Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 13 August 2021
Black Arrow Cyber Threat Briefing 13 August 2021:
-SMBs Increasingly Vulnerable To Ransomware, Despite The Perception They Are Too Small To Target
-440% Increase In Phishing
-Users Can Be Just As Dangerous As Hackers
-With Crime-As-A-Service, Anyone Can Be An Attacker
-Move To Cloud Creating Security Blindspots
-Connected Devices Increasingly At Risk Of Ransomware Attacks
-Ransomware Payments Explode Amid ‘Quadruple Extortion’
-Accenture Hit With $50M Ransomware
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
SMBs Increasingly Vulnerable To Ransomware, Despite The Perception They Are Too Small To Target
A new report this week warns that small and medium-sized businesses (SMBs) are at particular risk based on the attack trends seen during the first six months of the year. The report revealed that during the first half of 2021, 4 out of 5 organisations experienced a cyber security breach originating from a vulnerability in their third-party vendor ecosystem. That’s at a time when the average cost of a data breach rose to around $3.56 million, with the average ransomware payment jumping 33% to more than $100,000.
https://www.helpnetsecurity.com/2021/08/10/smbs-ransomware/
May 2021 Saw A 440% Increase In Phishing, The Single Largest Phishing Spike On Record
In May 2021, a report revealed a 440% increase in phishing, holding the record for the single largest phishing spike in a single month. It also showed that industries such as oil, gas and mining saw a 47% increase in the same six-month period, with manufacturing and wholesale traders seeing a 32% increase. The report extends its yearly threat intelligence report, with updated metrics between January 1 and June 30 2021. It also investigates the latest trends in malware, phishing and crypto exchanges.
https://www.infosecurity-magazine.com/news/may-phishing-increase-webroot/
Users Can Be Just As Dangerous As Hackers
Most organisations should be at least as worried about user management as they are about Bond villain-type hackers launching compromises from abroad. Most organisations have deployed single sign-on and modern identity-management solutions. These generally allow easy on-boarding, user management, and off-boarding. However, on mobile devices, these solutions have been less effective. Examples include mobile applications such as WhatsApp, Signal, Telegram, or even SMS-which are common in the workforce. All these tools allow for low-friction, agile communication in an increasingly mobile business environment. Today, many of these tools offer end-to-end encryption (e2ee), which is a boon when viewed through the lens of protecting against outside attackers. However, e2ee also resists internal governance and compliance programs.
https://thehackernews.com/2021/08/users-can-be-just-as-dangerous-as.html?m=1
With Crime-As-A-Service, Anyone Can Be An Attacker
Crime-as-a-Service (CaaS) is the practice of experienced cybercriminals selling access to the tools and knowledge needed to execute cyber crime – in particular, it’s often used to create phishing attacks. For hackers, phishing is one of the easiest ways to steal your organisation’s data. Traditionally, executing a successful phishing campaign required a seasoned cyber criminal with technical expertise and knowledge of social engineering. However, with the emergence of CaaS, just about anyone can become a master of phishing for a small fee.
https://www.helpnetsecurity.com/2021/08/03/crime-as-a-service/
The Rise Of Cloud Is Creating Security Blindspots
Businesses are growing increasingly reliant on cloud services, but with all the good, businesses must also face the bad, according to a new report which says that the rise of cloud means greater complexity and more security blind spots.
Increased expansion into the cloud has led to new risks. All of the respondents in the report had suffered at least one incident in their public cloud environment in the last year, with 30 percent saying they had no formal sign-off before pushing to production.
https://www.itproportal.com/news/the-rise-of-cloud-is-creating-security-blindspots/
Connected Devices Increasingly At Risk As New Ransomware Attacks Are Reported Almost Daily
A report has been released on the state of connected devices. The 2021 study addresses pandemic-related cyber security challenges, including the growth of connected devices and related increase of security risks from these devices as threat actors took advantage of chaos to launch attacks. The study incorporates security risk and trend analysis of anonymized data for the past 12 months (June 2020 through June 2021) across the company’s 500+ deployments in healthcare, life sciences, retail, and manufacturing verticals. The number of agentless and un-agentable devices increased to 42% in this year’s report (compared to 32% of agentless or un-agentable devices in 2020).
