Black Arrow Cyber Threat Briefing 22 December 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Majority of 2023’s Critical Cyber Attacks Stemmed from Fewer Than 1% of Vulnerabilities, with 1 in 4 High Risk Vulnerabilities Exploited Within 24 Hours of Going Public

A new Qualys report reveals that less than 1% of vulnerabilities are responsible for the greatest damage, and a quarter of high-risk vulnerabilities are now being exploited within a day of disclosure. In 2023, a record-breaking 26,000 vulnerabilities have been identified so far, emphasising the need for organisations to accelerate their response times. High-risk vulnerabilities, particularly in network devices and web applications, are the main targets for attackers seeking unauthorised access or privilege escalation. This situation underscores the critical need for organisations to implement a multi-layered defence strategy, automate patching where appropriate especially in areas of critical infrastructure, and adopt zero-trust principles to safeguard against such swift and potent cyber threats.

Sources: [SiliconANGLE] [SC Media]

Ransomware Gangs Are Increasingly Turning to Remote Access Tools for Attacks, As UK Honeypots Attacked 17 million Times Per Day

Nearly three quarters of cyber-attacks across the UK in 2023 targeted technology frequently used for remote working, new data from Coalition has revealed.

Attackers frequently target Remote Desktop Protocol (RDP), a tool that lets users access office computers from home, as it grants the attacker quick access to devices and allows them to execute further attacks.

Honeypot sensors maintained by Coalition have recorded 5.8 billion attacks so far in 2023, averaging around 17 million attacks per day. Of these it was found that 76% of attacks targeted RDP.

Attackers exploit RDP vulnerabilities that often stem from simple configuration mistakes. By taking steps like disabling unnecessary remote access or tightening controls, companies can help shield themselves from these pervasive threats.

Sources: [Insurance Times] [TechRadar] [Infosecurity Magazine]

Why Employees Are a Bigger Security Risk than Hackers

In today's interconnected world, the spotlight is often on cyber criminals attacking from outside, but a worrying trend points inward. A recent study by Imperva reveals that insiders pose a significant threat, being behind 58% of security incidents. The incidents are a mixture of deliberate misuse and accidents, however the majority of organisations lack a strategy to combat these risks. Even when strategies exist, they may be undermined by employees bypassing IT protocols or due to the pressures of adapting to new technologies. With insider incidents on the rise by 47% in two years, the costs are too great to ignore.

Source: [Raconteur]

77% of Financial Services Firms Detected a Cyber Attack in the Last Year, as Finance and Healthcare Continue to Suffer the Most Cyber Attacks

Cyber attacks are more prevalent in the financial services sector than in any other industry. Last year, 77% of financial institutions were targeted, primarily through phishing and ransomware attacks. After financial services the second most targeted sector is healthcare. Both types of institutions are attractive targets not only because of their wealth of sensitive data but also because disruptions to their operations can lead to substantial ransom payments. They face increasingly sophisticated threats and the financial impact is significant, with approximately a quarter of these institutions estimating damages of at least $50,000. To mitigate these risks organisations are turning to cyber insurance, which necessitates further tightening of security practices, including identity and access management, to meet insurers’ stringent standards.

The healthcare sector reported over 179,000 cyber attacks in a single quarter, affecting entities globally. The primary threats were infostealers and ransomware. There have been scores of notable incidents where hospitals have been shut down or otherwise unable to operate. In many cases, this resulted in closing emergency departments, interfering with planned or emergency surgeries and forcing ambulances to divert to other hospitals, potentially causing life threatening delays. Further, a recent report analysing the enterprise risk management for the financial sector found that the two biggest concerns were rising interest rates at 74% and ransomware attacks at 65%.

Sources: [Security Magazine] [MSSP Alert] [PR NewsWire] [Security Magazine]

New Report Data Shows 75% Increase in Suspicious Emails Hitting Inboxes

A new report has unveiled the escalating threat posed by phishing emails, as detected by DMARC software. In the past year, there's been a 70% rise in emails flagged as fraudulent, with almost 18% of total email traffic in the first half of 2023 being intercepted as potential phishing attempts. This surge underscores a pressing need for robust email security measures. Simple yet effective tools like DMARC, which automatically weeds out emails impersonating legitimate domains, are becoming critical in the fight against these sophisticated scams. With the average cost of a cyber attack now well into the millions, and given the high click rates on phishing emails, it is clear that taking proactive steps to strengthen an organisations digital defence is not just sensible, it is essential for safeguarding the businesses in the digital age.

Source: [Dark Reading]

Threat Actors Still Exploiting Old Unpatched Vulnerabilities

A report by Cisco has found that the most targeted vulnerabilities this year, same as previous years, were old unpatched vulnerabilities which should have been fixed a long time ago. Some of these security gaps in widely-used applications like Microsoft Office and or within versions of Windows itself are over a decade old. Unpatched vulnerabilities can leave systems open to exploitation, potentially leading to unauthorised access, data breaches, and widespread security incidents, including being a key enabler of ransomware attacks. This highlights an urgent call to action for organisations to patch known vulnerabilities and secure user accounts to fortify their defences against cyber threats.

Source: [IT Business]

Many Organisations Still Lack Formal Cyber Security Training

As we navigate into 2024, a new report by the SANS Institute found that more than 30% of organisations do not regularly perform cyber readiness exercises, while 40% have yet to establish formal training for cyber security. These findings underline a gap between the need for robust security measures and actual preparedness. On a positive note, most organisations are adopting frameworks like the NIST CSF to shape their security posture, and two-thirds are actively using metrics to gauge the effectiveness of their security operations. Yet, there’s a call to action here: for real progress, intentional investment and commitment to comprehensive training and stringent security operations are non-negotiable. This is the path to mature security operations that can withstand the complexities of today’s cyber threats.

Source: [Security Brief]

Addressing the Growing Threat of Supply Chain Cyber Attacks

As businesses become more interconnected through digital supply chains, supply chain cyber attacks are becoming more of a pressing issue for organisations. The attackers tend to exploit weaknesses in third-party suppliers, often with less guarded entry points, to access larger networks. With companies increasingly outsourcing and using cloud adoption, the need for stringent third-party cyber risk assessments is vital. However, complexities arise with the shared responsibility model for cloud security, where setting out the division of security duties between cloud service providers and clients can blur lines of defence. To tackle these challenges, integration of cyber security into procurement and supply chain processes is essential. This means enforcing collaboration between procurement and cyber security teams, mandating security standards in vendor contracts, and utilising automated tools for continuous risk assessments. Safeguarding modern supply chains is no longer a siloed task but a strategic, organisation wide imperative.

Source: [HackerNoon]

Cyber Incident Costs Surge 11% as Budgets Remain Muted

A new report found an 11% jump in the direct costs of a significant cyber incident, now averaging $1.7 million. The burden is even heavier for those without cyber insurance, with costs escalating to $2.7 million per incident. Cyber risks like fraud, third-party breaches, and data theft remain prevalent. Despite these increasing threats, cyber security budgets have grown modestly and are not keeping pace with the increased level of threat. The report also highlights a concerning gap in understanding cyber threats and a lack of internal training, emphasising the critical need for not just financial investment, but also a deeper engagement with cyber security training and awareness within organisations.

Source: [Infosecurity Magazine]

Attacks on Critical Infrastructure are Harbingers of War: Are We Prepared?

The escalating cyber threats against critical infrastructure, like recent attacks on water authorities, highlight an urgent security concern. These attacks, which are often state-sponsored, are not just targeting financial or data assets but are striking at essential services vital to human survival. The tactics used in these attacks, known as Intelligence Preparation of the Battlefield (IPB), are aimed at weakening a nation by disrupting services like power and water, key to both civil stability and military operations. Nations like Russia, China, and Iran employ these strategies for different purposes, ranging from strategic military advantages to ideological victories. The use of ransomware, as seen in the increasing incidents reported by the FBI, is a tool for both financial gain and geopolitical disruption. As we face these multifaceted threats, the need for robust cyber security measures to protect our critical infrastructure has never been more pressing. It is a call to action for nations and organisations alike to fortify their defences against these evolving and serious cyber threats.

Source: [SC Media]

UK Data Centres to be Classed as Critical Infrastructure Under New Gov Proposals

The UK government is considering new regulations aimed at enhancing the security and resilience of data centres. The Department for Science, Innovation and Technology (DSIT) recognises the vital role of these data hubs and is examining the adequacy of current safety practices. With the identification of varying levels of security across the sector, the prospect of legislating minimum security standards is on the table. This may include establishing a regulatory body to oversee incident reporting and risk mitigation strategies, particularly for third-party service providers. These measures underscore the government's commitment to safeguarding data centres, which are increasingly integral to the UK's economic vitality and national security. As part of a broader initiative, the sector could be designated as critical national infrastructure, aligning it with international best practices and ensuring comprehensive protection from cyber threats and other risks.

