Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 23 February 2024
Black Arrow Cyber Threat Intelligence Briefing 23 February 2024:
-Despite Recent FBI Disruptions, a Rise in Ransomware Means 2024 Will be a Volatile Year for Cyber Security
-The Old, Not the New: Basic Security Issues Still the Biggest Threat to Enterprises
-Reevaluating Your Cyber Security Priorities
-Cyber Threat Environment at its Most Dangerous for SMBs, as Geopolitical Tenison, Extortion and Attacks Present Biggest Risks
-Legal Sector Grows as a Target, with Cyber Attacks on Law Firms Surging by Over a Third
-It’s Not Only Ransomware Seeing Huge Rises, Business Email Compromise (BEC) Attacks are Also Seeing a Huge Rise – is Your Business Prepared?
-Deepfake Phishing Grew by 3,000% in 2023, and it’s Just the Beginning
-Cyber Attacks are Getting Faster, More Common and More Successful, Although Detection is More Advanced Than Ever — New Report Signals the Threats to Businesses, Supply Chains, and Democracy
-Report Finds Malicious Emails Bypassing Secure Email Gateways Rose by 105%
-Rising Cyber Threats Identified Amongst Other Major Business Risks for 2024
-Huge Cyber Security Leak Lifts the Lid on China’s Hackers for Hire
-Fifth of British Kids Have Broken the Law Online
-Over 40% of Firms Struggle with Cyber Security Talent Shortage
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Despite Recent NCA and FBI Disruptions, a Rise in Ransomware Means 2024 Will be a Volatile Year for Cyber Security
There has been a lot of high profile coverage this week of the infamous and prolific LockBit gang’s infrastructure having been seized by law enforcement following an international Police operation led by the UK’s National Crime Agency. Whilst the international operation shows the seriousness of the matter, and the success of the operation should be celebrated, those celebrations should be muted and organisations should not become lax. Like the Hydra of Greek mythology, when one head disappears, a few more appear in its place. Ransomware really is a case of if, not when, and your organisation needs to be prepared.
Further, a recent threat report has found that the median ransom demand rose by 20% year on year, hitting an average of $600,000 and it is expected that 2024 will be even more volatile. Ransomware groups are expanding their target lists and exploring new pressure tactics in response to increasingly effective law enforcement efforts, and this is coupled with the increasing regulatory impact on organisations.
Sources: [Sky News] [GOV Infosecurity] [Bleeping Computer] [Infosecurity Magazine] [Cyber Reason]
The Old, Not the New: Basic Security Issues Still the Biggest Threat to Enterprises
In the latest IBM X-Force Threat Intelligence Index, it was revealed that basic security issues remain the most significant threat to enterprises. Cyber criminals are increasingly turning to credential stuffing, using and exploiting valid accounts harvested from the darkweb and previous breaches, with a 266% uptick in info-stealing malware. This tactic is harder to detect and elicits a costly response from enterprises. On the other hand, it is also important to adopt an attacker mindset for effective security. Understanding the attacker’s tools, motives, and efforts can help in limiting access, compartmentalising the impact of any successful attack, and minimising the time to attack detection. In essence, while organisations continue to grapple with complex cyber threats, the biggest security problem boils down to the basic and the already known. Therefore, it is crucial to focus on strengthening basic security measures and thinking like an attacker to proactively mitigate the risk for a more secure attack surface.
Source: [Help Net Security] [Forbes]
Reevaluating Your Cyber Security Priorities
Both technology and cyber criminals are evolving, yet many companies and organisations are not. For many corporate leaders, they may not know where to begin. Organisations looking to evolve their cyber security posture should look to elevate cyber to the C-suite and board, conduct audits of their sensitive information, create or update and test their incident response plan and finally, revisit their cyber hygiene training to ensure it is doing more than just ticking boxes. Organisations doing the above will find themselves improving their cyber security posture, and mitigating their risk to threats.
Source: [Dark Reading]
Cyber Threat Environment at its Most Dangerous for SMBs, as Geopolitical Tenison, Extortion and Attacks Present Biggest Risks
A new study has found that extortion campaigns, geopolitical threats, and attacks on small and medium-sized businesses (SMBs) are amongst the greatest threats to cyber security defences currently. The report, conducted by Mimecast, highlights how individual ransom groups have claimed over 1,000 victims and over $300 million in payments. Regarding SMBs, the report found that these businesses encountered twice the normal number of threats, at over 30 threats per user, as compared to larger companies who saw approximately 15. Not only are SMBs at more risk, but they also do not have the same resources a large company would have to mitigate such threats. SMBs must be efficient in the way they prioritise and address their cyber risk as part of their larger risk management strategy.
Sources: [Emerging Risks] [The HR Director]
Legal Sector Grows as a Target, with Cyber Attacks on Law Firms Surging by Over a Third
A new report has found that the number of reported cyber breaches on UK law firms has increased 30% from the previous year, as attackers increasingly target the profession. As a note, this does not include firms who may be unaware that they have been breached. Law firms are an attractive target to attackers due to the sensitive information such as M&A activity, divorce information and big ticket litigation; many attackers believe that law firms will pay handsomely to have this data back.
Sources: [Emerging Risks] [Legal Cheek]
It’s Not Only Ransomware Seeing Huge Rises: Business Email Compromise (BEC) Attacks are Also Seeing a Huge Rise. Is Your Business Prepared?
A recent report found that business email compromise (BEC) saw a staggering increase of 10 time the amount compared to the previous year. BEC involves a genuine business email account being compromised by a threat actor; this could be your supplier, a client, or anyone you have legitimate contact with. With such an increase, organisations must consider if they would be able to spot and mitigate BEC in their corporate environment through robust operational controls such as callback procedures for example. Due to the rise in deep fake fraud with voice cloning and video, the efficacy of traditional safeguards such as callbacks are not providing the assurance they once did. Firms and employees need to be on their guard to these changing tactics to safeguard the business.
Source: [TechRadar]
Deepfake Phishing Grew by 3,000% in 2023, and it’s Just the Beginning
Phishing remains one of the most prevalent cyber security threats, and with the emergence of artificial intelligence it is only going to carry on getting worse. According to a recent report, the number of deepfake fraud attempts rose by 3,000%. In one instance, the CEO of an energy enterprise sent €220,000 to a supplier after getting a call from the parent company’s leader requesting the exchange; the call was a deepfake.
Source: [HackerNoon]
Cyber Attacks are Getting Faster, More Common and More Successful, Although Detection is More Advanced Than Ever. New Report Signals the Threats to Businesses, Supply Chains, and Democracy
A recent report from CrowdStrike sheds light on the increasing speed and sophistication of cyber attacks. Breakout times have plummeted to an average of 62 minutes, with a record time of just two minutes and seven seconds observed. Hackers are now targeting the cloud, exploiting its vulnerabilities and leveraging AI assistance to escalate attacks. The human factor remains a primary entry point for threat actors, with social engineering and phishing campaigns on the rise. As organisations transition to the cloud, threat actors follow suit, with cloud intrusions soaring by 75%. CrowdStrike warns of state-sponsored adversaries targeting critical elections, emphasising the need for a platform-based approach bolstered by threat intelligence to safeguard against evolving threats.
Source: [TechRadar]
Report Finds Malicious Emails Bypassing Secure Email Gateways Rose by 105%
A report by Cofense has found a 105% increase in malicious emails that successfully bypassed Secure Email Gateways (SEGs), with approximately one malicious email navigating their way past SEGs every 57 seconds. The report suggests that phishing efforts are outpacing that of SEGs, and such phishing efforts are responsible for 90% of data breaches. Whilst SEGs may be filtering out a number of malicious emails, they, like everything in cyber security, are not a silver bullet. Organisations should not fall foul of believing that they are impenetrable because they have a SEG.
Sources: [SiliconANGLE] [Security Magazine] [Help Net Security]
Rising Cyber Threats Identified as Major Business Risk for 2024
In the latest Allianz risk barometer, cyber incidents have been identified as the most significant concern for companies globally in 2024. This is particularly true for remote desktop connections, which have become a prime target for cyber attacks since the shift to a work-from-home environment. The report also highlights that the risk landscape is being shaped by digitalisation, climate change, and geopolitical uncertainties. Meanwhile, a report from Coalition reveals that the cyber attack surface has expanded due to new ways of working. The report found that smaller businesses often lack the resources to prepare for a wide range of risk scenarios, which can lead to longer recovery times after an unexpected incident. These findings underscore the importance of robust cyber security measures and the need for continuous monitoring and improvement of an organisation’s digital defences.
