Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 07 April 2023
Black Arrow Cyber Threat Briefing 07 April 2023:
-15 Million Public-Facing Services Vulnerable to Known Exploited Vulnerabilities
-New Research Highlights Increased Security Risks Posed by Remote Working and BYOD
-Lack of Security Employees Makes SMBs Sitting Ducks for Cyber Attacks
-IT and Security Pros Pressured to Keep Quiet About Data Breaches
-Phishing Emails are Seeing a Huge Rise, So Stay on Your Guard"
-Ransomware Attacks Skyrocket as Threat Actors Double Down on Global Attacks
-MSPs a Favoured Target of Supply Chain and Infrastructure Attacks
-Fake Ransomware Gang Targets Organisations with Empty Data Leak Threats
-GCHQ Updates Security Guidance for Boards
-More than 60% of Organisations have been Hit with Unplanned Downtime on a Monthly Basis
-For Cyber Crime Gangs, Professionnalisation Comes With “Corporate” Headaches
-UK’s Offensive Hacking Unit Takes on Military Opponents and Terrorist Groups
-Man Kills Himself After an AI Chatbot 'Encouraged' Him to Sacrifice Himself to Stop Climate Change
-Hackers Exploit WordPress Plugin Flaw That Gives Full Control of Millions of Sites
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
15 Million Public-Facing Services Vulnerable to Known Exploited Vulnerabilities
Over 15 million publicly facing services are susceptible to at least one of the 896 vulnerabilities listed in CISA's KEV (known exploitable vulnerabilities) catalogue. The findings are particularly worrying because the examined vulnerabilities are known and highlighted in CISA's KEV catalogue as actively exploited by hackers, so any delays in their patching maintain a large attack surface, giving threat actors numerous potential targets.
Over half of those 7 million instances were vulnerable to one of the 137 CVEs concerning Microsoft Windows, making this component a top priority for defenders and an excellent target for attackers. Almost half of those are over five years old, so roughly 800,000 machines have not applied security updates for a significant period of time.
New Research Highlights Increased Security Risks Posed by Remote Working and BYOD
New research has highlighted the increased threats associated with remote work and bring your own device (BYOD) policies faced by organisations. The results of the survey show that with remote and hybrid working, personal and work tasks blur together and the boundaries between the two have become more porous. The data shows that 32% of remote and hybrid workers use apps or software not approved by IT and 92% of remote employees perform work tasks on their personal tablet or smartphone devices. These devices, apps and software, along with the corporate data being accessed, are not visible to IT, thereby dramatically increasing an organisation’s risk posture.
Lack of Security Employees Makes SMBs Sitting Ducks for Cyber Attacks
Cyber security is a growing concern among all businesses but lack of security expertise in SMBs is leaving smaller firms open to attack. Cyber threats are more real and prevalent than ever before and the risk to businesses includes not only exposure of customer data and a decrease in trust, but also losses in revenue.
54% of small businesses say they are more concerned about cyber security now than one year ago yet 38% of SMBs said they had zero employees dedicated to security as part of their role, and 42% had just one employee working on security. Even without a traditional security role, there should be someone responsible for making security decisions in every organisation.
A lack of time to focus on security and keeping up with changing threats are amongst the biggest challenges for businesses.
https://www.helpnetsecurity.com/2023/04/04/smbs-security-posture/
IT and Security Pros Pressured to Keep Quiet About Data Breaches
It is not possible to stop every bad thing from happening. Alarmingly, when something does go wrong IT/security professionals are being told to keep a breach confidential, even when they knew it should be reported. More than 42% of IT/security professionals reporting this happening to them, and a worrying 30% said they have kept a breach confidential.
At 71%, IT/security professionals in the US were the most likely to say they have been told to keep quiet followed by the UK at 44%.
52% of global organisations have experienced a data breach or data leak in the last 12 months. The US led at 75% (or 23% higher than average) followed by the UK at 51.4%.
Infosec professionals are increasingly worried about their company facing legal action due to a breach being handled incorrectly.
https://www.helpnetsecurity.com/2023/04/06/pressure-keeping-breaches-confidential/
Phishing Emails are Seeing a Huge Rise, So Stay on Your Guard
Phishing attacks are up 5x year-on-year, researchers say. A report from Cofense analysed data received from 35 million people across the world, finding there has been a 569% increase in phishing attacks to 2022 and 478% increase to credential phishing. With the increased frequency, intensity and sophistication of these threats small and medium-sized businesses should be particularly wary of phishing and other forms of email-borne cyber attacks as their numbers have grown explosively over the last year, experts have warned. Organisations should keep eyes open for Business Email Compromise (BEC) attacks as this type continues to be one of the top crimes for the eighth year in a row.
