Black Arrow Cyber Threat Briefing 11 August 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

75% of Organisations Worldwide Set to Ban ChatGPT and Generative AI Apps on Work Devices

Newly released research found that 75% of organisations worldwide are currently implementing or considering bans on ChatGPT and other generative Artificial Intelligence (AI) applications within the workplace, with 61% stating that it will be a long term or permanent solution. Despite this, the majority recognised the opportunity such applications bring to the workplace, with 55% believing it would increase efficiency. All in all, 81% remained in favour of AI, highlighting that whilst organisations see the benefit, they are not ready to take the plunge for fear of being caught flat-footed.

Many organisations may simply not have the expertise-in house or confidence to employ AI effectively. These organisations lack an effective AI management plan, which governs the usage of AI in the corporate environment, rather than banning it outright. By having a clear-set AI plan, organisations can use AI to improve their efficiency, whilst maintaining cyber resilience. An increasing number of organisations have approached us at Black Arrow to discuss how to embrace AI securely; contact us to see how we can help you.

Source: [Dark Reading]

How an Eight-Character Password Could be Cracked in Just a Few Minutes

Strong and complex passwords are necessary to protect online accounts and data from cyber criminals. Complex passwords typically use lowercase and uppercase characters, numbers, and special characters. But complexity by itself can still open your password to cracking if it doesn’t contain enough characters, according to research by security firm Hive Systems. The report found that a complex password of eight characters can be cracked in only five minutes, and other weaker or shorter passwords are cracked instantly. However, passwords that have a greater number of characters are less vulnerable: for example an 18 character password, even if only lowercase letters, would take 481,000 years for a computer to crack.

Since creating and remembering multiple complex and lengthy passwords on your own is impossible, a password manager is your best bet. By using a password manager for yourself or within your organisation, you can generate, store and apply strong passwords for websites and online accounts.

Source: [Techrepublic]

Ransomware Victims Surge 143% as Threat Actors Pivot to Zero-Day Exploits

The number of organisations that became victims of ransomware attacks surged 143% between the first quarter of 2022 and first quarter of this year, as attackers increasingly leveraged zero-day vulnerabilities to break into target networks.

In many of these attacks, threat actors did not bother to encrypt data belonging to victim organisations. Instead, they focused solely on stealing their sensitive data and extorting victims by threatening to sell or leak the data to others. The tactic left even those with otherwise robust backup and restoration processes backed into a corner; this highlights the need for organisations to be able to detect and ideally block anomalous exfiltration of data, and have effective and rehearsed incident response plans to address the concept of pure exfiltration, because having backups is not enough.

The costs of these types of controls continue to fall making them viable for even smaller businesses. Without tools like Managed Detection and Response (MDR) and Data Loss Prevention (DLP), attacks of this nature cannot be detected until it is too late to do anything to stop them.

Source: [Dark Reading]

How Executives’ Personal Devices Threaten Business Security

Individuals, including executives, are considered a major target for cyber attacks. Motivated attackers know the right individual people they want to go after to achieve their larger organisational goal, and they’ll use any means necessary to be successful.

A recent report found that most executives are using their personal devices for work, creating a “backdoor” for cyber criminals to access large organisations. 50% of executive respondents reported receiving work-related scams in their personal emails.

Personal device use can be effective for organisations, however they need to implement an effective bring-your-own-device (BYOD) procedure and provide employees, including executives, with frequent user awareness and education training. All users at all levels within an organisation need to understand the risks, and importantly the role they play in keeping the organisation secure.

Sources: [Help Net Security] [Security Affairs]

77% of Financial Firms Saw an Increase in Cyber Attack Frequency

According a recent report on the financial services sector, 77% of firms reported an increase in attack frequency, and 87% said attacks were more severe. These firms unanimously said they would look to outsource their cyber security programs to third-party providers to shore up their cyber defences. Among the respondents, firms need to protect hybrid work environments (62%), consolidate cyber security and managed IT services (41%) and tap industry-specific and regulatory expertise (33%).

Source: [SecurityMagazine]

Protecting Against Sophisticated Cyber Attacks Requires Layered Defences

Faced with an influx of sophisticated cyber threats, including usage of AI to further enhance the efficacy of social engineering attacks, and the growth of both malware-as-a-service (MaaS) and ransomware-as-a-service (RaaS), it is critical for organisations to invest in layered security defences.

Services like managed detection and response (MDR) are integral to monitoring, investigating and responding to threats in real time. But without a strong and comprehensive foundational cyber security posture, managed services alone cannot effectively mitigate threats. To ensure comprehensive defences against emerging threats, organisations must prioritise proactive measures that can stop attacks before they even start. As adversaries continue to refine their attack techniques, layered protection that covers every stage in the attack chain becomes imperative.

Source: [Forbes]

Managing Human Cyber Risks Matters Now More Than Ever

As artificial intelligence (AI) amplifies the sophistication and reach of phishing, vishing, and smishing attacks, understanding and managing human cyber risks has become increasingly vital, according to the SANS Institute. It makes sense as no matter the technological advancement, the human element has always been a point of entry for attackers.

A recent study found that mature security programs, marked by robust teams and leadership support, are characterised by having at least three full-time employees in their security awareness teams. In some cases, this isn’t feasible for an organisation and this is where outsourcing comes in. By outsourcing security awareness, organisations can ensure that they have access to security awareness experts, to keep their organisation educated. Here at Black Arrow we offer regular security and awareness training, bespoke to your organisation, for your employees and leadership team.

Source: [Help Net Security]

Hackers are Targeting Top Executives’ Microsoft 365 Accounts to Steal Work Logins

Cyber security provider Proofpoint reported that high-level execs at some of the world’s leading companies are repeatedly targeted with credential-stealing attacks. More alarmingly, according to Proofpoint, around one-third (35%) of the compromised users had multi-factor authentication (MFA) enabled.

The attacks come amid a rise in cases of EvilProxy, a phishing tool that allows attackers to steal even MFA-protected credentials. In the three months to June 2023, around 120,000 EvilProxy phishing emails were observed being sent to hundreds of targeted organisations globally, with many targeting Microsoft 365 user accounts in particular. Approximately 39% of the victims were C-level executives of which 17% were Chief Financial Officers, and 9% were Presidents and CEOs. Users must be trained effectively, to help mitigate the chance of them suffering a phishing attack. The C-suite is no exception.

Sources: [Help Net Security] [Security Affairs]

UK Shaken by Major Data Breaches

Recent major data breaches impacting crucial institutions like the UK Electoral Commission (which exposed the data of 40 million UK voters) and the Police Service of Northern Ireland, have brought attention to potential risks. Following a recent freedom of information request 10,000 police officers and staff details where published including details such as first name and surname, their rank or grade and the unit and where they are based. This breach occurred when a junior member of staff forgot to remove the master spreadsheet containing sensitive data when responding to the request.

Sources: [Telegraph] [Tech Crunch]

Threat of Cyber Attacks to UK National Security Upgraded: Compared to Chemical Weapons or Nuclear Attack

The UK government has raised the threat level posed by cyber attacks, now deeming the risk of cyber attacks to be more severe than that presented by small-scale chemical, biological, radiological, or nuclear (CBRN) attacks according to the latest National Risk Register (NRR) report for 2023. The report also highlighted artificial intelligence (AI) as a “chronic risk” – that is, one that poses “continuous challenges that erode our economy, community, way of life, and/or national security”.

Sources: [ITPro] [Infosecurity Magazine]

Mac Users are Facing More Dangerous Security Threats Than Ever Before

Apple’s MacBook Pro or iPhone devices are often perceived as safer, from a cyber security standpoint, compared to those from Microsoft or Google, mostly because of its “walled garden” approach. However, another key reason why hackers were not historically as interested in Apple was the smaller market share Apple held. That is no longer the case and as attacks are rising against Apple devices, this is something we expect to see continuing to accelerate.

In the last 10 years, Apple’s market share on desktop has increased from less than 7.5% to just over 20% today. Apple frequently patches actively exploited vulnerabilities, with overall 261 security vulnerabilities addressed so far this year. A recent report found that Mac users are targeted by three key threats: Trojans, Adware, and Potentially Unwanted Applications (PUA). Of the three, Trojans are the biggest single threat, making up more than half of all threat detections. Of all those detections, around half (52.7%) were for the EvilQuest encryption malicious software.

Source: [Techradar]

Cyber Attack to Cost Outsourcing Firm Capita up to £25m

Capita expects to take a financial hit of as much as £25m as a result of a cyber attack that began in March, pushing the outsourcing group to a pre-tax loss of almost £68m for the first half of the year. The group is still recovering from the attack by the Black Basta ransomware group, which hacked its Microsoft Office 365 software and accessed the personal data of staff working for the company and dozens of clients. Capita, which runs crucial services for local councils, the military, and the NHS, estimated that the financial costs associated with what it called the “cyber incident” would be between £20m and £25m. Previous estimates had put the cost at £15m to £20m.

The group said this new figure reflected the complexities of analysing the “exfiltrated” data, as well as costs of recovery and remediation and new investment to improve its cyber security. However, Capita said it was not currently able to estimate the level of any potential fine related to the incident and had not yet made any provision to cover any future costs. The company’s shares fell by more than 12% in morning trading on Friday after the release of its results, making it the biggest faller on the FTSE 250.

Source: [Guardian]

Government and Public Services Face 40% More Cyber Attacks and Struggle to Protect Due to Lack of Resources

A report published by BlackBerry noted a 40% rise in cyber attacks against public sector organisations and government institutions. One of the reasons is the limited resources and resistance that these government and public have; this makes it much easier for an attacker. An easy target is an attractive target.

