Black Arrow Cyber Threat Briefing 12 November 2021

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

---

Top Cyber Stories of the Last Week

Covid Impact Heightens Risk Of Cyber Security Breaches

CYBER SECURITY breaches are the biggest staff-related risk as Covid-19 and recruitment difficulties continue to impact workplaces, according to a survey of Channel Island employers.

Seven out of ten senior HR professionals and business leaders saw a cyber security breach as the greatest staff-related risk for a regulated financial services business – way ahead of employees leaving (16%) and employees working from home (10%). Some 57% of employers said Covid-19 had changed their policies, procedures and systems ‘moderately’, with 29.5% reporting ‘significant’ changes, according to the research undertaken at a virtual employment conference organised by Walkers last month.

https://guernseypress.com/news/2021/11/12/covid-impact-heightens-risk-of-cyber-security-breaches/

81% of Organisations Experienced Increased Cyber Threats During COVID-19

More than four in five (81%) organisations experienced increased cyber-threats during the COVD-19 pandemic, according to a new study by McAfee and FireEye.

The global survey of 1451 IT and line of business decision-makers found that close to half (43%) have suffered from downtime due to a cyber concern. This resulted in costs of $100,000 for some organisations.

Despite the increased threat landscape and the fact that over half (57%) of organisations saw a rise in online/web activity, 24% of respondents revealed they have had their technology and security budgets reduced over this period.

https://www.infosecurity-magazine.com/news/81-orgs-cyber-threats-covid19/

Phishing Attacks Grow 31.5% Over 2020, Social Media Attacks Continue To Climb

Phishing remains the dominant attack vector for bad actors, growing 31.5 percent over 2020, according to a PhishLabs report. Notably, attacks in September 2021 were more than twice as high as the previous year.

https://www.helpnetsecurity.com/2021/11/11/phishing-attacks-grow-2020/

Threat from Organised Cyber Crime Syndicates Is Rising

Europol reports that criminal groups are undermining the EU’s economy and its society, offering everything from murder-for-hire to kidnapping, torture and mutilation.

From encrypting communications to fencing ill-gotten gains on underground sites, organised crime is cashing in on the digital revolution.

The latest organised crime threat assessment from Europol issues a dire warning about the corrosive effect the rising influence of criminal syndicates is having on both the economy and society of the European Union. And it’s all happening online.

https://threatpost.com/organised-cybercrime-syndicates-europol/176326/

Ransomware Gangs Are Using These 'Ruthless' Tactics As They Aim For Bigger Payouts

More sophisticated ransomware attacks are on the way as cyber criminals tailor campaigns to raise the chances of a ransom payment.

Ransomware attacks are becoming more sophisticated as cyber criminals continue to develop new techniques to make campaigns more effective and increase their chances of successfully demanding a ransom payment.

According to the European law enforcement agency Europol there was a 300% increase in the number of ransom payments between 2019 and 2020 alone – and that doesn't account for 2021 being another bumper year for cyber criminals launching ransomware attacks, as they've taken advantage of security vulnerabilities presented by the rise in remote working. 

Europol's Internet Organised Crime Threat Assessment (IOCT) shows that while cybercrime, including malware and DDoS attacks, continues to evolve, it's ransomware attacks that have been a significant amount of disruption over the course of the past year.

https://www.ZDNet.com/article/ransomware-gangs-are-now-using-ruthless-tactics-as-they-aim-for-bigger-payouts/

Firms Will Struggle to Secure Extended Attack Surface in 2022

Companies are relying more heavily on third parties, remote employees, and partners, expanding their attack surface area beyond traditional boundaries.

In 2022, much of cybersecurity will boil down to managing the security of relationships, as companies adapt to the post-pandemic remote workforce and the increased use of third-party providers, a panel of analysts stated at the Forrester Research Security & Risk 2021 Conference.

Among five predictions for the coming year, the analysts argued that companies' attempts to manage remote employees would stray into intrusive territory, causing workers to push back and hampering security-focused monitoring, such as that for insider threats. Other predictions maintain that 60% of security incidents in the next year will come from issues with third parties, while the cybersecurity workforce will suffer from burnout and join what's been called the "Great Resignation," the recent trend of workers leaving the workforce.

https://www.darkreading.com/risk/firms-will-struggle-to-secure-extended-attack-surface-in-2022

Millions Of Home Wi-Fi Routers Threatened By Malware — What To Do

Netgear, Linksys, D-Link routers among those targeted

There's a nasty new piece of malware out there targeting Wi-Fi routers, and you'll want to make sure yours is fully updated so it doesn't get infected.

The AT&T researchers who discovered the malware are calling it BotenaGo, and it's apparently different from the Mirai botnet malware that's been attacking routers since 2016. BotenaGo packs in exploits for 33 different known vulnerabilities in 12 different router brands, including D-Link, Linksys, Netgear, Tenda, Totolink, Zyxel and ZTE. A full list is on the AT&T Cybersecurity blog post.