https://www.techradar.com/news/phishing-emails-are-seeing-a-huge-rise-so-stay-on-your-guard
Ransomware Attacks Skyrocket as Threat Actors Double Down on Global Attacks
New studies have found that ransomware exploits are increasing, and a large percentage of victims are being hit multiple times. The NCC Group noted that there were 240 ransomware attacks in February 2023, a 45% increase from the record-high number of attacks in January. North America accounted for 47% of the global ransomware attacks, with Europe following (23%). Another report found that of all organisations hit by ransomware in the last 12 months, 28% were reported to be hit twice or more. Of the organisations breached, 69% reported phishing as the initial access vector.
https://www.techrepublic.com/article/nccgroup-ransomware-attacks-up-february/
MSPs a Favoured Target of Supply Chain and Infrastructure Attacks
With the backdrop of increasing cyber attacks on supply chains, Managed Service Providers (MSPs) are increasingly being favoured by attackers due to their pivotal role in the supply chain and access to the organisations they are serving.
When measured by sector, MSPs are the hardest hit by hackers in supply chain attacks.
ConnectWise’s cyber research unit analysed some 440,000 incidents that impacted MSPs and their clients and found that Lockbit led among the most prolific ransomware hijackers targeting MSPs, (42% of all ransomware attacks) followed by Cl0p at 11%. Whilst numerous other ransomware gangs also directly targeted MSPs in 2022.
Third party risk assessments should be carried out for all organisations in your supply chain and this is especially true of MSPs and external IT providers given the level of access they have into your systems and data.
Fake Ransomware Gang Targets Organisations with Empty Data Leak Threats
Fake extortionists are piggybacking on data breaches and ransomware incidents, threatening companies with publishing or selling allegedly stolen data unless they get paid. Sometimes the actors add the menace of a distributed denial-of-service (DDoS) attack if the message recipient does not comply with the instructions in the messages. It is possible that victims are selected from publicly available sources, such as the initial attacker’s data leak site, social media, news reports, or company disclosures; in some cases a fake extortionist could learn about ransomware victims that have yet to disclose the cyber attack, making it more likely for victims to believe them.
GCHQ Updates Security Guidance for Boards
The UK’s leading cyber security agency GCHQ, has urged the country’s business leaders to “get to grips” with cyber risk after releasing an updated toolkit to help them do so. GCHQ’s National Cyber Security Centre (NCSC) said its updated Cyber Security Board Toolkit is designed to boost the confidence of senior execs when discussing security with key stakeholders from the organisation.
Given the potentially serious impact breaches can have on business operations and growth, the agency wants boards to treat cyber risk with the same urgency as other business risks in areas such as financial and legal.
https://www.infosecurity-magazine.com/news/gchq-updates-security-guidance/
More than 60% of Organisations have been Hit with Unplanned Downtime on a Monthly Basis
A recent report found that 52% of organisations had suffered a data breach in the past two years, an increase from 49% in 2022. In addition, 62% of organisations reported that business critical applications suffered from unplanned downtime due to a cyber security incident on at least a monthly basis, an increase from 54% in 2022. Other key findings include downtime costing roughly 2.7% of annual revenue, 39% of organisations believing cyber security incidents directly harmed their competitive position and 31% noting that it had reduced shareholder revenue. As a result of the impact, 95% of organisations reported that they had planned to increase their security budget over the next 2 years.
For Cyber Crime Gangs, Professionalisation Comes With “Corporate” Headaches
Today’s largest cyber crime gangs are operating like large enterprises, with $50 million dollars in annual revenue and around 80% of operating expenses going towards wages. Researchers have found that small, medium and especially large cyber crime gangs are operating just like their legitimate counterparts, from their managerial structure to employee benefits. The research highlights a worrying level of sophistication within cyber crime gangs; we are no longer dealing with the lone attacker in a dark room, but in some cases an enterprise with clear objectives.
UK’s Offensive Hacking Unit Takes on Military Opponents and Terrorist Groups
Britain’s newly created offensive hacking unit, the National Cyber Force (NCF), has said it is engaged daily in operations to disrupt terrorist groups and military opponents of the UK. Operational details remain unclear, however the NCF says it is engaged in techniques to “undermine the tradecraft” of Russian, Chinese and other state-sponsored hackers and in “technical disruption” against terrorist groups, for example to prevent the dissemination of online propaganda. This news comes after the recent leak of files for Moscow, which had tasked an IT company to develop cyber warfare tools aimed at taking down infrastructure networks and scouring the internet for vulnerabilities.
Man Kills Himself After an AI Chatbot 'Encouraged' Him to Sacrifice Himself to Stop Climate Change
A man reportedly took his own life following a six-week-long conversation about the climate crisis with an artificial intelligence (AI) chatbot. Reports found that the chatbot had fed the mans worries about climate change, which had worsened his anxiety and later led to suicidal thoughts. The AI chatbot failed to dissuade the man from committing suicide and had in fact encouraged him to act on the thoughts and join the AI chatbot so “they could live together, as one person, in paradise”. This is despite the efforts made to limit these kind of events.