Source: [Financial Express]

---

Governance, Risk and Compliance

• SMB cyber security: Cyber Security challenge: SMBs and large enterprises face common threat but separate response routes - The Economic Times (indiatimes.com)

• Protecting Against Sophisticated Cyber attacks Requires Layered Defense (forbes.com)

• Managing human cyber risks matters now more than ever - Help Net Security

• Executives 'sleepwalking into cyber catastrophe', warns cyber security boss (cityam.com)

• How To Deal With the Vagueness in New Cyber Regulations (darkreading.com)

• Recent threat intelligence study indicates reactive measures are prioritized by most organisations over proactive | SC Media (scmagazine.com)

• Digital skills gap is challenging the cyber security of UK businesses - IT Security Guru

• Cyber attack to cost outsourcing firm Capita up to £25m | Capita | The Guardian

• 9 common risk management failures and how to avoid them | TechTarget

• Alarming survey: Many tech experts fail a test of their cyber security knowledge - SiliconANGLE

• Safeguarding Businesses From Data Privacy And Cyber security Risk (forbes.com)

• How Do Some Companies Get Compromised Again and Again? (securityintelligence.com)

• What happens if cyber insurance becomes unviable? - Raconteur

• Only 22% of Firms Have Mature Threat Intelligence Programs - Infosecurity Magazine (infosecurity-magazine.com)

• NIST announces rare overhaul of security framework, focusing on organisational leadership | ITPro

• Protection is No Longer Straightforward – Why More Cyber Security Solutions Must Incorporate Context - Security Week

• Cyber Security Must Focus on the Goals of Criminals (informationweek.com)

• Going Up! How to Handle Rising Cyber Security Costs (securityintelligence.com)

• Maintaining Data Security Amidst Rising Concerns of Cyber attacks (techreport.com)

• Why it’s time for everyone to reorient their thinking about cyber security | Federal News Network

• 'Confusing, misleading or just plain wrong': Researchers explain why cyber security is needlessly complex - Study Finds

• It's Time for Cyber security to Talk About Climate Change (darkreading.com)

• Prioritizing cyber attacks still needs a lot of work, according to new Picus Labs report - SiliconANGLE

• It's not always malware (betanews.com)

• Act Before You're Hacked (forbes.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Healthcare and Finance Firms Ranked as Leading Targets for Cyber Attacks - MSSP Alert

• Ransomware victim numbers surge as attackers target zero-day vulnerabilities | CSO Online

• Definitive Guide to Ransomware 2023 | IBM whitepaper | ITPro | ITPro

• UK Think Tank Proposes Greater Ransomware Reporting From Cyber Insurance to Government – Security Week

• The ransomware rollercoaster continues as criminals advance their business models - Help Net Security

• Data exfiltration is now the go-to cyber extortion strategy - Help Net Security

• Clop ransomware now uses torrents to leak data and evade takedowns (bleepingcomputer.com)

• Spot Fake Extortion Attacks Without Wasting Time and Money (securityintelligence.com)

• The number of ransomware attacks targeting Finland increased fourfold since it started the process to join NATO - Security Affairs

• New Yashma Ransomware Variant Targets Multiple English-Speaking Countries (thehackernews.com)

• Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits (darkreading.com)

• Recent ransomware attacks share curiously similar tactics - Help Net Security

• Ransomware Attacks: 20 Essential Considerations For Prep And Response (forbes.com)

• Ransomware attacks cost manufacturing sector $46 billion in downtime since 2018, report claims | Tripwire

• Navigating the gray zone of ransomware payment practices - Help Net Security

• Anatomy of a Black Basta Ransomware Attack on BankCard USA - MSSP Alert

• Mallox Ransomware Group Revamps Malware Variants, Evasion Tactics (darkreading.com)

• Clop Gang Offers Data Downloads Via Torrents - Infosecurity Magazine (infosecurity-magazine.com)

• The volume of ransomware attacks is dropping - but it’s no time to get complacent (networkingplus.co.uk)

• FortiGuard Labs: Organisations Detecting Ransomware Decline as the Volume and Impact of Targeted Attacks Continue to Rise (fortinet.com)

• Suspected Vietnamese hacker targets Chinese, Bulgarian organisations with new ransomware (therecord.media)

• Ransomware gangs are targeting public schools | Fortune

• New Report Exposes Vice Society's Collaboration with Rhysida Ransomware (thehackernews.com)

• White House Holds First-Ever Summit on Ransomware Crisis Plaguing Public Schools (insurancejournal.com)

• Dallas pays millions for ransomware expenses after May attack – NBC 5 Dallas-Fort Worth (nbcdfw.com)

• Strong authentication best defence against Ransomware: Yubico (securitybrief.co.nz)

• Best practices for reporting ransomware attacks | TechTarget

• Ransomware, healthcare and incident response: Lessons from the Allscripts attack | CSO Online

• Microsoft OneDrive is a willing 'ransomware double agent' • The Register

• Threat Report: Ransomware Down, Targeted Attacks on the Rise (inforisktoday.com)

• Rasnake: Ransomware Now Threatens All, Not Just Elites | Newsmax.com

• The Ransomware Prevention Guide For SMBs - GovInfoSecurity

Ransomware Victims

• Hospital System Goes Back To Paper Following Ransomware Attack (forbes.com)

• ‘Data Security Incident’: 16 Hospitals across Four States Forced to Close after Cyber attack - News18

• Cyber attack forces hospitals to divert ambulances in Connecticut and Pennsylvania | CNN Politics

• Dallas pays millions for ransomware expenses after May attack – NBC 5 Dallas-Fort Worth (nbcdfw.com)

• Colorado Department of Higher Education warns of massive data breach (bleepingcomputer.com)

• Israel hospital hacking disrupts services; cyber attackers unknown - Israel News - The Jerusalem Post (jpost.com)

• Bnei Brak hospital hit by cyber attack, bringing down computers | The Times of Israel

• LockBit posts Siemens company Varian to its victim blog (techmonitor.ai)

• Breach Connected to MOVEit Flaw Affects Missouri Medicaid Recipients - Infosecurity Magazine (infosecurity-magazine.com)

• Hacker stole more than $6 million from New Haven Public Schools (wfsb.com)

Phishing & Email Based Attacks

• Hackers are targeting top executives to steal their work logins | TechRadar

• Microsoft 365 accounts of execs, managers hijacked through EvilProxy - Help Net Security

• 9 of 10 Cyber attacks Start with a Phish, Comcast Study Shows - MSSP Alert

• Microsoft Teams used in phishing campaign to bypass multi-factor authentication (malwarebytes.com)

• AI tools like ChatGPT increasingly used by cyber criminals for phishing, experts warn | NL Times

• First quarter of 2023 saw 88% rise in phishing attacks: Kaspersky | The Peninsula Qatar

• RTL Today - Up to 80% of all cyber attacks: Phishing attempts surge in post-pandemic age

• 100K+ VIP Microsoft 365 users got targeted by phishers - OnMSFT.com

• Microsoft’s Role in Email Breach to Be Part of US Cyber Inquiry - BNN Bloomberg

• Interpol takes down phishing-as-a-service platform used by 70,000 people (therecord.media)

BEC – Business Email Compromise

• 37% of third-party applications have high-risk permissions - Help Net Security

Other Social Engineering; Smishing, Vishing, etc

• Social engineering biggest threat to online safety - Avast (securitybrief.co.nz)

Artificial Intelligence

• 75% of Organisations Worldwide Set to Ban ChatGPT and Generative AI Apps on Work Devices (darkreading.com)

• When your teammate is a machine: 8 questions CISOs should be asking about AI | CSO Online

• Generative AI In Cyber Should Worry Us, Here’s Why (forbes.com)

• How to Prepare for ChatGPT's Risk Management Challenges (darkreading.com)

• AI chatbots like ChatGPT could be security nightmares - and experts are trying to contain the chaos | TechRadar

• Experience: scammers used AI to fake my daughter’s kidnap | Family | The Guardian

• White House offers prize money for hacker-thwarting AI (techxplore.com)

• Criminals Have Created Their Own ChatGPT Clones | WIRED UK

• AI making cyber attacks more effective - Tech Monitor

• AI tools like ChatGPT increasingly used by cyber criminals for phishing, experts warn | NL Times

• Data attacks set to enter new era under 'FraudGPT', warn cyber security execs (cityam.com)

• Hackers Released New Black Hat AI Tool Evil-GPT (cybersecuritynews.com)

• Cyber security In The Age Of AI (forbes.com)

• In the age of ChatGPT, Macs are under malware assault | Digital Trends

• AI can now steal your passwords with almost 100% accuracy | Digital Trends

• Microsoft AI Red Team building future of safer AI | Microsoft Security Blog

• ChatGPT Security Concerns: Credentials on the Dark Web and More (techrepublic.com)

• Why We Need to Manage the Risk of AI Browser Extensions - Infosecurity Magazine (infosecurity-magazine.com)

• AI hacking gets White House backing; some already go rogue (9to5mac.com)

• Zoom trains its AI model with some user data, without giving them an opt-out option - Security Affairs

• OpenAI to Unleash New Web Crawler to Devour More of the Open Web - Decrypt

• 5 Pitfalls and Possibilities AI Brings to Cyber Insurance (informationweek.com)

2FA/MFA

• Microsoft Teams used in phishing campaign to bypass multi-factor authentication (malwarebytes.com)