Sources: [Reinsurance News] [Allianz]
Huge Cyber Security Leak Lifts the Lid on China’s Hackers for Hire
A huge leak of data from a Chinese cyber security firm, iSoon, has revealed state security agents paying tens of thousands of pounds to harvest data on targets, including the likes of foreign governments, and the leak shows this has been going on for years. Since the release, CrowdStrike has drawn overlaps between the firm and multiple known Chinese threat actors who are well resourced and conduct attacks over an extended period (referred to as advanced persistent threats, APTs). Among some of the 500 leaked documents are product manuals, lists of clients and employees, and WeChat instant messages. The leaks show over 14 governments have been attacked, as well as gambling and telecommunications companies.
Sources: [Dark Reading] [The Guardian]
Fifth of British Kids Have Broken the Law Online
In a recent study by the UK National Crime Agency (NCA), one in five children aged 10 to 16 have engaged in online offences with the figure rising to 25% among online gamers. These "low-level" cyber crimes, such as attempting to access protected servers or launching distributed denial of service (DDoS) attacks, may not be perceived by young individuals as violating the Computer Misuse Act. The consequences, however, are severe, including potential arrest, criminal records, and restrictions on future opportunities. The NCA stresses the importance of educating both children and adults about the legal and ethical implications of such actions, highlighting the transition from minor offences to more serious cyber crimes. With a significant shortage of cyber security professionals globally, fostering positive digital skills among young individuals is crucial for meeting industry demands and deterring cyber crime. Parents, teachers, and children are encouraged to explore resources provided by the NCA's Cyber Choices website to prevent inadvertent involvement in illegal online activities.
Source: [Infosecurity Magazine]
Over 40% of Firms Struggle with Cyber Security Talent Shortage
A recent report from Kaspersky has unveiled a critical global challenge: over 40% of companies are struggling to fill essential cyber security roles, with information security research and malware analysis roles particularly affected. This scarcity is felt most acutely in Europe and Latin America. Roles within security operations centres (SOCs) and network security are also understaffed, with figures around 35% and 33% respectively. The government sector faces the most significant demand for cyber security experts, followed closely by the telecoms and media sectors. While efforts like offering competitive salaries and enhanced training are underway, the gap persists due to the rapid pace of technological advancement outstripping educational initiatives. The report emphasises the need for innovative solutions to bridge this shortfall, highlighting recruitment, training, and technological advancements as key components of a comprehensive strategy to bolster cyber security resilience in the face of evolving threats.
Source: [Infosecurity Magazine]
Governance, Risk and Compliance
Cyber security professionals admit “knowledge gaps” have led to serious security blunders | ITPro
The old, not the new: Basic security issues still biggest threat to enterprises - Help Net Security
Cyber threat environment more dangerous then ever - Mimecast (emergingrisks.co.uk)
Gartner: Three top trends in cyber security for 2024 | Computer Weekly
Coalition report reveals rising cyber threats amidst business vulnerabilities - Reinsurance News
Thinking Like An Attacker—Another Look At Enterprise Security (forbes.com)
Hackers using stolen credentials to launch attacks as info-stealing peaks | CSO Online
How CISOs Balance Business Growth, Security in Cyber Threat Landscape (darkreading.com)
Allianz Risk Barometer: Identifying the major business risks for 2024
Why cyber security can boost organisational innovation | TechRadar
4 Key Steps to Reevaluate Your Cyber Security Priorities (darkreading.com)
Cyber security success -- elevate your defence against cyber threats (betanews.com)
Threats
Ransomware, Extortion and Destructive Attacks
Ransom demands surge by 20% in 2023, hitting key industries hardest - SiliconANGLE
LockBit Attempts to Stay Afloat with a New Version (trendmicro.com)
LockBit registered nearly 200 "affiliates" over the past two years | TechRadar
2024 will be a volatile year for cyber security as ransomware groups evolve - Help Net Security
Ransomware Experts See Problems With Banning Ransom Payments (govinfosecurity.com)
Ransomware and BEC are seeing a huge rise — is your business ready? | TechRadar
ConnectWise exploit could spur ‘ransomware free-for-all,’ expert warns | SC Media (scmagazine.com)
3 trends set to drive cyber attacks and ransomware in 2024 | World Economic Forum (weforum.org)
Year-over-year, the median initial ransom has risen by 20% | Security Magazine
Alpha ransomware linked to NetWalker operation dismantled in 2021 (bleepingcomputer.com)
Akira Ransomware Exploiting Cisco Anyconnect Vulnerability (gbhackers.com)
Knight ransomware source code for sale after leak site shuts down (bleepingcomputer.com)
Stuck in cyber attack nightmare? Call the negotiators (techxplore.com)
Report: Manufacturing bears the brunt of industrial ransomware | CyberScoop
Ransomware Victims
eSentire Confirms Rhysida Ransomware Victims - Infosecurity Magazine (infosecurity-magazine.com)
ALPHV ransomware claims loanDepot, Prudential Financial breaches (bleepingcomputer.com)
147 ransomware attacks on large Dutch companies, institutions last year; 18% paid ransom | NL Times
Pharmacy Delays Across US Blamed on Nation-State Hackers (darkreading.com)
Phishing & Email Based Attacks
New report warns of ongoing rise of malicious emails bypassing secure email gateways - SiliconANGLE
Deepfake Phishing Grew by 3,000% in 2023 — And It's Just Beginning | HackerNoon
Other Social Engineering
Artificial Intelligence
AI models can be weaponized to hack websites on their own • The Register
Deepfake Phishing Grew by 3,000% in 2023 — And It's Just Beginning | HackerNoon
Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard
As adversaries harness AI, tech firms peer through chat logs to catch them - Defense One
Air Canada Has to Honor a Refund Policy Its Chatbot Made Up | WIRED
36% of code generated by GitHub CoPilot contains security flaws - Help Net Security
Employees input sensitive data into generative AI tools despite the risks | ZDNET
Ransomware Declines as InfoStealers and AI Threats Gain Ground: IBM X-Force - SecurityWeek
Gartner: Three top trends in cyber security for 2024 | Computer Weekly
Malware
FBI's Most-Wanted Zeus and IcedID Malware Mastermind Pleads Guilty (thehackernews.com)
Iranian Hackers Target Middle East Policy Experts with New BASICSTAR Backdoor (thehackernews.com)
VIPRE report predicts 276% rise in malware in 2024 (securitybrief.co.nz)
Anatsa Android malware downloaded 150,000 times via Google Play (bleepingcomputer.com)
'Lucifer' Botnet Turns Up the Heat on Apache Hadoop Servers (darkreading.com)
What are Botnets and Why are MSSPs So Concerned? | MSSP Alert
New SSH-Snake malware steals SSH keys to spread across the network (bleepingcomputer.com)
Ransomware Declines as InfoStealers and AI Threats Gain Ground: IBM X-Force - SecurityWeek
Your Mac Is Not Virus Proof. It Never Has Been. (gizmodo.com)
Click: Your innocent mouse could be a cyber criminal's silent weapon - Digital Journal
Vibrator virus steals your personal information | Malwarebytes
Mobile
Meta Warns of 8 Spyware Firms Targeting iOS, Android, and Windows Devices (thehackernews.com)
New Wave of 'Anatsa' Banking Trojans Targets Android Users in Europe (darkreading.com)
New Wi-Fi Vulnerabilities Expose Android and Linux Devices to Hackers (thehackernews.com)
Zero-Click Apple Shortcuts Vulnerability Allows Silent Data Theft (darkreading.com)
Denial of Service/DoS/DDOS
Internet of Things – IoT
Wyze camera glitch gave 13,000 users a peek into other homes (bleepingcomputer.com)
As Cyber attacks Ramp Up, Electric Vehicles Are Vulnerable (autoweek.com)
Data Breaches/Leaks
Infosys subsidiary named as source of Bank of America leak • The Register
Massive Cloud Database Leak Exposes 380 Million Records (hackread.com)
UK council's sneaky insider steals 79k email addresses • The Register
Eye Care Services Firm Faces Lawsuit Over Data Breach Impacting 2.3 Million - SecurityWeek
Cyber Crime General & Criminal Actors
Fifth of British Kids Have Broken the Law Online - Infosecurity Magazine (infosecurity-magazine.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Insider Risk and Insider Threats
Insurance
Insurers Use Claims Data to Recommend Cyber Security Technologies (darkreading.com)
Cyber Insurance Needs to Evolve to Ensure Greater Benefit (darkreading.com)
What is Cyber Insurance and Does Your Small Business Need It? (smallbiztrends.com)