Hackers Exploit WordPress Plugin Flaw That Gives Full Control of Millions of Sites
Hackers are actively exploiting a critical vulnerability in a widely used WordPress plugin that gives them the ability to take complete control of millions of sites, researchers said. The vulnerability is in Elementor Pro, a premium plugin running on more than 12 million sites powered by WordPress. Despite the vulnerability being fixed, many have not installed the patch. Worryingly, this is a common theme in cyber; many organisations remain vulnerable due to them not having an efficient patching process and as a result, a number of the most exploited vulnerabilities have available patches.
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware attacks up sharply in February (techrepublic.com)
Fake ransomware gang targets U.S. orgs with empty data leak threats (bleepingcomputer.com)
New Money Message ransomware demands million dollar ransoms (bleepingcomputer.com)
Rorschach – A New Sophisticated and Fast Ransomware - Check Point Research
ALPHV ransomware exploits Veritas Backup Exec bugs for initial access (bleepingcomputer.com)
LockBit leaks data stolen from South Korean National Tax Service-Security Affairs
UK outsourcing services provider Capita suffered a cyber incident-Security Affairs
March ransomware disclosures spike behind Clop attacks | TechTarget
Protect Your Company: Ransomware Prevention Made Easy (thehackernews.com)
Dish Faces Investor Lawsuit Over Ransomware Attack, Downgrades From Equity Analysts | Next TV
Phishing & Email Based Attacks
Scammers Are Using ChatGPT to Write Emails That Aren't Riddled With Typos (futurism.com)
Phishing emails are seeing a huge rise, so stay on your guard | TechRadar
YouTube warns of email scam from seemingly authentic account | Science & Tech News | Sky News
BEC – Business Email Compromise
2FA/MFA
Malware
WinRAR SFX archives can run PowerShell without being detected (bleepingcomputer.com)
Malware and machine learning: A match made in hell - Help Net Security
Arid Viper Hacking Group Using Upgraded Malware in Middle East Cyber Attacks (thehackernews.com)
Flood of malicious packages results in NPM registry DoS - Help Net Security
Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks (thehackernews.com)
Researcher Tricks ChatGPT into Building Undetectable Steganography Malware (darkreading.com)
Typhon info-stealing malware devs upgrade evasion capabilities (bleepingcomputer.com)
Tax preparation and e-file service eFile.com compromised to serve malware-Security Affairs
The hidden picture of malware attack trends - Help Net Security
Mobile
BYOD
New Research Highlights Increased Security Risks Posed by Remote Working and BYOD - IT Security Guru
Internet of Things – IoT
Hackers can open Nexx garage doors remotely, and there's no fix (bleepingcomputer.com)
HP to patch critical bug in LaserJet printers within 90 days (bleepingcomputer.com)
Data Breaches/Leaks
Splunk Details Increase in Data Breaches, Downtime Due to Cyber security Issues - MSSP Alert
Uber driver info stolen in yet another third-party breach • The Register
ChatGPT linked to alleged leak of confidential information at Samsung (interestingengineering.com)
Law Firm for Uber Loses Drivers' Data to Hackers in Yet Another Breach (darkreading.com)
Marketplace 600K Records Leaked By Database Snafu (informationsecuritybuzz.com)
Organised Crime & Criminal Actors
For Cyber Crime Gangs, Professionalization & ‘Corporate’ Headaches (darkreading.com)
Fight Mercenaries with these Cyber security Principles (trendmicro.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
DoJ Recovers $112M in Crypto Stolen With Romance Scams (darkreading.com)
Hackers steal crypto assets by defeating 2FA with rogue browser extension | CSO Online
Insider Risk and Insider Threats
Re-evaluating immature and ineffective insider risk management programs - Help Net Security
Employees are as likely as cyber-criminals to cause cyber-incidents | The Independent
Fraud, Scams & Financial Crime
The staggering cost of identity fraud for financial services - Help Net Security
New dark web market STYX focuses on financial fraud services (bleepingcomputer.com)
What CISOs Can Do to Build Trust & Fight Fraud in the Metaverse (darkreading.com)
Feds seize $112m in currency tied to 'pig-butchering scams • The Register
Stop online counterfeiters dead in their tracks - Help Net Security
Deepfakes
Insurance
Dark Web
Supply Chain and Third Parties
MSPs a Favoured Target of Supply Chain and Infrastructure Attacks, ConnectWise Reports - MSSP Alert
APT group Winter Vivern exploits Zimbra webmail flaw to target government entities | CSO Online
Risk & Repeat: Inside the 3CX supply chain attack | TechTarget
10-year-old Windows bug with 'opt-in' fix exploited in 3CX attack (bleepingcomputer.com)
Automation, Cyber security, Integration Top the List of Priorities for MSPs in 2023 - MSSP Alert
Capita: Cyber attack caused pre-weekend outage • The Register
Western Digital Hit By Network Security Breach - Infosecurity Magazine (infosecurity-magazine.com)
Cloud/SaaS