Source: [ITPro]

Data Exfiltration and Extortion is the New Ransomware Threat, as 65% of Organisations Say Ransomware Concerns Impact Risk Management

Cyber criminals are escalating their tactics and becoming more aggressive in their effort to maximise disruption and compel the payment of ransom demands. Earlier this year, the ransomware group ALPHV exploited the new US data breach disclosure rules by filing a complaint with the US Securities and Exchange Commission (SEC) against a victim company for not reporting an alleged significant data breach. This marks a strategic evolution from traditional ransomware attacks, where data is encrypted and held hostage, to more nuanced extortion schemes. Such tactics are becoming more sophisticated, with triple extortion attacks threatening not just the target company but also their partners and clients. This shift from encryption to pure extortion requires a fresh understanding of cyber threats and a re-evaluation of defence strategies. It highlights the urgent need for businesses to protect not just their own data but also to consider the security of their entire data supply chain.

Source: [TechCrunch]

---

Governance, Risk and Compliance

• Cyber Incident Costs Surge 11% as Budgets Remain Muted - Infosecurity Magazine (infosecurity-magazine.com)

• Three Tech Budget Implementations To Help Optimize Your Resources (forbes.com)

• New Report: 85% Firms Face Cyber Incidents, 11% From Shadow IT - Infosecurity Magazine (infosecurity-magazine.com)

• 65% of organisations say ransomware concerns impact risk management | Security Magazine

• Healthcare and Finance Suffer Most Cyber Attacks | MSSP Alert

• CFOs are under the gun as the SEC's new 4-day data breach disclosure window goes into effect | Fortune

• SEC vs SolarWinds: A cyber security game changer for CISOs (securitybrief.co.nz)

• 77% of financial organisations detected a cyber attack in the last year | Security Magazine

• Level of cyber security: the new key indicator of a company's performance | TechRadar

• Managing cyber security risk during challenging economic times (techinformed.com)

• Many organisations still lack formal IT security training in 2024 (securitybrief.co.nz)

• The year in cyber security: 6 stories to read from 2023 | World Economic Forum (weforum.org)

• After-Incident Reports Turn Breaches Into Security Blueprints (pymnts.com)

• What's the Best Way to Communicate After a Data Breach? (darkreading.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Why extortion is the new ransomware threat | TechCrunch

• 65% of organisations say ransomware concerns impact risk management | Security Magazine

• FBI: ALPHV ransomware raked in $300 million from over 1,000 victims (bleepingcomputer.com)

• Ransomware attacks hit new record in November :: Insurance Day

• Ransomware attacks on the rise in the UK (itsecuritywire.com)

• UK at High Risk of ‘Catastrophic’ Cyber Attack Affecting Critical Infrastructure: Report (insurancejournal.com)

• Ransomware surges, despite aggressive defences | SC Media (scmagazine.com)

• BlackCat Strikes Back: Ransomware Gang “Unseizes” Website, Vows No Limits on Targets - Security Week

• A Major Ransomware Takedown Suffers a Strange Setback | WIRED

• Double-Extortion Play Ransomware Strikes 300 Organisations Worldwide (thehackernews.com)

• Ransomware trends and recovery strategies companies should know - Help Net Security

• Ransomware Attacks in November Rise 67% From 2022 (darkreading.com)

• 10 of the biggest ransomware attacks in 2023 | TechTarget

• BianLian, White Rabbit, and Mario Ransomware Gangs Spotted in a Joint Campaign (securityaffairs.com)

• ALPHV Second Most Prominent Ransomware Strain Before Reported Downtime - Infosecurity Magazine (infosecurity-magazine.com)

• CISA releases Play ransomware guidelines | Security Magazine

• US and Australia Warn of Play Ransomware Threat - Infosecurity Magazine (infosecurity-magazine.com)

• Devices (and ransomware) are everywhere: How endpoint security must adapt | SC Media (scmagazine.com)

• Behind the Scenes of Matveev's Ransomware Empire: Tactics and Team (thehackernews.com)

• Ransomware gangs are increasingly turning to remote encryption, and that's a huge problem | TechRadar

• FBI Develops Decryption Tool That Could Tackle Casino Attacks (sbcamericas.com)

Ransomware Victims

• Homebuyers stress as thousands of house purchases frozen by cyber attack - Property Industry Eye

• Ransomware gang behind threats to Fred Hutch cancer patients (bleepingcomputer.com)

• Delta Dental of California data breach exposed info of 7 million people (bleepingcomputer.com)

• Seattle cancer centre confirms cyber attack after ransomware gang threats (therecord.media)

• France International Schools Agency Impacted by Ransomware Hack - Bloomberg

• MOVEit Vulnerability Hits Delta Dental: 7 Million Records Exposed - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber Attack Slams The North Face and Vans Owner, Shares Plunge - The Messenger

• Mr Cooper now says 15M people's data exposed in cyber attack • The Register

• MongoDB shares fall on cyber security incident By Investing.com

• 2.7M medical records exposed in double-extortion ransomware attack | SC Media (scmagazine.com)

• Nearly 3 million affected by ransomware attack on medical software firm (therecord.media)

• Title insurance giant First American offline after cyber attack (bleepingcomputer.com)

• St Vincent’s Health Australia says data stolen in cyber attack (yahoo.com)

• Kansas City-area hospital transfers patients, reschedules appointments after cyber attack (therecord.media)

• Ransomware cyber attack hits Milton Town School District (databreaches.net)

• The ransomware attack on Westpole is disrupting digital services for Italian public administration (securityaffairs.com)

Phishing & Email Based Attacks

• Generative AI is making phishing attacks more dangerous | TechTarget

• New DMARC Data Shows 75% Increase in Suspicious Emails Hitting Inboxes (darkreading.com)

• Anatomy of a Phishing Attack: How Hackers Trick You - Techopedia

• Qakbot is back and targets the Hospitality industry (securityaffairs.com)

• SMTP Smuggling Allows Spoofed Emails to Bypass Authentication Protocols - Security Week

• Fake F5 BIG-IP zero-day warning emails push data wipers (bleepingcomputer.com)

• New phishing attack steals your Instagram backup codes to bypass 2FA (bleepingcomputer.com)

• Cyber espionage group Cloud Atlas targets Russian companies with war-related phishing attacks (therecord.media)

Artificial Intelligence

• Generative AI is making phishing attacks more dangerous | TechTarget

• AI’s efficacy is constrained in cyber security, but limitless in cyber crime - Help Net Security

• 'Unintended harms' of generative AI are national security risk to UK (techmonitor.ai)

• Unequal Risk, Unequal Reward: How Gen AI disproportionately harms countries (ox.ac.uk)

• Anonymous Sudan hacking group pledges to keep targeting OpenAI's ChatGPT (axios.com)

• Security Researchers: ChatGPT Vulnerability Allows Training Data to be Accessed by Telling Chatbot to Endlessly Repeat a Word - CPO Magazine

• AI in Cyber Security: It's All About Being Aware (inforisktoday.com)

• How AI is weaponized for cyber attacks (betanews.com)

• Why 'dark AI' is a top cyber security concern for 2024 | Pension Times

• The cyber security arms race: AI vs. AI | TechRadar

• How AI Is Shaping the Future of Cyber Crime (darkreading.com)

• 4 ways CISOs can manage AI use in the enterprise | CIO

2FA/MFA

• New phishing attack steals your Instagram backup codes to bypass 2FA (bleepingcomputer.com)

Malware

• New KV-Botnet Targeting Cisco, DrayTek, and Fortinet Devices for Stealthy Attacks (thehackernews.com)

• Rhadamanthys Malware: Swiss Army Knife of Information Stealers Emerges (thehackernews.com)

• Hackers Exploiting Old MS Excel Vulnerability to Spread Agent Tesla Malware (thehackernews.com)

• Windows and macOS targeted by new Go-based malware | TechRadar

• QNAP VioStor NVR vulnerability actively exploited by malware botnet (bleepingcomputer.com)

• Over 10K downloads amassed by malicious PyPi packages | SC Media (scmagazine.com)

• Info stealers and how to protect against them (securityaffairs.com)

• 8220 Gang Exploiting Oracle WebLogic Server Vulnerability to Spread Malware (thehackernews.com)

• Qakbot is back and targets the Hospitality industry (securityaffairs.com)

• Qakbot Sightings Confirm Law Enforcement Takedown Was Only a Setback (darkreading.com)

• Hospitality Industry Faces New Password-Stealing Malware - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber criminals target hotel staff for management credentials • The Register

• BattleRoyal Cluster Signals DarkGate Surge - Infosecurity Magazine (infosecurity-magazine.com)

• Scam 'missed parcel' SMS messages: advice on avoiding malware - NCSC.GOV.UK

• 3 Ways to Use Real-Time Intelligence to Defeat Bots (darkreading.com)