Supply Chain and Third Parties
Infosys subsidiary named as source of Bank of America leak • The Register
North Korean hackers linked to defence sector supply-chain attack (bleepingcomputer.com)
Cloud/SaaS
Cyber security report reveals 75% spike in cloud attacks (securitybrief.co.nz)
Massive Cloud Database Leak Exposes 380 Million Records (hackread.com)
Six steps for stronger cloud security | SC Media (scmagazine.com)
Identity and Access Management
Why identity fraud costs organisations millions - Help Net Security
Active Directory outages can cost organisations $100,000 per day - Help Net Security
Encryption
Linux and Open Source
Passwords, Credential Stuffing & Brute Force Attacks
Hackers using stolen credentials to launch attacks as info-stealing peaks | CSO Online
How to proactively prevent password-spray attacks on legacy email accounts | CSO Online
Social Media
EU Watchdog Urged to Reject Meta 'Pay for Privacy' Scheme - SecurityWeek
Social Media Platforms Are in an ‘Information Trafficking Business’: Cyber Security Adviser | NTD
ChatGPT Used by North Korean Hackers to Scam LinkedIn Users (tech.co)
76% of Super Bowl Traffic From Elon Musk's X to Advertisers Could Be Fake (thewrap.com)
Elon Musk’s X allows China-based propaganda banned on other platforms | Ars Technica
European Union deepens its investigation of TikTok • The Register
Training, Education and Awareness
Regulations, Fines and Legislation
European Court of Human Rights rules against government backdoors in end-to-end encryption - Neowin
Hedge Funds Warn SEC Cyber Lapses Risk Exposing Trading Secrets (bloomberglaw.com)
European Union deepens its investigation of TikTok • The Register
Decoding DORA: Navigating the digital regulatory landscape | World Finance
FTC Fines Avast $16.5 Million For Selling Browsing Data Harvested by Antivirus (404media.co)
Avast settles claims of customer data peddling for $17M • The Register
Careers, Working in Cyber and Information Security
The Psychology of Cyber Security Burnout (informationweek.com)
How can we adapt work practices to protect CISO mental health? | Computer Weekly
Misinformation, Disinformation and Propaganda
Feds deliver stark warnings to state election officials ahead of November - Iowa Capital Dispatch
UK election cyber attack warning after Putin's hackers target US (inews.co.uk)
Social Media Platforms Are in an ‘Information Trafficking Business’: Cyber Security Adviser | NTD
Elon Musk’s X allows China-based propaganda banned on other platforms | Ars Technica
Election security threats in 2024 range from AI to … anthrax • The Register
76 percent of Super Bowl LVIII traffic from Twitter dubbed 'fake' (awfulannouncing.com)
Iran and Hezbollah Hackers Launch Attacks to Influence Israel-Hamas Narrative (thehackernews.com)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Nation State Actors
Countries fear state-sponsored cyber war | The World from PRX
Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard
Pharmacy Delays Across US Blamed on Nation-State Hackers (darkreading.com)
China
'Major Chinese hack' on Foreign Office urgently investigated by UK spies (inews.co.uk)
Leaked Chinese Hacking Files Reveal How Compromised the US Could Be (businessinsider.com)
iSoon's Secret APT Status Exposes China's Foreign Hacking Machination (darkreading.com)
Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard
Elon Musk’s X allows China-based propaganda banned on other platforms | Ars Technica
China’s Spy Agency Sees Threats Everywhere in Data Security Push - Bloomberg
Russia
FBI disrupts hacking network 'linked to Russian intelligence services' | US News | Sky News
Russian APT 'Winter Vivern' Targets European Governments, Military (darkreading.com)
Russian Cyber attackers Launch Multiphase PsyOps Campaign (darkreading.com)
Russian-Linked Hackers Target 80+ Organisations via Roundcube Flaws (thehackernews.com)
NHS hospitals ‘easy targets’ for Russian hackers (thetimes.co.uk)
Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard
Russian Turla Cyber Spies Target Polish NGOs With New Backdoor - SecurityWeek
Russian Government Software Backdoored to Deploy Konni RAT Malware (thehackernews.com)
Three terms sure to grab attention: Russia, nuclear, anti-satellite weapon | Ars Technica
Iran
Iranian Hackers Target Middle East Policy Experts with New BASICSTAR Backdoor (thehackernews.com)
Iranian APTs Dress Up As Hacktivists for Disruption, Influence Ops (darkreading.com)
Iran and Hezbollah Hackers Launch Attacks to Influence Israel-Hamas Narrative (thehackernews.com)
Iran-Backed Charming Kitten Stages Fake Webinar Platform to Ensnare Targets (darkreading.com)
North Korea
Vulnerability Management
Vulnerabilities
ConnectWise exploit could spur ‘ransomware free-for-all,’ expert warns | SC Media (scmagazine.com)
Exploiting critical ConnectWise bug is 'embarrassingly easy' • The Register
Akira Ransomware Exploiting Cisco AnyConnect Vulnerability (gbhackers.com)
Microsoft Exchange flaw CVE-2024-21410 could impact up to 97,000 servers (securityaffairs.com)
VMware Alert: Uninstall EAP Now - Critical Flaw Puts Active Directory at Risk (thehackernews.com)
VMware issues no-patch advisory for critical flaw in old SSO plugin | SC Media (scmagazine.com)
Russian-Linked Hackers Target 80+ Organisations via Roundcube Flaws (thehackernews.com)
ESET fixed high-severity local privilege escalation bug in Windows products (securityaffairs.com)
SolarWinds addressed critical RCEs in Access Rights Manager (securityaffairs.com)
Chrome 122, Firefox 123 Patch High-Severity Vulnerabilities - SecurityWeek
Critical Vulnerability in VMware vSphere Plug-in Allows Session Hijacking (darkreading.com)
Joomla XSS Bugs Open Millions of Websites to RCE (darkreading.com)
Zero-Click Apple Shortcuts Vulnerability Allows Silent Data Theft (darkreading.com)
Urgent patches available for QNAP vulnerabilities, one 0-day • The Register
Hackers exploit critical RCE flaw in Bricks WordPress site builder (bleepingcomputer.com)
Tools and Controls
Stuck in cyber attack nightmare? Call the negotiators (techxplore.com)
New Google Chrome feature blocks attacks against home networks (bleepingcomputer.com)
How Businesses Can Safeguard Their Communication Channels Against Hackers (thehackernews.com)
Limiting remote access exposure in hybrid work environments | CSO Online
Cyber Insurance Needs to Evolve to Ensure Greater Benefit (darkreading.com)
Active Directory outages can cost organisations $100,000 per day - Help Net Security
SOC Landscapes: Insights from SANS' 2023 SOC Report (trendmicro.com)
36% of code generated by GitHub CoPilot contains security flaws - Help Net Security
Microsoft expands free logging capabilities after May breach (bleepingcomputer.com)
Why ransomware gangs love using RMM tools—and how to stop them | Malwarebytes
Other News
The Power Sector’s High-Stakes Battle for Cyber-Resiliency (powermag.com)
Ways to elevate public sector cyber security | Professional Security
Increasing Europe's cyber resilience - government.lu (gouvernement.lu)
Industries most targeted by active adversaries | SC Media (scmagazine.com)
US govt shares cyber attack defence tips for water utilities (bleepingcomputer.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 02 September 2022
Black Arrow Cyber Threat Briefing 02 September 2022
-79% Of Companies Only Invest in Cyber Security After Hacking Incidents
-Nearly Half of Breaches During First Half of 2022 Involved Stolen Credentials
-Outdated Infrastructure Not Up to Today’s Ransomware Challenges
-Ghost Data Increases Enterprise Business Risk
-Detected Cyber Threats Surge 52% in 1H 2022
-An Interview with Initial Access Broker Wazawaka: ‘There Is No Such Money Anywhere as There is in Ransomware’
-Cyber Crime Underground More Dangerous Than Organisations Realize
-New Ransomware Group BianLian Activity Exploding
-Can Your Passwords Withstand Threat Actors’ Dirty Tricks?
-Ransomware Gangs’ Favourite Targets
-Tentacles of ‘0ktapus’ Threat Group Victimize 130 Firms
-Organisations Are Spending Billions on Malware Defence That’s Easy to Bypass
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
79% Of Companies Only Invest in Cyber Security After Hacking Incidents
The British cyber security company Tanium published a survey on investments in digital protection in UK companies with alarming results: 79% of them only approve investments in cyber security after suffering a data breach; 92% experienced a data attack or breach, of which 74% occurred in 2021. Leadership reticence is also high, with 63% of leaders convinced cyber security is only a concern after an attack.
The complexity of the situation has grown with the digital transformation of work. If it streamlines many processes, it can also open up serious security gaps. A sensitive point is the “home office”: companies need effective solutions to eliminate gaps that may appear between employees’ computers (often shared devices) and the company’s internal network.