https://www.helpnetsecurity.com/2021/08/12/connected-devices-risks/
The Value Of PII And How It Still Fuels Malign Activities In The Digital Ecosystem
The COVID-19 pandemic engendered new vulnerabilities in the digital ecosystem for threat actors to exploit, resulting in items like vaccines, fraudulent vaccine certificates, and other COVID-19 related items being sold in dark marketplaces and underground forums, an Intelligence report reveals. The research analysed the value of personally identifiable information (PII), drawing links between the breach economy, PII, and a range of emerging digital threats to executives and brands.
https://www.helpnetsecurity.com/2021/08/10/pii-value-digital-ecosystem/
Ransomware Payments Explode Amid ‘Quadruple Extortion’
Two reports slap hard figures on what’s already crystal clear: Ransomware attacks have skyrocketed, and ransomware payments are the comet trails that have followed them skyward. The average ransomware payment spiked 82 percent year over year: It’s now over half a million dollars, according to the first-half 2021 update report. As far as the sheer multitude of attacks goes, researchers on Thursday reported that they’ve identified and analysed 121 ransomware incidents so far in 2021, a 64 percent increase in attacks, year-over-year.
https://threatpost.com/ransomware-payments-quadruple-extortion/168622/
Hackers Netting Average Of Nearly $10,000 For Stolen Network Access
A new report from a cyber security company has spotlighted the thriving market on the dark web for network access that nets cyber criminals thousands of dollars. Researchers have examined network access sales on underground Russian and English-language forums before compiling a study on why criminals sell their network access and how criminals transfer their network access to buyers. More than 37% of all victims in a sample of the data were based in North America while there was an average price of $9,640 and a median price of $3,000.
https://www.zdnet.com/article/hackers-netting-average-of-nearly-10000-for-stolen-network-access/
1M Stolen Credit Cards Hit Dark Web For Free
Threat actors have leaked 1 million stolen credit cards for free online as a way to promote a fairly new and increasingly popular cyber criminal site dedicated to…selling payment-card credentials. Researchers noticed the leak of the payment-card data during a “routine monitoring of cyber crime and Dark Web marketplaces,” researchers said in a post published over the weekend. The cards were published on an underground card-selling market, AllWorld.Cards, and stolen between 2018 and 2019, according to info posted on the forum.
https://threatpost.com/1m-stolen-credit-cards-dark-web/168514/
Ransomware Group Demanding $50M In Accenture Security Breach
The hacker group behind a ransomware attack on global solution provider giant Accenture has made a ransom demand for $50 million, according to a cyber security firm that reports seeing the demand. The threat actor is demanding the $50 million in exchange for more than 6 TB of data, according to a tweet.
Threats
Ransomware
Ransomware Gangs Exploiting Windows Print Spooler Vulnerabilities
Hackers Reportedly Threaten To Leak Data From Gigabyte Ransomware Attack
Synology Warns Of Malware Infecting NAS Devices With Ransomware
Phishing
Other Social Engineering
Malware
Discord Malware Is A Persistent And Growing Threat Warns Sophos
Microsoft Warning: This Unusual Malware Attack Has Just Added Some New Tricks
Experts Shed Light On New Russian Malware-As-A-Service Written In Rust
IISpy: A Complex Server‑Side Backdoor With Anti‑Forensic Features
Mobile
A 5G Shortcut Leaves Phones Exposed to Stingray Surveillance
Beware! New Android Malware Hacks Thousands of Facebook Accounts
IOT
Vulnerabilities
Microsoft Confirms There's Yet Another New Windows Print Spooler Security Bug
Magento Update Released To Fix Critical Flaws Affecting E-Commerce Sites
Organised Crime & Criminal Actors
Attackers Started Exploiting a Router Vulnerability Just 2 Days After Its Disclosure
Hackers Steal $600 Million In Crypto From DeFi Site Poly Network
Dark Web
Supply Chain
DoS/DDoS
Nation State Actors
Cloud
Privacy
Other News
The Challenges Healthcare CISOs Face In An Evolving Threat Landscape
Researchers Develop RISC-V Chip for Quantum-Resistant Encryption
Quantum Computers Could Threaten Blockchain Security. These New Defenses Might Be The Answer
Saving Money By Holding Onto Old Tech Is Costing Us All Billions
Attacks Against Industrial Networks Will Become A Bigger Problem. We Need To Fix Security Now
Kaseya's Universal Revil Decryption Key Leaked On A Hacking Forum
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 29 January 2021
Black Arrow Cyber Threat Briefing 29 January 2021: Phishing Attacks Show High-Ranking Execs ‘Most Valuable Asset’ and ‘Greatest Vulnerability’; Paying Ransomware Funding Organised Crime; Police take down botnet that hacked millions of computers; After SolarWinds Hack, Who Knows What Cyber Dangers We Face; Russian businesses warned of retaliatory cyber attacks; iOS vulns actively exploited; Top Cyber Attacks of 2020
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities and cyber related news from the last week.
