Black Arrow Cyber Threat Briefing 21 July 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• Cyber Attacks Reach Two-Year High Amid Ransomware Resurgence as Financial Service Firms Lose $32 Billion in 5 Years

The average weekly volume of cyber attacks reached a two-year high in the second quarter of 2023 amid a spike in activity among ransomware groups according to Check Point Research, with healthcare in particular facing a significant year-on-year increase. The impact of ransomware hits every organisation, with separate research finding global financial services organisations having lost over $32bn in downtime since 2018 due to ransomware breaches.

A recent report found that the ransomware gangs LockBit and Cl0p alone accounted for nearly 40% of all recorded ransomware attacks across June 2023. The impact from Cl0p’s MOVEit attack alone has been felt by over 400 organisations since May 2023. One of the key takeaways from the MOVEit attack is that no matter the sector, any organisation can be a victim and as such it is essential to have effective controls in place, incorporating defence-in-depth. It’s worth considering how many organisations are still running vulnerable instances of MOVEit, or have someone in their supply chain who is.

https://www.infosecurity-magazine.com/news/ransomware-costs-financial-32bn/

https://www.itpro.com/security/ransomware/weekly-cyber-attacks-reach-two-year-high-amid-ransomware-resurgence

• MOVEit Body Count Closes in on 400 Organisations, 20M+ Individuals

The number of victims and the costs tied to the MOVEit file transfer hack continues to climb as the fallout from the massive supply chain attack enters week seven. In late May 2023, Russian ransomware gang Cl0p exploited a security hole in Progress Software's MOVEit product suite to steal documents from vulnerable networks. As of last week, the number of affected organisations was closing in on 400 and individual victims exceed 20 million.

The attack highlights the need for organisations to have policies and procedures in place for third parties, and to be aware of the data which a third party supplier has on them. It will be the organisation who will need to let their customers know in the event of a breach.

https://www.theregister.com/2023/07/20/moveit_victim_count/

• IT Worker Jailed for Impersonating Ransomware Gang to Extort Employer

28-year-old Ashley Liles, a former IT employee, has been sentenced to over three years in prison for attempting to blackmail his employer during a ransomware attack. Liles, an IT security analyst at an Oxford-based company in the UK, exploited his position to intercept a ransomware payment following an attack suffered by his employer. To deceive the company, he impersonated the ransomware gang extorting them. He tried to redirect the ransomware payments by switching the cyber criminals' cryptocurrency wallet to one under his control. He also accessed a board member's private emails over 300 times.

Insider threat is a risk that organisations need to be aware of and, although it was malicious in this case, it can also come from employee negligence. Organisations looking to achieve a strong level of cyber resilience should incorporate insider risk into their training and controls.

https://www.bleepingcomputer.com/news/security/it-worker-jailed-for-impersonating-ransomware-gang-to-extort-employer/

• Stabilising the Cyber Security Landscape: The CISO Exodus and the Rise of vCISOs

In today's evolving digital landscape, the role of a chief information security officer (CISO) is critical. These professionals defend against the rising tide of daily cyber threats. Yet many CISOs are leaving or considering leaving their jobs; this trend seems to reflect the intense pressure CISOs endure. They face a constant stream of complex cyber threats, manage compliance issues and struggle with a talent deficit in cyber security. Paired with high expectations, many reconsider their roles which can lead to a leadership gap.

A virtual CISO (vCISO) is an outsourced security practitioner who offers their expertise to businesses on a part-time or contractual basis. These professionals provide many of the same services as a traditional CISO, such as developing and implementing security strategies, ensuring compliance with regulations, training staff and managing a company's cyber security posture. vCISOs, such as from Black Arrow, are often part of a larger team and can bring a wide range of experiences and skills. They are exposed to diverse security landscapes across industries, and can provide a fresh perspective and innovative solutions to your security challenges. The vCISO model may not replace the need for a full-time CISO in all cases, but it can certainly add a flexible and cost-effective tool to the arsenal of businesses looking to bolster their cyber security posture.

https://www.forbes.com/sites/theyec/2023/07/14/stabilizing-the-cybersecurity-landscape-the-ciso-exodus-and-the-rise-of-vcisos/

• Risk is Driving Medium-Sized Business Decisions

Small and medium sized businesses (SMBs) have long lacked the tools, expertise, staff and budget to make major cyber security investments. However, as threats become more mainstream and more advanced, the focus is shifting, so SMBs need to take the threats seriously and evaluate their cyber security controls.

In a survey of 140 SMBs, it was found that 40% of respondents believe they are very likely or extremely likely to experience a cyber security attack target in the next 12 months. That fear is founded, as 34% of organisations stated they experienced a malware attack in the past year, and 29% experienced a phishing or spear phishing incident. SMBs are putting their time, energy, and budget toward risk management. When it came to budgeting, 67% list their primary budgeting method as “risk-based”, and only 32% as “ad hoc/following an attack or breach”. It was found that over two-thirds of businesses would rather spend money now than pay a ransom later.

https://www.msspalert.com/cybersecurity-guests/risk-is-driving-small-and-medium-sized-businesses-smb-decisions/

• Talent and Governance, Not Technology, are Key to Drive Change Around Cyber Security

For the last 20 years, large organisations have been spending significant amounts of money on cyber security products and solutions, on managed services, or with consultancies large and small. Yet maturity levels remain elusive: a report found that 70% of firms surveyed had yet to fully advance to a mature-based approach. Cyber security good practices have been well established for the best part of the last 20 years and continue to provide, in most industries, an acceptable level of protection against most threats and an acceptable level of compliance against most regulations.

However cyber security is often viewed as something external to the business. This perspective leads to talent alienation and execution failures because the employees who should be invested in maintaining and improving cyber security may feel disconnected from these efforts. To make genuine progress, cyber security needs to be intrinsically linked to business values as a visible priority, owned and directed from the highest levels of an organisation.

This approach underlines the importance of governance in setting effective cyber security policies and procedures. It also highlights the crucial role of nurturing talent within the organisation to ensure active involvement in maintaining and improving cyber security measures. While technology is undoubtedly an essential element of cyber security, prioritising talent and governance can lead to lasting progress.

https://technative.io/talent-and-governance-not-technology-are-key-to-drive-change-around-cyber-security/

• Hybrid Work, Digital Transformation can Exploit Security Gaps

A new study showed that larger organisations generally recognise malware threats but they lack protection against malicious actors and ways to properly remediate infections. The report revealed security leaders are concerned about attacks that leverage malware-exfiltrated authentication data. 53% say they are extremely concerned about attacks, with 1% of security leaders saying they weren’t concerned at all. 98% said that better visibility into at-risk applications would significantly improve their security posture.

The most overlooked entry points for malware include 57% of organisations allowing employees to sync browser data between personal and corporate devices. 54% of organisations struggle with shadow IT, due to employees’ unsanctioned adoption of applications and systems, creating gaps not only in visibility but also in basic security controls and corporate policies.

https://www.msspalert.com/cybersecurity-research/digital-transformation-hybrid-work-models-create-perfect-setting-for-cybercriminals-to-exploit-security-gaps-study-finds/

• Human Cyber Risk Can Be Demonstrably Mitigated by Behaviour Changing Training

The process of encouraging secure cyber habits in end users is evolving from traditional awareness training toward changing end user behaviour. It reflects a growing acceptance that traditional methods haven’t worked. While traditional security awareness teaches users how to recognise social engineering, new behaviour changing trains the brain – almost pre-programs it – on the correct recognition and response to phishing.

