Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 02 February 2024
Black Arrow Cyber Threat Intelligence Briefing 02 February 2024:
-The Financial Sector Is Plagued by Increasingly Sophisticated Cyber Attacks That Demand a Defensive Paradigm Shift
-The $10 Billion Cyber Insurance Industry Sees a Dangerous Year in Cyber Crime Ahead. AI, Ransomware, and War are its Biggest Concerns
-Microsoft Says Russian Hackers Used Known Identified Tactics to Breach Senior Exec Emails
-Old Methods, New Tricks: Cyber Criminals Are Still Using Social Engineering to Steal Your Credentials
-UK Government Unveils New Cyber Threat Guidelines as 32% of Firms Suffer Attacks in Past Year
-94% of Organisations Would Pay a Ransom, Despite Having ‘Do Not Pay’ Policies, as 79% Faced an Attack in 2023
-Interpol Arrests More than 30 Cyber Criminals in Global Operation
-Divide and Succeed: Splitting IT and Security Makes Business Sense
-Ransomware Groups Gain Clout with False Attack Claims
-Payment Fraud is Hitting Organisations Harder Than Ever Before
-Chinese Hacking Operations Have Entered a Far More Dangerous Phase, US Warns
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
The Financial Sector is Plagued by Increasingly Sophisticated Cyber Attacks That Demand a Defensive Paradigm Shift
A series of interviews with senior cyber executives and decision makers around the world gave insights into the attacks seen in the financial sector. The findings include 77% of financial organisations detecting campaigns to steal non-public market information, 48% falling victim to attacks solely focused on destroying data and 45% of organisations believing they were a victim of an attack which they were unable to detect. The financial sector remains a valuable target for cyber criminals and as such, organisations within this sector must proactively protect themselves.
Source: [PR News Wire]
The $10 Billion Cyber Insurance Industry Sees a Dangerous Year in Cyber Crime Ahead. AI, Ransomware, and War are its Biggest Concerns
A recent report by insurance broker Woodruff Sawyer sheds light on pressing concerns from the perspective of the insurance industry. Amidst ongoing global conflicts and the rise of AI-driven cyber threats, the boundaries between war and cyber attacks are blurring. Insurers are increasingly wary, with many opting not to provide coverage, particularly against war-related risks. The survey reveals a grim outlook, with 56% of clients anticipating a significant increase in cyber risks in 2024, primarily driven by ransomware and war associated threats. The challenge lies in defining and navigating these evolving risks, leaving clients uncertain about their cyber security strategies. Additionally, updated US Securities and Exchange Commission (SEC) rules mandating rapid disclosure of cyber breaches add further complexity to the cyber security landscape, warranting close monitoring by insurers. As cyber threats continue to evolve in a turbulent world, the insurance industry faces unprecedented challenges in safeguarding against cyber risks.
Source: [Fortune]
Microsoft Says Russian Hackers Used Known Identified Tactics to Breach Senior Exec Emails
Hackers allegedly linked to Russia’s Foreign Intelligence Service (SVR) breached a legacy non-production test tenant account in Microsoft last November, before pivoting into their senior executives’ email accounts. Microsoft only discovered the incident on 12 January. In a blog post, Microsoft said that the attackers had used a password spray attack on a limited number of accounts. One of these accounts was a legacy, non-production test account that had elevated access to the Microsoft corporate environment, and the ability to create malicious OAuth applications with access to other corporate mailboxes, leading to them accessing senior executives’ emails. Microsoft has since confirmed that multi-factor authentication was not enabled. Microsoft has previously warned the public about this exact scenario, writing that attackers “compromise user accounts to create, modify, and grant high privileges to OAuth applications that they can misuse to hide malicious activity.”
