Cyber Weekly Flash Briefing 2 October 2020: Entry to Ransom in 45 Mins; Cyber War Collateral; Gallagher Hit with Ransomware; Adapting to Permanent WFH; Consumers Ditch Breached Firms; Awareness Month
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Ransomware: from Entry to Ransom in Under 45 Minutes
Ransomware gangs are performing wide-ranging internet scans to find vulnerable systems and then accelerating attacks to just minutes to capitalize on COVID-19, Microsoft has warned in a blog post introducing the firm’s latest Digital Defense Report
The report claimed that threat actors have “rapidly increased sophistication” over the past year, with ransomware the number one reason for Microsoft incident response between October 2019 and July 2020.
“Attackers have exploited the COVID-19 crisis to reduce their dwell time within a victim’s system — compromising, exfiltrating data and, in some cases, ransoming quickly — apparently believing that there would be an increased willingness to pay as a result of the outbreak. In some instances, cyber-criminals went from initial entry to ransoming the entire network in under 45 minutes”.
“At the same time, we also see that human-operated ransomware gangs are performing massive, wide-ranging sweeps of the internet, searching for vulnerable entry points, as they ‘bank’ access – waiting for a time that is advantageous to their purpose.”
Why this matters:
Not only are attackers speeding up attacks, attackers have also become more sophisticated in performing reconnaissance on high-value targets, so that they appear to know when certain factors like holidays will reduce the victim organisation’s chances of patching, or otherwise hardening their networks.
They’re also aware of how billing cycles operate in certain industries, and thus when specific targets may be more willing to pay.
Read more: https://www.infosecurity-magazine.com/news/ransomware-from-entry-ransom-under/
Business are concerned their companies will be collateral damage in a future cyber-war
Businesses are worrying about being caught in the crossfire of cyber warfare, according to research from Bitdefender – while industry figures warn that the gap between common-or-garden cyber threats and what nation states are doing is becoming smaller and smaller.
Bitdefender’s latest report, titled 10 in 10, surveyed around 6,000 C-suite executives responsible for cyber security and found “over a fifth” said that cyber warfare was one of the most challenging topics they had to convince their colleagues to take seriously.
Bitdefender don’t think these executives are afraid of cyber warfare in the sense of directly being targeted, more in line with being collateral victims of cyber warfare taking out electric power grids, internet. They need to be prepared for these kind of attacks.
Why this matters:
Cyber warfare, at its simplest, involves disrupting computers to achieve a real-world effect. This could be something like a denial-of-service (DoS) attack against a power grid, intended to cause a power outage, or the infamous Stuxnet malware infection that set back Iran’s nuclear weapon ambitions by several years. It could also include attacks designed to degrade an adversary’s own ability to mount cyber attacks; cyber on cyber.
An attack by one nation against another nation could have significant impact on the ability of a business to continue to operate, either in the short term or over the longer term.
Read more: https://www.theregister.com/2020/09/30/cyber_war_fears/
Ransomware hits US-based Arthur J. Gallagher insurance giant
US-based Arthur J. Gallagher (AJG) global insurance brokerage and risk management firm confirmed a ransomware attack that hit its systems on Saturday.
AJG is one of the largest insurance brokers in the world with more than 33,300 employees and operations in 49 countries, including Rossborough in Guernsey.
The company is ranked 429 on the Fortune 500 list and it provides insurance services to customers in over 150 countries.
AJG says that it detected the ransomware attack on September 26, 2020, with only a limited number of the company's internal systems being affected, but that they shut down all computing systems to block the attack
"We promptly took all of our global systems offline as a precautionary measure, initiated response protocols, launched an investigation, engaged the services of external cyber security and forensics professionals, and implemented our business continuity plans to minimize disruption to our customers," the company added on September 28th in an filing with US regulators.
Why this matters:
Firms everywhere are being hit with ransomware and the speed, frequency, and sophistication of these attacks is only going to carry on getting worse. Firms must ensure they are prepared for an attack ahead of an attack happening and ensure they have plans in place to be able to recover. Most ransomware starts with a user clicking on a link in an email or downloading an attachment so firms must ensure their staff realise the role they play in defending their organisations – this is not something that IT alone can protect firms against.
Paying ransomware demands could land you in hot water with authorities and regulators
Businesses, governments, and organisations that are hit by crippling ransomware attacks now have a new worry to contend with—big fines from authorities and regulators, such as the US Department of Treasury, in the event that they pay to recover their data.
US Treasury Department officials made that guidance official in an advisory published this week. It warns that payments made to specific entities or to any entity in certain countries—specifically, those with a designated “sanctions nexus”—could subject the payer to financial penalties levied by the US Office of Foreign Assets Control, or OFAC.
The prohibition applies not only to the group that is infected but also to any companies or contractors the hacked group’s security or insurance engages with, including those who provide insurance, digital forensics, and incident response, as well as all financial services that help facilitate or process ransom payments.
Why this matters:
Payments made to criminal groups, sanctioned groups or individuals, or otherwise making a payment that could be funding terrorism will fall foul of regulations in most regulated jurisdictions. The last thing a firm will need is having to recover from the ransomware attack and also then being hit with fines from regulators and authorities.
