Black Arrow Cyber Threat Briefing 27 May 2022
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
How Confident Are Companies In Managing Their Current Threat Exposure?
Crossword Cybersecurity has released a report based on the findings of a survey of over 200 CISOs and senior UK cyber security professionals. The paper reveals companies are more concerned and exposed to cyber threats than ever before, with 61 percent describing themselves as at best only “fairly confident” at managing their current cyber security threat exposure, which should raise some eyebrows around the boardroom.
Respondents also feared their cyber strategy would not keep pace with the rate of tech innovation and changes in the threat landscape. 40 percent of organisations believe their existing cyber strategy will be outdated in two years, and a further 37 percent within three years. Additional investment is needed to address longer term planning, with 44 percent saying they only have sufficient resources in their organisation to focus on the immediate and mid-term cyber threats and tech trends.
https://www.helpnetsecurity.com/2022/05/26/organizations-cyber-strategy/
'There's No Ceiling': Ransomware's Alarming Growth Signals A New Era, Verizon DBIR Finds
Ransomware has become so efficient, and the underground economy so professional, that traditional monetisation of stolen data may be on its way out.
The past year has seen a staggering acceleration in ransomware incidents, with 25% of all breaches containing a ransomware component.
That's the top-line finding in the 2022 Verizon Data Breach Investigations Report (DBIR), which found that ransomware events in conjunction with breaches ballooned 13% in the past year — last year's report found that just 12% of incidents were ransomware-related. That translates into a rate of increase that's more than the previous five years of growth combined.
The 15th annual DBIR analysed 23,896 security incidents, of which 5,212 were confirmed breaches. About four in five of those were the handiwork of external cyber criminal gangs and threat groups, according to Verizon. And according to Alex Pinto, manager of the Verizon Security Research team, these nefarious types are finding it easier and easier to earn an ill-gotten living with ransomware, making other types of breaches increasingly obsolete.
"Everything in cyber crime has become so commoditised, so much like a business now, and it's just too darn efficient of a methodology for monetising their activity," he tells Dark Reading, noting that with the emergence of ransomware as-a-service (RaaS) and initial-access brokers, it takes very little skill or effort to get into the extortion game.
"Before, you had to get in somehow, look around, and find something worth stealing that would have a reseller on the other end," he explains. "In 2008 when we started the DBIR, it was by and large payment-card data that was stolen. Now, that has fallen precipitously because they can just pay for access someone else established and install rented ransomware, and it's so much simpler to reach the same goal of getting money."
https://www.darkreading.com/attacks-breaches/ransomware-alarming-growth-verizon-dbir
Paying Ransom Doesn’t Guarantee Data Recovery
A Veeam report has found that 72% of organisations had partial or complete attacks on their backup repositories, dramatically impacting the ability to recover data without paying the ransom.
Additionally, 76% of organisations admitted to paying the ransom. But while 52% paid the ransom and were able to recover data, 24% paid the ransom but were still not able to recover data.
https://www.helpnetsecurity.com/2022/05/24/paying-ransom-recover-data-video/
Report: Frequency Of Cyber Attacks in 2022 Has Increased By Almost 3M
Kaspersky has released a new report revealing a growing number of cyber attacks on small businesses in 2022 so far. Researchers compared the period between January and April 2022 to the same period in 2021, finding increases in the numbers of Trojan-PSW detections, internet attacks and attacks on Remote Desktop Protocol.
In 2022, the number of Trojan-PSW (Password Stealing Ware) detections increased globally by almost a quarter compared to the same period in 2021 一 4,003,323 to 3,029,903. Trojan-PSW is a malware that steals passwords, along with other account information, which then allows attackers to gain access to the company network and steal sensitive information.
Internet attacks grew from 32,500,000 globally in the analysed period of 2021 to almost 35,400,000 in 2022. These can include web pages with redirects to exploits, sites containing exploits and other malicious programs, botnet command & control centres and more.
The number of attacks on Remote Desktop Protocol grew in the U.S. (while dropping slightly globally), going from 47.5 million attacks in the first trimester of 2021 to 51 million in the same period of 2022. With the widespread shift toward remote work, many companies have introduced Remote Desktop Protocol (RDP), a technology that enables computers on the same corporate network to be linked together and accessed remotely, even when the employees are at home.
With small business owners typically handling numerous responsibilities at the same time, cyber security is often an afterthought. However, this disregard for IT security is being exploited by cyber criminals. The Kaspersky study sought to assess the threats that pose an increasing danger to entrepreneurs.
New Zoom Flaws Could Let Attackers Hack Victims Just By Sending Them A Message
Popular video conferencing service Zoom has resolved as many as four security vulnerabilities, which could be exploited to compromise another user over chat by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages and execute malicious code.