What is considered a standard phishing email today may not be tomorrow, and changes in user behaviour will help to combat this. It is simply not enough to be shown one phishing email and be told to follow procedures. Training should instead be focused on going beyond; this should look to change how the user approaches things such as phishing, and gamifying the recognition and reporting of it.

https://www.securityweek.com/human-cyber-risk-can-be-demonstrably-mitigated-by-behavior-changing-training-analysis/

• AI Tool WormGPT Enables Convincing Fake Emails For BEC Attacks

A generative AI tool, WormGPT, has emerged as a powerful weapon in the hands of cyber criminals, specifically for launching business email compromise (BEC) attacks, according to new findings. The tool is designed for malicious purposes and has no restrictions on what a user can request. Such a tool allows for impeccable grammar in emails to reduce suspicion and allows sophistication with no restrictions on prompts. The lowered entry threshold enables cyber criminals with limited skills to execute sophisticated attacks, democratising the use of this technology.

https://www.infosecurity-magazine.com/news/wormgpt-fake-emails-bec-attacks/

https://www.independent.co.uk/tech/chatgpt-dark-web-wormgpt-hack-b2376627.html

• Pro-Russian Hacktivists Increase Focus on Western Targets

‘Anonymous Sudan’, apparent pro-Russian hacktivists, claimed a one-hour distributed denial of service attack on the social platform OnlyFans last week. This was the latest in a string of operations aimed at targets in the US and Europe. The group’s digital assaults coincide with attacks coming from a broader network of hackers aligned with Moscow that seek attention by taking down high-profile victims and strategic targets; many of the targets support Ukraine in its ongoing war against Russia.

The pro-Russian group appears to be affiliated with Killnet, a pro-Russian hacktivist group that emerged in late 2021 or early 2022 and has claimed distributed denial of service (DDoS) attacks, data theft and leaks on perceived adversaries of the Russian government, according to an analysis from Google’s Mandiant released earlier this week. The collective’s apparent significant growth in capabilities, demonstrated by Microsoft’s confirmation that Anonymous Sudan was responsible for the outages they experienced, potentially indicates a significant increase in outside investment in the collective, further suggesting a potential tie to the Russian state.

https://cyberscoop.com/anonymous-sudan-killnet-russia-onlyfans/

• Infosec Doesn't Know What AI Tools Organisations Are Using

With the marketplace awash in new artificial intelligence (AI) tools and new AI features being added to existing tools, organisations are finding themselves lacking visibility into what AI tools are in use, how they are used, who has access, and what data is being shared. As businesses try, adopt, and abandon new generative AI tools, it falls on enterprise IT, risk, and security leaders to govern and secure their use without hindering innovation. While developing security policies to govern AI use is important, it is not possible without knowing what tools are being used in the first place.

Enterprise security teams have to consider how to handle discovery, learning which generative AI tools have been introduced into the environment and by whom, as well as risk assessment.

https://www.darkreading.com/tech-trends/infosec-doesnt-know-what-ai-tools-orgs-are-using

• Google Restricting Internet Access to Some Employees to Reduce Cyber Attack Risk

In a bid to shrink the attack surface of its employees, and thus boost security, Google is taking an experimental, and some might say extreme, approach: cutting some of their workstations off from the internet. The company originally selected more than 2,500 employees to participate and will disable internet access on the selected desktops, except for internal web-based tools and Google owned websites like Google Drive and Gmail. Some workers who need the internet to do their job will get exceptions, the company stated in materials.

Google is running the programme to reduce the risk of cyber attacks, according to internal materials. If a Google employee’s device is compromised, the attackers may have access to user data and infrastructure code, which could result in a major incident and undermine user trust. The program comes as companies face increasingly sophisticated cyber attacks. Just last week, Microsoft said Chinese intelligence hacked into company email accounts belonging to two dozen government agencies in the US and Western Europe, including the US State Department, in a “significant” breach.

https://www.cnbc.com/2023/07/18/google-restricting-internet-access-to-some-employees-for-security.html

https://www.theregister.com/2023/07/19/google_cuts_internet/

• Unlocking Business Potential: How CISOs are Transforming Cyber Security into a Strategic Asset

Enterprises are responding to growing cyber security threats by working to make the best use of tools and services to ensure business resilience, according to a recent report. Chief information security officers (CISOs) and virtual CISOs (vCISOS) in particular, want more solutions and services that help them align security measures with enterprise objectives and C-level executives have become more aware of the need for cyber resilience. As a result, security investments have expanded beyond detection and response to include rapid recovery and business continuity.

The report found that amongst other things, enterprises are investing in risk assessments and outsourcing more services. In some cases, where a CISO cannot be hired, organisations may look to hire a vCISO. It is important that the vCISO is able to understand cyber in context to the business and help to align security objectives with the organisations objectives. Black Arrow supports clients as their vCISO with specialist experience in cyber security risk management in a business context.

https://www.blackarrowcyber.com/blog/threat-briefing-14-july-2023

---

Governance, Risk and Compliance

• Risk is Driving Small and Medium-Sized Businesses (SMB) Decisions - MSSP Alert

• Stabilising The Cyber security Landscape: The Rise Of vCISOs (forbes.com)

• Talent and Governance, not Technology, are Key to Drive Change around Cyber Security - TechNative

• Hybrid Work, Digital Transformation Can Exploit Security Gaps, Study Finds - MSSP Alert

• Human Cyber Risk Can Be Demonstrably Mitigated by Behaviour Changing Training: Analysis - SecurityWeek

• Stress, data privacy, zero trust to shape cyber security trends | SC Media (scmagazine.com)

• CISOs under pressure: Protecting sensitive information in the age of high employee turnover - Help Net Security

• Network, IAM, cloud are 2023's top cyber security spend priorities | VentureBeat

• CISOs are making cyber security a business problem - Help Net Security

• Top Information Security Threats for Businesses 2023 (cybersecuritynews.com)

• How to Build a Cyber Resilient Company | Entrepreneur

• Best practices for an effective cyber security strategy | CSO Online

• Exploring the macro shifts in enterprise security - Help Net Security

• Google Cloud CISO Phil Venables On Cyber security, Cloud Adoption And The Boardroom (forbes.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Ransomware Costs Financial Services $32bn in Five Years - Infosecurity Magazine (infosecurity-magazine.com)

• MOVEit victim count closes in on 400 orgs, 20M+ individuals • The Register

• Weekly cyber attacks reach two-year high amid ransomware resurgence | ITPro

• Ransomware attacks are on the rise—and so are ransom payments (fastcompany.com)

• IT worker jailed for impersonating ransomware gang to extort employer (bleepingcomputer.com)

• Security Patch Management Strengthens Ransomware Defence (trendmicro.com)

• The rise in ransomware attacks this year may be related to Russia's war in Ukraine : NPR

• Who are the ransomware gangs wreaking havoc on the world’s biggest companies? | Renee Dudley | The Guardian

• Cyber security firm Sophos impersonated by new SophosEncrypt ransomware (bleepingcomputer.com)

• Trends in ransomware-as-a-service and cryptocurrency to monitor - Help Net SecurityFIN8 deploys ALPHV ransomware using Sardonic malware variant (bleepingcomputer.com)

• Linux Ransomware Poses Significant Threat to Critical Infrastructure (darkreading.com)

• Financial cyber crime syndicate deploys reworked backdoor malware | CyberScoop

• Ransomware attackers getting more sophisticated: Canadian Centre for Cyber Security (yahoo.com)

• SophosEncrypt Ransomware Fools Security Researchers (darkreading.com)

• Mallox Ransomware Exploits Weak MS-SQL Servers to Breach Networks (thehackernews.com)

• New Ransomware With RAT Capabilities Impersonating Sophos - SecurityWeek

• Google’s Bard poses ransomware risk, say researchers | Cybernews

• Ransomware review: July 2023 (malwarebytes.com)

• FIN8 Group spotted delivering the BlackCat Ransomware - Security Affairs

• What is Cyber Extortion? | Definition from TechTarget

• Cyber insurers adapting to data-centric ransomware threats | TechTarget

• Shutterfly says Clop ransomware attack did not impact customer data (bleepingcomputer.com)

Ransomware Victims

• MOVEit victim count closes in on 400 orgs, 20M+ individuals • The Register

• Ofcom says it won’t pay ransom, as new MOVEit hack victims come forward | TechCrunch

• MOVEit Transfer vulnerability: New Cl0p 'victims' include Discovery (techmonitor.ai)

• BlackCat and Clop gangs both claim cyber attack on Estée Lauder | Computer Weekly

• Iron ore giant Fortescue Metals targeted by Russian ransomware group | Cybercrime | The Guardian

• Russian medical lab suspends some services after ransomware attack (therecord.media)