• Microsoft Authenticator will soon provide codes via WhatsApp - gHacks Tech News

• LastPass removes the master password from customers’ login with FIDO2 authenticators - Help Net Security

Malware

• In the age of ChatGPT, Macs are under malware assault | Digital Trends

• Mac users are facing more dangerous security threats than ever before | TechRadar

• Threat intelligence's key role in mitigating malware threats - Help Net Security

• This PowerPoint could help hackers empty your bank account | Digital Trends

• Safeguarding Against Silent Cyber Threats: Exploring the Stealer Log Lifecycle (bleepingcomputer.com)

• Israel cyber security agency says no breach after senior official self-infects home PC with malware | TechCrunch

• Latest Batloader Campaigns Use Pyarmor Pro for Evasion (trendmicro.com)

• Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems (thehackernews.com)

• Malicious npm Packages Found Exfiltrating Sensitive Data from Developers (thehackernews.com)

• Fake VMware vConnector package on PyPI targets IT pros (bleepingcomputer.com)

• New Malware Campaign Targets Inexperienced Cyber Criminals with OpenBullet Configs (thehackernews.com)

• Ukrainian state agencies targeted with open-source malware MerlinAgent (therecord.media)

• QakBot Malware Operators Expand C2 Network with 15 New Servers (thehackernews.com)

• This Mac Utility Is Now Malware (howtogeek.com)

• Hackers use open source Merlin post-exploitation toolkit in attacks (bleepingcomputer.com)

• New Statc Stealer Malware Emerges: Your Sensitive Data at Risk (thehackernews.com)

• Gafgyt malware exploits five-years-old flaw in EoL Zyxel router (bleepingcomputer.com)

• CISA: New Whirlpool backdoor used in Barracuda ESG hacks (bleepingcomputer.com)

Mobile

• Google explains how Android malware slips onto Google Play Store (bleepingcomputer.com)

• Czech cyber security experts warn against BaiRBIE.me app | Radio Prague International

• Removing Spyware From Your Android Phone: A How-To Guide (slashgear.com)

• How executives' personal devices threaten business security - Help Net Security

• Invisible Ad Fraud Targets Korean Android Users - Infosecurity Magazine (infosecurity-magazine.com)

• Google Play apps with 2.5M installs load ads when screen's off (bleepingcomputer.com)

• 40 Vulnerabilities Patched in Android With August 2023 Security Updates - Security Week

• Android 14 to let you block connections to unencrypted cellular networks (bleepingcomputer.com)

Botnets

• QakBot Malware Operators Expand C2 Network with 15 New Servers (thehackernews.com)

• Two-Thirds of UK Sites Vulnerable to Bad Bots - Infosecurity Magazine (infosecurity-magazine.com)

Denial of Service/DoS/DDOS

• Analysing Network Chaos Leads to Better DDoS Detection (darkreading.com)

• How to accelerate and access DDoS protection services using GRE - Help Net Security

• Researchers Strengthen Defences Against Common Cyber attack - CleanTechnica

Internet of Things – IoT

• What is IoT Security? | TechTarget

• Panasonic Warns That IoT Malware Attack Cycles Are Accelerating | WIRED

• Disposed-of Gadgets Can Lead to Wi-Fi Network Hacks, Kaspersky Says (darkreading.com)

• The new technology that is making cars easier for criminals to steal, or crash (techxplore.com)

Data Breaches/Leaks

• Executives 'sleepwalking into cyber catastrophe', warns cyber security boss (cityam.com)

• Over 200 Million Brits Have Data Compromised in Four Years - Infosecurity Magazine (infosecurity-magazine.com)

• The Top 10 Countries Being Bombarded by Data Breaches (gizmodo.com)

• UK Shaken by Major Data Breaches: Security Concerns Surge Over Data Protection Changes | Open Rights Group

• UK Electoral Commission hacked by 'hostile actors' | Reuters

• PSNI officers who work with MI5 face relocation after ‘humongous’ security breach (telegraph.co.uk)

• Northern Ireland police investigate second data breach after documents containing officers' names stolen | UK News | Sky News

• Burger King Serves Up Sensitive Data, No Mayo (darkreading.com)

• Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian

• TunnelCrack attack may cause vulnerable VPNs to leak traffic • The Register

• Phishing-resistant authentication a key to breach prevention (securitybrief.co.nz)

• How safe is my data after a hack or leak? - BBC News

Organised Crime & Criminal Actors

• Cloud Company Assisted 17 Different Government Hacking Groups: US Researchers | NTD

• New Malware Campaign Targets Inexperienced Cyber Criminals with OpenBullet Configs (thehackernews.com)

• IRS confirms takedown of bulletproof hosting provider Lolek (therecord.media)

• Interpol Shuts Down African Cyber crime Group, Seizes $2 Million (darkreading.com)

• Cyber security Must Focus on the Goals of Criminals (informationweek.com)

• How fame-seeking teenagers hacked some of the world’s biggest targets | Ars Technica

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• BlackBerry Discloses Major Crypto-Based Malware - The Tech Report

• FBI warns of phishing scams and social media account hijackers (cointelegraph.com)

• Crypto heavyweights back new cyber security standards after nearly $4 billion was lost to hacks in 2022 | Fortune Crypto

• Only 6 out of 45 crypto wallet brands have undergone penetration testing: Report (cointelegraph.com)

• Worldcoin is scanning eyeballs to build a global ID and finance system. Governments are not impressed (theconversation.com)

Insider Risk and Insider Threats

• Managing human cyber risks matters now more than ever - Help Net Security

• History’s Greatest Insider Threats - IT Security Guru

• US Navy sailors charged with stealing secret info for China • The Register

• Get consent before you monitor your staff, UK MPs suggest • The Register

Fraud, Scams & Financial Crime

• Rise in fraudsters spoofing the websites of leading UK banks | Computer Weekly

• Extended warranty robocallers fined $300 million after 5 billion scam calls (bleepingcomputer.com)

• Experience: scammers used AI to fake my daughter’s kidnap | Family | The Guardian

• Data attacks set to enter new era under 'FraudGPT', warn cyber security execs (cityam.com)

Impersonation Attacks

• Rise in fraudsters spoofing the websites of leading UK banks | Computer Weekly

Insurance

• What happens if cyber insurance becomes unviable? - Raconteur

• Cyber Insurance Experts Make a Case for Coverage, Protection (darkreading.com)

• 5 Pitfalls and Possibilities AI Brings to Cyber Insurance (informationweek.com)

• 10 Key Controls to Show Your Organisation Is Worthy of Cyber Insurance (darkreading.com)

• Lower Data Breach Insurance Costs with These Tips (trendmicro.com)

Dark Web

• Dark web activity targeting the financial sector - Help Net Security

• ChatGPT Security Concerns: Credentials on the Dark Web and More (techrepublic.com)

• Dark Web Threat Actors Targeting macOS | Accenture

Supply Chain and Third Parties

• Government contractor plunges after £25m cyber attack - The Mail (mailplus.co.uk)

• 37% of third-party applications have high-risk permissions - Help Net Security

Software Supply Chain

• Unravelling the importance of software supply chain security - Help Net Security

• OWASP Lead Flags Gaping Hole in Software Supply Chain Security (darkreading.com)

• 37% of third-party applications have high-risk permissions - Help Net Security

Cloud/SaaS

• Attackers Use EvilProxy to target C-suite Executives (inforisktoday.com)

• 100K+ VIP Microsoft 365 users got targeted by phishers - OnMSFT.com

• Credentials Account For Over Half of Cloud Compromises - Infosecurity Magazine (infosecurity-magazine.com)

• Cloud Company Assisted 17 Different Government Hacking Groups: US Researchers | NTD

• Microsoft OneDrive is a willing 'ransomware double agent' • The Register

• Managing and Securing Distributed Cloud Environments - Security Week

• How hybrid cloud is transforming cyber security | ITPro

• Microsoft 365 guests + Power Apps = security nightmare • The Register

Containers

• Kubernetes clusters under attack in hundreds of organisations | CSO Online

Identity and Access Management

• CrowdStrike observes massive spike in identity-based attacks | TechTarget

• Keeper Security reveals SMBs at risk due to lack of PAM (securitybrief.co.nz)

• Understanding Active Directory Attack Paths to Improve Security (thehackernews.com)

• 91% of IT leaders better protected with PAM but want more affordable solutions - IT Security Guru

• Strong authentication best defence against Ransomware: Yubico (securitybrief.co.nz)

• WhatsApp is working on phishing-proof passkey authentication (androidpolice.com)

• Phishing-resistant authentication a key to breach prevention (securitybrief.co.nz)

Encryption

• Cyber security Breakthrough: New Cipher System Protects Computers Against Spy Programs (scitechdaily.com)

• UK minister defends plan to demand access to encrypted messages | Privacy | The Guardian

• Quantum computing: A threat to asymmetric encryption. (thecyberwire.com)

• What if WhatsApp really does leave the UK? - Tech Monitor

Open Source

• Is Open Source Security a Ticking Cyber Time Bomb? (securityintelligence.com)

• Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems (thehackernews.com)

• Kemba Walden: We need to secure open source software | TechTarget

Passwords, Credential Stuffing & Brute Force Attacks

• Credentials Account For Over Half of Cloud Compromises - Infosecurity Magazine (infosecurity-magazine.com)

• How an 8-character password could be cracked in just a few minutes (techrepublic.com)

• AI can now steal your passwords with almost 100% accuracy | Digital Trends

• US Dept. of the Interior Employees Use Accounts That Are Easily Hacked (businessinsider.com)