Top Cyber Headlines of the Week
Phishing Attacks Show High-Ranking Execs May Be ‘Most Valuable Asset,’ and ‘Greatest Vulnerability’
Cyber criminals have been using a phishing kit featuring fake Office 365 password alerts as a lure to target the credentials of chief executives, business owners and other high-level corporate leaders. The scheme highlights the role and responsibility upper management plays in ensuring the security of their own company’s assets.
Insurers 'Funding Organised Crime' by Paying Ransomware Claims
Insurers are inadvertently funding organised crime by paying out claims from companies who have paid ransoms to regain access to data and systems after a hacking attack, Britain’s former top cybersecurity official has warned.
Emotet: Police raids take down botnet that hacked 'millions of computers worldwide'
Emotet, one of the world's most dangerous cyber crime services, has been taken down following one of the largest ever internationally-coordinated actions against cyber criminals. Although it began as banking malware designed to steal financial credentials, Emotet had become an infrastructure tool leased out to cyber criminals to break into victim computer networks and install additional malicious software.
After the SolarWinds Hack, We Have No Idea What Cyber Dangers We Face
Months before insurgents breached the Capitol and rampaged through the halls of Congress, a stealthier invader was muscling its way into the computers of government officials, stealing documents, monitoring e-mails, and setting traps for future incursions. Last March, a hacking team, believed to be affiliated with Russian intelligence, planted malware in a routine software upgrade from a Texas-based I.T. company called SolarWinds, which provides network-management systems to more than three hundred thousand clients.
FSB warns Russian businesses of cyber attacks as retaliation for SolarWinds hack
Russian authorities are alerting Russian organizations of potential cyberattacks launched by the United States in response to SolarWinds attack. The Russian intelligence agency FSB has issued a security alert this week warning Russian organizations of potential cyberattacks launched by the United States in response to the SolarWinds supply chain attack.
Update your iPhone — Apple just disclosed hackers may have 'actively exploited' a vulnerability in its iOS
On Tuesday released a new iOS software update that includes fixes for three security weaknesses in the former version. Its support website that it is aware of the three security bugs and that they "may have been actively exploited. “Also, it does not disclose details regarding security issues "until an investigation has occurred."
Top Cyber Attacks of 2020
"Zoombomb" became the new photobomb—hackers would gain access to a private meeting or online class hosted on Zoom and shout profanities and racial slurs or flash pornographic images. Nation-state hacker groups mounted attacks against organisations involved in the coronavirus pandemic response, including the World Health Organization and Centres for Disease Control and Prevention, some in an attempt to politicize the pandemic.
https://thehackernews.com/2021/01/top-cyber-attacks-of-2020.html
Threats
Ransomware
Cyber Criminals use deceased staff accounts to spread Nemty ransomware
US and Bulgarian authorities disrupt NetWalker ransomware operation
Former UK Cyber Security Chief Says Laws Are Needed to Stop Ransomware Payouts
BEC
Phishing
Other Social Engineering
Malware
DreamBus botnet targets enterprise apps running on Linux servers
Trickbot is back again - with fresh phishing and malware attacks
Mobile
Vulnerabilities
Heap-based buffer overflow in Linux Sudo allows local users to gain root privileges
Vulnerability found in top messaging apps let hackers eavesdrop
Experts Detail A Recent Remotely Exploitable Windows Vulnerability
Former LulzSec Hacker Releases VPN Exploit Used to Hack Hacking Team
KindleDrip exploit – Hacking a Kindle device with a simple email
Data Breaches
Charities
Insider Threats
Nation-State Actors
Denial of Service
Privacy
Reports Published in the Last Week
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.