• Microsoft: Hackers target defence firms with new FalseFont malware (bleepingcomputer.com)

• Hospitality sector subjected to new malware attacks | SC Media (scmagazine.com)

Mobile

• iOS 17.2 update puts an end to Flipper Zero's iPhone shenanigans | ZDNET

• The 5G risk: How to protect your smartphone from emerging security threats - PhoneArena

• Apple rolls out iOS 17.2.1 with bugfixes and minor improvements - Neowin

• What is spyware and what can you do to stay protected? - Amnesty International

• NSO Group May Be On Its Way Out But There’s No Shortage Of Competitors To Take Its Place | Techdirt

• Suspects can refuse to provide phone passcodes to police, court rules | Ars Technica

Internet of Things – IoT

• IoT security strategy: an arms race for businesses | ITPro

• Porsche To Kill ICE-Powered Macan In Europe Over Cyber Security Laws | Carscoops

• Cyber security and car thefts: how are car makers responding? | CAR Magazine

• Marketer sparks panic with claims it uses smart devices to eavesdrop on people | Ars Technica

• Marketing firm admits it listens to conversations to sell targeted ads (searchengineland.com)

Data Breaches/Leaks

• Data of over a million users of the crypto exchange GokuMarket exposed (securityaffairs.com)

• MongoDB says customer data was exposed in a cyber attack (bleepingcomputer.com)

• Mr Cooper now says 15M people's data exposed in cyber attack • The Register

• Wolverine-developer Insomniac Games sees 1.67TB of secrets leaked in data breach | Ars Technica

• Everything Hackers Just Revealed in Sony Insomniac Games Leak (tech.co)

• Comcast says hackers stole data of close to 36 million Xfinity customers | TechCrunch

• BMW dealer at risk of takeover by cyber criminals - Security Affairs

• Celebrities Found in Unprotected Real Estate Database Exposing 1.5 Billion Records - Security Week

• Data leak exposes users of car-sharing service Blink Mobility (securityaffairs.com)

• Hacked security cam footage from bedrooms, dressing rooms, spas found to be on sale on Telegram group - NotebookCheck.net News

Organised Crime & Criminal Actors

• Ex-Amazon engineer pleads guilty to hacking crypto exchanges (bleepingcomputer.com)

• How Microsoft’s cyber crime unit has evolved to combat increased threats | Ars Technica

• Gang charged with running $80 million "pig butchering" cryptocurrency investment scam (bitdefender.com)

• Microsoft’s Digital Crime Unit Goes Deep on How It Disrupts Cyber Crime | WIRED

• German police takes down Kingdom Market cyber crime marketplace (bleepingcomputer.com)

• INTERPOL celebrates huge cyber crime Christmas present (emergingrisks.co.uk)

• Law enforcement Operation HAECHI IV led to the seizure of $300 Million (securityaffairs.com)

• Two arrested as police investigate Birmingham dark web drugs trade - Birmingham Live (birminghammail.co.uk)

• NSA Blocked 10 Billion Connections to Malicious and Suspicious Domains - Security Week

• BattleRoyal Cluster Signals DarkGate Surge - Infosecurity Magazine (infosecurity-magazine.com)

• Intelligence Researchers to Study Computer Code for Clues to Hackers’ Identities - WSJ

• Dark web marketplace Kingdom Market dismantled | SC Media (scmagazine.com)

• Lapsus$ teen sentenced to indefinite detention in hospital • The Register

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Data of over a million users of the crypto exchange GokuMarket exposed (securityaffairs.com)

• Ex-Amazon engineer pleads guilty to hacking crypto exchanges (bleepingcomputer.com)

• Gang charged with running $80 million "pig butchering" cryptocurrency investment scam (bitdefender.com)

• DeFi’s billion-dollar secret: The insiders responsible for hacks – Cointelegraph Magazine

• Crypto scammers abuse Twitter ‘feature’ to impersonate high-profile accounts (bleepingcomputer.com)

• Crypto drainer steals $59 million from 63k people in Twitter ad push (bleepingcomputer.com)

Insider Risk and Insider Threats

• Insider threats: why employees are a bigger risk than hackers (raconteur.net)

• Former IT manager pleads guilty to attacking high school network (bleepingcomputer.com)

• DeFi’s billion-dollar secret: The insiders responsible for hacks – Cointelegraph Magazine

Insurance

• Mandatory protections, higher premiums and continued growth -- cyber insurance predictions for 2024 (betanews.com)

• Uninsured firms incur 69% higher cyber incident costs - CIR Magazine

Supply Chain and Third Parties

• What is supply chain risk management (SCRM)? | Definition by TechTarget

• Addressing the Growing Threat of Supply Chain Cyber Attacks | HackerNoon

• Homebuyers stress as thousands of house purchases frozen by cyber attack - Property Industry Eye

• Supply chain emerges as major vector in escalating automotive cyber attacks - Help Net Security

• Adapting to the Post-SolarWinds Era: Supply Chain Security in 2024 (darkreading.com)

Cloud/SaaS

• Most cloud transformations are stuck in the middle - Help Net Security

• IoT security strategy: an arms race for businesses | ITPro

• Millions of Microsoft Accounts Power Lattice of Automated Cyber Attacks (darkreading.com)

• Box cloud storage down amid 'critical' outage (bleepingcomputer.com)

Encryption

• Zscaler ThreatLabz Finds Most Cyber Attacks Hide (itsecuritywire.com)

• 86% of cyber attacks are delivered over encrypted channels - Help Net Security

• SSH protects the world’s most sensitive networks. It just got a lot weaker | Ars Technica

Passwords, Credential Stuffing & Brute Force Attacks

• The password attacks of 2023: Lessons learned and next steps (bleepingcomputer.com)

• CISA urges vendors to get rid of default passwords | CyberScoop

• BMW dealer at risk of takeover by cyber criminals - Security Affairs

• Hospitality Industry Faces New Password-Stealing Malware - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber criminals target hotel staff for management credentials • The Register

Social Media

• Social media platform X back up after global outage | Reuters

• Crypto scammers abuse Twitter ‘feature’ to impersonate high-profile accounts (bleepingcomputer.com)

• Crypto drainer steals $59 million from 63k people in Twitter ad push (bleepingcomputer.com)

• New phishing attack steals your Instagram backup codes to bypass 2FA (bleepingcomputer.com)

Malvertising

• Malvertising has been out of control in 2023, and Google needs to do more to stop it | ITPro

Training, Education and Awareness

• Are We Ready to Give Up on Security Awareness Training? (thehackernews.com)

• Many organisations still lack formal IT security training in 2024 (securitybrief.co.nz)

Regulations, Fines and Legislation

• CFOs are under the gun as the SEC's new 4-day data breach disclosure window goes into effect | Fortune

• SEC vs. SolarWinds: A cyber security game changer for CISOs (securitybrief.co.nz)

• Porsche To Kill ICE-Powered Macan In Europe Over Cyber Security Laws | Carscoops

• UK data centres to be classed as critical infrastructure under new gov proposals | ITPro

• Clock Starts on SEC Cyber Attack Rules: What CISOs Should Know (informationweek.com)

• SEC disclosure rule for ‘material’ cyber security incidents goes into effect | CyberScoop

• What Do CISOs Have to Do to Meet New SEC Regulations? (darkreading.com)

• EU agrees amendments to Cyber Solidarity Act in bid to create ‘cyber shield’ for member states | ITPro

• Rules targeting financial criminals will require new filings for startups and small businesses – GeekWire

• A quiet cyber security revolution is touching every corner of the economy as US, allies ‘pull all the levers’ to face new threats | Fortune

Models, Frameworks and Standards

• Cyber Security Frameworks: A Guide for MSSPs | MSSP Alert

• SANS Institute Research Shows the Frameworks Organisations Use (darkreading.com)

Careers, Working in Cyber and Information Security

• How cyber security roles are changing and what to look for when hiring | CSO Online

Law Enforcement Action and Take Downs

• BlackCat Strikes Back: Ransomware Gang “Unseizes” Website, Vows No Limits on Targets - Security Week

• A Major Ransomware Takedown Suffers a Strange Setback | WIRED

• US law enforcement seizes BlackCat ransomware site, distributes decryption key (axios.com)

• Ex-Amazon engineer pleads guilty to hacking crypto exchanges (bleepingcomputer.com)

• How Microsoft’s cyber crime unit has evolved to combat increased threats | Ars Technica

• Gang charged with running $80 million "pig butchering" cryptocurrency investment scam (bitdefender.com)

• Former IT manager pleads guilty to attacking high school network (bleepingcomputer.com)

• Microsoft’s Digital Crime Unit Goes Deep on How It Disrupts Cyber Crime | WIRED