Sources: [The Record] [Bleeping Computer]
Old Methods, New Tricks: Cyber Criminals Are Still Using Social Engineering to Steal Your Credentials
2023 showed us that despite all the advancements in cyber security, most threat actors are simply just logging in. To do this an attacker needs credentials, often gained through phishing, the most common social engineering tactic. The emergence and utilisation of artificial intelligence has only made this easier, the point being that now virtually anyone can conduct a sophisticated phishing campaign, and with huge success. But what can organisations do? Focus on their human firewall. Social engineering will remain, and organisations need to ensure that their staff are consistently trained to be vigilant, as well as regular updated training on current trends. Users should ensure that they don’t reuse passwords across accounts, nor use easy to guess passwords or patterns. Users should be encouraged to use password managers to enable better, and more manageable, password hygiene. Where possible, multi factor authentication should be enforced.
Sources: [Security Boulevard] [Beta News] [Security Intelligence]
UK Government Unveils New Cyber Threat Guidelines as 32% of Firms Suffer Attacks in Past Year
The UK government is urging organisations to prioritise cyber threats as a key business risk, on par with financial and legal challenges. They have released new guidelines, the Cyber Governance Code of Practice, aimed at directors and senior leaders to elevate cyber security as a focal point in business operations. The code recommends clear roles and responsibilities, customer protection, and plans to respond to cyber attacks. It also emphasises the need for employees to possess adequate cyber awareness and skills. As cyber security incidents rise, a report found that 77% of financial services organisations have experienced a cyber attack. Other figures also show that 32% of firms have suffered a cyber breach or attack in the past year alone. These guidelines align with the UK Government’s National Cyber Strategy, aiming to protect and promote online security in the country. With the financial sector experiencing underperforming cyber security providers, organisations need to strengthen their anti-fraud defences, possibly incorporating cyber risk ratings for a more robust security posture.
Source: [The Fintech Times]
94% of Organisations Would Pay a Ransom, Despite Having ‘Do Not Pay’ Policies, as 79% Faced an Attack in 2023
A recent study has found that 94% of organisations would pay a ransomware demand, even if they had a ‘do not pay’ policy, in the event of an attack. The study found that 79% had suffered a ransomware related attack in the second half of 2023. When it came to resilience, only 21% had full confidence in their organisation’s cyber resilience and ability to address today’s escalating cyber challenges and threats, and 23% reported that they would need over three weeks to recover data and restore business processes. A common theme in the study was the belief that senior and executive management do not fully understand the serious risks, with only 35% of respondents believing risks were fully understood.
Sources: [Beta News] [ Security Magazine] [MSSP Alert]
Interpol Arrests More than 30 Cyber Criminals in Global Operation
This week, international law enforcement announced that it detained 31 suspected cyber criminals and identified 1,300 malicious servers which were used to conduct phishing attacks and distribute malware. The operation, labelled “Synergia” was in response to “the clear growth, escalation and professionalisation of transnational cyber crime and the need for coordinated action against new cyber threats” Interpol said. Nearly 60 law enforcement agencies and several private companies were involved in the operation.
Sources: [The Record]
Divide and Succeed: Splitting IT and Security Makes Business Sense
Maintaining year-round security hygiene is important to protect both consumers and organisations. Cyber attacks, like the recent one on 23andMe, often exploit vulnerabilities that persist due to incomplete patching and compromised credentials. Many organisations cite time constraints as the primary reason for not updating security features. Ideally, in any organisation, and indeed in all organisations that have reached a level of maturity in this space, security and IT teams should be separate; however, this is not really achievable in many organisations and hence the responsibility to protect ultimately falls on IT teams. Overburdened IT teams, and IT teams whose primary focus is on operational IT, further compound the issue, spending significant time managing data requests and analysing data, leading to cyber security risks. As consumers become more privacy-conscious, businesses must review and adapt their data privacy policies to build trust. Additionally, the growing use of artificial intelligence poses new risks, necessitating the development of company-wide AI policies to protect data privacy. While privacy legislation remains fragmented, staying proactive by updating data privacy policies, understanding data usage, and fortifying cyber security defences is crucial for organisations.