Google Drive does a surprise rollout of file limits, locking out some users | Ars Technica
Capita: Cyber attack caused pre-weekend outage • The Register
Shadow data slipping past security teams - Help Net Security
Think Before You Share the Link: SaaS in the Real World (thehackernews.com)
Western Digital Hit By Network Security Breach - Infosecurity Magazine (infosecurity-magazine.com)
Hybrid/Remote Working
New Research Highlights Increased Security Risks Posed by Remote Working and BYOD - IT Security Guru
Unapproved Apps Used By 32% of Remote Workers - Infosecurity Magazine (infosecurity-magazine.com)
Shadow IT
Identity and Access Management
The high cost of insecure authentication methods - Help Net Security
3 Fronts in the Battle for Digital Identity (darkreading.com)
Passwords, Credential Stuffing & Brute Force Attacks
Takedown of notorious hacker marketplace selling your identity to criminals | Europol (europa.eu)
Stolen credential warehouse Genesis Market seized by FBI • The Register
Social Media
TikTok fined £12.7m for illegally processing children’s data | TikTok | The Guardian
TikTok bans explained: Everything you need to know (techtarget.com)
YouTube warns of email scam from seemingly authentic account | Science & Tech News | Sky News
Parental Controls and Child Safety
Regulations, Fines and Legislation
TikTok fined £12.7m for illegally processing children’s data | TikTok | The Guardian
UK data regulator issues warning over generative AI data protection concerns | CSO Online
Governance, Risk and Compliance
42% of IT leaders told to maintain breach confidentiality | TechTarget
GCHQ Updates Security Guidance for Boards - Infosecurity Magazine (infosecurity-magazine.com)
Splunk Details Increase in Data Breaches, Downtime Due to Issues - MSSP Alert
5 strategies to manage risks in mergers and acquisitions | CSO Online
Models, Frameworks and Standards
Careers, Working in Cyber and Information Security
Law Enforcement Action and Take Downs
Stolen credential warehouse Genesis Market seized by FBI • The Register
Spain's most dangerous and elusive hacker now in police custody (bleepingcomputer.com)
Genesis Market: Popular cyber crime website shut down by police - BBC News
Privacy, Surveillance and Mass Monitoring
Artificial Intelligence
Welcome to the era of viral AI generated 'news' images | CNN Business
Scammers Are Using ChatGPT to Write Emails That Aren't Riddled With Typos (futurism.com)
ChatGPT, the AI Revolution, and the Security, Privacy and Ethical Implications - SecurityWeek
Malware and machine learning: A match made in hell - Help Net Security
ChatGPT linked to alleged leak of confidential information at Samsung (interestingengineering.com)
UK data regulator issues warning over generative AI data protection concerns | CSO Online
Researcher Tricks ChatGPT into Building Undetectable Steganography Malware (darkreading.com)
Misinformation, Disinformation and Propaganda
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Russian pro-war military blogger killed in blast at St Petersburg cafe | Russia | The Guardian
China opens national security probe into Micron products • The Register
Vulkan Playbook Leak Exposes Russia's Plans for Worldwide Cyberwar (darkreading.com)
Britain’s cyberwarfare chief reveals his identity | The Economist
Nation State Actors
APT group Winter Vivern exploits Zimbra webmail flaw to target government entities | CSO Online
Russian pro-war military blogger killed in blast at St Petersburg cafe | Russia | The Guardian
China opens national security probe into Micron products • The Register
Report: Chinese State-Sponsored Hacking Group Highly Active - SecurityWeek
Vulkan Playbook Leak Exposes Russia's Plans for Worldwide Cyberwar (darkreading.com)
The other Chinese apps taking the US and UK by storm - BBC News
Google TAG Alerts Of ARCHIPELAGO Cyber attacks Linked To North Korea (informationsecuritybuzz.com)
Vulnerability Management
15 million public-facing services vulnerable to CISA KEV flaws (bleepingcomputer.com)
10-year-old Windows bug with 'opt-in' fix exploited in 3CX attack (bleepingcomputer.com)
Millions still exposed despite available fixes - Help Net Security
Microsoft to admins: Auto-review your Autopatch alerts • The Register
Vulnerabilities
Tools and Controls
How can organisations bridge the gap between DR and cyber security? - Help Net Security
Let’s pump the brakes on the rush to incorporate AI into cyber security | CSO Online
The high cost of insecure authentication methods - Help Net Security
How AI is transforming cyber security for better and worse - Help Net Security
3 Fronts in the Battle for Digital Identity (darkreading.com)
Reports Published in the Last Week
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links
Black Arrow Cyber Threat Briefing 15 April 2022
Black Arrow Cyber Threat Briefing 15 April 2022:
-Cyber Security Is Getting Harder: More Threats, More Complexity, Fewer People
-Terrible Cloud Security Is Leaving the Door Open for Hackers. Here's What You're Doing Wrong
-More Organisations Are Paying the Ransom. Why?