• Recycling Giant Tomra Takes Systems Offline Following Cyber attack - SecurityWeek

• Shutterfly says Clop ransomware attack did not impact customer data (bleepingcomputer.com)

Phishing & Email Based Attacks

• Typo leaks millions of US military emails to Mali web operator | Financial Times (ft.com)

• AI Tool WormGPT Enables Convincing Fake Emails For BEC Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft Exchange servers compromised by Turla APT - Help Net Security

• Microsoft takes pains to obscure role in 0-days that caused email breach | Ars Technica

• Analysis of Storm-0558 techniques for unauthorised email access | Microsoft Security Blog

• Only a handful of hackers are responsible for all email extortion attacks | TechRadar

• Microsoft Tops List of the Most Impersonated Brand for Phishing Scams in Q2 2023 - MSSP Alert

• Enhanced Monitoring to Detect APT Activity Targeting Outlook Online | CISA

• Sorillus RAT and Phishing Attacks Exploit Google Firebase Hosting - Infosecurity Magazine (infosecurity-magazine.com)

• Gmail encouraging users to enable Enhanced Safe Browsing (9to5google.com)

BEC – Business Email Compromise

• AI Tool WormGPT Enables Convincing Fake Emails For BEC Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Only a handful of hackers are responsible for all email extortion attacks | TechRadar

• Nigerian Man Sentenced to 8 Years in US Prison for $8 Million BEC Scheme - SecurityWeek

Other Social Engineering; Smishing, Vishing, etc

• Meta's Threads app used as a lure - Help Net Security

Artificial Intelligence

• ChatGPT rival WormGPT with ‘no ethical boundaries’ sold to hackers on dark web | The Independent

• Infosec Doesn't Know What AI Tools Orgs Are Using (darkreading.com)

• One in 12 victims of rise in AI scams (telegraph.co.uk)

• AI models must be reconciled with data protection laws • The Register

• UK Financial Regulator Urges Banks to Tackle AI-Based Fraud - Infosecurity Magazine (infosecurity-magazine.com)

• 1 in 4 Brits play with generative AI and some believe it too • The Register

• OpenAI credentials stolen by the thousands for sale on the dark web (bleepingcomputer.com)

• AI must have better security, says top cyber official - BBC News

• Google Categorises 6 Real-World AI Attacks to Prepare for Now (darkreading.com)

• How to Use Generative AI Tools While Still Protecting Your Privacy | WIRED

• Google’s Bard poses ransomware risk, say researchers | Cybernews

Malware

• Microsoft: Hackers turn Exchange servers into malware control centers (bleepingcomputer.com)

• Malicious USB Drives Targeting Global Targets with SOGU and SNOWYDRIVE Malware (thehackernews.com)

• Financial cyber crime syndicate deploys reworked backdoor malware | CyberScoop

• New SOHO Router Botnet AVrecon Spreads to 70,000 Devices Across 20 Countries (thehackernews.com)

• LokiBot Malware Targets Windows Users in Office Document Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Hackers Target Gamers With Microsoft-Signed Rootkit (darkreading.com)

• Source code of the BlackLotus UEFI Bootkit was leaked on GitHub - Security Affairs

• Are Viruses Still a Threat to Cyber security? (makeuseof.com)

• Black Hat Hacker Exposes Real Identity After Infecting Own Computer With Malware - SecurityWeek

• Pernicious Rootkits Pose Growing Blight On Threat Landscape (darkreading.com)

• Sorillus RAT and Phishing Attacks Exploit Google Firebase Hosting - Infosecurity Magazine (infosecurity-magazine.com)

Mobile

• Apple slams UK surveillance-bill proposals - BBC News

• Hackers Exploit WebAPK to Deceive Android Users into Installing Malicious Apps (thehackernews.com)

• Meta confirms WhatsApp is down worldwide (bleepingcomputer.com)

• Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware (thehackernews.com)

Botnets

• New SOHO Router Botnet AVrecon Spreads to 70,000 Devices Across 20 Countries (thehackernews.com)

• Ukraine's cyber police dismantled a massive bot farm - Security Affairs

Denial of Service/DoS/DDOS

• Cloudflare reports 'alarming surge' in DDoS sophistication, escalation in recent months | CyberScoop

• Attackers intensify DDoS attacks with new tactics - Help Net Security

• Zyxel Vulnerability Exploited by DDoS Botnets on Linux Systems - Infosecurity Magazine (infosecurity-magazine.com)

Internet of Things – IoT

• How your internet-connected domestic devices can be a critical tool of cyber attack (mid-day.com)

• US preparing Cyber Trust Mark for more secure smart devices (bleepingcomputer.com)

• Seven new gadgets added to riskiest connected devices list | SC Media (scmagazine.com)

Data Breaches/Leaks

• MOVEit Hack: Number of Impacted Organisations Exceeds 340 - SecurityWeek

• Data compromises on track to set a new record - Help Net Security

• Virustotal data leak exposed data of some registered customers - Security Affairs

• What to do (and what not to do) after a data breach - Help Net Security

• HWL Ebsworth hack: Queensland says its files were taken after criminals release Victorian documents | Cybercrime | The Guardian

• CISOs under pressure: Protecting sensitive information in the age of high employee turnover - Help Net Security

• Thousands of images on Docker Hub leak auth secrets, private keys (bleepingcomputer.com)

• Met Police ‘passed victims’ data to Facebook via online tracking tool’ | Evening Standard

• LastPass: The lessons we learnt from our devastating breach | TechRadar

• JumpCloud, an IT firm serving 200,000 orgs, says it was hacked by nation-state | Ars Technica

• Rogue Azure AD Guests Can Steal Data via Power Apps (darkreading.com)

• FIA World Endurance Championship driver passports leaked - Security Affairs

• Typo leaks millions of US military emails to Mali web operator | Financial Times (ft.com)

• Old Roblox Data Leak Resurfaces, 4000 Users' Personal Information Exposed - Infosecurity Magazine (infosecurity-magazine.com)

• Colorado State University says data breach impacts students, staff (bleepingcomputer.com)

Organised Crime & Criminal Actors

• Only a handful of hackers are responsible for all email extortion attacks | TechRadar

• Nigerian Man Sentenced to 8 Years in US Prison for $8 Million BEC Scheme - SecurityWeek

• NCA: Nation States Using Cyber crime Groups as Proxies - Infosecurity Magazine (infosecurity-magazine.com)

• Owner of BreachForums Pleads Guilty to Cyber crime and Child Pornography Charges (thehackernews.com)

• Genesis Market infrastructure and inventory sold on hacker forum (bleepingcomputer.com)

• Black Hat Hacker Exposes Real Identity After Infecting Own Computer With Malware - SecurityWeek

• Police arrests Ukrainian scareware developer after 10-year hunt (bleepingcomputer.com)

• Taking the Fight to the Cyber Criminals (trendmicro.com)

• Russian Charged with Tech Smuggling and Money Laundering - Infosecurity Magazine (infosecurity-magazine.com)

• Extremist-friendly tech company closes after fine for securities fraud | Technology | The Guardian

• Hacker Conversations: Inside the Mind of Daniel Kelley, ex-Blackhat - SecurityWeek

• Go Beyond the Headlines for Deeper Dives into the Cyber criminal Underground (thehackernews.com)

• SA on the brink of being Africa's capital of cyber crime, say digital experts | City Press (news24.com)

• What’s the NCA doing about cyber crime? - Tech Monitor

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Trends in ransomware-as-a-service and cryptocurrency to monitor - Help Net Security

Insider Risk and Insider Threats

• IT worker jailed for impersonating ransomware gang to extort employer (bleepingcomputer.com)

• Former contractor accused of remotely accessing town's water treatment facility | Tripwire

• Insider Risk Management Starts With SaaS Security (darkreading.com)

Fraud, Scams & Financial Crime

• One in 12 victims of rise in AI scams (telegraph.co.uk)

• A Twitter user found scam numbers for major airlines on Google Maps. Google is working to fix it | CNN Business

• UK Financial Regulator Urges Banks to Tackle AI-Based Fraud - Infosecurity Magazine (infosecurity-magazine.com)