• LastPass removes the master password from customers’ login with FIDO2 authenticators - Help Net Security

Biometrics

• Worldcoin is scanning eyeballs to build a global ID and finance system. Governments are not impressed (theconversation.com)

• Woman Falsely Arrested Sues Detroit Over Facial Recognition (govtech.com)

Social Media

• Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian

Malvertising

• Invisible Ad Fraud Targets Korean Android Users - Infosecurity Magazine (infosecurity-magazine.com)

• Google Play apps with 2.5M installs load ads when screen's off (bleepingcomputer.com)

• Not so fast: Don’t click that fake Amazon or Microsoft ad. Here’s why | Fox News

Training, Education and Awareness

• Managing human cyber risks matters now more than ever - Help Net Security

• Why Do Cyber security Awareness Programs Often Fail? (databreachtoday.co.uk)

Travel

• I'm a cyber security expert, here's why your airport selfie is a gift to scammers | Daily Mail Online

• Free Airline Miles, Hotel Points, and User Data Put at Risk by Flaws in Points Platform | WIRED

Parental Controls and Child Safety

• Cyber security expert warns parents of online predators, social media usage (wptv.com)

Cyber Bullying, Cyber Stalking and Sextortion

• Most domestic abuse cases feature spyware and remote monitoring, MPs warn | E&T Magazine (theiet.org)

• Baby monitors and smart speakers enabling abuse, say MPs - BBC News

Regulations, Fines and Legislation

• SEC Adopts Final Rules on Cyber security Risk Management, Strategy, Governance and Incident Disclosure by Public Companies | Akin Gump Strauss Hauer & Feld LLP - JDSupra

• How To Deal With the Vagueness in New Cyber Regulations (darkreading.com)

• What does the Data Protection and Digital Information (DPID) Bill mean for small businesses? | ITPro

• The Problem With Cyber security (and AI Security) Regulation (darkreading.com)

• CISA Unveils Cyber security Strategic Plan for Next 3 Years - Security Week

• The 5 Ways The SEC Failed Investors On Cyber security (forbes.com)

• What if WhatsApp really does leave the UK? - Tech Monitor

• America’s messy cyber regulations are no match for its adversaries | Financial Times (ft.com)

• Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian

• Banks hit with $549 million in fines for using Signal and WhatsApp to evade regulators (nbcnews.com)

• ICO threatens enforcement action against websites with 'harmful' cookie banners | ITPro

• UK minister defends plan to demand access to encrypted messages | Privacy | The Guardian

Models, Frameworks and Standards

• NIST Drafts Major Update to Its Widely Used Cyber security Framework | NIST

• Understanding NIST CSF and MITRE ATT&CK Security Frameworks - The New Stack

• OWASP Lead Flags Gaping Hole in Software Supply Chain Security (darkreading.com)

• Understanding Changes in the OWASP API Security Top 10 List - IT Security Guru

• 5 steps to ensure HIPAA compliance on mobile devices | TechTarget

Data Protection

• UK Shaken by Major Data Breaches: Security Concerns Surge Over Data Protection Changes | Open Rights Group

• Regulator: “Harmful” Web Design Could Break Data Protection Laws - Infosecurity Magazine (infosecurity-magazine.com)

• Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian

• ICO threatens enforcement action against websites with 'harmful' cookie banners | ITPro

Careers, Working in Cyber and Information Security

• Digital skills gap is challenging the cyber security of UK businesses - IT Security Guru

• Alarming survey: Many tech experts fail a test of their cyber security knowledge - SiliconANGLE

• Using creative recruitment strategies to tackle the cyber security skills shortage - Help Net Security

• Why cyber security is a blue-collar job - Help Net Security

• Will AI kill cyber security jobs? - Help Net Security

• Will CISOs become obsolete in the future? (betanews.com)

• 6 Essential Strategies for Enterprise Cyber security Workforce Development (govinfosecurity.com)

• Seasoned cyber pros are more complacent in their skills than junior staff - Help Net Security

Law Enforcement Action and Take Downs

• IRS confirms takedown of bulletproof hosting provider Lolek (therecord.media)

• Interpol takes down phishing-as-a-service platform used by 70,000 people (therecord.media)

Privacy, Surveillance and Mass Monitoring

• Missing persons NGO alliance kicks off global facial recognition initiative | Biometric Update

• China drafts rules for using facial recognition data - Japan Today

• Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian

• Zoom trains its AI model with some user data, without giving them an opt-out option - Security Affairs

• ICO threatens enforcement action against websites with 'harmful' cookie banners | ITPro

• Worldcoin is scanning eyeballs to build a global ID and finance system. Governments are not impressed (theconversation.com)

• Woman Falsely Arrested Sues Detroit Over Facial Recognition (govtech.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare and Cyber Espionage

Russia

• Electoral Commission cyber attack: Everything we know about the hack as Russia 'tops list' of suspects (inews.co.uk)

• BlueCharlie changes attack infrastructure in response to reports on its activity - Security Affairs

• The number of ransomware attacks targeting Finland increased fourfold since it started the process to join NATO - Security Affairs

• Microsoft Teams used in phishing campaign to bypass multi-factor authentication (malwarebytes.com)

• SpaceX's private control of satellite internet concerns military leaders | Space

• Analysts Say Use of Spyware During Conflict Is Chilling (voanews.com)

• Ukrainian state agencies targeted with open-source malware MerlinAgent (therecord.media)

• Cyber security experts discuss wins, losses and lessons at western Ukraine gathering : NPR

• Ukrainian official: Russian hackers change tactics from disruptive attacks | CyberScoop

• Ukraine Fends Off Sandworm Battlefield Espionage Ploy (govinfosecurity.com)

• Victor Zhora on cataloging cyber war crime evidence against Russian hackers targeting Ukraine | CyberScoop

• Microsoft addresses Office vulnerability attacked by Russian spooks in latest update | Computer Weekly

• Hackers with links to Pro-Russian groups compromised foreign embassies in Belarus, researchers say | CyberScoop

• New Cyber Threat 'MoustachedBouncer' Targets Embassies in Belarus - Infosecurity Magazine (infosecurity-magazine.com)

• Satellite hack on eve of Ukraine war was a coordinated, multi-pronged assault | CyberScoop

• US, Ukraine cyber leaders talk resilience, collaboration | TechTarget

• Kyiv Cyber Defenders Spot Open-Source RAT in Phishing Emails (govinfosecurity.com)

• North Korea compromised Russian missile engineering firm NPO Mashinostroyeniya - Security Affairs

• LockBit posts Siemens company Varian to its victim blog (techmonitor.ai)

China

• China-Linked Hackers Strike Worldwide: 17 Nations Hit in 3-Year Cyber Campaign (thehackernews.com)

• Electric vehicle threat: China will use its EV dominance to spy: UK warning (afr.com)

• UK security must not be sacrificed to net zero (telegraph.co.uk)

• Chinese cyber attacks on Japan prompts US push for stronger defences - Nikkei Asia

• China reportedly had ‘deep, persistent access’ to Japanese networks for months | Engadget

• Why the China cyber threat demands an airtight public-private response (federaltimes.com)

• China not ahead of US in cyber and surveillance, NSA head says - Nextgov/FCW

• China drafts rules for using facial recognition data - Japan Today

• US Navy sailors charged with stealing secret info for China • The Register

• RedHotel Checks in as Dominant China-Backed Cyber Spy Group (darkreading.com)

• US Navy sailors charged with stealing secret info for China • The Register

• APT31 Linked to Recent Industrial Attacks in Eastern Europe - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft’s Role in Email Breach to Be Part of US Cyber Inquiry - BNN Bloomberg

Iran

• Iranian state ‘now biggest threat to UK’ (thetimes.co.uk)

• Iranian cyber spies are targeting dissidents in Germany, warns intelligence service (therecord.media)

North Korea

• Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems (thehackernews.com)

• When the Absence of Noise Becomes Signal: Defensive Considerations for Lazarus FudModule (securityintelligence.com)

• North Korea compromised Russian missile engineering firm NPO Mashinostroyeniya - Security Affairs

Misc/Other/Unknown

• Cloud Company Assisted 17 Different Government Hacking Groups: US Researchers | NTD

• Security News This Week: The Cloud Company at the Center of a Global Hacking Spree | WIRED

---

Vulnerability Management

• Five Eyes Agencies Call Attention to Most Frequently Exploited Vulnerabilities - Security Week

• How an unpatched Microsoft Exchange 0-day likely caused one of the UK’s biggest hacks ever | Ars Technica

• Will CVSS 4.0 be a vulnerability-scoring breakthrough or is it broken? | CSO Online

• Microsoft hits back at Tenable’s criticism of its infosec • The Register

• The Four Pillars of Vulnerability Management - GovInfoSecurity

• Has Microsoft cut security corners once too often? | Computerworld

• Why Shellshock Remains a Cyber security Threat After 9 Years (darkreading.com)

• The 7 Worst Software Vulnerabilities of All Time (makeuseof.com)

Vulnerabilities

• Microsoft Patch Tuesday for August 2023 fixed 2 actively exploited flaws - Security Affairs

• Microsoft, Intel lead this month's security fix emissions • The Register

• Raft of TETRA Zero-Day Vulnerabilities Endanger Industrial Communications (darkreading.com)

• Nearly every AMD CPU since 2017 vulnerable to Inception bug • The Register

• Microsoft fixes flaw after being called irresponsible by Tenable CEO (bleepingcomputer.com)

• New PaperCut critical bug exposes unpatched servers to RCE attacks (bleepingcomputer.com)