-Cyber Attack Puts City Firms on High Alert To Bolster Defences
-More Than 60% of Organisations Suffered a Breach in the Past 12 Months
-Account Takeover Poised to Surpass Malware as The No. 1 Security Concern
-Security Research Reveals 42% Rise In New Ransomware Programs In 2021
-Fraudsters Stole £58m with Remote Access Trojans (RATs) in 2021
-As State-Backed Cyber Threats Grow, Here's How the World Is Reacting
-Q1 Reported Data Compromises Up 14% Over 2021
-Europol Announces Operation to Hit Russian Sanctions-Evaders
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Cyber Security Is Getting Harder: More Threats, More Complexity, Fewer People
Splunk and Enterprise Strategy Group released a global research report that examines the security issues facing the modern enterprise. More than 1,200 security leaders participated in the survey, revealing they’ve seen an increase in cyber attacks while their teams are facing widening talent gaps.
According to the report, 65% of respondents say they have seen an increase in attempted cyber attacks. In addition, many have been directly impacted by data breaches and costly ransomware attacks, which have left security teams exhausted:
· 49% of organisations say they have suffered a data breach over the past two years, an increase from 39% a year earlier.
· 79% of respondents say they’ve encountered ransomware attacks, and 35% admit that one or more of those attacks led them to lose access to data and systems.
· 59% of security teams say they had to devote significant time and resources to remediation, an increase from 42% a year ago.
· 54% of respondents report that their business-critical applications have suffered from unplanned outages related to cyber security incidents on at least a monthly basis, with a median of 12 outages per year. The median time to recover from unplanned downtime tied to cyber security incidents is 14 hours. Respondents estimated the cost of this downtime averaged about $200,000 per hour.
· 64% of security professionals have stated that it’s challenging to keep up with new security requirements, up from 49% a year ago.
https://www.helpnetsecurity.com/2022/04/13/modern-enterprise-security-issues/
Terrible Cloud Security Is Leaving the Door Open for Hackers. Here's What You're Doing Wrong
A rise in hybrid work and a shift to cloud platforms has changed how businesses operate - but it's also leaving them vulnerable to cyber attacks.
Cloud applications and services are a prime target for hackers because poor cyber security management and misconfigured services are leaving them exposed to the internet and vulnerable to simple cyber attacks.
Analysis of identity and access management (IAM) polices taking into account hundreds of thousands of users in 18,000 cloud environments across 200 organisations by cyber security researchers at Palo Alto Networks found that cloud accounts and services are leaving open doors for cyber criminals to exploit – and putting businesses and users at risk.
The global pandemic pushed organisations and employees towards new ways of remote and hybrid working, with the aid of cloud services and applications. While beneficial to businesses and employees, it also created additional cyber security risks – and malicious hackers know this.
More Organisations Are Paying the Ransom. Why?
Most organisations (71%) have been hit by ransomware in 2021, and most of those (63%) opted for paying the requested ransom, the 2022 Cyberthreat Defense Report (CDR) by the CyberEdge Group has shown.
The research company says that possible explanations for the steady yearly rise of the percentage of organisations that decided to pay the ransom may include: the threat of exposing exfiltrated data, increased confidence for data recovery, and the fact that many organisations find that paying a ransom is significantly less costly than system downtime, customer disruption, and potential lawsuits.
“72% of ransom-paying victims recovered their data [in 2021], up from 49% in 2017. This increased confidence for successful data recovery is often factored into the ransom-paying decision,” the company noted.
Similarly, BakerHostatler’s 2022 Data Security Incident Response Report says that in ransomware incidents the US-based law firm was called in to manage in 2021, ransomware groups provided decryptors and stuck to their promise to not publish stolen data 97% of the time.
https://www.helpnetsecurity.com/2022/04/11/organizations-paying-ransom/
Cyber Attack Puts City Firms on High Alert to Bolster Defences
Experts warn a combination of 'ignorance and arrogance' makes City executives vulnerable to attacks.
City firms on high alert for cyber attacks were sent a clear warning recently, bolstering concerns of the potential for breaches from Russia.
Ince Group, the London-listed law firm, last month fell prey to hackers who infiltrated its computer systems and stole confidential data. The company's security systems detected the intrusion on March 13, prompting the IT team to shut down servers to try and prevent widespread damage.