Putting in solutions is just the beginning of a necessary strategy and investment effort in virtual protection. Complex scams based on phishing, reverse engineering, and backdoor-type malicious programs (“planted” discreetly on a device and sometimes inactive for months) often combine real-world and virtual-world fraud.
The escalation of corporate data hijacking appears in this scenario. The most notorious case at a global level of such an incident, with a million-dollar ransom demand, was launched in 2021 on Colonial Pipeline. This US company paid $40 million to regain control over strategic data after fuel supplies through its pipelines to several states were threatened for days.
Nearly Half of Breaches During First Half of 2022 Involved Stolen Credentials
According to a new report by Acronis, a Switzerland-based cyber security company, nearly half of breaches during the first six months of 2022 involved stolen credentials.
The goal of stealing credentials is to launch ransomware attacks. According to the report, these “continue to be the number one threat to large and medium-sized businesses, including government organisations.”
Attackers usually use phishing techniques to extract these credentials. In the first half of the year, over 600 malicious email campaigns made their way across the internet, of which 58% were phishing attempts and 28% featured malware.
Acronis also added that “as reliance on the cloud increases, attackers have homed in on different entryways to cloud-based networks.”
Additionally, cyber criminals now also target unpatched or software vulnerabilities to extract data, with a recent increase on Linux operating systems and managed service providers (MSPs) and their network of SMB customers.
The third vector spotted by Acronis was “non-traditional entry avenues” such as cryptocurrencies and decentralised finance (DeFi) systems.
Outdated Infrastructure Not Up to Today’s Ransomware Challenges
A global research commissioned by Cohesity reveals that nearly half of respondents say their company depends on outdated, legacy backup and recovery infrastructure to manage and protect their data. In some cases, this technology is more than 20 years old and was designed long before today’s multicloud era and onslaught of sophisticated cyber attacks plaguing enterprises globally.
Challenges pertaining to outdated infrastructure could easily be compounded by the fact that many IT and security teams don’t seem to have a plan in place to mobilise if and when a cyber attack occurs. Nearly 60% of respondents expressed some level of concern that their IT and security teams would be able to mobilise efficiently to respond to the attack.
These are just some of the findings from an April 2022 survey, conducted by Censuswide, of more than 2,000 IT and SecOps professionals (split nearly 50/50 between the two groups) in the United States, the United Kingdom, Australia and New Zealand. All respondents play a role in the decision-making process for IT or security within their organisations.
IT and security teams should raise the alarm bell if their organisation continues to use antiquated technology to manage and secure their most critical digital asset – their data.
Cyber criminals are actively preying on this outdated infrastructure as they know it was not built for today’s dispersed, multicloud environments, nor was it built to help companies protect and rapidly recover from sophisticated cyber attacks.
https://www.helpnetsecurity.com/2022/08/30/outdated-infrastructure-manage-data/
Ghost Data Increases Enterprise Business Risk
IT has to get its hands around cloud data sprawl. Another area of focus should be on ghost data, as it expands the organisation's cloud attack surface.
Cloud sprawl is a big issue for organisations, with business teams spinning up cloud systems and services on their own, often without IT oversight. That leads to cloud data sprawl as data is scattered across different environments. If IT doesn’t know about the cloud systems and services, then IT is also not managing the data being collected, processed, and stored there.
We all know about shadow IT, the systems and network devices in the organisation’s environment that IT is not managing. Similarly, shadow data refers to unmanaged data store copies and snapshots or log data that are not part of IT’s backup and recovery strategy. Researchers at Cyera estimate that 60% of the data security posture issues that are present in cloud accounts stem from unsecured sensitive data.
Then there is the problem of ghost data. When data gets deleted from cloud systems, it isn’t fully gone. Copies linger in backups or snapshots of data stores. Ghost data refers to those copies left behind after the original has been deleted, and Cyera’s recent analysis show that enterprises have quite a lot of it.
After scanning the three major cloud providers (Amazon Web Services, Azure, and Google Cloud), Cyera researchers found that over 30% of scanned customer cloud data stores are ghost data and more than 58% contain sensitive, or very sensitive, data. For example, researchers found unsecured database snapshots in non-production environments that contained sensitive customer data where the original database had been destroyed. Researchers also uncovered sensitive personal and authentication data in plain text where the production data and application were no longer in use.
Ghost data usually has no business value - the data was deleted for a reason - and having it around unnecessarily increases business risk. Attackers don’t care if they get their hands on the original sensitive information or the copy because to them, all data has value, regardless of the form it takes.
https://www.darkreading.com/edge-threat-monitor/ghost-data-increases-enterprise-business-risk
Detected Cyber Threats Surge 52% in 1H 2022
A leading cyber security vendor blocked 63 billion threats in the first half of 2022 alone, over 50% more than the same period a year ago.
The findings come from the Trend Micro 2022 Midyear Cybersecurity Report and illustrate the scale of the challenge facing network defenders.
Trend Micro highlighted the persistent threat posed by ransomware-as-a-service (RaaS) groups as one that will continue to cause major challenges for organisations in the years to come.
It said detections of prolific groups such as LockBit and Conti increased by 500% year-on-year in 1H 2022. Such groups will continue to adapt their tactics, techniques and procedures (TTPs) in the race for profits.
The report warned of a surge in threats targeting Linux systems, for example. It said detections of attacks on Linux servers and embedded systems grew 75% year-on-year in the first half of 2022. Both SMBs and larger organisations are now a target, it claimed.
Many RaaS groups exploit vulnerabilities as a primary attack vector. Their job is getting easier as the number of published common vulnerabilities and exposures (CVEs) continues to grow strongly.
Trend Micro’s Zero Day Initiative published advisories on 944 vulnerabilities in the first half of 2021, a 23% year-on-year increase. The number of critical bug advisories it published soared by 400% over the same period.
https://www.infosecurity-magazine.com/news/detected-cyberthreats-surge-52-in/
An Interview with Initial Access Broker Wazawaka: ‘There Is No Such Money Anywhere as There is in Ransomware’
Last April, a ransomware group threatened to expose police informants and other sensitive information if the Washington, D.C. Metropolitan Police Department did not pay a demand.
The brazen attack was the work of a gang known as Babuk, which in early 2021 gained a reputation for posting stolen databases on its website from victims that refused to pay a ransom. Just days after it tried to extort the Metropolitan Police Department, Babuk announced it was closing its ransomware affiliate program, and would focus on data theft and extortion instead.
Earlier this year, cyber security journalist Brian Krebs uncovered details about one man behind the operation named Mikhail Matveev, who was also connected to a number of other groups and identities, including the handle ‘Wazawaka.’ According to Krebs, Matveev had become more unhinged than usual, “publishing bizarre selfie videos” and creating a Twitter account to share exploit code.
Matveev talked to Recorded Future about his interaction with other hackers, details about ransomware attacks he’s been involved in, and how he settled on the name Babuk.
Click the link below for the full interview but the long and short is ransomware has created a criminal ecosystem the likes of which the world has never seen.
Cyber Crime Underground More Dangerous Than Organisations Realise
Kela, a cyber threat intelligence specialist, found in a new study of some 400 security pros in the US that organisations are more at risk from the “cyber crime underground” than they realise.
The Israel-based company surveyed security team members responsible for gathering cyber crime threat intelligence daily to better understand if they’re proactively scanning the dark web and other cyber crime sources, what tools they’re using and the gaps they see in their cyber crime threat intelligence approach. Nearly 60% of the respondents do not believe their current cyber crime prevention is effective, the results showed.
Here are the study’s key findings:
69% are concerned about threats from the cyber crime underground.
54% wouldn’t be surprised to find their organisation’s data on the cyber crime underground.
Only 38% believe that they’re very likely to detect it if it was released.
48% have no documented cyber crime threat intelligence policy in place.
Only 41% believe their current security program is very effective.
49% are not satisfied with the visibility they have of the cyber crime underground.
Of the 51% who were satisfied with their visibility into the cyber crime underground, 39% were still unable to prevent an attack.
Additional training and proficiency in cyber crime intelligence investigations is the most needed capability.
New Ransomware Group BianLian Activity Exploding
A new ransomware group operating under the name BianLian emerged in late 2021 and has become increasingly active since.
The threat actor already has twenty alleged victims across several industries (insurance, medicine, law and engineering), according to a research paper from US cyber security firm Redacted, published on September 1, 2022. The majority of the victim organisations have been based in Australia, North America and the UK.
The research team has given no attribution yet but believes the threat actor “represents a group of individuals who are very skilled in network penetration but are relatively new to the extortion/ransomware business.”
BianLian uses a custom toolkit, including homemade encryptors and encryption backdoors. Both, as well as the command-and-control (C&C) software the hackers use, are written in Go, an increasingly popular programming language among ransomware threat actors.