• Growing scam activity linked to social media and automation - Help Net Security

• A fresh look at the current state of financial fraud - Help Net Security

• Tech support scammers now accepting cash via snail mail • The Register

• Half of UK company directors struck off linked to alleged Covid loan fraud | Coronavirus | The Guardian

• Extremist-friendly tech company closes after fine for securities fraud | Technology | The Guardian

• The cruel new holiday scams you need to know about | This is Money

• Airbnb-Related Scams Surge: Beware Of ‘Too Good To Be True’ Offers (forbes.com)

AML/CFT/Sanctions

• Russian Charged with Tech Smuggling and Money Laundering - Infosecurity Magazine (infosecurity-magazine.com)

Insurance

• Cyber insurers adapting to data-centric ransomware threats | TechTarget

• Strengthening Password Security may Lower Cyber Insurance Premiums (bleepingcomputer.com)

Dark Web

• Genesis Market infrastructure and inventory sold on hacker forum (bleepingcomputer.com)

• OpenAI credentials stolen by the thousands for sale on the dark web (bleepingcomputer.com)

• Exploring the Dark Side: OSINT Tools and Techniques for Unmasking Dark Web Operations (thehackernews.com)

Supply Chain and Third Parties

• JumpCloud, an IT firm serving 200,000 orgs, says it was hacked by nation-state | Ars Technica

• Google Cloud Build bug lets hackers launch supply chain attacks (bleepingcomputer.com)

• Supply chain executives unaware of growing customer trust issues - Help Net Security

• Possible Supply Chain Attack Targeting Pakistani Government Delivers Shadowpad (trendmicro.com)

Cloud/SaaS

• Microsoft makes cloud security logs available for free • The Register

• Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats (thehackernews.com)

• Top 5 Cloud Security Threats in 2023 (analyticsinsight.net)

• Network, IAM, cloud are 2023's top cyber security spend priorities | VentureBeat

• Google Cloud Build bug lets hackers launch supply chain attacks (bleepingcomputer.com)

• Reducing Security Debt in the Cloud (darkreading.com)

• Three key unanswered questions about the Chinese breach of Microsoft cloud services | CyberScoop

• TeamTNT's Cloud Credential Stealing Campaign Now Targets Azure and Google Cloud (thehackernews.com)

• How to manage cloud exploitation at the edge | CIO

• Sorillus RAT and Phishing Attacks Exploit Google Firebase Hosting - Infosecurity Magazine (infosecurity-magazine.com)

Hybrid/Remote Working

• Hybrid Work, Digital Transformation Can Exploit Security Gaps, Study Finds - MSSP Alert

• Securing The Hybrid Workforce Begins With Browsing (forbes.com)

Attack Surface Management

• How to Manage Your Attack Surface? (thehackernews.com)

• What is attack surface management? | Intruder

Identity and Access Management

• Attacker exploits vulnerability in Active Directory Certificate Services to take control of domain (securityintelligence.com)

• Network, IAM, cloud are 2023's top cyber security spend priorities | VentureBeat

• The rise of hassle-free and secure authentication | CyberScoop

Encryption

• Real-world examples of quantum-based attacks - Help Net Security

• EU Urged to Prepare for Quantum Cyber Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Signal president rejects ‘mass surveillance’ UK law | Fortune

API

• Docker Leaks API Secrets & Private Keys, as Cyber criminals Pounce (darkreading.com)

• API keys: Weaknesses and security best practices | TechTarget

Open Source

• Linux Ransomware Poses Significant Threat to Critical Infrastructure (darkreading.com)

• Half of AI Open Source Projects Reference Buggy Packages - Infosecurity Magazine (infosecurity-magazine.com)

• Zyxel Vulnerability Exploited by DDoS Botnets on Linux Systems - Infosecurity Magazine (infosecurity-magazine.com)

Passwords, Credential Stuffing & Brute Force Attacks

• LastPass: The lessons we learnt from our devastating breach | TechRadar

• Millions of Keyboard Walk Patterns Found in Compromised Passwords - IT Security Guru

• TeamTNT's Cloud Credential Stealing Campaign Now Targets Azure and Google Cloud (thehackernews.com)

• Strengthening Password Security may Lower Cyber Insurance Premiums (bleepingcomputer.com)

Social Media

• Growing scam activity linked to social media and automation - Help Net Security

• Met Police ‘passed victims’ data to Facebook via online tracking tool’ | Evening Standard

• Meta's Threads app used as a lure - Help Net Security

• TechScape: ‘Lives are ruined in an afternoon’ – social media and the Huw Edwards story | Technology | The Guardian

Training, Education and Awareness

• Human Cyber Risk Can Be Demonstrably Mitigated by Behavior Changing Training: Analysis - SecurityWeek

• Security Awareness Training Isn’t Working - How Can We Improve It? - SecurityWeek

• Companywide Cyber security Training: 20 Tips To Make It ‘Stick’ (forbes.com)

Digital Transformation

• Hybrid Work, Digital Transformation Can Exploit Security Gaps, Study Finds - MSSP Alert

Travel

• The cruel new holiday scams you need to know about | This is Money

• Airbnb-Related Scams Surge: Beware Of ‘Too Good To Be True’ Offers (forbes.com)

• A Twitter user found scam numbers for major airlines on Google Maps. Google is working to fix it | CNN Business

Regulations, Fines and Legislation

• AI models must be reconciled with data protection laws • The Register

• UK Financial Regulator Urges Banks to Tackle AI-Based Fraud - Infosecurity Magazine (infosecurity-magazine.com)

• Apple slams UK surveillance-bill proposals - BBC News

• Online Safety Bill Last chance for Lords to stop surveillance | Evening Standard

Models, Frameworks and Standards

• OWASP ZAP 2.13.0 Released – What’s New! (gbhackers.com)

Data Protection

• AI models must be reconciled with data protection laws • The Register

Careers, Working in Cyber and Information Security

• Career Benefits of Learning Ethical Hacking (analyticsinsight.net)

• Should You Be Using a Cyber security Careers Framework? (darkreading.com)

Law Enforcement Action and Take Downs

• Nigerian Man Sentenced to 8 Years in US Prison for $8 Million BEC Scheme - SecurityWeek

• Owner of BreachForums Pleads Guilty to Cyber crime and Child Pornography Charges (thehackernews.com)

• What’s the NCA doing about cyber crime? - Tech Monitor

• Police arrests Ukrainian scareware developer after 10-year hunt (bleepingcomputer.com)

• Russian Charged with Tech Smuggling and Money Laundering - Infosecurity Magazine (infosecurity-magazine.com)

• Ukraine's cyber police dismantled a massive bot farm - Security Affairs

Privacy, Surveillance and Mass Monitoring

• Apple slams UK surveillance-bill proposals - BBC News

• Online Safety Bill Last chance for Lords to stop surveillance | Evening Standard

• Stress, data privacy, zero trust to shape cyber security trends | SC Media (scmagazine.com)

• How to Use Generative AI Tools While Still Protecting Your Privacy | WIRED

Misinformation, Disinformation and Propaganda

• Ukraine's cyber police dismantled a massive bot farm - Security Affairs

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare and Cyber Espionage

Russia

• The rise in ransomware attacks this year may be related to Russia's war in Ukraine : NPR

• Gamaredon hackers start stealing data 30 minutes after a breach (bleepingcomputer.com)

• Analysis of Storm-0558 techniques for unauthorised email access | Microsoft Security Blog

• Microsoft Exchange servers compromised by Turla APT - Help Net Security

• Pro-Russian hacktivists increase focus on Western targets. The latest is OnlyFans. | CyberScoop

• Elon Musk’s Starlink is putting our soldiers at risk, Ukraine warns (telegraph.co.uk)

• New Threat Actor Launches Cyber attacks on Ukraine and Poland - Infosecurity Magazine (infosecurity-magazine.com)

• 1st Case Of Online Killing? Russian Submarine Commander Falls Prey To Fitness Tracking App (eurasiantimes.com)

• Thousands of Russian officials to give up iPhones over US spying fears | Financial Times (ft.com)