Source: [Digital Journal]
Ransomware Groups Gain Clout with False Attack Claims
A concerning trend is on the rise: fake breach claims by ransomware groups. Cyber criminals are leveraging the dark web and social media to spread misinformation about alleged breaches, triggering unwarranted cyber investigations and generating unwanted, and unwarranted, negative publicity for the alleged victim. Recent incidents involving Technica Corp and Europcar exemplify this growing threat. While these claims often lack credible evidence, they serve as a means for ransomware operators to gain attention and clout in the cyber criminal world. These groups resort to false claims to maintain relevance. Cyber security teams must adapt to this new ransomware misinformation communication strategy and exercise caution when evaluating breach claims.
Source: [Dark Reading]
Payment Fraud is Hitting Organisations Harder Than Ever Before
According to research, 96% of companies in the US were targeted with at least one fraud attempt in the past year. 36% who suffered said the average loss they experienced was more than $1 million and for 25%, this was more than $5 million. The study found misaligned perception as despite the number falling victim, only 5% believed they could not keep up with fraud. Of concern, 75% of C-level finance leaders said they would stop doing business with an organisation that fell victim to payment fraud.
Source: [Help Net Security]
Chinese Hacking Operations Have Entered a Far More Dangerous Phase, US Warns
In the US, the directors of the FBI, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), have stated that China’s cyber activity is moving beyond the last decade’s spying and data theft toward direct attacks on critical infrastructure. It was identified that Chinese nation-state actors were planting malware on network routers and other internet-connected devices that, if triggered, could disrupt water, power, rail and other critical services, possibly causing widespread chaos, or even injury or deaths as a result.
Source: [Defense One]
Governance, Risk and Compliance
$10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune
Recognizing Security as a Strategic Component of Business (darkreading.com)
Top Five Risks Facing Corporate Boards | The Volkov Law Group - JDSupra
Improving cyber security culture: A priority in the year of the CISO | CSO Online
Top 3 Cyber Security Trends for SME Business Leaders | MSSP Alert
What the Charges Against the SolarWinds CISO Mean for Security in 2024 - Security Boulevard
Divide and succeed: Splitting IT and Security makes business sense - Digital Journal
Strengthening Cyber Security: The rise of the Security Assurance Officer (securitybrief.co.nz)
5 Cyber Security Strategies You Must Embrace to Protect Your Business | Inc.com
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Survey Shows 94% of Companies Would Pay | MSSP Alert
$10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune
Ransomware's Impact May Include Heart Attacks, Strokes & PTSD (techrepublic.com)
79% of organisations faced a ransomware attack in H2 2023 | Security Magazine
Ransomware Groups Gain Clout With False Attack Claims (darkreading.com)
LockBit remorseless in latest children's hospital attack • The Register
The Ransomware Threat in 2024 is Growing: Report - Security Week
Akira ransomware attacks linked to Cisco vuln fixed in 2020 • The Register
OpenText Cyber Security Global Ransomware Survey: The Risk Perception Gap | MSSP Alert
The evolution of ransomware: Lessons for the future (securityintelligence.com)
New strain of the Phobos ransomware discovered in VBA script | SC Media (scmagazine.com)
Canadian Man Sentenced to Prison for Ransomware Attacks - Security Week
Ransomware Research Reveals Millions Spent Despite Do Not Pay Policies - IT Security Guru
A Cyber Insurer's Perspective on How to Avoid Ransomware (darkreading.com)
Online ransomware decryptor helps recover partially encrypted files (bleepingcomputer.com)
Higher cyber defences lead to higher ransoms, study finds | Cybernews
ICS Ransomware Danger Rages Despite Fewer Attacks (darkreading.com)
Ransomware Victims
ICO confirms data breach probe as UK councils remain downed by cyber attack | TechCrunch
Pentagon investigating theft of sensitive files by ransomware group | CyberScoop
Johnson Controls says ransomware attack cost $27 million, data stolen (bleepingcomputer.com)