Troublingly, the Redacted team of researchers has found evidence that BianLian is likely now trying to up their game.
https://www.infosecurity-magazine.com/news/new-ransomware-group-bianlian/
Can Your Passwords Withstand Threat Actors’ Dirty Tricks?
Password security hinges on the answer to that seemingly simple question. Unfortunately, you can’t know the answer until you’ve engaged a ruthless penetration tester to find out if your environment can stand up to the frighteningly good password cracking skills of today’s most nefarious hackers.
The whole purpose of hiring skilled penetration testers (“pentesters”) is to find out if your environment is truly impenetrable — and if it’s not, exactly how you should shore up your defences. Good pentesters and red teamers spend their time trying to simulate and emulate the real bad actors. After all, what’s the point of pressure-testing your IT infrastructure if you don’t use the same pressure that you’ll face in the real world?
You should “train like you fight.” Without sparring, how can you expect to jump into a boxing ring and go a few rounds with a skilled boxer? That’s the entire point of goal-based penetration testing and red/purple team engagements that simulate real-world threat actors.
Password cracking will continue to evolve – and so should your penetration testing tactics and plans. By the time you get to your fourth or fifth round with a quality pentesting consultancy, your risk mitigation will have dramatically improved — which means you’ll be able to move on to the next stage of security maturity.
https://www.helpnetsecurity.com/2022/08/30/stand-up-to-password-cracking/
Ransomware Gangs’ Favourite Targets
Barracuda released its fourth-annual threat research report which looks at ransomware attack patterns that occurred between August 2021 and July 2022.
For the 106 highly publicised attacks our researchers analysed, the dominant targets are still five key industries: education (15%), municipalities (12%), healthcare (12%), infrastructure (8%), and financial (6%). The number of ransomware attacks increased year-over-year across each of these five industry verticals, and attacks against other industries more than doubled compared to last year’s report.
While attacks on municipalities increased only slightly, the analysis over the past 12 months showed that ransomware attacks on educational institutions more than doubled, and attacks on the healthcare and financial verticals tripled. Many choose not to disclose when they get hit.
This year, researchers dug in deeper on these highly publicised attacks to see which other industries are starting to be targeted. Service providers were hit the most, and ransomware attacks on automobile, hospitality, media, retail, software, and technology organisations all increased as well.
Most ransomware attacks don’t make headlines, though. Many victims choose not to disclose when they get hit, and the attacks are often sophisticated and extremely hard to handle for small businesses.
As ransomware and other cyber threats continue to evolve, the need for adequate security solutions has never been greater. Many cyber criminals target small businesses in an attempt to gain access to larger organisations. As a result, it is essential for security providers to create products that are easy to use and implement, regardless of a company’s size.
Additionally, sophisticated security technologies should be available as services, so that businesses of all sizes can protect themselves against these ever-changing threats. By making security solutions more accessible and user-friendly, the entire industry can help to better defend against ransomware and other cyber attacks.
https://www.helpnetsecurity.com/2022/08/31/ransomware-attack-patterns/
Tentacles of ‘0ktapus’ Threat Group Victimise 130 Firms
Over 130 companies were tangled in sprawling phishing campaign that spoofed a multi-factor authentication system.
Targeted attacks on Twilio and Cloudflare employees are tied to a massive phishing campaign that resulted in 9,931 accounts at over 130 organisations being compromised. The campaigns are tied to focused abuse of identity and access management firm Okta, which gained the threat actors the 0ktapus moniker, by researchers.
The primary goal of the threat actors was to obtain Okta identity credentials and multi-factor authentication (MFA) codes from users of the targeted organisations. These users received text messages containing links to phishing sites that mimicked the Okta authentication page of their organisation.
114 US-based firms were impacted, with additional victims of sprinkled across 68 additional countries. The full scope of the attack is still unknown but the 0ktapus campaign has been incredibly effective, and the full scale of it may not be known for some time.
The 0ktapus attackers are believed to have begun their campaign by targeting telecommunications companies in hopes of winning access to potential targets’ phone numbers.
While unsure exactly how threat actors obtained a list of phone numbers used in MFA-related attacks, one theory researchers posit is that 0ktapus attackers began their campaign targeting telecommunications companies.
https://threatpost.com/0ktapus-victimize-130-firms/180487/
Organisations Are Spending Billions on Malware Defence That’s Easy to Bypass
Last year, organisations spent $2 billion on products that provide Endpoint Detection and Response, a relatively new type of security protection for detecting and blocking malware targeting network-connected devices. EDRs, as they're commonly called, represent a newer approach to malware detection. Static analysis, one of two more traditional methods, searches for suspicious signs in the DNA of a file itself. Dynamic analysis, the other more established method, runs untrusted code inside a secured "sandbox" to analyse what it does to confirm it's safe before allowing it to have full system access.
EDRs—which are forecasted to generate revenue of $18 billion by 2031 and are sold by dozens of security companies—take an entirely different approach. Rather than analyse the structure or execution of the code ahead of time, EDRs monitor the code's behaviour as it runs inside a machine or network. In theory, it can shut down a ransomware attack in progress by detecting that a process executed on hundreds of machines in the past 15 minutes is encrypting files en masse. Unlike static and dynamic analyses, EDR is akin to a security guard that uses machine learning to keep tabs in real time on the activities inside a machine or network.
Despite the buzz surrounding EDRs, new research suggests that the protection they provide isn't all that hard for skilled malware developers to circumvent. In fact, the researchers behind the study estimate EDR evasion adds only one additional week of development time to the typical infection of a large organisational network. That's because two fairly basic bypass techniques, particularly when combined, appear to work on most EDRs available in the industry.
Threats
Ransomware
Ransomware Research: 10 Key Findings, Five Ways to Defend Against Hijackers - MSSP Alert
LockBit ransomware gang gets aggressive with triple-extortion tactic (bleepingcomputer.com)
New Golang-based 'Agenda Ransomware' Can Be Customized For Each Victim (thehackernews.com)
Chile and Montenegro Floored by Ransomware - Infosecurity Magazine (infosecurity-magazine.com)
Researchers Detail Emerging Cross-Platform BianLian Ransomware Attacks (thehackernews.com)
Ragnar Locker Brags About TAP Air Portugal Breach (darkreading.com)
Police ‘negotiating with hackers’ who hit Paris hospital computer system | World | The Times
Advanced cyber-attack: NHS doctors' paperwork piles up - BBC News
Another Ransomware For Linux Likely In Development - Security Affairs
Montenegro hit by ransomware attack, hackers demand $10 million (bleepingcomputer.com)
Should ransomware payments be banned? A few considerations - Help Net Security
Researchers Spot Snowballing BianLian Ransomware Gang Activity (darkreading.com)
Ragnar Locker continues trend of ransomware targeting energy sector | CSO Online
BlackCat ransomware claims attack on Italian energy agency (bleepingcomputer.com)
Italian Oil Major Becomes Victim Of Ransomware Attack | OilPrice.com
Damart clothing store hit by Hive ransomware, $2 million demanded (bleepingcomputer.com)
Gloucester Council planning site still disrupted from cyber attack - BBC News
BEC – Business Email Compromise
Malware
Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users | McAfee Blog
A study on malicious plugins in WordPress Marketplaces - Security Affairs
BumbleBee a New Modular Backdoor Evolved From BookWorm (trendmicro.com)
Malicious Chrome Extensions Plague 1.4M Users (darkreading.com)
Mobile
Mobile banking apps put 300,000 digital fingerprints at risk • The Register
Researcher unveils smart lock hack for fingerprint theft (techtarget.com)
Internet of Things – IoT
Skyrocketing IoT Bug Disclosures Put Pressure on Security Teams (darkreading.com)
Singapore clocks higher ransomware attacks, warns of IoT risks | ZDNET
ieGeek Vulnerabilities still prevalent in 2022 - Amazon Ft. IG20 (realinfosec.net)
Data Breaches/Leaks
Okta Says Customer Data Compromised in Twilio Hack | SecurityWeek.Com
Neopets says hackers had access to its systems for 18 months (bleepingcomputer.com)
Akasa Air Suffers Data Leak on First Day of Operation- IT Security Guru
Samsung says hackers obtained some customer data in newly disclosed breach | Engadget