• German police takes down Kingdom Market cyber crime marketplace (bleepingcomputer.com)

• Law enforcement Operation HAECHI IV led to the seizure of $300 Million (securityaffairs.com)

• Two arrested as police investigate Birmingham dark web drugs trade - Birmingham Live (birminghammail.co.uk)

• Interpol op cuffs 3,500 cyber suspects, seizes $300M • The Register

• NSA Blocked 10 Billion Connections to Malicious and Suspicious Domains - Security Week

• Qakbot Sightings Confirm Law Enforcement Takedown Was Only a Setback (darkreading.com)

• Suspects can refuse to provide phone passcodes to police, court rules | Ars Technica

• Dark web marketplace Kingdom Market dismantled | SC Media (scmagazine.com)

• Lapsus$ teen sentenced to indefinite detention in hospital • The Register

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Attacks on critical infrastructure are harbingers of war: Are we prepared? | SC Media (scmagazine.com)

Nation State Actors

China

• China's Cyber Warfare Surges With Hacking Of US Infrastructure (thefederalist.com)

• Espionage from the East: "Russia Is a Storm, China Is Climate Change" - DER SPIEGEL

• US cyber warriors issue a call to arms - Asia Times

• China's Secret War Preps Inside US Utilities (spytalk.co)

• National Grid drops Beijing-backed supplier over UK power network fears (ft.com)

• Chinese Spacecraft Emitting Strong Signal Over North America (futurism.com)

• A top-secret Chinese spy satellite just launched on a supersized rocket | Ars Technica

• China's MIIT Introduces Color-Coded Action Plan for Data Security Incidents (thehackernews.com)

Russia

• Cyber attack on Kyivstar is likely one of highest-impact disruptive in Ukraine since Feb 2022 - British intelligence (interfax.com.ua)

• The UK Defence Intelligence Analyses Massive Cyber Attack Ukraine Suffered | Defence Express (defence-ua.com)

• Ukraine updates: UK says Ukraine suffered severe cyber attack – DW – 12/16/2023

• Espionage from the East: "Russia Is a Storm, China Is Climate Change" - DER SPIEGEL

• US cyber warriors issue a call to arms - Asia Times

• Anonymous Sudan hacking group pledges to keep targeting OpenAI's ChatGPT (axios.com)

• UK and partners form The Tallinn Mechanism for cyber security - GOV.UK (www.gov.uk)

• Ukraine mobile cyber attack high impact says UK - Emerging Risks Media Ltd

• Russian APT29 Hacked US Biomedical Giant in TeamCity-Linked Breach (hackread.com)

• Cyber espionage group Cloud Atlas targets Russian companies with war-related phishing attacks (therecord.media)

Iran

• Israel-linked hacking group claims it ‘disabled’ gas stations across Iran | World News - Hindustan Times

• Iranian 'Seedworm' Cyber Spies Target African Telcos & ISPs (darkreading.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Intellexa and Cytrox: From fixer-upper to Intel Agency-grade spyware (talosintelligence.com)

---

Vulnerability Management

• 2023 Cyber Threats: 26,000+ Vulnerabilities, 97 Beyond CISA List - Infosecurity Magazine (infosecurity-magazine.com)

• Majority of 2023's critical cyber attacks stemmed from fewer than 1% of vulnerabilities - SiliconANGLE

• 1 in 4 high-risk CVEs are exploited within 24 hours of going public | SC Media (scmagazine.com)

• Will Putting a Dollar Value on Vulnerabilities Help Prioritize Them? (darkreading.com)

• Creating a formula for effective vulnerability prioritization - Help Net Security

• Zoom Unveils Open Source Vulnerability Impact Scoring System - Security Week

• Threat actors still exploiting old unpatched vulnerabilities, says Cisco | IT Business

Vulnerabilities

• 80 percent of Struts 2 downloads include critical flaw • The Register

• ESET fixed a high-severity bug in the Secure Traffic Scanning Feature of several products (securityaffairs.com)

• Fortinet Releases Security Updates for Multiple Products | CISA

• Flaws in pfSense firewall can lead to arbitrary code execution (securityaffairs.com)

• QNAP VioStor NVR vulnerability actively exploited by malware botnet (bleepingcomputer.com)

• MOVEit Vulnerability Hits Delta Dental: 7 Million Records Exposed - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft discovers critical RCE flaw in Perforce Helix Core Server (bleepingcomputer.com)

• Years-Old, Unpatched GWT Vuln Leaves Apps Open to Server-Side RCE (darkreading.com)

• 8220 Gang Exploiting Oracle WebLogic Server Vulnerability to Spread Malware (thehackernews.com)

• 3CX Urges Customers to Disable Integration Due to Potential Vulnerability - Security Week

• Mozilla Patches Firefox Vulnerability Allowing Remote Code Execution, Sandbox Escape - Security Week

• Researchers uncover major security issue in Microsoft Azure - here's what we know | TechRadar

• Microsoft Outlook Zero-Click Security Flaws Triggered by Sound File (darkreading.com)

• 3CX warns customers to disable SQL database integrations (bleepingcomputer.com)

• Dell Urges Customers to Patch Vulnerabilities in PowerProtect Products - Security Week

• Outlook Plays Attacker Tunes: Vulnerability Chain Leading to Zero-Click RCE - Security Week

• Targeted F5 Vulnerability 'Update' Delivers Wiper to Israeli Victims (darkreading.com)

• Urgent: New Chrome Zero-Day Vulnerability Exploited in the Wild - Update ASAP (thehackernews.com)

• Ivanti releases patches for 13 critical Avalanche RCE flaws (bleepingcomputer.com)

• Apple rolls out iOS 17.2.1 with bugfixes and minor improvements - Neowin

• Hackers Exploiting MS Excel Vulnerability to Spread Agent Tesla Malware (thehackernews.com)

• SSH protects the world’s most sensitive networks. It just got a lot weaker | Ars Technica

• Impact of Log4Shell Bug Was Overblown, Say Researchers - Infosecurity Magazine (infosecurity-magazine.com)

• Fake F5 BIG-IP zero-day warning emails push data wipers (bleepingcomputer.com)

• New Security Vulnerabilities Uncovered in pfSense Firewall Software - Patch Now (thehackernews.com)

---

Tools and Controls

• AI’s efficacy is constrained in cyber security, but limitless in cyber crime - Help Net Security

• More cyber criminals turning to remote desktop protocol attacks | Insurance Times

• Insurer’s UK Honeypots Attacked 17 Million Times Per Day - Infosecurity Magazine (infosecurity-magazine.com)

• The cyber security arms race: AI vs. AI | TechRadar

• Microsoft unveils new, more secure Windows Protected Print Mode (bleepingcomputer.com)

• 65% of organisations say ransomware concerns impact risk management | Security Magazine

• AI in Cyber Security: It's All About Being Aware (inforisktoday.com)

• Demystifying Open XDR: What It Is, How to Do It, and ROI | Binary Defence

• 5 things you need to know about your EDR | CSO Online

• Can you trust Windows Hello biometric authentication | Kaspersky official blog

• Many organisations still lack formal IT security training in 2024 (securitybrief.co.nz)

• How CISOs can manage multiprovider cyber security portfolios | TechTarget

• Intelligence Researchers to Study Computer Code for Clues to Hackers’ Identities - WSJ

• CISA Releases Microsoft 365 Secure Configuration Baselines and SCuBAGear Tool | CISA

• Are Workstation Security Logs Actually Important? | MSSP Alert

• What's the Best Way to Communicate After a Data Breach? (darkreading.com)

• How Segmentation Can Slow a Cyber Attack - ClearanceJobs

---

Reports Published in the Last Week

• Annual Payment Fraud Intelligence Report: 2023 | Recorded Future

---

Other News

• The Financial Sector Experiences More Cyber Attacks than Other Verticals, and those Incidents Result in Costlier Outcomes (prnewswire.com)

• 77% of financial organisations detected a cyber attack in the last year | Security Magazine

• Small businesses targeted by cyber criminals for data (securitybrief.co.nz)

• Retailers Are Being Barraged By Cyber Attacks This Holiday Season (forbes.com)

• Complexity leaves energy companies vulnerable to cyber attacks - Verdict

• The MOVEit breach may well have been the biggest cyber attack of the year | TechRadar

• How to bolster security against intellectual property theft (c4isrnet.com)

• In Cyber Security, Some Conventional Wisdom, While Well-Intentioned, Is Off-Base (newsweek.com)

• Navigating The Cyber Security Landscape In 2024 (forbes.com)

• 3 Strategic Insights from Cyber Security Leader Study (trendmicro.com)

• Healthcare sector warned of poor cyber hygiene; CISA doles out remedy advice | SC Media (scmagazine.com)

• The truth behind four small business cyber security myths (themanufacturer.com)

• Conclusion of Crossed Swords: the most exciting offensive cyber operations exercise

• Australia announces cyber security plan after major breaches | World Economic Forum (weforum.org)

• National Grid drops Beijing-backed supplier over UK power network fears (ft.com)

• As British Library faces fallout of cyber attack—what can arts bodies do to combat ransomware threats? (theartnewspaper.com)

• NIST Report Spotlights Cyber, Privacy Risks in Genomic Data (inforisktoday.com)

• Zscaler ThreatLabz Finds Most Cyber Attacks Hide (itsecuritywire.com)

• 86% of cyber attacks are delivered over encrypted channels - Help Net Security

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 25 August 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Cloud Hosting Firm Loses All Customer Data After Ransomware Attack

CloudNordic, a Danish cloud hosting provider, has told customers to consider all of their data as having been lost following a ransomware infection that encrypted the large Danish cloud provider. The threat actors had destroyed the organisation’s backups, which prevented the firm from recovering effectively. The attack also impacted AzeroCloud, which is owned by the same company.