New Jersey School District Shut Down by Cyber Attack (darkreading.com)
Cactus ransomware gang claims the Schneider Electric hack (securityaffairs.com)
Schneider Electric Responding to Ransomware Attack, Data Breach - Security Week
Akira ransomware gang says it stole passport scans from Lush • The Register
Kansas public transportation authority hit by ransomware (bleepingcomputer.com)
Phishing & Email Based Attacks
In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technica
AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)
Artificial Intelligence
$10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune
AI-Powered Attacks and Deepfake Technology Fuel Cyber Attack Concern - IT Security Guru
ChatGPT bug leaked conversations from others in your history (bgr.com)
AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)
Expect ‘AI versus AI’ conflict soon, Pentagon cyber leader says - Defense One
AI Companies Will Need to Start Reporting Their Safety Tests to the US Government - Security Week
AI-generated code leads to security issues for most businesses: report | CIO Dive
Assessing and quantifying AI risk: A challenge for enterprises | CSO Online
2FA/MFA
Malware
How the ZeuS Trojan Info Stealer Changed Cyber Security (securityintelligence.com)
FBI disrupts Chinese botnet by wiping malware from infected routers (bleepingcomputer.com)
AllaKore RAT Malware Targeting Mexican Firms with Financial Fraud Tricks (thehackernews.com)
Police disrupt Grandoreiro banking malware operation, make arrests (bleepingcomputer.com)
Threat Actors Using Adult Games To Launch Remcos RAT Attack - Security Boulevard
Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware (thehackernews.com)
More Android apps riddled with malware spotted on Google Play (bleepingcomputer.com)
Don't believe everything you read - hackers are pushing malware via media, news sites | TechRadar
Mobile
Man Sentenced to Prison for Stealing Millions in Cryptocurrency via SIM Swapping - Security Week
More Android apps riddled with malware spotted on Google Play (bleepingcomputer.com)
Denial of Service/DoS/DDOS
Internet of Things – IoT
Data Breaches/Leaks
There was a 39% surge in data exfiltration cyber attacks in 2023 | Security Magazine
Europcar denies data breach of 50 million users, says data is fake (bleepingcomputer.com)
3.5M exposed in COVID-19 e-passport leak (securityaffairs.com)
Mercedes-Benz accidentally exposed sensitive data, including source code (securityaffairs.com)
FTC orders Blackbaud to boost security after massive data breach (bleepingcomputer.com)
23andMe admits it didn’t detect cyber attacks for months | TechCrunch
Football Australia investigating 'critical data' leak - ESPN
Top 3 Data Breaches of 2023, and What Lies Ahead in 2024 (darkreading.com)
DHS employees jailed for stealing data of 200K US govt workers (bleepingcomputer.com)
Cyber criminals replace familiar tactics to exfiltrate sensitive data - Help Net Security
Data leak at fintech giant Direct Trading Technologies (securityaffairs.com)
Timex breach leaks employee Social Security numbers | SC Media (scmagazine.com)
Cloudflare hacked using auth tokens stolen in Okta attack (bleepingcomputer.com)
Keenan warns 1.5 million people of data breach after summer cyber attack (bleepingcomputer.com)
Organised Crime & Criminal Actors
ReasonLabs Releases Annual "State of Consumer Cyber Security Report" for 2024 (prnewswire.com)
Cyber criminals replace familiar tactics to exfiltrate sensitive data - Help Net Security
Smarter, Meaner, Sneakier: Security Trends for 2024 (trendmicro.com)
How businesses can tackle the cyber crime economy (siliconrepublic.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Insider Risk and Insider Threats
DHS employees jailed for stealing data of 200K US govt workers (bleepingcomputer.com)
Put People First When Facing Sophisticated Cyber Threats (forbes.com)
Insurance
A Cyber Insurer's Perspective on How to Avoid Ransomware (darkreading.com)
$10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune
Supply Chain and Third Parties
Supply Chain Security and NIS2: What You Need to Know - Security Boulevard
Third-party risk management best practices and why they matter - Help Net Security
Cloudflare hacked using auth tokens stolen in Okta attack (bleepingcomputer.com)
Cyber criminals embrace smarter strategies, less effort - Help Net Security
Cloud/SaaS