• Google Chrome will get weekly security updates - gHacks Tech News

• Downfall: New Intel CPU Attack Exposing Sensitive Information - Security Week

• Adobe Releases Security Updates for Multiple Products | CISA

• New 'Inception' Side-Channel Attack Targets AMD Processors - Security Week

• Collide+Power, Downfall, and Inception: New Side-Channel Attacks Affecting Modern CPUs (thehackernews.com)

• Dell Credentials Bug Opens VMWare Environments to Takeover (darkreading.com)

---

Tools and Controls

• Managing human cyber risks matters now more than ever - Help Net Security

• Windows Defender-Pretender Attack Dismantles Flagship Microsoft EDR (darkreading.com)

• MDR: Empowering Organisations with Enhanced Security (thehackernews.com)

• 9 common risk management failures and how to avoid them | TechTarget

• Why Do Cyber security Awareness Programs Often Fail? (databreachtoday.co.uk)

• Only 22% of Firms Have Mature Threat Intelligence Programs - Infosecurity Magazine (infosecurity-magazine.com)

• Here’s Why You Need Identity, Privacy, and Device Protection (finextra.com)

• What Is Content Disarm and Reconstruction? How CDR Tools Protect You From Malicious Files (makeuseof.com)

• Attacker Breakout Time Shrinks Again, Underscoring Need for Automation (darkreading.com)

• Managing and Securing Distributed Cloud Environments - Security Week

• How to handle API sprawl and the security threat it poses - Help Net Security

• Threat intelligence's key role in mitigating malware threats - Help Net Security

• What Is Comprehensive Cyber-Resiliency? - The Futurum Group

• The Role of AI in Cyber security and Threat Detection: 5 Use Cases | by David Silva | Aug, 2023 | UX Planet

• Phishing-resistant authentication a key to breach prevention (securitybrief.co.nz)

• 10 Key Controls to Show Your Organisation Is Worthy of Cyber Insurance (darkreading.com)

• Lower Data Breach Insurance Costs with These Tips (trendmicro.com)

• AI Risk Database Tackles AI Supply Chain Risks (darkreading.com)

Other News

• UK Sounds Warning Over Targeted Healthcare Attack (databreachtoday.co.uk)

• British Government Report Highlights Pressing Risks: Terrorism, Cyber Attacks, and International Conflicts - Shafaq News

• Budget constraints threaten cybersecurity in government bodies - Help Net Security

• Threat of cyber attacks to national security compared to that of chemical weapons | ITPro

• UK Government: Cyber Attacks Could Kill or Maim Thousands - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber Signals: Sporting events and venues draw cyberthreats at increasing rates | Microsoft Security Blog

• Cyber Security A Major Vulnerability In The Not For Profit Sector | Scoop News

• Government and public services face 40% more cyberattacks, struggle to protect due to lack of resources: Report | The Financial Express

• Hacker attacks on Mac users are 10x as high as they were in 2019, report says | iMore

• Venture Capital Investments at Risk: DynaRisk Identifies Critical Cybersecurity Gaps in Companies Backed By Some Of London’s Biggest VC Funds | Pressat

• Cyber Security Threats From Online Gaming – Analysis – Eurasia Review

• Satellites easier to hack than a Windows device | Cybernews

• Cyber attack cost Interserve more than £11m | News | Building

• Exploitable Vulnerabilities That Expose Healthcare Facilities Surged Nearly 60% Since 2022, New Research Report Finds (prweb.com)

• Environmental Regulations, OT & the Maritime Industry's New Challenges (darkreading.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 20 August 2021

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

A Third of Global Companies Have Experienced Ransomware Attack, Survey Finds

Roughly a third of large international companies have faced a ransomware attack or other data breach in the last 12 months, according to a new survey.

Analysts surveyed almost 800 companies and found 37% of international companies experienced ransomware attacks this past year. The survey focused on companies with more than 500 employees.

https://www.vice.com/en/article/jg84q3/a-third-of-global-companies-have-experienced-ransomware-attack-survey-finds

Company Size Is A Nonissue With Automated Cyber Attack Tools

Even with plenty of old problems to contend with, firms need to get ready for new and more powerful automated ransomware tools.

Cyber criminals are constantly looking for the best return on their investment and solutions that lower the chance of being caught. Sadly, that appears to mean small businesses are their current target of opportunity.

Tech media and cyber pundits have been sounding the alarm and offering small businesses specific cybersecurity solutions for a few years now, but it seems to no avail.

https://www.techrepublic.com/article/company-size-is-a-nonissue-with-automated-cyberattack-tools/

Over 60% Of Employees Reuse Passwords Across Business And Personal Accounts

Nearly two thirds of employees are using personal passwords to protect corporate data, and vice versa, with even more business leaders concerned about this very issue. Surprisingly, 97% of employees know what constitutes a strong password, yet over half (53%) admit to not always using one.

http://hrnews.co.uk/over-60-of-employees-reuse-passwords-across-business-and-personal/

LockBit 2.0 Ransomware Proliferates Globally 

Fresh attacks target companies’ employees, promising millions of dollars in exchange for valid account credentials for initial access.

The LockBit ransomware-as-a-service (RaaS) gang has ramped up its targeted attacks, researchers said, with attempts against organizations in Chile, Italy, Taiwan and the U.K. using version 2.0 of its malware.

https://threatpost.com/lockbit-ransomware-proliferates-globally/168746/

Secret Terrorist Watchlist With 2 Million Records Exposed Online

A secret terrorist watchlist with 1.9 million records, including classified "no-fly" records was exposed on the internet.

The list was left accessible on an Elasticsearch cluster that had no password on it.

https://www.bleepingcomputer.com/news/security/secret-terrorist-watchlist-with-2-million-records-exposed-online/

Phishing Costs Nearly Quadrupled Over 6 Years

Lost productivity & mopping up after the costly attacks that follow phishing – BEC & ransomware in particular – eat up most costs, not pay-outs to crooks.

Research shows that the cost of phishing attacks has nearly quadrupled over the past six years: Large US companies are now losing, on average, $14.8 million annually, or $1,500 per employee.

That’s up sharply from 2015’s figure of $3.8 million, according to a new study from Ponemon Institute that was sponsored by Proofpoint.

According to the study, released Tuesday, phishing leads to some of the costliest cyber attacks.

https://threatpost.com/phishing-costs-quadrupled/168716/

Security Teams Report Rise In Cyber Risk

A recent report shows declining confidence in many organisations’ security function to address today’s threats.

80% of respondents to the Trend Micro’s biannual Cyber Risk Index (CRI) report said they expect to experience a data breach that compromises customer data in the next 12 months.

The report surveyed more than 3,600 businesses of all sizes and industries across North America, Europe, Asia-Pacific, and Latin America for their thoughts on cyber risk. Despite an increased focus on security due to high-profile ransomware and other attacks in the past year, respondents reported a rise in risk due to inadequate security processes like backing up key assets.

Organisations are overwhelmed as they pivot from traditional to distributed networks. Pandemic-driven work-from-home growth is potentially how businesses will be run going forward. That distributed network means that it’s harder for IT staff to know what assets are under their control and what security controls should be in place. With the line blurring between corporate and personal assets, organizations are overwhelmed with the pace of change.

https://www.csoonline.com/article/3629477/security-teams-report-rise-in-cyber-risk.html

Organisations Aware Of The Importance Of Zero Trust, Yet Still Relying On Passwords

Organisations have become more security conscious over the course of the pandemic, leading them to invest heavily in zero trust, according to a new study.

The report surveyed over 600 global security leaders about their initiatives and found that remote work has led to a change in how organizations view the importance of zero trust, with financial services, healthcare organisations and the software industry seeing the most significant progress.

78% of companies globally say that zero trust has increased in priority and nearly 90% are currently working on a zero trust initiative, up from just 41% a year ago.

https://www.helpnetsecurity.com/2021/08/11/importance-of-zero-trust/

Reliance On Third Party Workers Making Companies More Vulnerable To Cyber Attacks

A new survey revealed 83% of respondents agree that because organisations increasingly rely on contractors, freelancers, and other third party workers, their data systems have become more vulnerable to cyber attacks.

Further, 88% of people say organisations and government entities must have better data security systems in place to protect them from the increase in third party remote attacks.

Recent high-profile breaches, including SolarWinds, Colonial Pipeline, and JBS Foods, have exposed how vulnerable organisations are to cyber crime and in particular ransomware attacks. Of note with recent attacks is how data breaches can quickly affect aspects of everyday life, such as the ability to fill a car with petrol or buy meat at the supermarket.

https://www.helpnetsecurity.com/2021/08/16/reliance-on-third-party-workers/

The Cyber Security Skills Gap Persists For The Fifth Year Running

Most organisations are still lacking talent, according to a new report, but experts think expanding the definition of a cybersecurity professional can help.

https://www.techrepublic.com/article/the-cybersecurity-skills-gap-persists-for-the-fifth-year-running/

T-Mobile Hack Is A Return To The Roots Of Cyber Crime

In the world of cyber crime, ransomware attacks might be the sophisticated bank heists. The hack of T-Mobile is more akin to smashing a window, grabbing merchandise, and running.

The attack that exposed the personal information of millions of T-Mobile customers spotlights a common type of cyber threat that can inflict significant damage to consumers, much like the recent rash of ransomware attacks hitting companies.

The breach exposed the data of more than 40 million people, T-Mobile confirmed Wednesday, including customer’s full names and driver’s license information. A hacker posted about the stolen information on a cyber crime forum late last week, offering to sell the information to buyers for the price of six bitcoin, or about $270,000.