With Zoom's chat functionality built on top of the XMPP standard, successful exploitation of the issues could enable an attacker to force a vulnerable client to masquerade a Zoom user, connect to a malicious server, and even download a rogue update, resulting in arbitrary code execution stemming from a downgrade attack.
https://thehackernews.com/2022/05/new-zoom-flaws-could-let-attackers-hack.html
VMware, Airline Targeted As Ransomware Chaos Reigns
Global ransomware incidents target everything from enterprise servers to grounding an airline, with one India-based group even taking a Robin Hood approach to extortion with the "GoodWill" strain.
Ransomware incidents are on the rise and this week proved no exception, with the discovery of a Linux-based ransomware family called Cheerscrypt targeting VMware ESXi servers and an attack on SpiceJet, India’s second largest airline.
Meanwhile, an oddball "GoodWill" variant purports to help the needy.
The Cheerscrypt ransomware variant was uncovered by Trend Micro and relies on the double-extortion scheme to coerce victims to pay the ransom – i.e., stealing data as well and threatening to leak it if victims don’t pay up.
Because of the popularity of ESXi servers for creating and running multiple virtual machines (VMs) in enterprise settings, the Cheerscrypt ransomware could be appealing to malicious actors looking to rapidly distribute ransomware across many devices.
Meanwhile, low-cost carrier SpiceJet faced a ransomware attack this week, causing flight delays of between two and five hours as well as rendering unavailable online booking systems and customer service portals.
While the company’s IT team announced on Twitter that it had successfully prevented the attempted attack before it was able to fully breach all internal systems and take them over, customers and employees are still experiencing the ramifications.
https://www.darkreading.com/attacks-breaches/vmware-airline-targeted-as-ransomware-chaos-reigns
Crypto Hacks Aren't A Niche Concern; They Impact Wider Society
Million-dollar crypto heists are becoming more common as the currency starts to go mainstream; prevention and enforcement haven't kept pace.
The attack against the Ronin Network in March was quickly speculated to be one of the largest cryptocurrency hacks of all time. Approximately $540 million was stolen from the cryptocurrency and NFT games company in a combination of USDC and Etherium, with $400 million of the stolen funds owned by customers playing the game Axie Infinity.
This attack was the latest in a string of thefts perpetrated against crypto and should be a jolt to both the digital asset and cyber security communities to bring the security of cryptocurrencies into line.
The current vogue of large-scale crypto heists goes as far back as the 2014 Mt. Gox hack (another cryptocurrency exchange built around a game, Magic: The Gathering), which went into bankruptcy after losing $460 million of assets.
However, the trend has been gathering pace. In the months leading up to the Ronin Network attack, cyber criminals stole nearly $200 million worth of cryptocurrency from the crypto trading platform BitMart, attacked 400 Crypto.com users, and orchestrated NFT-related scams, to name but a few incidents.
There is often an uncomfortable tendency to see these attacks as something that takes place in isolation in a remote part of the Internet when they actually have a huge impact on thousands of people.
State Of Cyber Security Report 2022 Names Ransomware And Nation-State Attacks As Biggest Threats
Ransomware is the biggest concern for cyber security professionals, according to results of the Infosecurity Group’s 2022 State of Cybersecurity Report, produced by Infosecurity Europe and Infosecurity Magazine.
Cyber Security Professionals' Number One Concern: Ransomware.
This attack vector was voted as the biggest cyber security trend (28%) by the survey respondents (including CISOs, CTOs, CIOs and academics), marking a significant change from the previous report in 2020, where ransomware did not break the top three. This follows surging ransomware incidents in 2021, with ransom demands and payments growing significantly last year. A number of these attacks have also impacted critical industries, for example, taking down the US’ largest fuel pipeline.
The survey respondents also highlighted the evolving tactics and capabilities of ransomware attackers. This includes threat actors becoming more sophisticated as they evolve into loosely coupled service-based operations.
A number of cyber security professionals believe that cyber-criminal groups will become more guarded in their approach due to new initiatives by governments and law enforcement to tackle these activities.
Cyber Security Professionals' Number Two Concern: Nation-State Attacks.
The second biggest concern for survey respondents was geopolitics/nation-state attacks (24%), particularly the shifting hostilities from the Russia-Ukraine conflict into cyberspace. Russia already had a reputation for conducting offensive cyber operations prior to the conflict, and the Ukrainian government and critical services have experienced numerous attacks both before and since the war began.
https://www.infosecurity-magazine.com/news/2022-state-industry-report/
Vishing (Voice Phishing) Cases Reach All Time High
Vishing (voice phishing) cases have increased almost 550 percent over the last twelve months (Q1 2021 to Q1 2022), according to the latest Quarterly Threat Trends & Intelligence Report from Agari and PhishLabs.