But soon after, the hackers demanded a ransom for stolen data and threatened to publish it on the dark web if Ince Group, which has clients in the shipping, energy and healthcare sectors, didn't pay up.
The incident has intensified worries of possible breaches after warnings that City firms could be targeted by Russian hackers following Putin’s invasion of Ukraine.
Julia O'Toole, chief executive of MyCena Security Solutions, says executives should be "very concerned" about any news of a cyber attack at a rival company.
More Than 60% of Organisations Suffered a Breach in the Past 12 Months
Firms focus too narrowly on external attackers when it's insiders, third parties, and stolen assets that cause many breaches, new study shows.
The majority of companies — 63% — have suffered at least one breach in the past 12 months. The global average breach cost $2.4 million — a price tag that increases to $3.0 million for companies unprepared to respond to compromises.
The new data from Forrester Research, released on April 8 in a report titled "The 2021 State Of Enterprise Breaches," found that the number of breaches and the cost of breaches varied widely depending on the geographic location of the business and to what degree the organisation is prepared to respond to breaches. Companies in North America had the largest disparity between the haves and have-nots: While the average organisation required 38 days to find, eradicate, and recover from a breach, companies that failed to adequately prepare for security challenges took 62 days.
The difference in response resulted in a large difference in cost as well, with the average North American company paying $3.0 million to recover from a breach, a bill that rises to $4.0 million if the company suffered from a lack of incident-response preparation.
"The misalignment between the expectation and the reality of breaches has become very important," says Allie Mellen, an analyst with Forrester's Security and Risk group. "On a global scale, there is a big disparity of about $600,000 between those who are prepared to respond to a breach and those who are not."
Account Takeover Poised to Surpass Malware as The No. 1 Security Concern
As most researchers and financial executives can attest, virtually all types of fraud have dramatically risen over the past two years. However, attackers taking over legitimate financial accounts have become even more of a favourite with cyber criminals than most fraud schemes.
Many major recent research reports have pointed out that account takeover (ATO), a form of identity theft where bad actors access legitimate bank accounts, change the account information and passwords, and hijack a real customer’s account, has skyrocketed since last year. According to Javelin Research’s annual "Identity Fraud Study: The Virtual Battleground" report, account takeover increased by 90% to an estimated $11.4 billion in 2021 when compared with 2020 — representing roughly one-quarter of all identity fraud losses last year.
Like many types of financial fraud, cyber thieves are betting on the fact that if they attempt to seize a large number of legitimate accounts, eventually they will get a payoff.
Account takeovers are a numbers game, the more accounts that an organisation has, the bigger their risk that some of them will be compromised.
Account takeovers often piggyback off of previous attacks, making these crimes a way for hackers to make the most out of stolen information. Diskin pointed out that account takeovers most commonly happen when a password is “taken from another data leak and reused for different accounts. But there are a variety of risky scenarios that can lead to compromise.”
Security Research Reveals 42% Rise in New Ransomware Programs In 2021
Critical infrastructure in the crosshairs: operational technology vulnerabilities jump 88% .
Threat intelligence analysts at Skybox Research Lab uncovered a 42% increase in new ransomware programs targeting known vulnerabilities in 2021. The Silicon Valley cyber security company released its annual 2022 Vulnerability and Threat Trends Report, revealing how quickly cyber criminals capitalise on new security weaknesses – shrinking the window that organisations have to remediate vulnerabilities ahead of an attack.
With 20,175 new vulnerabilities published in 2021, Skybox Research Lab witnessed the most vulnerabilities ever reported in a single year. And these new vulnerabilities are just the tip of the iceberg. The total number of vulnerabilities published over the last 10 years reached 166,938 in 2021 — a three-fold increase over a decade. These cumulative vulnerabilities, piling up year after year, represent an enormous aggregate risk, and they’ve left organisations struggling with a mountain of cyber security debt. As the US Cybersecurity and Infrastructure Security Agency (CISA) highlights in its Top Routinely Exploited Vulnerabilities list, threat actors are routinely exploiting publicly disclosed vulnerabilities from years past.
The sheer volume of accumulated risks — hundreds of thousands or even millions of vulnerability instances within organisations — means they can’t possibly patch all of them. To prevent cyber security incidents, it is critical to prioritise exposed vulnerabilities that could cause the most significant disruption, then, apply appropriate remediation options including configuration changes or network segmentation to eliminate risk, even before patches are applied or in cases where patches aren’t available.
Fraudsters Stole £58m with Remote Access Trojans (RATs) in 2021
2021 saw victims of Remote Access Tool (RAT) scams lose £58m in 2021, official UK police figures show.
RAT scams involve scammers taking control of a victim’s device, typically in order to access bank accounts.
Some 20,144 victims fell for this type of scam in 2021, averaging around £2800 stolen per incident.
Typically, RAT attacks begin with a victim being inundated with pop-ups claiming there is a problem with the computer. Users are often then asked to call a “hotline” number, when a scammer will persuade them to download a RAT.