CIOs say security must adapt to permanent work-from-home
Both private- and public-sector CIOs see many more employees permanently working remotely, and say security needs to adapt to new threats and how they communicate.
Much of the public and private sector was forced to shut down in-person facilities and operations almost overnight in March as COVID quarantines began. The new conditions forced organisations to quickly find ways to secure tens of millions of new, vulnerable endpoints created by at-home workers. Now, six months later, technology leaders are taking stock of what happened and considering how a post-COVID landscape might look.
Why this matters:
COVID has resulted in a lot of changes and is behind a lot of innovation but it looks like some places will be putting up with these short term measures for longer than originally planned.
What might have been OK as a short term fix needs to become ‘business as usual’ and security controls will need to be adapted to these more permanent new ways of working.
DDoS attacks are getting more powerful as attackers change tactics
There's been a surge in Distributed Denial of Service (DDoS) attacks throughout the course of this year, and the attacks are getting more powerful and more disruptive.
Why this matters:
DDoS attacks are launched against websites or web services with the aim of disrupting them to the extent that they are taken offline. Attackers direct the traffic from a botnet army of hundreds of thousands of PCs, servers and other internet-connected devices they've gained control of via malware towards the target, with the aim of overwhelming it.
An attack can last for just seconds, or hours or days and prevent legitimate users from accessing the online service for that time.
And while DDoS attacks have been a nuisance for years, the prospect of corporate, e-commerce, healthcare, educational and other services being disrupted at a time when the ongoing global pandemic means more people are reliant on online services than ever could create huge problems.
Read more: https://www.zdnet.com/article/ddos-attacks-are-getting-more-powerful-as-attackers-change-tactics/
KPMG: Consumers Vote to Ditch Breached Firms
Most consumers would take their business elsewhere if they discovered an organisation had suffered a major cyber-attack or data breach, according to new data from KPMG.
The global consulting firm polled over 2000 Canadians in September to better understand the impact of security incidents and the risks for online firms that fail to adequately protect customer data.
As many as 90% of respondents said they would feel wary about sharing personal or financial information with a company that had suffered such an incident, and over two-thirds (67%) are more worried than ever about their data being breached.
Why this matters:
The findings come at a time when consumers are spending more of their lives, and sharing more of their data, online.
Over half (54%) of respondents said they are shopping more online than they used to pre-COVID, rising to 64% for the 18-44 age group. The same number (54%) said they had received a lot more suspicious emails in the first half of 2020, and even more (84%) claimed they were being “extra careful” when shopping online for fear of their data being stolen.
Phishing (38%) and spear-phishing (13%) were revealed as the most common attacks likely to face Canadians, as they are consumers in other Western countries. Unfortunately for brands, they are likely to get the blame for successful attacks on consumers even though it is the email recipients themselves who make the mistake of clicking through.
Read more: https://www.infosecurity-magazine.com/news/kpmg-consumers-vote-to-ditch/
InterPlanetary Storm Botnet Infects 13K Mac, Android Devices
A new variant of the InterPlanetary Storm malware has been discovered, which comes with fresh detection-evasion tactics and now targets Mac and Android devices (in addition to Windows and Linux, which were targeted by previous variants of the malware).
Researchers say the malware is building a botnet with a current estimated 13,500 infected machines across 84 countries worldwide – and that number continues to grow. Half of the infected machines are in Hong Kong, South Korea and Taiwan. Other infected systems are in Russia, Brazil, the U.S., Sweden and China.
Why this matters:
While the botnet that this malware is building does not have clear functionality yet, it gives the campaign operators a backdoor into the infected devices so they can later be used for cryptomining, DDoS, or other large-scale attacks.
Read more: https://threatpost.com/botnet-mac-android/159714/
Android Spyware Variant Snoops on WhatsApp, Telegram Messages
Researchers say they have uncovered a new Android spyware variant with an updated command-and-control communication strategy and extended surveillance capabilities that snoops on social media apps WhatsApp and Telegram.
The malware, Android/SpyC32.A, is currently being used in active campaigns targeting victims in the Middle East. It is a new variant of an existing malware operated by threat group APT-C-23 (also known as Two-Tailed Scorpion and Desert Scorpion). APT-C-23 is known to utilize both Windows and Android components, and has previously targeted victims in the Middle East with apps in order to compromise Android smartphones.
Why this matters:
APT groups are increasing activity and they are continually, enhancing their toolsets and running new operations. This the group’s newest spyware version features several improvements making it more dangerous to victims. Whilst these attacks are targeting victims in the Middle East different groups will be using similar tactics against different targets in different locations.
Read more: https://threatpost.com/new-android-spyware-whatsapp-telegram/159694/
It’s Cyber Security Awareness Month
October is Cyber Security Awareness Month, and annual initiative by the National Cyber Security Alliance. How cyber security aware are you? How cyber security aware are your staff? What about your Board?
Why this matters:
Fundamentally attackers find it easier to your people than to break in via technical means – so cyber security awareness, and instilling in your staff that they have a role to play in helping to secure your organisation is absolutely key.
If you need help raising cyber amongst your staff, users or executives drop us a line – we can help
Read more: https://staysafeonline.org/cybersecurity-awareness-month/