This type of attack, in which hackers worm their way into companies’ systems, steal data and try to sell it online, has been a common tactic for years, cyber security experts say. Unlike the high-profile ransomware attacks that have disrupted fuel supplies, hospital systems and food production in recent months, these data exfiltration hacks do not lock down computer systems.

https://www.washingtonpost.com/technology/2021/08/19/tmobile-breach-data-hacks/

Phishing Attacks Increase In H1 2021, Sharp Jump In Crypto Attacks

The first half of 2021 shows a 22 percent increase in the volume of phishing attacks over the same time period last year, a new report reveals. Notably, however, phishing volume in June dipped dramatically for the first time in six months, immediately following a very high-volume in May.

Bad actors continue to utilise phishing to fleece proprietary information, and are developing more sophisticated ways to do so based on growth in areas such as cryptocurrency and sites that use single-sign-on.

https://www.helpnetsecurity.com/2021/08/19/phishing-attacks-h1-2021/

Connected Devices Increasingly At Risk As New Ransomware Attacks Are Reported Almost Daily

A new report has shined a light on the state of connected devices. The number of agentless and un-agentable devices increased to 42% in this year’s report (compared to 32% of agentless or un-agentable devices in 2020). These devices include medical and manufacturing devices that are critical to business operations along with network devices, IP phones, video surveillance cameras and facility devices (such as badge readers) that are not designed with security in mind, cannot be patched, and cannot support endpoint security agents.

With almost half of devices in the network that are either agentless or un-agentable, organisations need to complement their endpoint security strategy with a network-based security approach to discover and secure these devices.

https://www.helpnetsecurity.com/2021/08/12/connected-devices-risks/

---

Threats

Ransomware

• John Oliver On Ransomware Attacks: ‘It’s In Everyone’s Interest To Tet This Under Control’

• Hospitals Hamstrung By Ransomware Are Turning Away Patients

• Half Of US Hospitals Shut Down Networks Due To Ransomware

• Device Complexity Leaving Schools At Heightened Risk Of Ransomware Attacks

• This Ransomware Has Returned With New Techniques To Make Attacks More Effective

• Diavol Ransomware Sample Shows Stronger Connection To TrickBot Gang

• Ransomware Criminals' Demands Rise As Aggressive Tactics Pay Off

BEC

• 23 Charged Over Covid-19 Business Email Compromise Fraud

Phishing

• "Jigsaw Puzzle" Phishing Attacks Use Morse Code To Hide

• Cyber Attackers Embrace CAPTCHAs To Hide Phishing, Malware

• WordPress Sites Abused In Aggah Spear-Phishing Campaign

• This Microsoft 365 Spear-Phishing Campaign Has Been Running Riot For Over A Year

Other Social Engineering

• Delivery Scams Most Prominent Form Of Smishing

Malware

• Malware Campaign Uses Clever 'Captcha' To Bypass Browser Warning

• Malware Dev Infects Own PC And Data Ends Up On Intel Platform

• Researchers Discover New AdLoad Malware Campaigns Targeting Macs And Apple Products

Mobile

• How Hackers Can Use Message Mirroring Apps To See All Your SMS Texts — And Bypass 2FA Security

IOT

• Amazon Sidewalk Highlights Network Security Visibility Risks Consumer Services Pose

Vulnerabilities

• Multiple Flaws Affecting Realtek Wi-Fi SDKs Impact Nearly A Million IoT Devices

• Unpatched Remote Hacking Flaw Disclosed In Fortinet's FortiWeb WAF

• Linux Glibc Security Fix Created A Nastier Linux Bug

• 65 Vendors Affected By Severe Vulnerabilities In Realtek Chips

• Eight-Year-Old Bug In Microsoft's 64-Bit VBA Prompts Complaints Of Neglect

• Cisco Won’t Fix Zero-Day RCE Vulnerability In End-Of-Life VPN Routers

• Adobe Addresses Two Critical Vulnerabilities In Photoshop

Data Breaches/Leaks

• Chase Bank Accidentally Leaked Customer Info To Other Customers

• Colonial Pipeline Reports Data Breach After May Ransomware Attack

• Ford Bug Exposed Customer And Employee Records From Internal Systems

Dark Web

• Dark Web Blockchain Analysis Tool Suspended After Flurry Of Media Coverage

• Dark Web Drug Dealer Indicted For Laundering $137 Million In Bitcoin From Prison

• Dark Web Criminals Have Built A Tool That Checks For Dirty Bitcoin

Supply Chain

DoS/DDoS

• Attackers Can Weaponize Firewalls And Middleboxes For Amplified DDoS Attacks

• Botnet Generates One of the Largest DDoS Attacks on Record

OT, ICS, IIoT and SCADA

• Mysterious Hacker Group Suspected In July Cyber Attack On Iranian Trains

Nation State Actors

• Chinese Espionage Tool Exploits Vulnerabilities In 58 Widely Used Websites

• North Korea Hackers Spreading Malware Via Browser Exploits

Cloud

• The Overlooked Security Risks Of The Cloud

---

Other News

• Blackbaud – Firm That Paid Off Crooks After 2020 Ransomware Attack – Fails To Get California Privacy Law Claim Dropped

• Threat Actors Hacked US Census Bureau In 2020 By Exploiting A Citrix Flaw

• Cyber Security Is Top Priority For Enterprises As They Shift To Digital-First Operating Models

• SMEs Awareness Of GDPR Is High, But Few Adhere To Its Legal Requirements

• Hacker Finds A Way To Steal Windows 365 User Names And Passwords

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 23 July 2021

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

---

Top Cyber Stories of the Last Week

40% Fell Victim To A Phishing Attack In The Past Month

The global shift to remote work has exacerbated the onslaught, sophistication, and impact of phishing attacks, according to Ivanti. Nearly three-quarters (74%) of respondents said their organisations have fallen victim to a phishing attack in the last year, with 40% confirming they have experienced one in the last month.

Eighty percent of respondents said they have witnessed an increase in volume of phishing attempts and 85% said those attempts are getting more sophisticated. In fact, 73% of respondents said that their IT staff had been targeted by phishing attempts, and 47% of those attempts were successful.

Smishing and vishing scams are the latest variants to gain traction and target mobile users. According to recent research by Aberdeen, attackers have a higher success rate on mobile endpoints than on servers – a pattern that is trending dramatically worse. Meanwhile, the annualized risk of a data breach resulting from mobile phishing attacks has a median value of about $1.7M, and a long tail of value of about $90M.

https://www.helpnetsecurity.com/2021/07/23/risk-phishing-attacks/

Traditional Ransomware Defences Are Failing Businesses

Traditional cyber security strategies are failing to protect organisations from ransomware attacks, new research suggests. Based on a poll of 200 IT decision-makers whose businesses recently suffered ransomware attacks, 54 percent of all victims had their employees go through anti-phishing training. Furthermore, almost half (49 percent) had perimeter defences set up at the time of the attack. However, attack methods have grown too sophisticated for traditional security measures to keep up. Many attacks (24 percent) still start with a successful phishing attempt, while almost a third (31 percent) see attacker enter the network through public cloud.

https://www.itproportal.com/news/traditional-ransomware-defenses-are-failing-businesses/

Cyber Security Risk: The Number Of Employees Going Around IT Security May Surprise You

Last month, a report was published highlighting challenges associated with enabling IT freedoms while ensuring tight security procedures. The findings detail a complex balancing act between IT teams and network users. Calibrating this equilibrium is particularly challenging in the age of remote work as employees log on and virtually collaborate via a host of digital solutions. Overall, the survey found that virtually all employees (93%) "are working around IT restrictions," and a mere 7% said they were "satisfied with their corporate IT restrictions." Interestingly, this information about IT workarounds does not match security leaders' and IT expectations.

https://www.techrepublic.com/article/cybersecurity-risk-the-number-of-employees-going-around-it-security-may-surprise-you/

740 ransomware victims named on data leak sites in Q2 2021: report

More than 700 organizations were attacked with ransomware and had their data posted to data leak sites in Q2 of 2021, according to a new research report from cyber security firm Digital Shadows.

Out of the almost 2,600 victims listed on ransomware data leak sites, 740 of them were named in Q2 2021, representing a 47% increase compared to Q1.

https://www.zdnet.com/article/740-ransomware-victims-named-on-data-leak-sites-in-q2-2021-report/

A More Dynamic Approach Is Needed To Tackle Today’s Evolving Cyber Security Threats

For decades, the cyber security industry has followed a defense-in-depth strategy, which allowed organisations to designate the battlefield against bad actors at their edge firewall. Nowadays, cyber criminals have become as creative as ever. New cyber threats are emerging every day, and with the constantly increasing rate of Ransomware, Phishing, etc. We’re forced to take a more dynamic approach when tackling these cyber threats on a day to day basis. Recent statistics demonstrate the scale of the cyber security issues faced by companies. In 2020, malware attacks increased by 358% and ransomware increased by 435%, and the average cost of recovering from a ransomware attack has doubled in the last 12 months, reaching almost $2 million in 2021.

https://www.helpnetsecurity.com/2021/07/13/dynamic-approach-cybersecurity-threats/

Law Firm For Ford, Boeing, Exxon, Marriott, Walgreens, And More Hacked In Ransomware Attack

Campbell Conroy & O'Neil, P.C., a law firm handling hundreds of cases for the world's leading companies, has announced a large data breach that resulted from a ransomware attack in February.  In a statement, the law firm said it noticed unusual activity on its network on February 27. The firm later realized it was being hit with a ransomware attack and contacted the FBI as well as cyber security companies for help.

https://www.zdnet.com/article/law-firm-for-ford-boeing-exxon-marriott-walgreens-and-more-hacked-in-ransomware-attack/

UK And Allies Accuse China Of 'Reckless' Cyber Extortion And Microsoft Hack

The Government was hinting yet again at covertly using Britain’s own offensive cyber capabilities – hitting back at cyber attacks with cyber attacks of our own. This approach goes all the way back to 2013, when then defence secretary told the Conservative Party conference that the UK would “build a dedicated capability to counter-attack in cyber space and, if necessary, to strike in cyber space”.

https://www.telegraph.co.uk/world-news/2021/07/19/uk-allies-accuse-china-reckless-cyber-extortion-microsoft-hack/

Even after Emotet takedown, Office docs deliver 43% of all malware downloads now

Malware delivered over the cloud increased by 68% in Q2, according to data from cyber security firm Netskope.