Millions of student loan accounts exposed in data breach | TechRadar
Russian streaming platform confirms data breach affecting 7.5M users (bleepingcomputer.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
FBI: Crooks stole $1b+ in cryptocurrency already this year • The Register
Ukraine takes down cyber crime group hitting crypto fraud victims (bleepingcomputer.com)
FBI: Crooks are using these DeFi flaws to steal your money | ZDNET
Windows malware delays coinminer install by a month to evade detection (bleepingcomputer.com)
Crypto-Crooks Spread Trojanized Google Translate App in Watering-Hole Attack (darkreading.com)
Hackers Use ModernLoader to Infect Systems with Stealers and Cryptominers (thehackernews.com)
Insider Risk and Insider Threats
Fraud, Scams & Financial Crime
Insurance
Cyber insurance has been around for 25 years. It’s still a bit of a mess. (slate.com)
Travelers, Policyholder Agree to Void Current Cyber Policy (insurancejournal.com)
Cyber Frauds Skyrocket: Can Cyber Insurance Protect You in Real World? Experts Explain (news18.com)
Google Cloud, Microsoft and AWS dive into cyber insurance - Protocol
Cyber Insurance Price Hike Hits Local Governments Hard (insurancejournal.com)
Insurers must rethink handling of cyber attacks on states | Financial Times (ft.com)
Cyber insurance on rise as attacks surge | Mint (livemint.com)
Dark Web
German man charged for trying to hire fake contract killer on darkweb | Euronews
NATO Investigates Dark Web Leak of Data Stolen From Missile Vendor (darkreading.com)
Supply Chain and Third Parties
Software Supply Chain
Denial of Service DoS/DDoS
Cloud/SaaS
1 in 3 organisations don't know if their public cloud data was exfiltrated - Help Net Security
Real-World Cloud Attacks: The True Tasks of Cloud Ransomware Mitigation (darkreading.com)
Encryption
CISA: Prepare now for quantum computers, not when hackers use them (bleepingcomputer.com)
Homomorphic encryption: a holy grail for privacy, explained (fastcompany.com)
API
Open Source
Passwords, Credential Stuffing & Brute Force Attacks
LastPass source code breach – do we still recommend password managers? – Naked Security (sophos.com)
Social Media
Social media is ruining our lives and the public are finally waking up (telegraph.co.uk)
Thousands lured with blue badges in Instagram phishing attack (bleepingcomputer.com)
Training, Education and Awareness
Privacy
Trident Royal Navy staff reveal sensitive data on fitness app | News | The Times
Cops wanted to keep mass surveillance app secret; privacy advocates refused | Ars Technica
US telcos admit to storing, handing over location data • The Register
Facebook moves to settle Cambridge Analytica lawsuit | TechCrunch
Homomorphic encryption: a holy grail for privacy, explained (fastcompany.com)
Nobody’s special to the WFH software spies | Comment | The Times
Travel
Parental Controls and Child Safety
Scammers Targeting Thousands Of Children As Young As Six, Figures Show (informationsecuritybuzz.com)
Over a Third of Parents Do Not Know What Online Accounts Their Children Use - IT Security Guru
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Why Russia's cyber war in Ukraine hasn't played out as predicted (newatlas.com)
Ukraine's army of hackers failed to thwart Russia and quickly gave up | New Scientist
Moscow gridlock as hackers send dozens of taxis to Hotel Ukraine (telegraph.co.uk)
Finland To Offer Businesses Cybersec Vouchers In Wake Of Nato-related (informationsecuritybuzz.com)
China-linked APT40 used ScanBox Framework in a long-running espionage campaign - Security Affairs
Montenegro says Russian cyber attacks threaten key state functions (bleepingcomputer.com)
Google says it cut off Russian disinformation sites from its vast ad display network - CyberScoop
Ex-spies banned from arms exports for UAE hack-for-hire work • The Register
Nation State Actors
Nation State Actors – Russia
FBI deploys cyber team to Montenegro following massive cyber attack | The Hill
Montenegro Sent Back to Analog by Unprecedented Cyber Attacks | Balkan Insight
Nation State Actors – China
Chinese Hackers Target Energy Firms in South China Sea | SecurityWeek.Com
China-linked APT40 targets wind turbines, Aust. government • The Register
Nation State Actors – Misc
Vulnerabilities
Apple Quietly Releases Another Patch for Zero-Day RCE Bug (darkreading.com)
Google Chrome emergency update fixes new zero-day used in attacks (bleepingcomputer.com)
URGENT! Apple slips out zero-day update for older iPhones and iPads – Naked Security (sophos.com)
WordPress 6.0.2 Patches Vulnerability That Could Impact Millions of Legacy Sites | SecurityWeek.Com
Critical hole in Atlassian Bitbucket needs patching now • The Register
Reports Published in the Last Week
Other News
Former Cyber criminal: These Are the Biggest Threats on the Internet (businessinsider.com)
Stuxnet explained: The first known cyber weapon | CSO Online
Infra Used in Cisco Hack Also Targeted Workforce Management Solution (thehackernews.com)
Okta Impersonation Technique Could be Utilized by Attackers | SecurityWeek.Com
Remote Work Cyber Security: 12 Risks and How to Prevent Them (techtarget.com)
Does your cyber crime prevention program work? - Help Net Security
Does Blockchain really offer Better Digital Security? - IT Security Guru
IT and Employees Don’t Always See Eye to Eye on Cyber Security - IT Security Guru
New Cyber Security Regulations Are Coming. Here’s How to Prepare. (hbr.org)
Cyber security budget breakdown and best practices (techtarget.com)
How Just-in-Time privilege elevation prevents data breaches and lateral movement - Help Net Security
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 22 April 2022
Black Arrow Cyber Threat Briefing 22 April 2022:
-Why Ransomware Attacks Prefer Small Business Targets Rather Than Rich Enterprises
-Ransomware Plagues Finance Sector as Cyber Attacks Get More Complex
-76% of Organisations Worldwide Expect to Suffer a Cyber Attack This Year
-Most Email Security Approaches Fail to Block Common Threats
-Financial Leaders Grappling with More Aggressive and Sophisticated Attack Methods
-Hackers Sneak Malware into Resumes Sent to Corporate Hiring Managers
-West Warns of Russian Cyber-Attacks As Concerns Rise Over Putin’s Nuclear Rhetoric
-Criminals Adopting New Methods To Bypass Improved Defences, Says Zscaler
-Cyber Criminals Are ‘Drinking the Tears’ Of Ukrainians
-Hackers For Hire Attempt to Destroy Hedge Fund Manager's Reputation
-New Threat Groups and Malware Families Emerging
-Economic Warfare: Attacks on Critical Infrastructure Part of Geopolitical Conflict
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Why Ransomware Attacks Prefer Small Business Targets Rather Than Rich Enterprises
Enterprise businesses with 25,000 employees+ are less likely to get hit by a ransomware attack than smaller businesses — even though big companies typically can afford to pay higher ransoms, the 2022 CyberEdge Cyberthreat Defense Report concluded.
What explains hackers taking aim at small businesses more frequently than enterprise giants? The answer: Damaging a critical infrastructure facility or similar disruptions are certain to catch the eye of federal law enforcement, or national governments — something that no hacker wants, CyberEdge said. Smaller to medium-sized firms, as it turns out, get hit more frequently by ransomware attacks, on average at roughly 70 percent, the report said.
Overall, some 71 percent of organisations have been bitten by ransomware in 2022, up a point and a half from last year and by 8.5 points in 2020. It’s companies of 10,000 to 24,999 employees that are the sweet spot for ransomware hackers, nearly 75 percent of which are victimised by cyber extortionists.
The extensive study, which surveyed 1,200 security decision makers and practitioners employed by companies of greater than 500 people in 17 countries across 19 industries, is geared to helping gauge their internal practices and investments against those of their counterparts in other parts of the world.
Ransomware Plagues Finance Sector as Cyber Attacks Get More Complex
Cyber criminals have evolved from hacking wire transfers to targeting market data, as ransomware continues to hit financial firms, says a new VMware report. Here's what to do about it.
Ransomware plagues financial institutions as they face increasingly complex threats over previous years owing to the changing behaviour of cyber criminal cartels, according to VMware's latest Modern Bank Heists report.
This has happened as the cyber crime cartels have evolved beyond wire transfer frauds to target market strategies, take over brokerage accounts, and island-hop into banks, according to the report.
For the report, VMware surveyed 130 financial sector CISOs and security leaders from across different regions including North America, Europe, Asia Pacific, Central and South America, and Africa.
Report findings were consistent with observations by other security experts. "The Secret Service, in its investigative capacity to protect the nation's financial payment systems and financial infrastructure, has seen an evolution and increase in complex cyber-enabled fraud," says Jeremy Sheridan, former assistant director at the US Secret Service. "The persistent, inadequate security of systems connected to the internet provides opportunity and methodology."
76% of Organisations Worldwide Expect to Suffer a Cyber Attack This Year
Ransomware, phishing/social engineering, denial of service (DoS) attacks, and the business fallout of a data breach rank as the top concerns of global organisations, a new study shows.