In Q1 2022, Agari and PhishLabs detected and mitigated hundreds of thousands of phishing, social media, email, and dark web threats targeting a broad range of enterprises and brands. The report provides an analysis of the latest findings and insights into key trends shaping the threat landscape.
According to the findings, vishing attacks have overtaken business email compromise (BEC) as the second most reported response-based email threat since Q3 2021. By the end of the year, more than one in four of every reported response-based threat was a vishing attack, and this makeup continued through Q1 2022.
https://www.helpnetsecurity.com/2022/05/24/vishing-cases-increased/
DeFi (Decentralised Finance) Is Getting Pummelled By Cyber Criminals
Decentralised finance lost $1.8 billion to cyber attacks last year — and 80% of those events were the result of vulnerable code, analysts say.
Decentralised finance (DeFi) platforms — which connect various cryptocurrency blockchains to create a decentralised infrastructure for borrowing, trading, and other transactions — promise to replace banks as a secure and convenient way to invest in and spend cryptocurrency. But in addition to attracting hordes of new users with dreams of digital fortune, cyber criminals have discovered them to be an easy target, wiping out wallets to zero balances in a moment, tanking whole markets while profiting, and more, according to a new report.
Analysts with Bishop Fox found that DeFi platforms lost $1.8 billion to cyber attacks in 2021 alone. With a total of 65 events observed, 90% of the losses came from unsophisticated attacks, according to the report, which points to the lax cyber security practices of the sector.
DeFi averaged five attacks per week last year, with most of them (51%) coming from the exploitation of "smart contracts" bugs, the analysts found. Smart contracts are essentially records of transactions, stored on the blockchain.
Other top DeFi attack vectors include cryptowallets, protocol design flaws, and so-called "rug-pull" scams (where investors are lured to a new cryptocurrency project that is then abandoned, leaving targets with a worthless currency). But taken together, 80% of all events were caused by the use (and re-use) of buggy code, according to the report.
https://www.darkreading.com/attacks-breaches/defi-pummeled-by-cybercriminals
Threats
Ransomware
Ransomware Attacks Increasing at “Alarming” Rate - Infosecurity Magazine
VMware, Airline Targeted as Ransomware Chaos Reigns (darkreading.com)
Clop ransomware gang is back, hits 21 victims in a single month (bleepingcomputer.com)
Link Found Connecting Chaos, Onyx and Yashma Ransomware | Threatpost
Ransomware demands three good demands to restore files • The Register
Ransomware Cheerscrypt targets VMware ESXi systems • The Register
New Chaos Malware Variant Ditches Wiper for Encryption (darkreading.com)
Industrial Spy data extortion market gets into the ransomware game (bleepingcomputer.com)
BlackCat/ALPHV ransomware asks $5 million to unlock Austrian state (bleepingcomputer.com)
Conti Ransomware Operation Shut Down After Splitting into Smaller Groups (thehackernews.com)
Suspected phishing email crime boss arrested in Nigeria • The Register
BEC – Business Email Compromise
Interpol arrests alleged leader of the SilverTerrier BEC gang (bleepingcomputer.com)
Cyber security breach at the city of Portland led to fraudulent $1.4M transaction | KATU
Phishing & Email Based Attacks
Intuit warns of QuickBooks phishing threatening to suspend accounts (bleepingcomputer.com)
Suspected phishing email crime boss arrested in Nigeria • The Register
Other Social Engineering
Malware
BPFDoor malware uses Solaris vulnerability to get root privileges (bleepingcomputer.com)
New Windows Subsystem for Linux malware steals browser auth cookies (bleepingcomputer.com)
This Windows malware uses PowerShell to subvert Chrome • The Register
Hackers have found a new way to smuggle malware onto your device | TechRadar
Cyber Security Community Warned of Fake PoC Exploits Delivering Malware | SecurityWeek.Com
Popular Python and PHP libraries hijacked to steal AWS keys (bleepingcomputer.com)
New Attack Shows Weaponized PDF Files Remain a Threat (darkreading.com)
Mobile
Microsoft finds severe bugs in Android apps from large mobile providers (bleepingcomputer.com)
Google warns Android smartphones targeted by dangerous Predator spyware | TechRadar
New ERMAC 2.0 Android malware steals accounts, wallets from 467 apps (bleepingcomputer.com)
BYOD
Data Breaches/Leaks
GM Discloses Data Breach of Cars' Locations, Mileage, Service (gizmodo.com)
MGM Resorts' customer data now leaked on Telegram for free • The Register
Organised Crime & Criminal Actors