Worryingly, many organisations believe that having backups and using the cloud is enough for them to be able to recover from any cyber incident; unfortunately, as shown in the CloudNordic and AzeroCloud attacks, it is not enough. Organisations need to have a recovery plan in place which is tested and improved, to best strengthen themselves in the event of a cyber incident.

Sources: [The Register] [Bleeping Computer] [Help Net Security]

Would You Infect Others to Rid Yourself of Ransomware?

Hackers continually develop ransomware with new and creative attack methods that keep internet security professionals on their toes and pose challenges for people trying to detect threats. Victims of ransomware usually see messages asking them to pay for file access restoration; however, the Popcorn Time ransomware group takes a different approach to getting victims involved.

The Popcorn Time ransomware approach works via the referral method. The ransomware group is willing to give victims access to their files if they send the referral link to two other people, extending the attacker’s reach. Most people would hesitate to distribute a ransomware link through email, WhatsApp, or another method that is easy for victims to identify them as the perpetrators. Law enforcement bodies categorise ransomware attacks as crimes that come with hefty fines and prison time. Even those choosing to send the links to people they know face disastrous consequences beyond law enforcement, including the loss of jobs and relationships.

Source: [CyberNews]

Artificial Intelligence and USBs Drive 8% Rise in Cyber Attacks

Checkpoint’s 2023 Mid-Year Security Report shows an 8% surge in global weekly cyber attacks during Q2, marking the most significant increase in two years. The report highlights the fusion of advanced artificial intelligence (AI) technology with traditional tools like USB devices used for disruptive cyber attacks.

Other significant findings include the evolution of ransomware tactics. The report found that ransomware groups are exploiting vulnerabilities in common corporate software and shifting focus from encrypting data to stealing it. USB devices have resurfaced as threats, employed by both state-affiliated groups and cyber-criminals to distribute malware globally. The misuse of AI has escalated, as attackers use generative AI tools for phishing emails, keystroke monitoring malware and basic ransomware code.

Source: [InfoSecurity Magazine]

Ransomware Attacks Broke Records in July, Mainly Driven By One Group

A number of ransomware actors are utilising the threat of releasing sensitive data to get organisations to pay ransoms; in some cases this is combined with encryption to give the actor two avenues of payment. A report has found there were over 500 attacks last month, an increase of 153% compared to one year ago, and a 16% increase compared to June. Within Europe, there was a 59% increase in ransomware attacks from June to July.

Part of the significant rise is due to the ransomware group called Cl0p, whose attack on the MOVEit software has accounted for hundreds of victims this year. The Cl0p ransomware group has kept its promise to publish files on the clearweb of all its victims if contact was not made. The clearweb is simply what we know as the internet; anyone can access it. As such, there will be many organisations who are now having their sensitive data published and readily viewable for anyone who has access to the internet.

Sources: [Gov Info Seccurity] [Security Week] [ZDNET] [Cyber News]

Cyber Risk in The Boardroom

The relationship between the CISO and the wider boardroom has become increasingly cooperative, with 77% of CEO’s seeing cyber as a strategic function and a potential source of competitive advantage. While it is ultimately up to the board to take steps to keep cybersecurity high on the agenda, the CISO also has a responsibility to press the message and bridge any gaps.

CISOs must deliver concerns, strategies and recommendations in a business-first manner, while avoiding jargon and overly technical language. Attracting and retaining good quality senior security professionals is very challenging in the current market and Black Arrow offer a fractional CISO service, giving access to a whole team of specialists with wider expertise, experience and backgrounds, for less than the cost of hiring one individual.

Sources: [Security Week] [TechRadar]

Malware-Infected Advertising Grows Ever More Sophisticated, And More Damaging

The malware exploits known as malware-infected ads, or malvertising, have been around for decades, but new reports point to a steady rise in efficacy. With malvertising, the infected ads are typically placed on legitimate ad networks, which makes them more difficult to spot and remove. The technique continues to use more and more sophisticated mechanisms for getting their infections spread throughout the web and keeping them running for a long time. The exploits can operate in one of several ways, including intercepting a user’s clickstream on random hyperlinks and substituting them with redirects to advertising websites.

Adblockers either on endpoints or at the network level can also help to prevent malvertising from causing harm.

Source: [SiliconAngle]

Cyber Security is Everyone’s Responsibility

A recent survey found that 41% of respondents said that poor quality training, or a lack of training altogether, and insider threats were impacting their organisation’s security. Cyber security involves everyone as any employee can be an entry point for a cyber incident, but they also have the power to prevent one. It is important to make sure all employees are provided adequate training. Not every role requires the same training however, so it is important for organisations to identify and provide training that is appropriate to employees. Black Arrow provide live in person and online instructor lead cyber security training, both through Cyber Risk and Governance Workshops for Senior Leadership and Awareness, Behaviour and Culture Training for employees and contractors.

Source: [IT Pro Today]

QR Code Hacks Are Another Thing to Worry About Now

One of the upcoming technologies thrust upon us is QR codes. At this point, you can find them at most restaurants and parking sites. You simply scan the code and you are taken to the relevant site, for example, the menu for the restaurant. Attackers have cottoned on to this and started to use QR codes in phishing attacks; the idea being that the victim will scan the code without scrutinising it and be taken to a malicious website instead.

Source: [Bloomberg]

Security Basics Aren’t So Basic Anymore

The basics of cyber security, it turns out, aren’t so basic anymore. What was considered basic has moved way beyond just having firewalls and antivirus, and the most basic controls nowadays include more advanced controls such as robust identity and access management, multi-factor authentication (MFA) and patching and vulnerability management. Many of these now basic controls are lacking or non-existent across the economy according to cyber security experts. A report found that only 28% of Microsoft users had MFA enabled as 2022 closed.

You can’t solve all the problems at once. However, progress on these fronts also relies heavily on the need for a cultural shift. Organisations need to get to the point where they view cyber security in the same light as locks on doors and seatbelts in cars.

Source: [CioDive]

Apple MacOS Security Myths

Apple has maintained a reputation as being more secure than other manufacturers, and whilst Apple has put many different security mechanisms into its operating system, no technology is bulletproof. Assuming an Apple device is invulnerable can lead users to believe that their Mac will not get viruses or be subject to a plethora of other cyber threats. As a result, this can lead to poor cyber hygiene from the individual, as they assume they are safe regardless of what they do. Apple users need to remain every bit as aware of risks, social engineering, keeping devices up to date, and having appropriate security controls.

Source: [Huntress]

Security Leaders Report Misalignment of Investments and Risk Reduction

The cyber risk landscape was analysed in a recent report that examined the amount of risk that organisations are willing to accept, their resource constraints and key priorities for approaching cyber risk in the future. The report found 66% of respondents indicating that they have limited visibility and insight into their cyber risk profiles, hindering their ability to prioritise investments and allocate resources effectively. 67% of organisations experienced a breach requiring attention within the last two years despite having traditional threat-based security measures in place. Further, 61% of security executives expressed concerns over the current misalignment between cyber security investments and their organisation's risk reduction priorities.

Source: [InfoSecurity Magazine]

Many CISOs Tout SaaS (Cloud) Cyber Security Confidence, but 79% Admit to Incidents

Cyber security, IT, and business leaders alike recognise SaaS (cloud) cyber security as an increasingly important part of the cyber threat landscape. And at first glance, respondents appear generally optimistic about their SaaS cyber security as 85% answered that they are confident or very confident in their company's or customer's data security in sanctioned SaaS apps.

Despite the confidence, 79% of respondents confirmed that their organisation had identified SaaS cyber security incidents over the past 12 months. Many of those incidents occurred in environments with cyber security policies in place and enforced, as 66% of respondents claimed in their responses.