To avoid infection, ensure you update your router with the latest firmware.

https://www.tomsguide.com/uk/news/botenago-router-malware

Vulnerabilities Associated With Ransomware Increased 4.5% In Q3 2021

Ransomware groups are continuing to grow in sophistication, boldness, and volume, with numbers up across the board since Q2 2021, a report by Ivanti, Cyber Security Works and Cyware reveals.

This last quarter saw a 4.5% increase in CVEs associated with ransomware, a 4.5% increase in actively exploited and trending vulnerabilities, a 3.4% increase in ransomware families, and a 1.2% increase in older vulnerabilities tied to ransomware compared to Q2 2021.

https://www.helpnetsecurity.com/2021/11/10/vulnerabilities-associated-with-ransomware/

80% Of Organisations Experienced Employees Misusing And Abusing Access To Business Apps

Organisations continue to operate with limited visibility into user activity and sessions associated with web applications, despite the ever-present risk of insider threats and credential theft, a CyberArk research reveals.

While the adoption of web applications has brought flexibility and increased productivity, organisations often lag in implementing the security controls necessary to mitigate risk of human error or malicious intent.

https://www.helpnetsecurity.com/2021/11/08/user-activity-visibility/

Gen Z Is Behaving Recklessly Online - And Will Live To Regret It

Handing out personal information could be a slippery slope

Members of Generation Z, the cohort of people born in the first decade of the 21st century, care about digital privacy, but their desire for online fame and popularity is greater, a new study from ExpressVPN suggests.

The VPN provider surveyed 1,500 young adults from the US to evaluate their online habits and attitudes towards social media, and identified a troubling pattern that could have dire consequences.

The survey found that Generation Z isn’t trusting of the social media platforms they frequent, expressing concern that platforms may be using their images for facial recognition (67%) and wariness about oversharing personal information (66%).

https://www.techradar.com/news/gen-z-is-behaving-recklessly-online-and-will-live-to-regret-it

---

Threats

Ransomware

• 12 New Flaws Used in Ransomware Attacks in Q3 | Threatpost

• Average Ransomware Payment For US Victims More Than $6 Million, Survey Says | ZDNet

• Ransomware Disrupted Store Operations In The Netherlands And Germany - Security Affairs

• Toronto’s Transit Agency Cyber Attack Exposes 25,000 Employees’ Data | Techcrunch

• Comic Book Distributor Struggling With Shipments After Ransomware Attack | ZDNet

• Ransomware Attack Hits UK Fertility Clinic - Infosecurity Magazine (infosecurity-magazine.com)

• Spanish Brewery “Paralyzed” by Cyber-Attack - Infosecurity Magazine (infosecurity-magazine.com)

• TrickBot Teams Up With Shatak Phishers For Conti Ransomware Attacks (Bleepingcomputer.Com)

• REvil Ransomware: US seizes $6 Million In Ransom Payments And Expected To Charge Ukrainian Over Major Cyber Attack - CNNPolitics

BEC

• Interpol Closes in on Global BEC Gang - Infosecurity Magazine (infosecurity-magazine.com)

• Tiny Font Size Fools Email Filters in BEC Phishing | Threatpost

Phishing

• How Cyber Criminals Use Bait Attacks To Gather Info About Their Intended Victims - TechRepublic

• Microsoft Warns Of Surge In HTML Smuggling Phishing Attacks (Bleepingcomputer.Com)

• Shadow IT Makes People More Vulnerable to Phishing (sans.edu)

• Gmail Accounts Are Used In 91% Of All Baiting Email Attacks (Bleepingcomputer.Com)

Other Social Engineering

• SMS About Bank Fraud as a Pretext for Voice Phishing – Krebs on Security

Malware

• QAKBOT Loader Returns With New Techniques and Tools (trendmicro.com)

• Abcbot — A New Evolving Wormable Botnet Malware Targeting Linux (thehackernews.com)

• GravityRAT Returns Disguised As An End-To-End Encrypted Chat App - Security Affairs

• Report: 57% Of All Ecommerce Cyber Attacks Are Bot-Driven | Venturebeat

• New BazarBackdoor Attack Discovered - Infosecurity Magazine (infosecurity-magazine.com)

Mobile

• More Than 1,000 Android Phones Found Infected By Creepy New Spyware | Ars Technica

IOT

• BotenaGo Botnet Targets Millions Of IoT Devices With 33 Exploits (Bleepingcomputer.Com)

• Why the NSA Wants To Protect You From Your Toothbrush (msnbc.com)

Vulnerabilities

• Intel And AMD Address High Severity Vulnerabilities In Products And Drivers - Security Affairs

• Samba Update Patches Plaintext Passwork Plundering Problem – Naked Security (Sophos.Com)

• Microsoft Fixes Exchange Server Zero-Day (DarkReading.com)

• Palo Alto Networks Patches Zero-Day Affecting Firewalls Using GlobalProtect Portal VPN | ZDNet

• Researchers Wait 12 Months To Report Vulnerability With 9.8 Out Of 10 Severity Rating | Ars Technica

• Google Warns Hackers Used MacOS Zero-Day Flaw, Could Capture Keystrokes, Screengrabs | ZDNet