REvil prosecutions reach a 'dead end,' Russian media reports - CyberScoop
Scammer Behind $568M International Cyber Crime Syndicate Gets 4 Years (darkreading.com)
Multi-Continental Operation Leads to Arrest of Cyber Crime Gang Leader - Infosecurity Magazine
Cryptocurrency/Cryptomining/Cryptojacking/NFTs
Insider Risk and Insider Threats
68% of Legal Sector Data Breaches Caused by Insider Threats - Infosecurity Magazine
Verizon Report: Ransomware, Human Error Among Top Security Risks | Threatpost
Dark Web
Military cyber weapons could become available on dark web: Interpol (cnbc.com)
Darknet market Versus shuts down after hacker leaks security flaw (bleepingcomputer.com)
Supply Chain and Third Parties
Denial of Service DoS/DDoS
Cybergang Claims REvil is Back, Executes DDoS Attacks | Threatpost
DDoS Extortion Attack Flagged as Possible REvil Resurgence (darkreading.com)
Anatomy of a DDoS amplification attack - Microsoft Security Blog
Cloud/SaaS
Attack Surface Management
Open Source
Privacy
Passwords & Credential Stuffing
Strong Password Policy Isn't Enough, Study Shows (darkreading.com)
Verizon DBIR: Stolen credentials led to nearly 50% of attacks (techtarget.com)
Regulations, Fines and Legislation
GDPR Anniversary, Expert Insight On What Lead To GDPR Fines – Information Security Buzz
Indian stock markets given ten day deadline to file reports • The Register
Spyware, Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Network of hyperlocal Russian Telegram channels spew disinformation in occupied Ukraine - CyberScoop
Predator spyware uses in Chrome, Android zero-day exploits • The Register
Unknown APT group is targeting Russian government entities - Security Affairs
Hackers target Russian govt with fake Windows updates pushing RATs (bleepingcomputer.com)
Remote bricking of Ukrainian tractors raises agriculture security concerns | CSO Online
Anonymous Declares Cyber-War On Pro-Russian Hacker Gang Killnet – Information Security Buzz
Ex-spymaster and fellow Brexiteers' emails stolen, leaked • The Register
Nation State Actors
Nation State Actors – Russia
Russian Hackers Believed to Be Behind Leak of Hard Brexit Plans - Infosecurity Magazine
Russian Gamaredon APT could fuel a new round of DDoS attacks - Security Affairs
Putin aimed cyber attack at me, says former MI6 chief Sir Richard Dearlove | News | The Times
Nation State Actors – China
Trend Micro Patches Vulnerability Exploited by Chinese Cyber Spies | SecurityWeek.Com
Chinese "Twisted Panda" Hackers Caught Spying on Russian Defense Institutes (thehackernews.com)
Nation State Actors – Iran
Vulnerabilities
CISA ‘Strongly Urges’ You To Patch 75 Actively Exploited Security Bugs (forbes.com)
CISA adds 41 vulnerabilities to list of bugs used in cyber attacks (bleepingcomputer.com)
Exploit released for critical VMware auth bypass bug, patch now (bleepingcomputer.com)
Zyxel addresses four flaws affecting APs, AP controllers, and firewalls - Security Affairs
Critical New Google Chrome Security Warning For All Users, Update Now (forbes.com)
Patching the latest Active Directory vulnerabilities is not enough | CSO Online
Microsoft Elevation-of-Privilege Vulnerabilities Spiked Again in 2021 (darkreading.com)
Sector Specific
SMBs – Small and Medium Businesses
Legal
Health/Medical/Pharma Sector
teiss - News - American healthcare tech giant Omnicell suffers a major ransomware attack
Web app attacks on the rise in healthcare as insider challenges remain (scmagazine.com)
Retail/eCommerce
Microsoft: Credit card stealers are getting much stealthier (bleepingcomputer.com)
Microsoft warns of new highly evasive web skimming campaigns - Security Affairs
Transport and Aviation
Hundreds Stranded After Ransomware Attack on Indian Airline | SecurityWeek.Com
SpiceJet airline passengers stranded after ransomware attack (bleepingcomputer.com)
CNI, OT, ICS, IIoT and SCADA
Taking the Danger Out of IT/OT Convergence (darkreading.com)
Critical Flaws in Popular ICS Platform Can Trigger RCE | Threatpost
Energy & Utilities
Oil, Gas and Mining
Education and Academia
Other News
IP and cyber security disputes are top legal concerns for tech companies | TechCrunch
Verizon DBIR: Stolen credentials led to nearly 50% of attacks (techtarget.com)
Managed Detection and Response (MDR): Who's Responsible for the R? - MSSP Alert
Survey Evidences Leaders Lack Confidence in Cyber-Risk Management - Infosecurity Magazine
Flaw in PayPal can allow attackers to steal money from users' account - Security Affairs
Most organisations do not follow data backup best practices - Help Net Security
Why are current cyber security incident response efforts failing? - Help Net Security
Nation-state malware will be a commodity on dark web soon, Interpol warns - Security Affairs
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.