Source: [The Hacker News]

If You Ever Used Duolingo, Watch Out for Phishing Email

Users of Duolingo, past and present, should be wary of phishing emails as data on about 2.6 million accounts were scraped through an exposed application programming interface (API), and then offered on a hacking forum back in January. Login and real names, email addresses, phone numbers, and courses studied were part of the collection, which went for $1,500. Now that data has resurfaced on a different forum, and at a substantially lower cost of just a few dollars, users of the service can expect this data to be used in fresh phishing campaigns.

Source: [PCWorld]

91% of Security and IT Professionals: Criminals are Already Using AI in Email Attacks

Recent research found that 91% of security and IT professionals are noticing cyber criminals already using AI as part of email attack campaigns, with 74% indicating they have experienced an increase in the use of AI by cyber criminals in the past six months. This is worrying as 52% reported that email security is among one of their top three concerns.

Organisations need to make sure that their technologies, procedures and policies are updated to factor in AI-enabled email attacks to help reduce the risk they pose to the organisation. Such improvements should also include employees.

Source: [PR Newswire]

---

Governance, Risk and Compliance

• Cyber security 'number one on the agenda in boardrooms,' Cramer says (cnbc.com)

• Firms have mere hours to deflect cyber attacks, warns cyber security CEO (cointelegraph.com)

• The End of “Groundhog Day” for the Security in the Boardroom Discussion? - SecurityWeek

• Cyber risk: the view across the boardroom table | TechRadar

• Too many businesses struggling to hire and retain talent, amplifying security risks – Digital Journal

• How Cyber Security Leaders Can Help Lower Expenses While Reducing Risk (informationweek.com)

• Who’s Your Next Cyber Chief? Good Question. (wsj.com)

• Cyber crime: A Multi-Billion-Dollar Industry (thecyberwire.com)

• How the downmarket impacted enterprise cyber security budgets - Help Net Security

• What is Risk Analysis? | Definition from TechTarget

• When Leadership Style Is a Security Risk (darkreading.com)

• The Changing Landscape of Cyber Security Education (inforisktoday.com)

• Protect Your Cyber Security Budget and Your Organisation | Dell USA

• Rapid cyber attacks demand modernised security, says Palo Alto CEO (crypto.news)

• Cyber security Is Everyone’s Responsibility | ITPro Today: IT News, How-Tos, Trends, Case Studies, Career Tips, More

• The Cost of 'Good Enough' Security - GovInfoSecurity

---

Threats

Ransomware, Extortion and Destructive Attacks

• Cl0p dumps all MOVEit victim data on clearnet, threat insiders talk ransom strategy | Cybernews

• Cuba ransomware gang looking for unpatched Veeam installations: Report | IT Business

• Ransomware attacks broke records in July, mainly driven by this one group | ZDNET

• Hosting firm says it lost all customer data after ransomware attack (bleepingcomputer.com)

• FE News | 70% of secondary schools have experienced a cyber incident. BIP shares three ways they can protect against attacks ahead of results day

• Cyber Attacks have left some hospital computers offline for 2 weeks, closing ERs and postponing surgeries

• Continued MOVEit Exploitation Drives Record Ransomware Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Would You Infect Others to Rid Yourself of Ransomware? (makeuseof.com)

• How Application Allowlisting Combats Ransomware Attacks (securityintelligence.com)

• Akira ransomware gang spotted targeting Cisco VPN products to hack organisations-Security Affairs

• Scarab Ransomware Deployed Worldwide Via Spacecolon Toolset - Infosecurity Magazine (infosecurity-magazine.com)

• Why Ransomware Gangs Opt for Encryption-Less Attacks (govinfosecurity.com)

• MOVEit Health Data Breach Tally Keeps Growing (inforisktoday.com)

• British intelligence is tipping off ransomware targets to disrupt attacks (therecord.media)

• What the Hive Ransomware Case Says About RaaS and Cryptocurrency (darkreading.com)

• 6 Ransomware Trends & Evolutions For 2023 (trendmicro.com)

• New Study Sheds Light on ADHUBLLKA Ransomware Network - Infosecurity Magazine (infosecurity-magazine.com)

• North Korea ready to cash out more than $40 million in Bitcoin after summer of attacks, warns FBI | Tripwire

• Ransomware dwell time hits new low - Help Net Security

• Three trends to watch in the growing threat landscape (betanews.com)

Ransomware Victims

• Cl0p dumps all MOVEit victim data on clearnet, threat insiders talk ransom strategy | Cybernews

• Hosting firm says it lost all customer data after ransomware attack (bleepingcomputer.com)

• Cyber attacks have left some hospital computers offline for 2 weeks, closing ERs and postponing surgeries

• BlackCat ransomware group claims the hack of Seiko network -Security Affairs

• Ransomware gang threatens Raleigh Housing Authority months after devastating attack (therecord.media)

• The Estée Lauder Cos. Addresses Cyber security Attack – WWD

• Mysterious Cyber Attack Shuts Down Yet More Telescopes For Weeks | IFLScience

• St Helens Council hit by suspected Ransomware cyber attack | St Helens Star

Phishing & Email Based Attacks

• 91% of security pros say cyber criminals are using AI in email attacks | Security Magazine

• Insurer Denies Coverage Under Professional Liability Policy for Lawyer’s Email Compromise | Robinson+Cole Data Privacy + Security Insider - JDSupra

• Cyber criminals turn to AI to bypass modern email security measures - Help Net Security

• New Generation of Phishing Hides Behind Trusted Services (securityintelligence.com)

• New phishing campaign recognised in Europe and South America | Security Magazine

• If you ever used Duolingo, watch out for phishing emails | PCWorld

• Open redirect flaws increasingly exploited by phishers - Help Net Security

• How to spot phishing on a hacked WordPress website | Kaspersky official blog

• The Dual Role of AI in Email Security - GovInfoSecurity

• New Telegram Bot "Telekopye" Powering Large-scale Phishing Scams from Russia (thehackernews.com)

• eBay Users Beware Russian 'Telekopye' Telegram Phishing Bot (darkreading.com)

• Phish in a Barrel: Real-World Cyber Attack Examples (govinfosecurity.com)

• Email Security: Top 5 Threats and How to Protect Your Business - ReadWrite

BEC – Business Email Compromise

• 91% of security pros say cyber criminals are using AI in email attacks | Security Magazine

• Breaking Down BEC: The Modern CISO’s Framework for Identifying, Classifying and Stopping Email Fraud (govinfosecurity.com)

Other Social Engineering; Smishing, Vishing, etc

• Blockchain Capital’s Bart Stephens Lost $6.3 Million In SIM-Swap Hack (forbes.com)

• What Is Virtual Kidnapping and How Can You Fight It? (makeuseof.com)

Artificial Intelligence

• 91% of Security and IT Professionals Agree Cyber Criminals are Already Using AI in Email Attacks, per Report from SlashNext and Osterman Research (prnewswire.com)

• Artificial Intelligence and USBs Drive 8% Rise in Cyber-Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Deceptive AI Bots Spread Malware, Raise Security Concerns - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber criminals turn to AI to bypass modern email security measures - Help Net Security

• Compliance, Risk Management and Security Are Being Impact by Generative AI... But How? | The Fintech Times

• Tricks for making AI chatbots break rules are freely available online | New Scientist

• What Is Virtual Kidnapping and How Can You Fight It? (makeuseof.com)

• Generative AI Is Scraping Your Data. So, Now What? (darkreading.com)

• Fake versions of Google Bard are spreading malware | TechRadar

• AI and the evolution of surveillance systems - Help Net Security

• The Dual Role of AI in Email Security - GovInfoSecurity

• Thinking of Deploying Generative AI? You May Already Have (govinfosecurity.com)

• Three trends to watch in the growing threat landscape (betanews.com)

• Careful -- Hackers are targeting Google Bard ads for malware | Digital Trends

Malware

• Deceptive AI Bots Spread Malware, Raise Security Concerns - Infosecurity Magazine (infosecurity-magazine.com)

• Serious WinRAR Flaw Can Be Exploited to Launch Malware (pcmag.com)

• Hackers use VPN provider's code certificate to sign malware (bleepingcomputer.com)

• HiatusRAT Malware Resurfaces: Taiwan Firms and US Military Under Attack (thehackernews.com) Ask the Mac Guy: macOS Security Myths (huntress.com)

• New Variant of XLoader macOS Malware Disguised as 'OfficeNote' Productivity App (thehackernews.com)

• New "Whiffy Recon" Malware Triangulates Infected Device Location via Wi-Fi Every Minute (thehackernews.com)

• Researchers Uncover New Lazarus Group Malware Details | Decipher (duo.com)

Mobile

• New stealthy Android malware stumps antivirus, poses huge threat to phones, study reveals | Tech News (hindustantimes.com)

• Thousands of Android Malware Apps Using Stealthy APK Compression to Evade Detection (thehackernews.com)