• Ukraine innovates on cyber defence | Financial Times (ft.com)

China

• Three key unanswered questions about the Chinese breach of Microsoft cloud services | CyberScoop

• Chinese APT Favourite Backdoor Found in Pakistani Government App - Infosecurity Magazine (infosecurity-magazine.com)

• China Espionage Operatives Left Empty Handed in Email Heist, White House Official Says - MSSP Alert

• Xi wants to make the Great Firewall of China even greater • The Register

• Chinese APT41 Hackers Target Mobile Devices with New WyrmSpy and DragonEgg Spyware (thehackernews.com)

North Korea

• JumpCloud breach traced back to North Korean state hackers (bleepingcomputer.com)

• North Korean hackers breached a US tech company to steal crypto | Reuters

Misc/Other/Unknown

• JumpCloud, an IT firm serving 200,000 orgs, says it was hacked by nation-state | Ars Technica

• NCA: Nation States Using Cyber crime Groups as Proxies - Infosecurity Magazine (infosecurity-magazine.com)

• APT Protection: The Key to Safeguarding Your Business (ts2.space)

• How to Secure Your OT Network Against Advanced Persistent Threats (APTs) (ts2.space)

• Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats (thehackernews.com)

---

Vulnerability Management

• CVSS 4.0 released, to help assess real-time threat and impact of vulnerabilities - Help Net Security

• Security Patch Management Strengthens Ransomware Defence (trendmicro.com)

• What is Vulnerability Assessment In Cyber security? (gbhackers.com)

• Half of AI Open Source Projects Reference Buggy Packages - Infosecurity Magazine (infosecurity-magazine.com)

Vulnerabilities

• Windows Users Urged To Update As Microsoft Confirms New Zero-Day Exploits (forbes.com)

• Microsoft Bug Allowed Hackers to Breach Over Two Dozen Organisations via Forged Azure AD Tokens (thehackernews.com)

• Microsoft still unsure how hackers stole Azure AD signing key (bleepingcomputer.com)

• Microsoft takes pains to obscure role in 0-days that caused email breach | Ars Technica

• CVE-2023-38408: Remote Code Execution in OpenSSH’s forwarded ssh-agent | Qualys Security Blog

• New critical Citrix ADC and Gateway flaw exploited as zero-day (bleepingcomputer.com)

• OpenSSH Addresses Remote Code Execution Vulnerability: CVE-2023-38408 - VULNERA

• New AMI BMC Flaws Allowing Takeover and Physical Damage Could Impact Millions of Devices - SecurityWeek

• Adobe Rolls Out New Patches for Actively Exploited ColdFusion Vulnerability (thehackernews.com)

• Cisco fixed a critical flaw in SD-WAN vManage - Security Affairs

• Hacking campaign targets sites using WordPress WooCommerce Payments Plugin - Security Affairs

• Microsoft hit by Storm season – a tale of two semi-zero days – Naked Security (sophos.com)

• Chrome 115 Patches 20 Vulnerabilities - SecurityWeek

• 'METIOR' Defence Blueprint Against Side-Channel Vulnerabilities Debuts | Tom's Hardware (tomshardware.com)

• 5 Major Takeaways From Microsoft's July Patch Tuesday (darkreading.com)

• Two Jira Plugin Vulnerabilities in Attacker Crosshairs - SecurityWeek

• Zyxel Vulnerability Exploited by DDoS Botnets on Linux Systems - Infosecurity Magazine (infosecurity-magazine.com)

• Google says Apple employee found a zero-day but did not report it | TechCrunch

---

Tools and Controls

• Human Cyber Risk Can Be Demonstrably Mitigated by Behaviour Changing Training: Analysis - SecurityWeek

• CISOs under pressure: Protecting sensitive information in the age of high employee turnover - Help Net Security

• Network, IAM, cloud are 2023's top cyber security spend priorities | VentureBeat

• Stress, data privacy, zero trust to shape cyber security trends | SC Media (scmagazine.com)

• Reducing Security Debt in the Cloud (darkreading.com)

• Leverage Threat Intelligence, AI, and Data at Scale to Boost Cyber Defences (darkreading.com)

• A Few More Reasons Why RDP is Insecure (Surprise!) (thehackernews.com)

• Enterprise communication security a growing risk, priority | TechTarget

• SBOMs Still More Mandate Than Security (darkreading.com)

• MIT’s Cyber security Metior: A Secret Weapon Against Side-Channel Attacks (scitechdaily.com)

• NCSC Shares Alternatives to Using a SOC - Infosecurity Magazine (infosecurity-magazine.com)

• Building resilience through DevSecOps - Help Net Security

• Microsoft's security roadmap: Protect Azure DevOps secrets • The Register

• CISA shares free tools to help secure data in the cloud (bleepingcomputer.com)

• What is the new Enhanced Safe Browsing for Gmail (and should you enable it)? | ZDNET

• Insider Risk Management Starts With SaaS Security (darkreading.com)

• What is Real-Time Monitoring? | Definition from TechTarget

• How to Manage Your Attack Surface? (thehackernews.com)

• What is attack surface management? | Intruder

• 67% of daily security alerts overwhelm SOC analysts - Help Net Security

• Technical Aspects Of Modern SIEM Systems (forbes.com)

• Gmail encouraging users to enable Enhanced Safe Browsing (9to5google.com)

• Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats (thehackernews.com)

• 3 Ways AI Could Improve Authentication (darkreading.com)

• Microsoft makes cloud security logs available for free • The Register

• Security Awareness Training Isn’t Working - How Can We Improve It? - SecurityWeek

• The XDR Payoff: Better Security Posture (trendmicro.com)

• API keys: Weaknesses and security best practices | TechTarget

• 10 Steps to Help Secure Your APIs - SecurityWeek

• Threat Actors are Targeting Your Web Applications – Here’s How To Protect Them (bleepingcomputer.com)

---

Other News

• Google restricting internet access to some employees for security (cnbc.com)

• Enterprise communication security a growing risk, priority | TechTarget

• Healthcare organisations in the crosshairs of cyber attackers - Help Net Security

• Broadband consumers demand security and sustainability - Help Net Security

• Microsoft Exchange Online hit by new outage blocking emails (bleepingcomputer.com)

• Famed Hacker Kevin Mitnick Dead at 59 - SecurityWeek

• Most CNI Firms Think Climate Tech is Increasing Cyber Risk - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber security measures SMBs should implement - Help Net Security

• Satellites Are Rife With Basic Security Flaws | WIRED

• How Hackers Can Hijack a Satellite (darkreading.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 10 March 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber threat intelligence experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Business Email Compromise Attacks Can Take Just Hours

Microsoft’s security intelligence team found that Business Email Compromise (BEC) attacks are moving rapidly, with some taking mere minutes. Microsoft found the whole process, from signing in using compromised credentials to registering typo squatting domains and hijacking an email thread, took threat actors only a couple of hours. Such a rapid attack leaves minimal time for organisations to identify and take preventative action. This is worrying when considering the cost of BEC is predicted to more than tens of billions.

https://www.bleepingcomputer.com/news/security/microsoft-business-email-compromise-attacks-can-take-just-hours/

Research Reveals ‘Password’ is Still the Most Common Term used by Hackers to Breach Enterprise Networks

In a report of over 800 million breached passwords, vendor Specops identified some worrying results. Some of the key findings from the report include 88% of passwords used in successful attacks consisting of 12 characters or less and the most common base terms used in passwords involving ‘password’, ‘admin’, ‘welcome’ and ‘p@ssw0rd’. The report found that 83% of the compromised passwords satisfied both the length and complexity requirements of cyber security compliance standards such as NIST, GDPR, HIPAA and Cyber Essentials.

https://www.itsecurityguru.org/2023/03/08/research-reveals-password-still-the-most-common-term-used-by-hackers-to-breach-enterprise-networks/