The company released the fifth edition of its Cloud and Threat Report that covers the cloud data risks, threats and trends they see throughout the quarter.

The report noted that cloud storage apps account for more than 66% of cloud malware delivery.

"In Q2 2021, 43% of all malware downloads were malicious Office docs, compared to just 20% at the beginning of 2020. This increase comes even after the Emotet takedown, indicating that other groups observed the success of the Emotet crew and have adopted similar techniques," the report said.

https://www.zdnet.com/article/even-after-emotet-takedown-office-docs-deliver-43-of-all-malware-downloads-now/

Gun Owners' Fears After Firearms Dealer Data Breach

Thousands of names and addresses belonging to UK customers of a leading website for buying and selling shotguns and rifles have been published to the dark web following a "security breach".

Guntrader.uk told the BBC it learned of the breach on Monday and had notified the Information Commissioner's Office.

Police, including the National Crime Agency, are investigating.

One affected gun owner said he was afraid the breach could lead to his family being targeted by criminals.

Gun ownership is tightly controlled in the UK, making guns difficult to acquire, and potentially valuable on the black market.

The individual, who did not wish to be named, told the BBC the breach "seriously compromises my security arrangements for my firearms and puts me in a situation where me and my family could be targeted and in danger".

https://www.bbc.co.uk/news/technology-57932823  

---

Threats

Ransomware

• SpearTip Finds New Diavol Ransomware Does Steal Data

• The Ransomware Point Of Attack Is Sharper

• Ransomware Incident At Major Cloud Provider Disrupts Real Estate, Title Industry

• In The Fight Against Ransomware, Microsoft Must Do More

• Tracking Malware And Ransomware Domains In 2021

BEC

Phishing

• Google Chrome Now Comes With Up To 50x Faster Phishing Detection

Malware

• Leaked NSO Group Data Hints At Widespread Pegasus Spyware Infections

• This New Malware Hides Itself Among Windows Defender Exclusions To Evade Detection

• MacBook Users Beware! Hackers Are Buying $49 Malware To Wreak Havoc On MacOS

• New MosaicLoader Malware Targets Software Pirates Via Online Ads

• CISA Warns Of Stealthy Malware Found On Hacked Pulse Secure Devices

• This Password-Stealing Windows Malware Is Distributed Via Ads In Search Results

• Pirate Gamers, Beware: This Malware Targets You

Mobile

• Joker Malware Returns To Target Millions More Android Devices

Vulnerabilities

• You'll Want To Shut Down The Windows Print Spooler Service (Yes, Again): Another Privilege Escalation Bug Found

• Google Patches Chrome Zero-Day, Eighth One In 2021

• Researcher Uncovers Yet Another Unpatched Windows Printer Spooler Vulnerability

• 16-Year-Old Security Bug Affects Millions Of HP, Samsung, Xerox Printers

• Fortinet Fixes Bug Letting Unauthenticated Hackers Run Code As Root

• Windows 10 Vulnerability Lets Anyone Get Administrator Privileges

• Researchers Discover Security Flaws In Telegram Encryption Protocol

• New Sequoia Bug Gives You Root Access On Most Linux Systems

• Microsoft Shares Workaround For Windows 10 SeriousSAM Vulnerability

• Apple Issues Urgent iPhone Updates; None for Pegasus Zero-Day

Data Breaches

• Aruba Waited Months To Notify Customers Regarding A Recent Data Breach

• Data Breach Claimants Lose Bid For Anonymity In Court

• Oil Giant Saudi Aramco Hit By 1TB Data Breach

Organised Crime & Criminal Actors

• Botnet Operator Who Proxied Traffic For Other Cybercrime Groups Pleads Guilty

Supply Chain

• NPM Package Steals Passwords via Chrome’s Account-Recovery Tool

DoS/DDoS

• DDoS: Google Has A New Tool To Defend Against Attacks Launched By Botnets

OT, ICS, IIoT and SCADA

• Industrial Networks Exposed Through Cloud-Based Operational Tech

Nation State Actors

• Iranian State Sponsored Hacking Attempts

• UK And Allies Hold Chinese State Responsible For Pervasive Pattern Of Hacking

• China Accused Of Cyber-Attack On Microsoft Exchange Servers

• Chinese Hacking Group APT31 Uses Mesh Of Home Routers To Disguise Attacks

• France Warns Of APT31 Cyber Spies Targeting French Organisations

• APT Hackers Distributed Android Trojan Via Syrian E-Government Portal

Cloud

• Why The Bank Of England Has Its Head In The Cloud Over Data Security

Privacy

• FT Editor Among 180 Journalists Identified By Clients Of Spyware Firm

• Revealed: leak uncovers global abuse of cyber surveillance weapon

---

Other News

• Is Open-Source Software Secure?

• Application Security Tools Ineffective Against New And Growing Threats

• Pegasus: What Is The Israeli Spyware And How Can You Tell If It’s On Your Phone?

• UK.Gov's Huawei Watchdog Says Firm Made 'No Overall Improvement' On Firmware Security But Won't Say Why

• DHS Releases New Mandatory Cyber Security Rules For Pipelines After Colonial Ransomware Attack

• 1 in 5 companies fail PCI compliance assessments of their infrastructure

• Biden Puts a $10M Bounty on Foreign Hackers

• MITRE updates list of top 25 most dangerous software bugs

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 04 December 2020

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities and cyber related news from the last week.

---

Top Cyber Headlines of the Week

Covid vaccine supply chain targeted by hackers, say security experts

Cyber attackers have targeted the cold supply chain needed to deliver Covid-19 vaccines, according to a report detailing a sophisticated operation likely backed by a nation state. 

The hackers appeared to be trying to disrupt or steal information about the vital processes to keep vaccines cold as they travel from factories to hospitals and doctors’ offices.

https://www.ft.com/content/9c303207-8f4a-42b7-b0e4-cf421f036b2f

Criminals to Favour Ransomware and BEC Over Breaches in 2021

The era of the mega-breach may be coming to an end as cyber-criminals eschew consumers’ personal data and focus on phishing and ransomware.

Cyber-criminals are relying less on stolen personal information and more on “poor consumer behaviors” such as password reuse to monetize attacks.

https://www.infosecurity-magazine.com/news/criminals-favor-ransomware-bec/

Bank Employee Sells Personal Data of 200,000 Clients

South Africa–based financial services group Absa has stated that one of its employees sold the personal information of 200,000 clients to third parties.

The group confirmed on Wednesday that the illegal activity had occurred and that 2% of Absa's retail customer base had been impacted.

The employee allegedly responsible for it was a credit analyst who had access to the group's risk-modeling processes.

Data exposed as a result of the security incident included clients' ID numbers, addresses, contact details, and descriptions of vehicles that they had purchased on finance.

https://www.infosecurity-magazine.com/news/bank-employee-sells-personal-data/

LastPass review: Still the leading password manager, despite security history

"'Don't put all your eggs in one basket' is all wrong. I tell you 'put all your eggs in one basket, and then watch that basket,'" said industrialist Andrew Carnegie in 1885. When it comes to privacy tools, he's usually dead wrong. In the case of password managers, however, Carnegie is usually more dead than wrong. To wit, I have been using LastPass so long I don't know when I started using LastPass and, for now, I've got no reason to change that. 

https://www.cnet.com/news/lastpass-review-still-the-leading-password-manager-despite-security-history/

The most significant security innovations of 2020

Who gets access? That is the question that drives every security measure and innovation that’s landed on PopSci’s annual compendium since we launched the category in 2008. Every year, that question gets bigger and bigger. In 2020, the world quaked under a global pandemic that took 1.4 million lives, the US saw a rebirth in its civil rights movement, and a spate of record-breaking wildfires forced entire regions to evacuate. And those are just the new scares. A buildup of angst against ad trackers and app snooping led to major changes in hardware and software alike. It was a year full of lessons, nuances, and mini revolutions, and we strive to match that with our choices.

https://www.popsci.com/story/technology/most-important-security-innovations-2020/

2020 security priorities: Pandemic changing short- and long-term approaches to risk

Security planning and budgeting is always an adventure. You can assess current risk and project the most likely threats, but the only real constant in cybersecurity risk is its unpredictability. Layer a global pandemic on top of that and CISOs suddenly have the nearly impossible task of deciding where to request and allocate resources in 2021.