RAT scams are often compared to the classic “tech support” scams. Modern RAT scams are typically more devious, however, with scammers often cold-calling their victims pretending to work for their bank and claiming that they need computer access to investigate a fraudulent transaction.
https://www.itsecurityguru.org/2022/04/11/fraudsters-stole-58m-with-rats-in-2021/
As State-Backed Cyber Threats Grow, Here's How the World Is Reacting
With the ongoing conflict in Eurasia, cyber warfare is inevitably making its presence felt. The fight is not only being fought on the fields. There is also a big battle happening in cyberspace. Several cyber-attacks have been reported over the past months.
Notably, cyber attacks backed by state actors are becoming prominent. There have been reports of a rise of ransomware and other malware attacks such as Cyclops Blink, HermeticWiper, and BlackCat. These target businesses as well as government institutions and nonprofit organisations. There have been cases of several attempts to shut down online communications and IT infrastructure.
The ongoing list of significant cyber incidents curated by the Center for Strategic and International Studies (CSIS) shows that the number of major incidents in January 2022 is 100% higher compared to the same period in the previous year. With the recent activities in cyberspace impacted by the emergence of the geopolitical tumult in February, it is not going to be surprising to see an even more dramatic rise in the number of significant incidents.
https://thehackernews.com/2022/04/as-state-backed-cyber-threats-grow.html
Q1 Reported Data Compromises Up 14% Over 2021
The Identity Theft Resource Center published a First Quarter 2022 Data Breach Analysis which found that Q1 of 2022 began with the highest number of publicly reported data compromises in the past three years.
Publicly reported data compromises totalled 404 through March 31, 2022, a 14 percent increase compared to Q1 2021.
This is the third consecutive year when the number of total data compromises increased compared to Q1 of the previous year. It also represents the highest number of Q1 data compromises since 2020.
https://informationsecuritybuzz.com/expert-comments/q1-reported-data-compromises-up-14-over-2021/
Europol Announces Operation to Hit Russian Sanctions-Evaders
European police have announced a major new operation designed to crack down on Russian oligarchs and businesses looking to circumvent sanctions.
Operation Oscar will run for at least a year as an umbrella initiative that will feature many separate investigations, Europol explained.
The policing organisation’s European Financial and Economic Crime Centre will work to exchange information and intelligence with partners and provide operational support in financial crime investigations.
A key focus appears to be on illicit flows of money, which Russian individuals and entities will be trying to move around the region in order to bypass sanctions imposed since President Putin’s invasion of Ukraine.
“Europol will centralise and analyse all information contributed under this operation to identify international links, criminal groups and suspects, as well as new criminal trends and patterns,” Europol said.
“Europol will further provide tailor-made analytical support to investigations, as well as operational coordination, forensics and technical expertise, and financial support to the relevant national authorities.”
https://www.infosecurity-magazine.com/news/europol-hit-russian/
Threats
Ransomware
Ransomware: These Two Gangs Are Behind Half of All Attacks | ZDNet
Don't Let Ransomware Gangs Spend Months in Your Network • The Register
Karakurt Data Thieves Linked to Larger Conti Hacking Group | CSO Online
Conti Ransomware Gang Claims Responsibility for The Nordex Hack - Security Affairs
OldGremlin Ransomware Gang Targets Russia with New Malware (bleepingcomputer.com)
Conti Ransomware Offshoot Targets Russian Organisations | Malwarebytes Labs
Other Social Engineering
FBI: Payment App Users Targeted in Social Engineering Attacks (bleepingcomputer.com)
These Hackers Pretend to Poach, Recruit Rival Bank Staff In New Cyber Attacks | ZDNet
Malware
Microsoft Sounds The Alarm Over New Cunning Windows Malware | TechRadar
Spring4Shell Under Active Exploit by Mirai Botnet Herders • The Register
Haskers Gang Gives Away ZingoStealer Malware to Other Cyber Criminals for Free (thehackernews.com)
Hackers Hijack Adult Websites to Infect Victims With Malware | TechRadar
Qbot Malware Switches To New Windows Installer Infection Vector (bleepingcomputer.com)
Windows 11 tool to Add Google Play Secretly Installed Malware (bleepingcomputer.com)