Microsoft Teams phishing pushes DarkGate malware via group chats (bleepingcomputer.com)
'Leaky Vessels' Cloud Bugs Allow Container Escapes Globally (darkreading.com)
Cyber Attacks, AI and Multicloud Hit Cyber Security in 2023 - The New Stack
Why DNS protection should be the first step in hybrid cloud security | TechRadar
Identity and Access Management
Microsoft tells how Russia's Cozy Bear broke into its email • The Register
In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technica
Microsoft Shares New Guidance in the Wake of 'Midnight Blizzard' Cyber Attack (darkreading.com)
Linux and Open Source
Cyber Security in Review: The Alarming Trend of Unsupported Systems - Security Boulevard
New Glibc Flaw Grants Attackers Root Access on Major Linux Distros (thehackernews.com)
White House releases report on securing open-source software | CyberScoop
Passwords, Credential Stuffing & Brute Force Attacks
Hundreds of network operators’ credentials found circulating in Dark Web (securityaffairs.com)
US charges two more suspects with DraftKing account hacks (bleepingcomputer.com)
Social Media
A tangled mess: Government rules for social media security lack clarity | CyberScoop
Defending Against Corporate Social Media Account Takeovers (databreachtoday.co.uk)
Malvertising
Regulations, Fines and Legislation
ICO confirms data breach probe as UK councils remain downed by cyber attack | TechCrunch
SolarWinds Files Motion to Dismiss SEC Lawsuit (darkreading.com)
What the Charges Against the SolarWinds CISO Mean for Security in 2024 - Security Boulevard
A tangled mess: Government rules for social media security lack clarity | CyberScoop
AI Companies Will Need to Start Reporting Their Safety Tests to the US Government - Security Week
The SEC Won't Let CISOs Be: Understanding New SaaS Cyber Security Rules (thehackernews.com)
How to Align Your Incident Response Practices With the New SEC Disclosure Rules - Security Week
UK law could ban Apple security updates across the world in an 'unprecedented overreach' | TechRadar
Models, Frameworks and Standards
Supply Chain Security and NIS2: What You Need to Know - Security Boulevard
NIS2 Directive raises stakes for security leaders - Help Net Security
Data Protection
Careers, Working in Cyber and Information Security
Wait, infosec isn't a computer science degree requirement? • The Register
The Future Of Cyber Security Is More Human Than You Think (forbes.com)
Law Enforcement Action and Take Downs
Interpol arrests more than 30 cyber criminals in global ‘Synergia’ operation (therecord.media)
US charges two more suspects with DraftKing account hacks (bleepingcomputer.com)
US sanctions 3 for supporting ISIS with cyber security expertise, money transfers - UPI.com
Canada's 'most prolific hacker' jailed for two years (bitdefender.com)
FBI disrupts Chinese botnet by wiping malware from infected routers (bleepingcomputer.com)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
$10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune
Cyber attacks as war crimes | International Bar Association (ibanet.org)
What Are State-Sponsored Cyber Attacks? - Security Boulevard
Satya Nadella Worries About Hackers Causing 'Breakdown of World Order' (businessinsider.com)
Expect ‘AI versus AI’ conflict soon, Pentagon cyber leader says - Defense One
The Cyber Warfare Option Against Hostile States and Groups | National Review
Nation State Actors
China
Chinese hacking operations have entered a far more dangerous phase, US warns - Defense One
FBI disrupts Chinese botnet by wiping malware from infected routers (bleepingcomputer.com)
Wray’s stunning warning points to a new age of US vulnerability | CNN Politics
Cyber attacks as war crimes | International Bar Association (ibanet.org)
EU economic security plan eyes China with more defence than offense (qz.com)
Russia
In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technicac
Microsoft Shares New Guidance in the Wake of 'Midnight Blizzard' Cyber Attack (darkreading.com)
Russia hacks Microsoft: It’s worse than you think | Computerworld
Series of Cyber Attacks Hit Ukrainian Critical Infrastructure Organisations (darkreading.com)
Russian 'cyber war' could exploit divisions in Scotland | The Herald (heraldscotland.com)
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets (trendmicro.com)
Russian threat actors dig in, prepare to seize on war fatigue | Security Insider (microsoft.com)