Data Breaches/Leaks

• Robinhood Discloses Data Breach Impacting 7 Million Customers (Bleepingcomputer.Com)

• This Top VPN Provider May Have Leaked Millions Of User Details | Techradar

Organised Crime & Criminal Actors

• UK Recorded 1.8m Computer Misuse Crimes During 2019 • The Register

• These Are The Top-Level Domains Threat Actors Like The Most (Bleepingcomputer.Com)

• Aleksandr Zhukov, Self-Described 'King Of Fraud,' Is Sentenced To 10 Years - Cyberscoop

• Cyber-Mercenary Group Void Balaur Attacks High-Profile Targets for Cash | Threatpost

• Humanizing Hackers: Entering The Minds Of Those Behind The Attacks - Help Net Security

Cryptocurrency/Cryptojacking

• How To Spot And Block Cryptominers On Your Network | CSO Online

Insider Threats

• Insider IP Theft Is Surging — and Most Can't Stop It (darkreading.com)

DoS/DDoS

• DDoS Attacks Shatter Records in Q3, Report Finds   | Threatpost

OT, ICS, IIoT and SCADA

• 83% of Critical Infrastructure Organisations Suffered Breaches, 2021 Cyber Security Research Reveals (darkreading.com)

Nation State Actors

• State Hackers Breach Defence, Energy, Healthcare Orgs Worldwide (Bleepingcomputer.Com)

• China’s next generation of hackers won’t be criminals. That’s a problem. | TechCrunch

• Suspected Chinese Hackers Hit Critical Infrastructure, Government Agencies In Espionage Operation - MSSP Alert

• Russian Cyber Crime Group Exploits SolarWinds Serv-U Vulnerability | SecurityWeek.Com

• Microsoft: Patch Zoho Bug Now to Stop Chinese Hackers - Infosecurity Magazine (infosecurity-magazine.com)

• North Korean Hackers Target The South's Think Tanks Through Blog Posts | ZDNet

• Iranian Threat Actors Attempt To Buy Stolen Data Of US Orgs, FBI Warns - Security Affairs

• 'Lyceum' Threat Group Broadens Focus to ISPs (darkreading.com)

Cloud

• Cloud Attack Analysis Unearths Lessons for Security Pros (darkreading.com)

Privacy

• There’s Been A Big Rise In Monitoring Workers At Home. We Should All Be Worried | ZDNet

• Spyware Providers Are Flocking To International Arms Fairs To Sell To NATO Foes - Cyberscoop

• CEO of Blacklisted Spyware Firm Quits - Infosecurity Magazine (infosecurity-magazine.com)

• The Metaverse Is the Ultimate Surveillance Tool (vice.com)

---

Reports Published in the Last Week

• Internet Organised Crime Threat Assessment (IOCTA) 2021 | Europol (europa.eu)

• Sophos 2022 Threat Report: Malware, Mobile, Machine learning and more! – Naked Security

• Kaspersky Q3 2021 DDoS Attack Report | Securelist

• Report: 74% Of IT Security Pros Want Better Penetration Testing | Venturebeat

---

Other News

• Booking.com Was Reportedly Hacked By A Us Intel Agency But Never Told Customers | Ars Technica

• Younger Generations Care Little About Cybersecurity - Help Net Security

• Hundreds Of Thousands Of Fake Warnings Of Cyber Attacks Sent From A Hacked FBI Email Server - Security Affairs

• The Rising Threat Stemming From Identity Sprawl | SecurityWeek.Com

• Playstation 5 Hacked—Twice! - Malwarebytes Labs | Malwarebytes Labs

• Hong Kong Cyber Attack Reveals That Apple Favours Latest OS Versions For Security Updates | Techspot

• Unique Challenges to Cyber-Security in Healthcare and How to Address Them (thehackernews.com)

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

The Risks Posed by Home Routers - Cyber Tip Tuesday 22 July 2020

Welcome to this week's Black Arrow Cyber Tip Tuesday, this week James is talking about risks posed by home routers.

A recent study in Germany of 127 home routers from 7 different brands including D-Link, Linksys, TP-Link and Zyxel found that almost 60 percent of models hadn't had a security update in over a year and most were affected by hundreds of known vulnerabilities. On top of that, they found that vendors were shipping updates with no fixes for critical vulnerabilities that have been known about for many years, some are even observed as being actively exploited.

Most routers are based on a Linux operating system which is patched and maintained regularly but the home router manufacturers are choosing to use old and known vulnerable versions of the operating system without sending updates to customers devices.

The lesser of the evils seemed to be Asus and Netgear who both applied more security fixes more frequently but another recent study found that 79 of Netgear's routers have a critical security vulnerability that would allow a remote attacker to take complete control of the device and the network behind which has been present since 2007.

With the increasing popularity of home working it is essential that both individuals and firms take in to account this increase in attack surface and apply appropriate controls and mitigations to prevent their data and their clients data from being captured by malicious third parties.

When approached correctly, home working can provide significant benefits to productivity without compromising security. Speak to us today to find out how you can achieve this.