Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 19 February 2021
Black Arrow Cyber Threat Briefing 19 February 2021: Masslogger Swipes Outlook & Chrome Credentials; Phishers trick LinkedIn users; Solarwinds Attack ‘Largest And Most Sophisticated Attack’ Ever; Ransomware gangs are running riot, paying them off doesn’t help; Most security bugs in the wild are years old; Hacker Claims Files Stolen from Prominent Law Firm; 100+ Financial Services Firms Targeted in Ransom DDoS Attacks in 2020; 14 million alleged Amazon and eBay account details sold online; Think backups will protect you from ransomware? What do you think gets attacked first?
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities and cyber related news from the last week.
Top Cyber Stories of the Last Week
Masslogger Swipes Microsoft Outlook, Google Chrome Credentials
Cyber Criminals are targeting Windows users with a new variant of the Masslogger trojan, which is spyware designed to swipe victims’ credentials from Microsoft Outlook, Google Chrome and various instant-messenger accounts. Researchers uncovered the campaign targeting users in Italy, Latvia and Turkey starting in mid-January. When the Masslogger variant launched its infection chain, it disguised its malicious RAR files as Compiled HTML (CHM) files. This is a new move for Masslogger, and helps the malware sidestep potential defensive programs, which would otherwise block the email attachment based on its RAR file extension, said researchers on Wednesday.
https://threatpost.com/masslogger-microsoft-outlook-google-chrome/164011/
Phishers tricking users via fake LinkedIn Private Shared Document
The phishing message is delivered via LinkedIn’s internal messaging system and looks like it has been sent by one of the victim’s contacts. The message urges the recipient to follow a third-party link to view a document. If they fail to find this suspicious, they’ll be redirected to a convincingly spoofed LinkedIn login page, and if they enter their login credentials, their account will probably soon be sending out phishing messages to their contacts.
https://www.helpnetsecurity.com/2021/02/18/linkedin-private-shared-document/
Solarwinds Attack Hit 100 Companies And Took Months Of Planning’; ‘Largest And Most Sophisticated Attack’ Ever Seen According To Microsoft; Hackers Downloaded Some Azure, Exchange, And Intune Source Code
A hacking campaign that used a tech company as a springboard to compromise a raft of US government agencies has been called “the largest and most sophisticated attack the world has ever seen”, according to Microsoft. Nine US governmental agencies were breached along with 100 different private sector companies , many of which were technology companies, including products that could be used to launch additional intrusions. Microsoft said it has formally completed its investigation into the SolarWinds-related breach and found no evidence that hackers abused its internal systems or official products to pivot and attack end-users and business customers, though it did state that it had discovered that hackers used the access they gained through the SolarWinds Orion app to pivot to Microsoft's internal network, where they accessed the source code of several internal projects.
https://www.zdnet.com/article/solarwinds-attack-hit-100-companies-and-took-months-of-planning-says-white-house/ https://www.independent.co.uk/news/world/americas/solarwinds-us-russia-hacking-b1802299.html https://www.zdnet.com/article/microsoft-says-solarwinds-hackers-downloaded-some-azure-exchange-and-intune-source-code/
Ransomware gangs are running riot – paying them off doesn’t help
In the past five years, ransomware attacks have evolved from rare misfortunes into common and disruptive threats. Hijacking the IT systems of organisations and forcing them to pay a ransom in order to reclaim them, cyber criminals are freely extorting millions of pounds from companies – and they’re enjoying a remarkably low risk of arrest as they do it.
https://theconversation.com/ransomware-gangs-are-running-riot-paying-them-off-doesnt-help-155254
Most security bugs in the wild are years old
Most vulnerabilities exploited in the wild are years old and some could be remedied easily with a readily available patch. This is one of the findings of a new report, which states that two thirds (65 percent) of CVEs found in 2020 were more than three years old, while a third of those (32 percent) were originally identified in 2015 or earlier.
https://www.itproportal.com/news/most-security-bugs-in-the-wild-are-multiple-years-old/
Hacker Claims to Have Stolen Files Belonging to Prominent Law Firm Jones Day
A hacker claims to have stolen files belonging to the global law firm Jones Day and posted many of them on the dark web. Jones Day has many prominent clients, including former President Donald Trump and major corporations. Jones Day, in a statement, disputed that its network has been breached. The statement said that a file-sharing company that it has used was recently compromised and had information taken. Jones Day said it continues to investigate the breach and will continue to be in discussion with affected clients and appropriate authorities.
Former Spy Chief Calls For Military Cyber Attacks On Ransomware Hackers
The state should launch military cyber attacks to shut down ransomware gangs that have extorted millions of pounds from British businesses, a former spy chief has said.