Russian spies impersonating Western researchers in ongoing hacking campaign (therecord.media)
Ukraine's POW Coordination Headquarters restores services after cyber attack (kyivindependent.com)
Ukraine Military Targeted With Russian APT PowerShell Attack (darkreading.com)
Iran
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Vulnerability Management
Does CVSS 4.0 solve the exploitability problem? - Help Net Security
Why the Right Metrics Matter When it Comes to Vulnerability Management (thehackernews.com)
Cyber Security in Review: The Alarming Trend of Unsupported Systems - Security Boulevard
Why organisations need risk-based vulnerability management | TechTarget
Vulnerabilities
Akira ransomware attacks linked to Cisco vuln fixed in 2020 • The Register
Ivanti Struggling to Hit Zero-Day Patch Release Schedule - Security Week
Ivanti releases patches for old and new VPN zero-days • The Register
45k Jenkins servers exposed to RCE attacks using public exploits (bleepingcomputer.com)
Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws (thehackernews.com)
New Glibc Flaw Grants Attackers Root Access on Major Linux Distros (thehackernews.com)
CISA Warns of Active Exploitation of Critical Flaws in Apple iOS and macOS (thehackernews.com)
Tools and Controls
Microsoft tells how Russia's Cozy Bear broke into its email • The Register
In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technica
Microsoft Shares New Guidance in the Wake of 'Midnight Blizzard' Cyber Attack (darkreading.com)
Multi-factor authentication suffers from three major weaknesses | TechRadar
AI-generated code leads to security issues for most businesses: report | CIO Dive
3 Best Practices to Improve Threat Hunting - Security Boulevard
Assessing and quantifying AI risk: A challenge for enterprises | CSO Online
How to Align Your Incident Response Practices With the New SEC Disclosure Rules - Security Week
Why DNS protection should be the first step in hybrid cloud security | TechRadar
What Is Cyber Threat Hunting? (Definition & How it Works) (techrepublic.com)
The Future Of Cyber Security Is More Human Than You Think (forbes.com)
Reports Published in the Last Week
Other News
How SMBs can lower their risk of cyber attacks and data breaches (bleepingcomputer.com)
FTC orders Blackbaud to boost security after massive data breach (bleepingcomputer.com)
Global critical infrastructure faces relentless cyber activity - Help Net Security
Why the healthcare industry must prioritize cyber resilience | World Economic Forum (weforum.org)
UK says Emirates-backed stake in Vodafone poses national security risk | Vodafone | The Guardian
Israeli Government: Smallest of SMBs Hit Hardest in Cyber Attacks (darkreading.com)
CISA: Vendors must secure SOHO routers against Volt Typhoon attacks (bleepingcomputer.com)
Firmware remains the soft underbelly of banking cyber defence (techmonitor.ai)
Cyber attacks on state and local governments rose in 2023, says CIS report | StateScoop
Fulton County Suffers Power Outages as Cyber Attack Continues (darkreading.com)
The Imperative for Robust Security Design in the Health Industry (darkreading.com)
National cyber security plans lack performance measures and estimated costs, GAO says | CyberScoop
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 06 January 2023
Black Arrow Cyber Threat Briefing 06 January 2023:
-Cyber War in Ukraine, Ransomware Fears Drive Surge in Demand for Threat Intelligence Tools
-Cyber Premiums Holding Firms to Ransom
-Ransomware Ecosystem Becoming More Diverse For 2023
-Attackers Evolve Strategies to Outmanoeuvre Security Teams
-Building a Security-First Culture: The Key to Cyber Success
-Adobe, Apple, Cisco, Microsoft Flaws Make Up Half of Known Exploited Vulnerabilities Catalogue
-First LastPass, Now Slack and CircleCI. The Hacks Go On (and will likely worsen)
-Data of 235 Million Twitter Users Leaked Online
-16 Car Makers, including BMW, Ferrari, Ford, Honda, Kia, Land Rover, Mercedes and Toyota, and Their Vehicles Hacked via Telematics, APIs, Infrastructure
-Ransomware Gang Apologizes, Gives SickKids Hospital Free Decryptor
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Cyber War in Ukraine, Ransomware Fears Drive 2022 Surge in Demand for Threat Intelligence Tools
Amid the heightened fear of ransomware in 2022, threat intelligence emerged as a core requirement of doing business in a world gone mad.