Show how the COVID pandemic has changed what security focuses on now and what will drive security priorities and spending in 2021. Based on a survey of 522 security professionals from the US, Asia/Pacific and Europe, the study reveals how the pandemic has changed the way organizations assess risk and respond to threats—permanently.

https://www.csoonline.com/article/3598393/new-study-shows-pandemic-changing-short-and-long-term-approaches-to-risk.html

Cyber risks take the fun out of connected toys

As Christmas approaches, internet-enabled smart toys are likely to feature heavily under festive trees. While some dolls of decades past were only capable of speaking pre-recorded phrases, modern equivalents boast speech recognition and can search for answers online in real time.

Other connected gadgets include drones or cars such as Nintendo’s Mario Kart Live Home Circuit, where players race each other in a virtual world modelled after their home surroundings.

But for all the fun that such items can bring, there is a risk — poorly-secured Internet of Things toys can be turned into convenient tools for hackers.

https://www.ft.com/content/c653e977-435f-4553-8401-9fa9b0faf632

Remote Workers Admit Lack of Security Training

A third of remote working employees have not received security training in the last six months.

400 remote workers in the UK across multiple industries, while 83% have had access to security best practice training and 88% are familiar with IT security policies, 32% have received no security training in the last six months.

Also, 50% spend two or more hours a week on IT issues, and 42% felt they had to go around the security policies of their organization to do their job.

https://www.infosecurity-magazine.com/news/remote-workers-training/ 

---

Threats

---

Ransomware

Delaware County Pays $500,000 Ransom After Outages

A US county is in the process of paying half-a-million dollars to ransomware extorters who locked its local government network, according to reports.

Pennsylvania’s Delaware County revealed the attack last week, claiming in a notice that it had disrupted “portions of its computer network.

“We commenced an immediate investigation that included taking certain systems offline and working with computer forensic specialists to determine the nature and scope of the event. We are working diligently to restore the functionality of our systems,” it said.

https://www.infosecurity-magazine.com/news/delaware-county-pays-500k-ransom/

MasterChef Producer Hit by Double Extortion Ransomware

A multibillion-dollar TV production company has become the latest big corporate name caught out by ransomware, it emerged late last week.

The firm owns over 120 production firms around the world, delivering TV shows ranging from MasterChef and Big Brother to Black Mirror and The Island with Bear Grylls.

In a short update last Thursday, it claimed to be managing a “cyber-incident” affecting the networks of Endemol Shine Group and Endemol Shine International, Dutch firms it acquired in a $2.2bn deal in July.

Although ransomware isn’t named in the notice, previous reports suggest the firm is being extorted.

https://www.infosecurity-magazine.com/news/masterchef-producer-double/

Sopra Steria to take multi-million euro hit on ransomware attack

The company revealed in October that it had been hit by hackers using a new version of Ryuk ransomware.

It now says that the fallout, with various systems out of action, is likely to have a gross negative impact on operating margin of between €40 million and €50 million.

The group's insurance coverage for cyber risks is EUR30 million, meaning that negative organic revenue growth for the year is now expected to be between 4.5% and five per cent (previously between two per cent and four per cent). Free cash flow is now expected to be between €50 million and €100 million (previously between €80 million and €120 million).

https://www.finextra.com/newsarticle/37020/sopra-steria-to-take-multi-million-euro-hit-on-ransomware-attack

---

BEC

FBI: BEC Scams Are Using Email Auto-Forwarding

The agency notes in an alert made public this week that since the COVID-19 pandemic began, leading to an increasingly remote workforce, BEC scammers have been taking advantage of the auto-forwarding feature within compromised email inboxes to trick employees to send them money under the guise of legitimate payments to third parties.

This tactic works because most organizations do not sync their web-based email client forwarding features with their desktop client counterparts. This limits the ability of system administrators to detect any suspicious activities and enables the fraudsters to send malicious emails from the compromised accounts without being detected, the alert, sent to organizations in November and made public this week, notes.

https://www.bankinfosecurity.com/fbi-bec-scams-are-using-email-auto-forwarding-a-15498

---

Phishing

Phishing lures employees with fake 'back to work' internal memos

Scammers are trying to steal email credentials from employees by impersonating their organization's human resources (HR) department in phishing emails camouflaged as internal 'back to work' company memos.

These phishing messages have managed to land in thousands of targeted individuals' mailboxes after bypassing G Suite email defences according to stats provided by researchers at email security company Abnormal Security who spotted this phishing campaign.

There is a high probability that some of the targets will fall for the scammers' tricks given that during this year's COVID-19 pandemic most companies have regularly emailed their employees with updates regarding remote working policy changes.

https://www.bleepingcomputer.com/news/security/phishing-lures-employees-with-fake-back-to-work-internal-memos/

Warning: Massive Zoom phishing targets Thanksgiving meetings

Everyone should be on the lookout for a massive ongoing phishing attack today, pretending to be an invite for a Zoom meeting. Hosted on numerous landing pages, BleepingComputer has learned that thousands of users' credentials have already been stolen by the attack.

With many in the USA hosting virtual Thanksgiving dinners and people in other countries conducting Zoom business meetings, as usual, today is a prime opportunity to perform a phishing attack using Zoom invite lures.

https://www.bleepingcomputer.com/news/security/warning-massive-zoom-phishing-targets-thanksgiving-meetings/

---

Malware

All-new Windows 10 malware is excellent at evading detection

Security researchers at Kaspersky have discovered a new malware strain developed by the hacker-for-hire group DeathStalker that has been designed to avoid detection on Windows PCs.

While the threat actor has been active since at least 2012, DeathStalker first drew Kaspersky's attention back in 2018 because of its distinctive attack characteristics which didn't resemble those employed by cybercriminals or state-sponsored hackers.

https://www.techradar.com/news/all-new-windows-10-malware-is-excellent-at-evading-detection

New TrickBot version can tamper with UEFI/BIOS firmware

The operators of the TrickBot malware botnet have added a new capability that can allow them to interact with an infected computer's BIOS or UEFI firmware.

The new capability was spotted inside part of a new TrickBot module, first seen in the wild at the end of October, security firms Advanced Intelligence and Eclypsium said in a joint report published today.

The new module has security researchers worried as its features would allow the TrickBot malware to establish more persistent footholds on infected systems, footholds that could allow the malware to survive OS reinstalls.

https://www.zdnet.com/article/new-trickbot-version-can-tamper-with-uefibios-firmware/

Russia-linked APT Turla used a new malware toolset named Crutch

Russian-linked APT group Turla has used a previously undocumented malware toolset, named Crutch, in cyberespionage campaigns aimed at high-profile targets, including the Ministry of Foreign Affairs of a European Union country.

The Turla APT group (aka Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) has been active since at least 2007 targeting diplomatic and government organizations and private businesses in the Middle East, Asia, Europe, North and South America, and former Soviet bloc nations.

https://securityaffairs.co/wordpress/111813/apt/turla-crutch-malware-platform.html

MacBooks under attack by dangerous malware: What to do

a recent spate of malware attacks targeting macOS of late that installs backdoors to steal sensitive personal information. The security firm discovered that a new malware variant is being used online and backed by a rogue nation-state hacking group known as OceanLotus, which also operates under the name AKTP2 and is based in Vietnam. 

The new malware was created by OceanLotus due to the “similarities in dynamic behavior and code” from previous malware connected to the Vietnamese-based hacking group. 

https://www.laptopmag.com/news/macbooks-under-attack-by-dangerous-malware-what-to-do

Hackers Using Monero Mining Malware as Decoy, Warns Microsoft

The company’s intelligence team said a group called BISMUTH hit government targets in France and Vietnam with relatively conspicuous monero mining trojans this summer. Mining the crypto generated side cash for the group, but it also distracted victims from BISMUTH’s true campaign: credential theft.

Crypto-jacking “allowed BISMUTH to hide its more nefarious activities behind threats that may be perceived to be less alarming because they’re ‘commodity’ malware,” Microsoft concluded. It said the conspicuousness of monero mining fits BISMUTH’s “hide in plain sight” MO.

Microsoft recommended organizations stay vigilant against crypto-jacking as a possible decoy tactic.

https://www.coindesk.com/hackers-using-monero-mining-malware-as-decoy-warns-microsoft

---

Vulnerabilities

Zerologon is now detected by Microsoft Defender for Identity

There has been a huge focus on the recently patched CVE-2020-1472 Netlogon Elevation of Privilege vulnerability, widely known as ZeroLogon. While Microsoft strongly recommends that you deploy the latest security updates to your servers and devices, we also want to provide you with the best detection coverage possible for your domain controllers. Microsoft Defender for Identity along with other Microsoft 365 Defender solutions detect adversaries as they try to exploit this vulnerability against your domain controllers.

https://www.microsoft.com/security/blog/2020/11/30/zerologon-is-now-detected-by-microsoft-defender-for-identity/

---

Privacy

'We've heard the feedback...' Microsoft 365 axes per-user productivity monitoring after privacy backlash

If you heard a strange noise coming from Redmond today, it was the sound of some rapid back-pedalling regarding the Productivity Score feature in its Microsoft 365 cloud platform.

Following outcry from subscribers and privacy campaigners, the Windows giant has now vowed to wind back the functionality so that it no longer produces scores for individual users, and instead just summarizes the output of a whole organization. It was feared the dashboard could have been used by bad bosses to measure the productivity of specific employees using daft metrics like the volume of emails or chat messages sent through Microsoft 365.

https://www.theregister.com/2020/12/01/productivity_score/

---

Other News

Think-Tanks Under Attack by Foreign APTs, CISA Warns

AI needed to vet 100 billion cyber threat items per day

Cloud native security: A maturing and expanding arena

MOD Corsham seeks new recruits to combat cyber warfare

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.