The newly published Cyber Risk Index, a study by Trend Micro and the Ponemon Institute, shows that more than three-quarters of global organisations expect to suffer a cyber attack in the next 12 months — 25% of which say an attack is "very likely."
More than 80% of the 3,400 CISO and IT professionals and managers surveyed say their organisations were hit with one or more successful cyber attacks in the past 12 months, and 35% suffered seven or more attacks, according to the report, which covers the second half of 2021.
Most Email Security Approaches Fail to Block Common Threats
A full 89 percent of organisations experienced one or more successful email breaches during the previous 12 months, translating into big-time costs.
On overwhelming number of security teams believe their email security systems to be ineffective against the most serious inbound threats, including ransomware.
That’s according to a survey of business customers using Microsoft 365 for email commissioned by Cyren and conducted by Osterman Research, which examined concerns with phishing, business email compromise (BEC), and ransomware threats, attacks that became costly incidents, and preparedness to deal with attacks and incidents.
“Security team managers are most concerned that current email security solutions do not block serious inbound threats (particularly ransomware), which requires time for response and remediation by the security team before dangerous threats are triggered by users,” according to the report, released Wednesday.
Less than half of those surveyed said that their organisations can block delivery of email threats. And, correspondingly, less than half of organisations rank their currently deployed email security solutions as effective.
https://threatpost.com/email-security-fail-block-threats/179370/
Financial Leaders Grappling with More Aggressive and Sophisticated Attack Methods
VMware released a report which takes the pulse of the financial industry’s top CISOs and security leaders on the changing behaviour of cyber criminal cartels and the defensive shift of the financial sector.
The report found that financial institutions are facing increased destructive attacks and falling victim to ransomware more than in years past, as sophisticated cyber crime cartels evolve beyond wire transfer fraud to now target market strategies, take over brokerage accounts and island hop into banks.
In the Modern Bank Heists report, 63% of financial institutions admitted experiencing an increase in destructive attacks, with cyber criminals leveraging this method as a means to burn evidence as part of a counter incident response.
Additionally, 74% experienced at least one ransomware attack over the past year, with 63% paying the ransom. When asked about the nation-state actors behind these attacks, the majority of financial instructions stated that Russia posed the greatest concern, as geopolitical tension continues to escalate in cyberspace.
https://www.helpnetsecurity.com/2022/04/21/cybercriminal-cartels-financial-sector/
Hackers Sneak Malware into Resumes Sent to Corporate Hiring Managers
A new set of phishing attacks delivering the ‘more_eggs’ malware has been observed striking corporate hiring managers with bogus resumes as an infection vector, a year after potential candidates looking for work on LinkedIn were lured with weaponised job offers.
"This year the more_eggs operation has flipped the social engineering script, targeting hiring managers with fake resumes instead of targeting jobseekers with fake job offers," eSentire's research and reporting lead, Keegan Keplinger, said in a statement.
The Canadian cyber security company said it identified and disrupted four separate security incidents, three of which occurred at the end of March. Targeted entities include a US-based aerospace company, an accounting business located in the UK, a law firm, and a staffing agency, both based out of Canada.
The malware, suspected to be the handiwork of a threat actor called Golden Chickens (aka Venom Spider), is a stealthy, modular backdoor suite capable of stealing valuable information and conducting lateral movement across the compromised network.
"More_eggs achieves execution by passing malicious code to legitimate windows processes and letting those windows processes do the work for them," Keplinger said. The goal is to leverage the resumes as a decoy to launch the malware and sidestep detection.
https://thehackernews.com/2022/04/hackers-sneak-moreeggs-malware-into.html
West Warns of Russian Cyber Attacks as Concerns Rise Over Putin’s Nuclear Rhetoric
Cyber crime groups have publicly pledged support for Russia, western officials worry about Putin’s reliance on nuclear threats and the battle for Mariupol in Ukraine grinds on.
The US and four of its closest allies have warned that “evolving intelligence” shows that Russia is contemplating cyber attacks on countries backing Ukraine, as the Kremlin’s frustration grows at its failure to make military gains.
Vladimir Putin used the launch on Wednesday of a powerful new Sarmat intercontinental ballistic missile (ICBM), capable of carrying ten or more warheads, to make nuclear threats against western countries.
The Sarmat has long been in development and test flights were initially due to start in 2017. The Pentagon confirmed that the US had been given notice of the test and was not alarmed. Western officials are more concerned by the increasing emphasis Moscow puts on its nuclear arsenal as its conventional forces have faltered in Ukraine.
The Ukrainian army continued to put up resistance in the besieged and devastated city of Mariupol, but Putin’s Chechen ally, Ramzan Kadyrov, predicted that the last stand of the port’s defenders at the Azovstal steel works would fall on Thursday.
The Kremlin has made repeated threats against the many countries that have been supplying Ukraine’s army with modern weapons, and members of the “Five Eyes” intelligence sharing network – the US, Britain, Canada, Australia and New Zealand – predicted Moscow could also work with cyber crime groups to launch attacks on governments, institutions and businesses.
Criminals Adopting New Methods To Bypass Improved Defences, Says Zscaler
The number of phishing attacks worldwide jumped 29 percent last year as threat actors countered stronger enterprise defences with newer methods, according to researchers with Zscaler's ThreatLabz research team.
Cyber criminals have adapted to multi-factor authentication (MFA), employee security awareness training, and security controls by broadening who and where they will attack.
While the United States remained the country with the most phishing attempts, others are seeing faster growth in the number of incidents – exploiting new vectors like SMS and lowering the barrier of entry for launching attacks through pre-built tools made available on the market.
"Phishing attacks continue to remain one of the most prevalent attack vectors, often serving as a starting point for more advanced next stage attacks that may result in a large-scale breach," Deepen Desai, CISO and vice president of security research and operations at Zscaler, told The Register.
https://www.theregister.com/2022/04/20/phishing-attempts-on-rise-zscaler/
Cyber Criminals Are ‘Drinking the Tears’ of Ukrainians
In biology, when an insect drinks the tears of a large creature, it is called lachryphagy. And in cyberspace, malicious actors are likewise “drinking tears” by exploiting humanitarian concerns about the war in Ukraine for profit. Different forms of deception include tricking people into donating to bogus charities, clicking on Ukraine-themed malicious links and attachments, and even impersonating officials to extort payment for rescuing loved ones.
It is an unfortunate reality that cyber opportunists are engaging in lachryphagy to exploit humanitarian concerns about the war for profit or data collection. To date, one of the largest cryptocurrency scams involving fraudulent Ukrainian relief payments totalled $50 million in March, the Wall Street Journal reports.
Immediately following Russia’s invasion of Ukraine, cybersecurity companies warned the public that criminals were preying on Ukrainian relief fundraising efforts with cryptocurrency scams. Bitdefender Labs reports that cyber criminals have impersonated Ukrainian government entities and charitable organisations such as UNICEF, and the Australian humanitarian agency, Act for Peace. “Some [scammers] are even pretending to be Wladimir Klitschko, whose brother Vitali is mayor of Ukraine’s capital, Kyiv,” according to the BBC.
Hackers For Hire Attempt to Destroy Hedge Fund Manager's Reputation
Hackers bombarded a British hedge fund manager with 3,000 emails and fake news stories about his mortgage in an effort to destroy his reputation after being hired by a corporate rival.
Criminals even sought to gain personal information about Matthew Earl by pretending to be his sister in a three-year campaign when he raised concerns over the controversial German payments company Wirecard.
Mr Earl, a former City analyst who runs the hedge fund ShadowFall, said he was targeted by a group called Dark Basin.
This group has been linked to Aviram Azari, who this week pleaded guilty in New York to a conspiracy to target journalists and critics of Wirecard using phishing emails.
Mr Earl said the hacking attempts started in 2016 after ShadowFall, nicknamed the “dark destroyer” in the City, criticised the financial performance of Wirecard. The German company was later mired in a series of accounting scandals and went bust.
He said: “I was being sent very targeted emails, which were crafted with personal information about my interests, friends and family’s details. They were very specific.”
Mr Earl received news stories that appeared to be from media outlets such as Reuters and Bloomberg. Another email appeared to be sent by his sister, sharing family photographs, he added.
https://www.telegraph.co.uk/business/2022/04/21/reign-terror-hackers-hire-ramp-corporate-espionage/
New Threat Groups and Malware Families Emerging
Mandiant announced the findings of an annual report that provides timely data and insights based on frontline investigations and remediations of high-impact cyber attacks worldwide. The 2022 report––which tracks investigation metrics between October 1, 2020 and December 31, 2021—reveals over 1,100 new threat groups and 733 new malware families.