Just 10% of Firms Can Resolve Cloud Threats in an Hour

Two-thirds (39%) of global organisations reported a surge in breaches over the past year, with IT complexity increasing and detection and response capabilities worsening, according to Palo Alto Networks. It found that as enterprises move more of their data and workloads to the cloud, they’re finding it increasingly difficult to discover and remediate incidents quickly. Over two-fifths (42%) reported an increase in mean time to remediate, while 90% said they are unable to detect, contain and resolve cyber-threats within an hour. Nearly a third (30%) reported a major increase in intrusion attempts and unplanned downtime. Part of the challenge appears to be the complexity of their cloud security environments – partly caused by tool bloat.

https://www.infosecurity-magazine.com/news/10-firms-resolve-cloud-threats-hour/

MSPs in the Crosshairs of Ransomware Gangs

Many attacks have heightened attention around third-party risk and the security obligations of MSPs in meeting multiple customers’ IT needs. Attacks such as the ones on RackSpace and LastPass show that some ransomware actors are now intentionally targeting MSPs to access sensitive customer data. It is now believed that some advanced persistent threat (APT) groups could be stepping up their attacks on MSP’s in order to gain sensitive customer data.

https://www.msspalert.com/cybersecurity-research/msps-in-the-crosshairs-of-ransomware-gangs/

Stolen Credentials Increasingly Empower the Cyber Crime Underground

Threat Intelligence provider Flashpoint found that last year threat actors exposed or stole 22.62 billion credentials and personal records, which often make their way to underground forums and cyber criminal markets. This follows a significant increase in market activity; just last year Flashpoint recorded 190 new illicit markets emerge and the continual rise in attacks focused on stealing credentials only further empowers cyber crime underground.

https://www.csoonline.com/article/3690409/stolen-credentials-increasingly-empower-the-cybercrime-underground.html#tk.rss_news

It’s Time to Assess the Potential Dangers of an Increasingly Connected World

As global conflicts continue, cyber has become the fifth front of warfare. The world is approaching 50 billion connected devices, controlling everything from our traffic lights to our nuclear arsenal and we have already seen large-scale cyber attacks. Adding to this, a multitude of infrastructure runs on services ran by a handful of companies; Palo Alto Networks, Cisco and Fortinet control more than 50% of the market for security appliances. As such, an attack on one of these companies could cause a huge ripple effect on their customers.

https://www.darkreading.com/risk/it-s-time-to-assess-the-potential-dangers-of-an-increasingly-connected-world-

Mounting Cyber Threats Mean Financial Firms Urgently Need Better Safeguards

According to the International Monetary Fund (IMF) 64% of banks and supervisory authorities do not mandate testing and exercising cyber security and 54% lack dedicated a cyber incident reporting regime. This increases the risk of experiencing a cyber attack. Regularly testing and exercising security will aid any organisation in its cyber resilience.

https://www.imf.org/en/Blogs/Articles/2023/03/02/mounting-cyber-threats-mean-financial-firms-urgently-need-better-safeguards

Insider Threat: Developers Leaked 10m Credentials Including Passwords in 2022

Security provider GitGuardian found that the rate at which developers leaked critical software secrets jumped by 0.5 to reach 5.5 out of every 1,000 commits to GitHub repositories; overall, this amounted to at least 10 million instances of secrets leaking to a public repository. Generic passwords accounted for the majority of leaked secrets (56%) and more than a third (38%) of leaks involved API keys, random number generator seeds and other sensitive strings. These leaks can have worrying consequences for organisations.

https://www.darkreading.com/application-security/inside-threat-developers-leaked-10m-credentials-passwords-2022

Cyber Threat Detections Surges 55% In 2022

Security Provider Trend Micro has said that it stopped 146 billion cyber threats in 2022, a 55% increase on the previous year and evidence of the increase of attacks ramping up. Trend Micro also found a 242% increase in the number of blocked malicious files and an 86% increase in backdoor malware detections with the latter showing an increase in attackers gaining initial access. Furthermore, the number of critical vulnerabilities in 2022 doubled compared to the previous year. Trend Micro noted that this is all likely due to an ever expanding attack surface of organisations.

https://www.infosecurity-magazine.com/news/cyberthreat-detections-surge-55/

European Central Bank Tells Banks to Run Cyber Stress Tests after Rise in Hacker Attacks

The European Central Bank (ECB) will ask all major lenders in the Eurozone to detail by next year, how they would respond to and recover from a successful cyber attack. The ECB is in the process of designing a scenario involving a theoretical breach of the financial system’s cyber defences, which will be sent to all of the 111 banks it assesses to see how they would react. The stress test stems from the increasing amount of cyber attacks. If cyber has shown us anything, it’s that anyone can be a target and performing a stress test would help any organisation prepare for the worst.

https://www.ft.com/content/f03d68a4-fdb9-4312-bda3-3157d369a4a6

Employees Are Feeding Sensitive Business Data to ChatGPT

1 in 20 employees have put sensitive corporate data into popular AI tool ChatGPT, raising concerns that this could result in massive leaks of proprietary information. In some cases, this has involved employees cutting and pasting strategic documents and asking ChatGPT to make a PowerPoint.

https://www.darkreading.com/risk/employees-feeding-sensitive-business-data-chatgpt-raising-security-fears

Is Ransomware Declining? Not So Fast Experts Say

Security provider CrowdStrike have explained that the perceived decline in ransomware reflects the abilities of threat actors to adapt, splinter and regroup against defensive measures. CrowdStrike expand on this, stating that whilst ransom payments dipped slightly in 2022, there was an uprise in data extortion and ransomware as a service (RaaS).

https://www.techtarget.com/searchsecurity/news/365532201/Is-ransomware-declining-Not-so-fast-experts-say

Preventing Corporate Data Breaches Starts with Remembering that Leaks have Real Victims

The impact a data breach can have on an individual is devastating and ultimately there’s not much an individual can do themselves if the organisation that holds their data isn’t taking the right steps. To best protect themselves and their clients’ data, organisations should look to have appropriate defence in depth controls, including effective asset management, an open security culture, close monitoring of access, utilising strong authentication and maintaining an awareness of the ever changing threat landscape.

https://www.helpnetsecurity.com/2023/03/07/preventing-corporate-data-breaches/

Faced With Likelihood of Ransomware Attacks, Businesses Still Choosing to Pay Up

In a recent report Proofpoint found that globally 76% of organisations experienced ransomware attempts, with 64% eventually infected. Amongst those that had a cyber insurance policy, 82% of insurers stepped up to pay the ransom either in full or partially. The report found that with the rise in number and sophistication of attacks it is more important than ever for proper security training and awareness in organisations.

https://www.zdnet.com/article/faced-with-likelihood-of-ransomware-attacks-businesses-still-choosing-to-pay-up/

Experts See Growing Need for Cyber Security Workers as One in Six Jobs go Unfilled

A report by the Information and Communications Technology Council (ICTC) found that 1 in 6 cyber security jobs are unfulfilled and this is only expected to grow in the coming years. The ICTC stated that “This is not just about education or government funding, but about companies willing to provide hands-on training and experience to the next generation of cyber security experts”.

https://www.theglobeandmail.com/business/careers/article-experts-see-growing-need-for-cybersecurity-workers-as-one-in-six-jobs/

---

Threats

Ransomware, Extortion and Destructive Attacks

• Faced with likelihood of ransomware attacks, businesses still choosing to pay up | ZDNET

• MSPs in the Crosshairs of Ransomware Gangs - MSSP Alert

• Is ransomware declining? Not so fast, experts say | TechTarget

• FBI and CISA warn of increasing Royal ransomware attack risks (bleepingcomputer.com)

• City of Oakland Faces Major Data Leak - Infosecurity Magazine (infosecurity-magazine.com)

• Indigo Books Refuses LockBit Ransomware Demand (darkreading.com)

• Anatomy of a Ransomware Attack

• Core Members of DoppelPaymer Ransomware Gang Targeted in Germany and Ukraine (thehackernews.com)

• Ransom House ransomware attack hit Hospital Clinic de Barcelona- - Security Affairs

• Security Patch Management Strengthens Ransomware Defence (trendmicro.com)

• Ransomware's Favorite Target: Critical Infrastructure and Its Industrial Control Systems (darkreading.com)

• Ransomware review: March 2023 (malwarebytes.com)

• Ransomware gang posts video of data stolen from Minneapolis schools (bleepingcomputer.com)