Ciaran Martin, who previously led the UK’s National Cyber Security Centre, said the problem of criminal gangs locking and stealing files has become so serious that Government should now seek to disrupt the operations of prolific criminals.
The plans would mark a major change of tack for the UK authorities, who have long downplayed the idea they could routinely use offensive hacking as well as cyber defence.
Think your backups will protect you from ransomware? What do you think the malware attacked first?
If you think your backup strategy means you’re protected from the worst that cyber criminals can throw at you, we’ve got some bad news. Ransomware creators know all about backups, too. So, if you are unlucky enough to get a “pay up or else” notice, there’s a very good chance that the attacker in question has already been stealthily working their way through your systems for some time, ensuring your recovery data has already been comprehensively trashed.
https://www.theregister.com/2021/02/17/protect_yourself_from_ransomware_webcast/
100+ Financial Services Firms Targeted in Ransom DDoS Attacks in 2020
More than 100 financial services firms across multiple countries were targeted in a wave of ransom distributed denial-of-service (DDoS) attacks conducted by the same threat actor in 2020. The attacks moved in methodical fashion across Europe, North America, Latin America, and Asia, hitting dozens of organizations in the financial sector in each region, the Financial Services Information Sharing and Analysis Center (FS-ISAC) disclosed this week. Among those targeted were banks, exchanges, payments companies, card issuers, payroll companies, insurance firms, and money transfer services.
14 million alleged Amazon and eBay account details sold online
An unknown user was offering the data of 14 million Amazon and eBay customers’ accounts for sale on a popular hacking forum. The data appears to come from users who had Amazon or eBay accounts from 2014-2021 in 18 different countries. The database was being sold for $800 and the accounts are divided into their respective countries. The leaked data includes the customer’s full name, postal code, delivery address, and shop name, as well 1.6 million phone records.
https://cybernews.com/security/14-million-amazon-and-ebay-accounts-sold-online-in-new-leak/
Threats
Ransomware
BEC
Phishing
This phishing email promises you a bonus - but actually delivers this Windows trojan malware
How Hackers use Phishing to Hijack Sites through Hosting Provider
Malware
Windows and Linux servers targeted by new WatchDog botnet for almost two years
TrickBot's BazarBackdoor malware is now coded in Nim to evade antivirus
Mobile
IOT
Vulnerabilities
WordPress plugin exploit puts more than one million sites at risk
Bug in shared SDK can let attackers join calls undetected across multiple apps
Malvertisers Exploited WebKit 0-Day to Redirect Browser Users to Scam Sites
Microsoft Pulls Bad Windows Update After Patch Tuesday Headaches
Telegram privacy feature failed to delete self-destructing video files
Data Breaches
Organised Crime
Insider Threats
Supply Chain
OT, ICS, IIoT and SCADA
Nation-State Actors
Russian state hackers targeted Centreon servers in years-long campaign
Feds Indict North Korean Hackers for Years of Heists and Scams
MPs sign up to Clubhouse app despite Chinese security concerns
Privacy
Reports Published in the Last Week
Other News
Most businesses plan to move away from VPNs, adopt a zero-trust access model
20 Common Tools & Techniques Used by macOS Threat Actors & Malware
Discord is fast becoming a favourite tool among cyber criminals
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 25 December 2020
Black Arrow Cyber Threat Briefing 25 December 2020: The Cyber Threat Is Real and Growing; Ransomware Attacks Surge in Q3; In 2021 there will be a cyber attack every 11 seconds; The West has suffered a massive cyber breach and it's hard to overstate how bad it is; Big tech companies including Intel, Nvidia, and Cisco were all infected during the SolarWinds hack
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities and cyber related news from the last week.
Top Cyber Headlines of the Week
The Cyber Threat Is Real and Growing
The SolarWinds breach could be one of the most significant cyber incidents in history. Russian intelligence—likely the SVR, the foreign-intelligence branch—infiltrated and sat undetected on U.S. and other government networks for nearly 10 months. It was a sophisticated, smart and savvy attack that should alarm the public and private sectors.
We may not know the full extent of the damage for some time. Don’t be surprised if more government entities disclose that they too were victims of this attack. Don’t be surprised either if it emerges that private companies were hit. SolarWinds says it has more than 300,000 customers, including 400 companies in the Fortune 500. That’s a lot of potential victims.
https://www.wsj.com/articles/the-cyber-threat-is-real-and-growing-11608484291
Ransomware Attacks Surge in Q3 as Cyber Criminals Shift Tactics
A record growth in ransomware attacks took place in Q3 of 2020 compared to Q2, from 39% to 51% of all malware attempts according to a new study. The study also found that hacking accounted for 30% of all attacks during Q3, with cyber criminals reducing their emphasis on social engineering tactics compared with earlier this year. The researchers noted that the percentage of social engineering attacks using COVID-19 as a lure fell from 16% in Q2 to just 4% in Q3, which they attribute to people becoming more accustomed to this crisis. Additionally, social engineering attacks targeting organizations fell from 67% of all attempts in Q1 to under half (45%) in Q3.
