnerability - Security Affairs
Steady Rise in Severe Web Vulnerabilities - Help Net Security
ACF WordPress Plugin Vulnerability Affects Up To +2 Million Sites (searchenginejournal.com)
Zero Days Are for Life, Not Just For Christmas. Here’s How to Deal With Them • The Register
Sector Specific
Financial Services Sector
FinTech
Health/Medical/Pharma Sector
Manufacturing
CNI, OT, ICS, IIoT and SCADA
Europe Warned About Cyber Threat to Industrial Infrastructure | SecurityWeek.Com
BlackCat Ransomware Targets Industrial Companies | SecurityWeek.Com
Energy & Utilities
Reports Published in the Last Week
Other News
Okta CEO Says Lapsus$ Hack is 'Big Deal,' Aims to Restore Trust (yahoo.com)
86% of Developers Don't Prioritise Application Security - Help Net Security
Digital Transformation Requires Security Intelligence - Help Net Security
Government Officials: AI Threat Detection Still Needs Humans (techtarget.com)
The Original APT: Advanced Persistent Teenagers – Krebs on Security
How Many Steps Does It Take for Attackers To Compromise Critical Assets? - Help Net Security
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.