The report also notes a realignment and retooling of China cyber espionage operations to align with the implementation of China’s 14th Five-Year Plan in 2021. The report warns that the national-level priorities included in the plan “signal an upcoming increase in China-nexus actors conducting intrusion attempts against intellectual property or other strategically important economic concerns, as well as defence industry products and other dual-use technologies over the next few years.”
https://www.helpnetsecurity.com/2022/04/22/adversaries-innovating-and-adapting/
Economic Warfare: Attacks on Critical Infrastructure Part of Geopolitical Conflict
We’ve known for years that since at least March of 2016, Russian government threat actors have been targeting multiple U.S. critical infrastructure sectors including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors. The Department of Homeland Security (DHS), the Federal Bureau of Investigations (FBI), and other agencies have acknowledged this for quite some time in many of their technical alerts and statements.
In the intervening years, with the acceleration of digital transformation, cyber criminals and nation-state actors have increasingly set their sights on these sectors. The convergence of physical and digital assets brings competitive advantage but also inevitable risks. Attacks against hospitals, oil pipelines, food supply chains, and other critical infrastructure, have brought into sharp focus the vulnerability of cyber-physical systems (CPS) and the impact on lives and livelihoods when they are disrupted. Now, overwhelming signs indicate critical infrastructure companies are in the bullseye of geopolitical conflict.
Threats
Ransomware
How Ready Are Organisations to Manage and Recover From A Ransomware Attack? - Help Net Security
FBI: BlackCat Ransomware Breached At Least 60 Entities Worldwide (bleepingcomputer.com)
Ransomware: This Gang Is Getting a Lot Quicker at Encrypting Networks | ZDNet
Hive Hackers Are Exploiting Microsoft Exchange Servers in Ransomware Spree | ZDNet
REvil's TOR Sites Come Alive to Redirect To New Ransomware Operation (bleepingcomputer.com)
PYSA Ransomware Attacks: Here's What MSSPs Need to Know - MSSP Alert
An Investigation of the BlackCat Ransomware via Trend Micro Vision One
REvil Resurrected? Ransomware Crew Appears to Be Back • The Register
FBI Warning: Ransomware Gangs Are Going After This Lucrative but Unexpected Target | ZDNet
Phishing & Email Based Attacks
LinkedIn Brand Takes Lead as Most Impersonated In Phishing Attacks (bleepingcomputer.com)
FBI Warns of 'Reverse' Instant Payments Phishing Schemes | SecurityWeek.Com
Spreading Malware Through Community Phishing - Help Net Security
Malware
Windows Malware Can Steal Social Media Credentials and Banking Logins (komando.com)
Emotet Botnet Switches to 64-bit Modules, Increases Activity (bleepingcomputer.com)
New SolarMarker Malware Variant Using Updated Techniques to Stay Under the Radar (thehackernews.com)
Emotet Reestablishes Itself at The Top Of The Malware World • The Register
Mobile
BYOD
IoT
How to Secure Smart Home (IOT) Devices | Reviews by Wirecutter (nytimes.com)
New Stealthy BotenaGo Malware Variant Targets DVR Devices (bleepingcomputer.com)
Organised Crime & Criminal Actors
Russian Hackers Are Seeking Alternative Money-Laundering Options (bleepingcomputer.com)
How Russia Is Isolating Its Own Cyber Criminals (darkreading.com)
Cryptocurrency/Cryptomining/Cryptojacking
Hackers Hammer SpringShell Vulnerability In Attempt To Install Cryptominers | Ars Technica
Beanstalk DeFi Platform Loses $182 Million In Flash-Loan Attack (bleepingcomputer.com)
Hackers Steal $655K After Picking MetaMask Seed from iCloud Backup (bleepingcomputer.com)
LemonDuck Botnet Plunders Docker Cloud Instances in Cryptocurrency Crime Wave | ZDNet
Fraud, Scams & Financial Crime
Security Lessons From a Payment Fraud Attack (darkreading.com)
Scammers Snatch Up Expired Domains, Vexing Google | TechCrunch
Insurance
Dark Web
Supply Chain and Third Parties
Cloud
Rethinking Cyber-Defence Strategies in the Public-Cloud Age | Threatpost
Cyber Criminals Are Shifting Their Gaze To Kubernetes - Information Security Buzz
Passwords & Credential Stuffing
Digital Transformation
Spyware, Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Moving Towards Defence in Depth Under The Grey Skies Of Conflict - Help Net Security
Locked Shields ‘Live Fire’ Cyber Drills to be Held as War in Ukraine Continues - Bloomberg
Russian-Linked Shuckworm Crew Ups Attacks on Ukraine • The Register
Russian Gamaredon APT Continues to Target Ukraine - Security Affairs
Phishing Attacks Using the Topic "Azovstal" Targets Entities in Ukraine - Security Affairs
Hackers Claim to Target Russia with Cyber Attacks and Leaks - The New York Times (nytimes.com)
The Anonymous Collective Hacked Other Russian Organisations - Security Affairs
Spyware Was Used Against Catalan Targets and UK Prime Minister and Foreign Office | CSO Online
Stalkerware Detection Trends: Monitor and Spyware Findings - MSSP Alert
Catalan Chief Accuses Spain's Intelligence Agency of Hacking | SecurityWeek.Com
Anomaly 6 Tracked NSA and CIA Spies as Product Demo: Report (gizmodo.com)
Nation State Actors
Nation State Actors – Russia
Five Eyes Nations Warn of Russian Cyber Attacks Against Critical Infrastructure (thehackernews.com)
NATO Locked Shields War Games Prep for Real Russian Cyber Attack (gizmodo.com)
The Russian Cyber Threat Is Here to Stay and NATO Needs To Understand It | Fox News
A Russian Cyber Attack Is Coming —Lawmakers and Citizens Must Prepare | The Hill
US Officials Increase Warnings About Russian Cyber-Attacks - Infosecurity Magazine
Work From Home Software 'At Risk of Russian Cyber Attacks' (telegraph.co.uk)
US Officials Preparing for Potential Russian Cyber Attacks - CBS News
After Foiled Sandworm Attack, US Critical Infrastructure Should Stand Guard | CSO Online
Nation State Actors – China
Nation State Actors – North Korea
North Korea Funds Nuclear Program with Cyber Crime- IT Security Guru
North Korea Aims 'TraderTraitor' Malware at Cryptocurrency Workers (cyberscoop.com)
Blockchain Companies Warned of North Korean Hackers - IT Security Guru
Nation State Actors – Misc
Vulnerabilities
VMware, Chrome Flaws Added to Known Exploited Vulnerabilities Catalogue - Security Affairs
Cisco Releases Security Patches for TelePresence, RoomOS and Umbrella VA (thehackernews.com)
Time to get patching: Oracle's quarterly Critical Patch Update arrives with 520 fixes | ZDNet
7-Zip Zero-Day Vulnerability Grants Privilege Escalation | TechSpot
QNAP Warns of New Bugs in Its Network Attached Storage Devices – Naked Security (sophos.com)
Cisco Umbrella Default SSH Key Allows Theft of Admin Credentials (bleepingcomputer.com)
Researcher Releases PoC for Recent Java Cryptographic Vulnerability (thehackernews.com)
Critical Cryptographic Java Security Blunder Patched – Update Now! – Naked Security (sophos.com)
Atlassian Drops Patches for Critical Jira Authentication Bypass Vulnerability (thehackernews.com)
Unpatched Bug in RainLoop Webmail Could Give Hackers Access to all Emails (thehackernews.com)
Sector Specific
Financial Services Sector
Modern Bank Heists 5.0: The Escalation from Dwell to Destruction (vmware.com)
Two-Thirds of Global Banks Witness Surge in Destructive Attacks - Infosecurity Magazine
FinTech
Health/Medical/Pharma Sector
The New Cyberthreat To Healthcare: Killware - Information Security Buzz
Many Medical Device Makers Skimp on Security Practices (darkreading.com)
Transport and Aviation
Other News
Why Companies Should Make ERP Security a Top Priority (techtarget.com)
The Evolving Role of The Lawyer in Cyber Security - Help Net Security
Cyber Security Litigation Risks: 4 Top Concerns for CISOs | CSO Online
Ponemon Research - Businesses to Invest $172b On Cyber Security In 2022 - Information Security Buzz
Funkypigeon.com Suspends Orders After 'Cyber Security Incident' | Business News | Sky News
The SEC Is About To Force CISOs Into America’s Boardrooms (forbes.com)
Data Breaches, Ransomware Attacks Leave Security Teams “Exhausted” - MSSP Alert
When Attacks Surge, Turn to Data to Strengthen Detection and Response | SecurityWeek.Com
Attacker Accessed Dozens of Repositories After OAuth Token Theft - Information Security Buzz
7 Best Practices for Web3 Security Risk Mitigation (techtarget.com)
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.