• IceFire ransomware now encrypts both Linux and Windows systems (bleepingcomputer.com)

• Examining Ransomware Payments From a Data-Science Lens (trendmicro.com)

• DND: Black & McDonald reported ransomware attack | CTV News

• Cyble — BlackSnake Ransomware Emerges from Chaos Ransomware's Shadow

Phishing & Email Based Attacks

• AI is taking phishing attacks to a whole new level of sophistication - Help Net Security

• Catches of the Month: Phishing Scams for March 2023 - IT Governance UK Blog

• Emotet starts post-break phishing campaign • The Register

BEC – Business Email Compromise

• Microsoft: Business email compromise attacks can take just hours (bleepingcomputer.com)

Other Social Engineering; Smishing, Vishing, etc

• Experts Warn of "SMS Pumping" Fraud Epidemic - Infosecurity Magazine (infosecurity-magazine.com)

• Vishing attacks increasing, but AI's role still unclear | TechTarget

• Defeating the Deepfake Danger - SecurityWeek

• Does Your Help Desk Know Who's Calling? (thehackernews.com)

2FA/MFA

• NCSC: Twitter Users Should Find MFA Alternatives - Infosecurity Magazine (infosecurity-magazine.com)

Malware

• DrayTek VPN routers hacked with new malware to steal data, evade detection (bleepingcomputer.com)

• Malicious PyPI package signals direction of cyber crime • The Register

• How to prevent Microsoft OneNote files from infecting Windows with malware (bleepingcomputer.com)

• Snake Keylogger Malware Removal Guide (makeuseof.com)

• Stealthy UEFI malware bypassing Secure Boot enabled by unpatchable Windows flaw | Ars Technica

• New malware infects business routers for data theft, surveillance (bleepingcomputer.com)

• Old Windows ‘Mock Folders’ UAC bypass used to drop malware (bleepingcomputer.com)

• Emotet malware attacks return after three-month break (bleepingcomputer.com)

• AI-Powered 'BlackMamba' Keylogging Attack Evades Modern EDR Security (darkreading.com)

• New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic (thehackernews.com)

• Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware (thehackernews.com)

• Custom Chinese Malware Found on SonicWall Appliance - SecurityWeek

• Remcos Trojan Returns to Most Wanted Malware List After Ukraine Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• FBI and international cops catch a NetWire RAT • The Register

Mobile

• Transparent Tribe Hackers Distribute CapraRAT via Trojanized Messaging Apps (thehackernews.com)

• Officials Targeted with Romance Scams and Android Trojan - Infosecurity Magazine (infosecurity-magazine.com)

• Google One expands security features to all plans with dark web report, VPN access - Help Net Security

Denial of Service/DoS/DDOS

• Akamai mitigated a record-breaking DDoS that peaked 900Gbps- Security Affairs

Internet of Things – IoT

• TPM 2.0 Library Vulnerabilities May Affect Billions of IoT Devices - Infosecurity Magazine (infosecurity-magazine.com)

• Chinese Hikvision cameras ‘that pose security threat’ used on King’s Sandringham estate (thetimes.co.uk)

Data Breaches/Leaks

• Preventing corporate data breaches starts with remembering that leaks have real victims - Help Net Security

• The LastPass Hack Somehow Gets Worse | WIRED

• LastPass Hack: Engineer's Failure to Update Plex Software Led to Massive Data Breach (thehackernews.com)

• Credential Stuffing attack on Chick-fil-A impacted +71K users- Security Affairs

• Popular fintech apps expose valuable, exploitable secrets - Help Net Security

• PayPal Sued Over Data Breach that Impacted 35,000 users (hackread.com)

• Acer Data Breach? Hacker Claims to Sell 160GB Trove of Stolen Data (hackread.com)

• Brazilian Conglomerate Suffers 3TB Data Breach: Report - Infosecurity Magazine (infosecurity-magazine.com)

• Data breach exposed millions of Verizon customers' account info (androidpolice.com)

• Congress’ Social Security Numbers Leaked in DC Health Link Hack (gizmodo.com)

• Data protection vendor Acronis admits to data leak • The Register

• AT&T confirms 9m wireless accounts exposed by third part • The Register

Organised Crime & Criminal Actors

• At Least 30% of "Cyber-Criminals" Are Women: Report - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber crime site shows off with a free leak of 2 million stolen card numbers - The Record from Recorded Future News

• BidenCash leaks 2.1M stolen credit/debit cards- Security Affairs

• Malicious PyPI package signals direction of cyber crime • The Register

• Where are the women in cyber security? • The Register

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• FTX Confirms $9 Billion in Customer Funds Vanished (gizmodo.com)

• Russia-Ukraine war: How both sides of the conflict have used crypto to win (cointelegraph.com)

• New ScrubCrypt Crypter Used in Cryptojacking Attacks Targeting Oracle WebLogic (thehackernews.com)

Insider Risk and Insider Threats

• 6 Ways To Go Beyond Awareness And Foster A Real Culture Of Cyber security (forbes.com)

Fraud, Scams & Financial Crime

• Scams Security Pros Almost Fell For (darkreading.com)

• FTX Confirms $9 Billion in Customer Funds Vanished (gizmodo.com)

• Experts Warn of "SMS Pumping" Fraud Epidemic - Infosecurity Magazine (infosecurity-magazine.com)

• Scammers using voice-cloning A.I. to mimic relatives | Fortune

• Alleged security breach leaves millions of dollars missing from Flutterwave accounts | TechCrunch

• UK Government Plans Skills Boost for Public Sector Fraud Fight - Infosecurity Magazine (infosecurity-magazine.com)

• Officials Targeted with Romance Scams and Android Trojan - Infosecurity Magazine (infosecurity-magazine.com)

• New Rise In ChatGPT Scams Reported By Fraudsters (informationsecuritybuzz.com)

Deepfakes

• From Disinformation to Deep Fakes: How Threat Actors Manipulate Reality (thehackernews.com)

• Defeating the Deepfake Danger - SecurityWeek

Insurance

• Talking Cyber Insurance With Munich Re - SecurityWeek

Dark Web

• Cyber crime site shows off with a free leak of 2 million stolen card numbers - The Record from Recorded Future News

• Google One expands security features to all plans with dark web report, VPN access - Help Net Security

Supply Chain and Third Parties

• Snap CISO talks risky supply chain security business • The Register

• SolarWinds IR lead: supply-chain attacks 'getting bigger' • The Register

• AT&T confirms 9m wireless accounts exposed by third part • The Register

Software Supply Chain

• SBOMs become a security staple for the software supply chain • The Register

Cloud/SaaS

• Just 10% of Firms Can Resolve Cloud Threats in an Hour - Infosecurity Magazine (infosecurity-magazine.com)

• Experts Reveal Google Cloud Platform's Blind Spot for Data Exfiltration Attacks (thehackernews.com)

• Hackers are quickly learning how to target cloud systems (axios.com)

• Understanding the Shared Responsibility Model, Critical Step to Ensure Cloud Security - Infosecurity Magazine (infosecurity-magazine.com)

Attack Surface Management

• 5 Reasons You Should Care About Unmanaged Assets (darkreading.com)

Asset Management

• 5 Reasons You Should Care About Unmanaged Assets (darkreading.com)

Encryption

• New TPM 2.0 flaws could let hackers steal cryptographic keys (bleepingcomputer.com)

• New Steganography Breakthrough Enables “Perfectly Secure” Digital Communications (scitechdaily.com)

API

• API Security for UK companies - IT Security Guru

• Attackers exploit APIs faster than ever before - Help Net Security

Open Source

• IceFire ransomware now encrypts both Linux and Windows systems (bleepingcomputer.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Research Reveals 'Password' Still the Most Common Term Used by Hackers to Breach Enterprise Networks - IT Security Guru

• Stolen credentials increasingly empower the cyber crime underground | CSO Online

• The LastPass Hack Somehow Gets Worse | WIRED

• Credential Stuffing attack on Chick-fil-A impacted +71K users- Security Affairs

• The Role of Verifiable Credentials In Preventing Account Compromise (darkreading.com)