https://www.infosecurity-magazine.com/news/ransomware-attacks-surge-q3/
In 2021, there will be a cyber attack every 11 seconds. Here’s how to protect yourself
Experienced outdoor athletes know that with winter rapidly approaching, the secret to success lies in protecting the core. That is, the body’s core temperature through layering, wicking and a host of ever-improving technical fabrics that prevent the cold, snow and ice from affecting performance. The same could be said for cyber security. With organizations and workers now in their ninth month of COVID-19, the time has come to prepare as the threat of cyber attacks becomes even more menacing.
The US, and much of the West, has suffered a massive cyber breach. It's hard to overstate how bad it is
Recent news articles have all been talking about the massive Russian cyber-attack against the United States, but that’s wrong on two accounts. It wasn’t a cyber-attack in international relations terms, it was espionage. And the victim wasn’t just the US, it was the entire world. But it was massive, and it is dangerous.
Espionage is internationally allowed in peacetime. The problem is that both espionage and cyber-attacks require the same computer and network intrusions, and the difference is only a few keystrokes. And since this Russian operation isn’t at all targeted, the entire world is at risk – and not just from Russia. Many countries carry out these sorts of operations, none more extensively than the US. The solution is to prioritize security and defense over espionage and attack.
https://www.theguardian.com/commentisfree/2020/dec/23/cyber-attack-us-security-protocols
Big tech companies including Intel, Nvidia, and Cisco were all infected during the SolarWinds hack
Last week, news broke that IT management company SolarWinds had been hacked, possibly by the Russian government, and the US Treasury, Commerce, State, Energy, and Homeland Security departments have been affected — two of which may have had emails stolen as a result of the hack. Other government agencies and many companies are investigating due to SolarWinds’ extensive client list. The Wall Street Journal is now reporting that some big tech companies have been infected, too.
Cisco, Intel, Nvidia, Belkin, and VMware have all had computers on their networks infected with the malware. There could be far more: SolarWinds had stated that “fewer than 18,000” companies were impacted, as if that number is supposed to be reassuring, and it even attempted to hide the list of clients who used the infected software. Today’s news takes some of SolarWinds’ big-name clients from “possibly affected’’ to “confirmed affected.”
https://www.theverge.com/2020/12/21/22194183/intel-nvidia-cisco-government-infected-solarwinds-hack
Researchers share the lists of victims of SolarWinds hack
Security experts started analyzing the DGA mechanism used by threat actors behind the SolarWinds hack to control the Sunburst/Solarigate backdoor and published the list of targeted organizations. Researchers from multiple cybersecurity firms published a list that contains major companies, including Cisco, Deloitte, Intel, Mediatek, and Nvidia. The researchers decoded the DGA algorithm used by the backdoor to assign a subdomain of the C2 for each of the compromised organizations.
https://securityaffairs.co/wordpress/112555/hacking/solarwinds-victims-lists.html
Threats
Ransomware
Ransomware: Attacks could be about to get even more dangerous and disruptive
IOT
New Critical Flaws in Treck TCP/IP Stack Affect Millions of IoT Devices
Malware
Emotet Returns to Hit 100K Mailboxes Per Day
Microsoft has discovered yet more SolarWinds malware
3 million users hit with infected Google Chrome and Microsoft Edge extensions
Vulnerabilities
Windows zero-day with bad patch gets new public exploit code
Script for detecting vulnerable TCP/IP stacks released
New SUPERNOVA backdoor found in SolarWinds cyberattack analysis
Smart Doorbell Disaster: Many Brands Vulnerable to Attack
Zero-day exploit used to hack iPhones of Al Jazeera employees
Signal: Cellebrite claimed to have 'cracked' chat app's encryption
Data Breaches
There's been a Nintendo Switch data leak, according to reports
Data breach hits 30,000 signed up to workplace pensions provider
Thousands of customer records exposed after serious data breach
Organised Crime
Cyber criminals have started indexing the dark web
Joker’s Stash Carding Site Taken Down
International sting shuts down 'favourite' VPN of cyber criminals
Dark Web Pricing Skyrockets for Microsoft RDP Servers, Payment-Card Data
NSA Warns of Hacking Tactics That Target Cloud Resources
Denial of Service
Cloudflare has identified a new type of DDoS attack inspired by an acoustic beat
Privacy
The pandemic has taken surveillance of workers to the next level
Other News
Dozens of Al Jazeera journalists allegedly hacked using Israeli firm's spyware
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.