Over 16,500 Sites Hacked to Distribute Malware via Web Redirect Service (thehackernews.com)
Enemybot: a New Mirai, Gafgyt Hybrid Botnet Joins The Scene | ZDNet
Mobile
Android Banking Malware Intercepts Calls to Customer Support (bleepingcomputer.com)
How to Stop Octo Malware From Remotely Accessing Your Android (lifehacker.com)
IoT
New EnemyBot DDoS Botnet Recruits Routers and IoTs Into Its Army (bleepingcomputer.com)
3 Reasons Connected Devices are More Vulnerable than Ever (bleepingcomputer.com)
Data Breaches/Leaks
Organised Crime & Criminal Actors
New Industrial Spy Stolen Data Market Promoted Through Cracks, Adware (bleepingcomputer.com)
Google Files Suit Against Cameroonian Cyber Criminal Who Used Puppies as Lures - CyberScoop
Cryptocurrency/Cryptomining/Cryptojacking
10 NFT and Cryptocurrency Security Risks That CISOs Must Navigate | CSO Online
A Practical Reason Why Crypto Might Not Work for Large-Scale Sanctions Evasion - CyberScoop
Insider Risk and Insider Threats
Fraud, Scams & Financial Crime
Denial of Service DoS/DDoS
New Fodcha DDoS Botnet Targets Over 100 Victims Every Day (bleepingcomputer.com)
New EnemyBot DDoS Botnet Borrows Exploit Code from Mirai and Gafgyt (thehackernews.com)
Cloud
99% Of Cloud Identities Are Overly Permissive, Opening Door to Attackers | CSO Online
Top Attack Techniques for Breaching Enterprise And Cloud Environments - Help Net Security
Finding Attack Paths in Cloud Environments (thehackernews.com)
The Two Words You Should Never Forget When You’re Securing a Cloud - Help Net Security
Privacy
Spyware, Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Preparing for Armageddon: How Ukraine Battles Russian hackers | Ars Technica
Hackers Target Ukrainian Govt with IcedID Malware, Zimbra Exploits (bleepingcomputer.com)
Russia’s Sandworm Hackers Attempted a Third Blackout In Ukraine | Ars Technica
The Unceasing Action of Anonymous Against Russia - Security Affairs
European Officials Reportedly Targeted by NSO Spyware • The Register
Nation State Actors
Nation State Actors – Russia
Nation State Actors – China
Nation State Actors – North Korea
US Gov Believes Lazarus APT is Behind Ronin Validator Cyber Heist - Security Affairs
Feds Offer $5m Reward for Info on North Korean Cyber Crooks • The Register
FBI Links Largest Crypto Hack Ever to North Korean Hackers (bleepingcomputer.com)
Symantec: North Korea's Lazarus Targets Chemical Companies • The Register
Vulnerabilities
Microsoft Issues Patches for 2 Windows Zero-Days and 126 Other Vulnerabilities (thehackernews.com)
Google Issues Third Emergency Fix For Chrome This Year • The Register
Critical HP Teradici PCoIP Flaws Impact 15 Million Endpoints (bleepingcomputer.com)
Critical Windows RPC Vulnerability Raises Alarm (techtarget.com)
VMware Workspace One Flaw Actively Exploited in The Wild (techtarget.com)
Adobe Patches Gaping Security Holes in Acrobat, Reader, Photoshop | SecurityWeek.Com
Cisco Vulnerability Lets Hackers Craft Their Own Login Credentials (bleepingcomputer.com)
Several Vulnerabilities Allow Disabling of Palo Alto Networks Products | SecurityWeek.Com
Cisco Patches Critical Vulnerability in Wireless LAN Controller | SecurityWeek.Com
Critical Flaw in Elementor WordPress Plugin May Affect 500k Sites (bleepingcomputer.com)
Critical Apache Struts RCE Vulnerability Wasn't Fully Fixed, Patch Now (bleepingcomputer.com)
Attackers Are Exploiting VMware RCE to Deliver Malware (CVE-2022-22954) - Help Net Security
These D-Link Routers Are Vulnerable To Remote Hacks And Should Be Retired Immediately | HotHardware
Upgrades for Spring Framework Have Stalled (darkreading.com)
Sector Specific
CNI, OT, ICS, IIoT and SCADA
CISA Alert on ICS, SCADA Devices Highlights Growing Enterprise IoT Security Risks (darkreading.com)
Pipedream Malware: Feds Uncover 'Swiss Army Knife' for Industrial System Hacking | WIRED
New Malware Tools Pose 'Clear and Present Threat' to ICS Environments (darkreading.com)
US Warns of APT Hackers Targeting ICS/SCADA Systems with Specialized Malware (thehackernews.com)
Flaws in ABB Network Interface Modules Expose Industrial Systems to DoS Attacks | SecurityWeek.Com
Energy & Utilities
Reports Published in the Last Week
Other News
Singapore To License Infosec Service Providers • The Register
What Is the Cyber Kill Chain? A Model for Tracing Cyber Attacks | CSO Online
Cyber Defense: Prioritized By Real-World Threat Data - Help Net Security
The Cyber Criminal Isn’t Necessarily Who You Think… | Mind Matters
How Cryptocurrency Gave Birth to the Ransomware Epidemic (vice.com)
Dark Data Is a Pain Point For Many Security Leaders - Help Net Security
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.