• Securing ways to share workplace passwords • The Register

• Young government workers show poor password management habits - Help Net Security

Social Media

• NCSC: Twitter Users Should Find MFA Alternatives - Infosecurity Magazine (infosecurity-magazine.com)

• TikTok unveils new European data security regime | Reuters

Training, Education and Awareness

• 6 Ways To Go Beyond Awareness And Foster A Real Culture Of Cyber security (forbes.com)

Regulations, Fines and Legislation

• Biden Administration's Cyber security Strategy Takes Aim at Hackers (gizmodo.com)

• Government Claims New UK GDPR Will Save Firms Billions - Infosecurity Magazine (infosecurity-magazine.com)

Governance, Risk and Compliance

• Inadequate patches and advisories increase cyber risk - Help Net Security

• Why do Businesses Need to Focus More on Cyber security (hackread.com)

• Flashpoint: Threat vectors converging, increasing damage | TechTarget

• How to achieve and shore up cyber resilience in a recession - Help Net Security

• The cyber security landscape in the era of economic instability – Help Net Security

Models, Frameworks and Standards

• Open letter demands OWASP overhaul, warns of mass project exodus | CSO Online

• PCI Compliance Requirements Guide (trendmicro.com)

• NIST Retooling Cyber security Framework to Reflect Changing Cyber scape – MSSP Alert

Data Protection

• Government Claims New UK GDPR Will Save Firms Billions – Infosecurity Magazine (infosecurity-magazine.com)

Careers, Working in Cyber and Information Security

• Experts see growing need for cyber security workers as one in six jobs go unfilled – The Globe and Mail

• How to Jump-Start Your Cyber security Career (darkreading.com)

Law Enforcement Action and Take Downs

• Core Members of DoppelPaymer Ransomware Gang Targeted in Germany and Ukraine (thehackernews.com)

• FBI and international cops catch a NetWire RAT • The Register

Privacy, Surveillance and Mass Monitoring

• Secret Service and ICE break the law with fake phone towers • The Register

• Thought you'd opted out of online tracking? Think again • The Register

Artificial Intelligence

• AI is taking phishing attacks to a whole new level of sophistication - Help Net Security

• Employees Are Feeding Sensitive Business Data to ChatGPT (darkreading.com)

• You can poison AI datasets for just $60, a new study shows (fastcompany.com)

• Microsoft and MITRE developed a tool to prepare security teams for attacks on ML systems - Help Net Security

• Thousands scammed by AI voices mimicking loved ones in emergencies | Ars Technica

• Vishing attacks increasing, but AI's role still unclear | TechTarget

• AI-Powered 'BlackMamba' Keylogging Attack Evades Modern EDR Security (darkreading.com)

• Criminals will use ChatGPT to unleash wave of fraud, warns Darktrace (telegraph.co.uk)

Misinformation, Disinformation and Propaganda

• From Disinformation to Deep Fakes: How Threat Actors Manipulate Reality (thehackernews.com)

---

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• What can security teams learn from a year of cyber warfare? | Computer Weekly

• New Backdoor MQsTTang Attributed to Mustang Panda Group - Infosecurity Magazine (infosecurity-magazine.com)

• Pegasus spyware used to spy on a Polish mayor- Security Affairs

• Russia-Ukraine war: How both sides of the conflict have used crypto to win (cointelegraph.com)

• Sharp Panda targets government entities in Southeast Asia- Security Affairs

• Russia’s Cyber Tactics in Ukraine Shift to Focus on Espionage - Infosecurity Magazine (infosecurity-magazine.com)

• Managed Service Provider Identifies Potential Chinese Spy Ring - MSSP Alert

• Chinese cyber spies target unpatched SonicWall gear • The Register

• What is Cyberwarfare? | Definition from TechTarget

Nation State Actors

• What can security teams learn from a year of cyber warfare? | Computer Weekly

• New Backdoor MQsTTang Attributed to Mustang Panda Group - Infosecurity Magazine (infosecurity-magazine.com)

• Russia Bans Messengers, Including WhatsApp, Telegram, And More (informationsecuritybuzz.com)

• Russia-Ukraine war: How both sides of the conflict have used crypto to win (cointelegraph.com)

• Chinese Hikvision cameras ‘that pose security threat’ used on King’s Sandringham estate (thetimes.co.uk)

• China-aligned APT is exploring new technology stacks for malicious tools - Help Net Security

• Sharp Panda targets government entities in Southeast Asia- Security Affairs

• Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity (thehackernews.com)

• Russia’s Cyber Tactics in Ukraine Shift to Focus on Espionage - Infosecurity Magazine (infosecurity-magazine.com)

• Managed Service Provider Identifies Potential Chinese Spy Ring - MSSP Alert

• Chinese firm got Covid contract despite trying to hack NHS data, minister says | Politics | The Guardian

• Chinese cyber spies target unpatched SonicWall gear • The Register

• TikTok unveils new European data security regime | Reuters

• Lazarus group infiltrated South Korean finance firm twice last year | CSO Online

• Remcos Trojan Returns to Most Wanted Malware List After Ukraine Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• New Chinese regulatory body expected to streamline data governance rules | CSO Online

---

Vulnerability Management

• Inadequate patches and advisories increase cyber risk - Help Net Security

• Build Cyber Resiliency With These Security Threat-Mitigation Considerations

• Zero Day Threat Protection for Your Network (trendmicro.com)

• 557 CVEs Added to CISA's Known Exploited Vulnerabilities Catalog in 2022 - SecurityWeek

• Machine Learning Improves Prediction of Exploited Vulnerabilities (darkreading.com)

• Security Patch Management Strengthens Ransomware Defense (trendmicro.com)

• VulnCheck: CISA's KEV missing 42 vulnerabilities from 2022 | TechTarget

Vulnerabilities

• TPM 2.0 Library Vulnerabilities May Affect Billions of IoT Devices - Infosecurity Magazine (infosecurity-magazine.com)

• Researchers discover 'kill switch' in Starlink terminals - Security - iTnews

• PoC exploit for recently patched Microsoft Word RCE is public (CVE-2023-21716) - Help Net Security

• CISA's KEV Catalog Updated with 3 New Flaws Threatening IT Management Systems (thehackernews.com)

• Exploitation of Critical Vulnerability in End-of-Life VMware Product Ongoing - SecurityWeek

• Fortinet warns of new critical unauthenticated RCE vulnerability (bleepingcomputer.com)

• Information Disclosure Vulnerability in Adobe Experience Manager affecting multiple companies… | by Fat Selimi | Feb, 2023 | InfoSec Write-ups (infosecwriteups.com)

• Chinese cyber spies target unpatched SonicWall gear • The Register

• Chrome 111 Patches 40 Vulnerabilities - SecurityWeek

• Bitwarden flaw can let hackers steal passwords using iframes (bleepingcomputer.com)

• Veeam warns to install patches to fix a bug in Backup & Replication- Security Affairs

• Hackers Exploiting Remote Desktop Software Flaws to Deploy PlugX Malware (thehackernews.com)

• Vulnerability Exposes Cisco Enterprise Routers to Disruptive Attacks - SecurityWeek

• Jenkins Server Vulnerabilities Chained for Remote Code Execution  - SecurityWeek

---

Tools and Controls

• The LastPass Hack Somehow Gets Worse | WIRED

• 3 Ways Security Teams Can Use IP Data Context (darkreading.com)

• Two-Thirds of European Firms Have Started Zero Trust - Infosecurity Magazine (infosecurity-magazine.com)

• What is zero trust? A model for more effective security | CSO Online

• Too Many SOAR Vendors are Failing MSSPs - MSSP Alert

• Why enterprise SecOps strategies must include XDR and MDR | TechTarget

---

Other News

• Biden Administration's Cyber security Strategy Takes Aim at Hackers (gizmodo.com)

• Tracking device technology: A double-edged sword for CISOs | CSO Online

• From Disinformation to Deep Fakes: How Threat Actors Manipulate Reality (thehackernews.com)

• What CISOs need to understand about document signing - Help Net Security

• Thousands of websites hacked as part of redirection campaign- Security Affairs

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.