• “Snakes in airplane mode” – what if your phone says it’s offline but isn’t? – Naked Security (sophos.com)

• Google wants to fight pre-installed Android malware | TechSpot

• Children and smartphones: How to protect and guide them from bullying, phishing and grooming – The Irish Times

Denial of Service/DoS/DDOS

• DDoS Attacks in H1 2023 Up 200% from 2022 According to New Zayo Data | Business Wire

Internet of Things – IoT

• TP-Link smart bulbs can let hackers steal your WiFi password (bleepingcomputer.com)

• When Your Home Security System Turns the Camera on You | The Epoch Times

• Anticipating the next wave of IoT cyber security challenges - Help Net Security

• The Physical Impact of Cyber Attacks on Cities (darkreading.com)

• Smart Cities: Utopian Dream, Security Nightmare, or Political Gimmick? - SecurityWeek

• Yes, Your Electric Vehicle Could Be Hacked - IEEE Spectrum

Data Breaches/Leaks

• Insurer Denies Coverage Under Professional Liability Policy for Lawyer’s Email Compromise | Robinson+Cole Data Privacy + Security Insider - JDSupra

• Tesla Data Breach Investigation Reveals Inside Job (darkreading.com)

• Leak of 75k staff records was insiders' fault, Tesla claims • The Register

• Guernsey CCTV investigation widened after more footage leaked | Bailiwick Express Jersey

• Scraped data of 2.6 million Duolingo users released on hacking forum (bleepingcomputer.com)

• Thousands of Charity Donors Have Details Leaked Onto Dark Web | The Epoch Times

• How a Christie’s website revealed where people kept their art | The Seattle Times

• Defence contractor Belcan leaks admin password with a list of flaws-Security Affairs

• Critical Insight Report: 15% Drop in Breaches, 31% Surge in Victims - Infosecurity Magazine (infosecurity-magazine.com)

• What lessons must be learned from the Electoral Register cyber attack? | theHRD (thehrdirector.com)

• 5 Early Warning Indicators That Are Key to Protecting National Secrets (darkreading.com)

• Sensitive Data of 10m at Risk After French Employment Agency Breach - Infosecurity Magazine (infosecurity-magazine.com)

• University of Minnesota Confirms Data Breach, Says Ransomware Not Involved - SecurityWeek

Organised Crime & Criminal Actors

• Check Point reveals 8% spike in global cyber attacks by mid-2023 (securitybrief.co.nz)

• Attack Dwell Times Fall but Threat Actors Are Moving Faster - Infosecurity Magazine (infosecurity-magazine.com)

• UK Court Convicts Lapsus$ Hacker for Breaching ISP BT and EE UPDATE - ISPreview UK

• Cyber crime: A Multi-Billion-Dollar Industry (thecyberwire.com)

• Bruce Schneier gets inside the hacker's mind | CyberScoop

• Hacking group KittenSec claims to 'pwn anything we see' to expose corruption | CyberScoop

• Ransomware dwell time hits new low - Help Net Security

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Blockchain Capital’s Bart Stephens Lost $6.3 Million In SIM-Swap Hack (forbes.com)

• What the Hive Ransomware Case Says About RaaS and Cryptocurrency (darkreading.com)

• North Korea ready to cash out more than $40 million in Bitcoin after summer of attacks, warns FBI | Tripwire

Insider Risk and Insider Threats

• Leak of 75k staff records was insiders' fault, Tesla claims • The Register

• Police Insider Tipped Off Criminal Friend About EncroChat Bust - Infosecurity Magazine (infosecurity-magazine.com)

• Three trends to watch in the growing threat landscape (betanews.com)

• Phish in a Barrel: Real-World Cyber Attack Examples (govinfosecurity.com)

Fraud, Scams & Financial Crime

• Interpol arrest 14 who allegedly scammed $40m from victims • The Register

• Germany Hunts for Cyber Criminals Amid Billion-Euro Scams - Bloomberg

• Billion Dollar Heist: The simple typo that stopped the Bangladesh bank robbers from stealing $1 billion (ladbible.com)

• Sneaky Amazon Google ad leads to Microsoft support scam (bleepingcomputer.com)

• Blockchain Capital’s Bart Stephens Lost $6.3 Million In SIM-Swap Hack (forbes.com)

• Surge in identity crime victims reporting suicidal thoughts - Help Net Security

Impersonation Attacks

• How to spot phishing on a hacked WordPress website | Kaspersky official blog

Deepfakes

• What Is Virtual Kidnapping and How Can You Fight It? (makeuseof.com)

Insurance

• Insurer Denies Coverage Under Professional Liability Policy for Lawyer’s Email Compromise | Robinson+Cole Data Privacy + Security Insider - JDSupra

• Cyber security insurance is missing the risk - Help Net Security

• Cyber Security Insurance Market worth $17.6 billion by 2028 - Exclusive Report by MarketsandMarkets™ (prnewswire.com)

• Cyber Security Insurance Market Size & Share Analysis - (globenewswire.com)

• The Shifting Dynamics of Cyber Insurance - BankInfoSecurity

• Global Cyber Security Insurance Market to Reach USD 33.4 Billion by 2028, Driven by Rising Cyber Threats and Regulatory Compliance (prnewswire.com)

Dark Web

• Thousands of Charity Donors Have Details Leaked Onto Dark Web | The Epoch Times

Supply Chain and Third Parties

• New Chinese APT Group Launches Supply Chain Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• New Supply Chain Attack Hit Close to 100 Victims—and Clues Point to China | WIRED

• Supply chain as kill chain | ITPro

Cloud/SaaS

• The Importance Of SaaS Backup And Disaster Recovery: Reasons To Consider (informationsecuritybuzz.com)

• Cloud hosting firms hit by devastating ransomware attack - Help Net Security

• Warning: Attackers Abusing Legitimate Internet Services (inforisktoday.com)

• How to conduct a cloud security assessment | TechTarget

• Maintaining consistent security in diverse cloud infrastructures - Help Net Security

• How API authentication vulnerabilities are at the center of cloud security concerns | CSO Online

• CISOs Tout SaaS Cyber Security Confidence, But 79% Admit to SaaS Incidents, New Report Finds (thehackernews.com)

• Lack of visibility into cloud access policies leaves enterprises flying blind - Help Net Security

• Cloud services are creating more cyber-risks for telcos   - Mobile Europe

Identity and Access Management

• Ongoing Duo outage causes Azure Auth authentication errors (bleepingcomputer.com)

• Cisco's Duo Security suffers major authentication outage • The Register

Encryption

• Apple security updates could be banned by British government (9to5mac.com)

API

• Understanding how attackers exploit APIs is more important than ever - Help Net Security

• How API authentication vulnerabilities are at the centre of cloud security concerns | CSO Online

Biometrics

• ICO publishes guidance on use of biometric data in the UK - Tech Monitor

• Is Facial Recognition Technology Becoming a Privacy Risk? (makeuseof.com)

• Facial Recognition Technology (FRT) Statistics for 2023 (techreport.com)

• Biometric payment systems raise privacy concerns (iapp.org)

Social Media

• Global warning issued on social media data scraping (iapp.org)

Malvertising

• Sneaky Amazon Google ad leads to Microsoft support scam (bleepingcomputer.com)

• Malware-infected advertising grows ever more sophisticated, and lethal - SiliconANGLE

• Careful -- Hackers are targeting Google Bard ads for malware | Digital Trends

Training, Education and Awareness

• 2023 Cyber Security Awareness Month Appeal: Make Online Security Easier (govtech.com)

• The Changing Landscape of Cyber Security Education (inforisktoday.com)

Parental Controls and Child Safety

• Report reveals insights on cyber security conversations with children | Security Magazine

• Children and smartphones: How to protect and guide them from bullying, phishing and grooming – The Irish Times

Cyber Bullying, Cyber Stalking and Sextortion

• Nearly a third of young people preyed on by "text pest" delivery drivers (bitdefender.com)

Regulations, Fines and Legislation

• Apple security updates could be banned by British government (9to5mac.com)

• How EU lawmakers can make mandatory vulnerability disclosure responsible - Help Net Security

• Cyber Security Laws and Regulations in Germany | UpGuard

• Morgan Stanley Fined for UK Energy Trading WhatsApp Breach (yahoo.com)

• New NCUA Rule Requires Swift Cyber Incident Reporting - Infosecurity Magazine (infosecurity-magazine.com)

• SEC Cyber Security Rules: Considerations for Incident Response Planning | Holland & Knight LLP - JDSupra

• Controversial Cyber crime Law Passes in Jordan (darkreading.com)

• Experian Pays $650,000 to Settle Spam Claims - Infosecurity Magazine (infosecurity-magazine.com)

• Strengthening Cyber Security In Finance: A Look At EU DORA Regulations (forbes.com)

• Proposed bill would require vulnerability disclosure policies for all federal contractors (therecord.media)

Backup and Recovery

• The Importance Of SaaS Backup And Disaster Recovery: Reasons To Consider (informationsecuritybuzz.com)

Data Protection

• ICO publishes guidance on use of biometric data in the UK - Tech Monitor

• Experian Pays $650,000 to Settle Spam Claims - Infosecurity Magazine (infosecurity-magazine.com)

Careers, Working in Cyber and Information Security

• Too many businesses struggling to hire and retain talent, amplifying security risks – Digital Journal

• Unrealistic expectations exacerbate the cyber security talent shortage - Help Net Security

• It's Time to Approach The Cyber Security Skills Gap Differently - IT Security Guru

• How To Become Chief Information Security Officer - The Economic Times (indiatimes.com)

• 4 ways simulation training alleviates team burnout - Help Net Security

• Government Urges More Students to Be Cyber Explorers - Infosecurity Magazine (infosecurity-magazine.com)

• Tens of thousands of students receive free training to build cyber skills - The Business Magazine

• 90% of Consumers Worry Cyber Security’s Future Is in Jeopardy if Students Aren’t Exposed to the Field at an Earlier Age - IT Security Guru

• 5 Ways SMBs Can Bridge the Cyber Security Skills Gap | Mimecast

• The Importance of Accessible and Inclusive Cyber Security (securityintelligence.com)

Law Enforcement Action and Take Downs

• Interpol arrest 14 who allegedly scammed $40m from victims • The Register

• UK Court Convicts Lapsus$ Hacker for Breaching ISP BT and EE UPDATE - ISPreview UK

• Two dozen arrested, hundreds of malicious IPs taken down in African cyber crime operation | CyberScoop

• Germany Hunts for Cyber Criminals Amid Billion-Euro Scams - Bloomberg

• Police Insider Tipped Off Criminal Friend About EncroChat Bust - Infosecurity Magazine (infosecurity-magazine.com)

Privacy, Surveillance and Mass Monitoring

• Is Facial Recognition Technology Becoming a Privacy Risk? (makeuseof.com)

• When Your Home Security System Turns the Camera on You | The Epoch Times

• Biometric payment systems raise privacy concerns (iapp.org)

• AI and the evolution of surveillance systems - Help Net Security

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare and Cyber Espionage

Russia

• Intelligence agencies warn foreign spies are targeting US space companies - Times of India (indiatimes.com)

• Incident response lessons learned from the Russian attack on Viasat | CSO Online

• Ukrainian hackers claim to leak emails of Russian parliament deputy chief (therecord.media)

• New Telegram Bot "Telekopye" Powering Large-scale Phishing Scams from Russia (thehackernews.com)

China

• Mounting Cyber Espionage and Hacking Threat from China - Modern Diplomacy

• Cyberespionage campaign by China's Ministry of State Security. CSRB will look into cyberespionage against Microsoft Exchange. Attacks against industrial systems. Threats to satellite communications. (thecyberwire.com)

• HiatusRAT Malware Resurfaces: Taiwan Firms and US Military Under Attack (thehackernews.com)

• New Chinese APT Group Launches Supply Chain Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• New Supply Chain Attack Hit Close to 100 Victims—and Clues Point to China | WIRED

• Exposed: the Chinese spy using LinkedIn to hunt UK secrets (thetimes.co.uk)

• FBI: Suspected Chinese actors continue Barracuda ESG attacks | TechTarget

• Microsoft says Chinese hacking crew is targeting Taiwan | CyberScoop

• US space companies face foreign spy threat, intelligence agencies say (usatoday.com) 

North Korea

• N. Korean Kimsuky APT targets S. Korea-US military exercises-Security Affairs

• Researchers Uncover New Lazarus Group Malware Details | Decipher (duo.com)

• North Korea ready to cash out more than $40 million in Bitcoin after summer of attacks, warns FBI | Tripwire

Misc/Other/Unknown

• Syrian Threat Actor EVLF Unmasked as Creator of CypherRAT and CraxsRAT Android Malware (thehackernews.com)

---

Vulnerability Management

• NCSC issues warning on cyber vulnerabilities (ukdefencejournal.org.uk)

• How EU lawmakers can make mandatory vulnerability disclosure responsible - Help Net Security

Vulnerabilities

• Juniper Networks fixes flaws leading to RCE in firewalls and switches - Help Net Security

• Serious WinRAR Flaw Can Be Exploited to Launch Malware (pcmag.com)

• Ivanti issues fix for third zero-day flaw exploited in the wild | TechTarget

• Ivanti Ships Urgent Patch for API Authentication Bypass Vulnerability - SecurityWeek

• FBI: Patches for Recent Barracuda ESG Zero-Day Ineffective - SecurityWeek

• GDS: Microsoft, Intel confirm "Downfall" of 7th, 8th, 9th, 10th, 11th Gen CPUs, firmware out - Neowin

• Critical Adobe ColdFusion Flaw Added to CISA's Exploited Vulnerability Catalog (thehackernews.com)

• 3,000 Openfire Servers Exposed to Attacks Targeting Recent Vulnerability - SecurityWeek

• Western Digital patches potentially dangerous security flaw, so update now | TechRadar

---

Tools and Controls

• The Importance Of SaaS Backup And Disaster Recovery: Reasons To Consider (informationsecuritybuzz.com)

• How Cyber Security Leaders Can Help Lower Expenses While Reducing Risk (informationweek.com)

• Security leaders report misalignment of investments and risk reduction | Security Magazine

• Cyber security insurance is missing the risk - Help Net Security

• Cyber security Insurance Market worth $17.6 billion by 2028

• Bolstering Cyber Security: Why Browser Security Is Crucial (inforisktoday.com)

• How Application Allowlisting Combats Ransomware Attacks (securityintelligence.com)

• The Vanishing Data Loss Prevention (DLP) Category - IT Security Guru

• Cyber Security: CASB vs SASE-Security Affairs

• Unveiling the Hidden Risks of Routing Protocols (darkreading.com)

• Hackers use VPN provider's code certificate to sign malware (bleepingcomputer.com)

• Network detection and response in the modern era - Help Net Security

• What’s Beyond SASE? The Next Steps (informationsecuritybuzz.com)

• Prevention First: Don’t Neglect Endpoint Security | CSO Online

• More Than Half of Browser Extensions Pose Security Risks (darkreading.com)

• Protect Your Cyber Security Budget and Your Organisation | Dell USA

• How the downmarket impacted enterprise cyber security budgets - Help Net Security

• Compliance, Risk Management and Security Are Being Impact by Generative AI... But How? | The Fintech Times

• SEC Cyber Security Rules: Considerations for Incident Response Planning

• How to conduct a cloud security assessment | TechTarget

• Maintaining consistent security in diverse cloud infrastructures - Help Net Security

• How API authentication vulnerabilities are at the centre of cloud security concerns | CSO Online

• The Needs of a Modernized SOC for Hybrid Cloud (securityintelligence.com)

• 2023 Cyber Security Awareness Month Appeal: Make Online Security Easier (govtech.com)

• The MOVEit hack and what it taught us about application security (bleepingcomputer.com)

• The Changing Landscape of Cyber Security Education (inforisktoday.com)

• The Dual Role of AI in Email Security - GovInfoSecurity

• Akamai Survey Finds Third-Party Defences Help Reduce Risk from Online Threats (prnewswire.com)

• The Shifting Dynamics of Cyber Insurance - BankInfoSecurity

• Global Cyber Security Insurance Market to Reach USD 33.4 Billion by 2028, Driven by Rising Cyber Threats and Regulatory Compliance (prnewswire.com)

• 5 Best Practices for Implementing Risk-First Cyber Security (darkreading.com)

• What's Going on With LastPass, and is it Safe to Use? (securityintelligence.com)

• Malicious web application transactions skyrocket 500% (securitybrief.co.nz)

---

Other News

• Our health care system may soon receive a much-needed cyber security boost | Ars Technica

• Swan Retail cyber attack: 300 retailers crippled by breach (techmonitor.ai)

• Cyber Attackers lie in wait as federal tech agencies brace for a mass exit of top officials - Washington Times

• Cyber Attack on Energy One affects corporate systems in Australia and the UK | CSO Online

• Vendors criticize Microsoft for repeated security failings | TechTarget

• Microsoft's become a cyber security titan. That could be a problem - Tech Monitor

• Global Naval Communication Market Research Report (globenewswire.com)

• The CSO guide to top security conferences | CSO Online

• IT's rising role in physical security technology - Help Net Security

• Construction businesses are at risk as nation-state attacks are on the rise - Construction & Civil Engineering magazine (ccemagazine.com)

• Hackers knocked out San Francisco's main real estate database | Fortune

• Microsoft's 6 Biggest Hacks: Is Better Security Needed? (makeuseof.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.