A sizable amount of interest in the historically tech-centric discipline was fuelled in part by fear of cyber attacks tied to the war between Russia and Ukraine. In one example, the Ukrainian government warned the world that the Russian military was planning for multi-pronged attacks targeting the energy sector. Other nation-state cyber attack operations also contributed to the demand, including one June 2022 incident were Iran’s Cobalt Mirage exploited PowerShell vulnerabilities to launch ransomware attacks.
And of course, headlines of data breaches tied to vulnerabilities that organisations did not even know existed within their networks caught the attention not just of security teams, but the C-Suite and corporate board. A misconfigured Microsoft server, for example, wound up exposing years of sensitive data for tens of thousands of its customers, including personally identifiable information, user data, product and project details and intellectual property.
Indeed, according to 183 security pros surveyed by CyberRisk Alliance Business Intelligence in June 2022, threat intelligence has become critical in arming their security operations centres (SOCs) and incident response teams with operational data to help them make timely, informed decisions to prevent system downtime, thwart the theft of confidential data, and protect intellectual property.
Threat intelligence has emerged as a useful tool for educating executives. Many also credited threat intelligence for helping them protect their company and customer data — and potentially saving their organisation's reputation.
Cyber Premiums Holding Firms to Ransom
Soaring premiums for cyber security insurance are leaving businesses struggling to pay other bills, a key industry player has warned.
Mactavish, which buys insurance policies on behalf of companies, said that more than half of big businesses that had bought cyber security insurance had been forced to make cuts elsewhere to pay for it.
In a survey of 200 companies with a turnover above £10 million, Mactavish found that businesses were reducing office costs and staff bonuses and were cutting other types of insurance to meet the higher payments.
Last month Marsh, an insurance broker, revealed that costs for cyber insurance had increased by an average of 66 per cent in the third quarter compared with last year.
Meanwhile, the risk to businesses from hackers continues to rise. A government report on digital threats, published this month, showed the proportion of businesses experiencing cyber security incidents at least monthly had increased from 53 per cent to 60 per cent in the past year. Uber, Cisco and InterContinental Hotels Group were among high-profile targets this year.
https://www.thetimes.co.uk/article/cyber-safety-premiums-hold-firms-to-ransom-tnrsz3vs2
Ransomware Ecosystem Becoming More Diverse for 2023
The ransomware ecosystem has changed significantly in 2022, with attackers shifting from large groups that dominated the landscape toward smaller ransomware-as-a-service (RaaS) operations in search of more flexibility and drawing less attention from law enforcement. This democratisation of ransomware is bad news for organisations because it also brought in a diversification of tactics, techniques, and procedures (TTPs), more indicators of compromise (IOCs) to track, and potentially more hurdles to jump through when trying to negotiate or pay ransoms.
Since 2019 the ransomware landscape has been dominated by big and professionalised ransomware operations that constantly made the news headlines and even looked for media attention to gain legitimacy with potential victims. We've seen ransomware groups with spokespeople who offered interviews to journalists or issued "press releases" on Twitter and their data leak websites in response to big breaches.
The DarkSide attack against Colonial Pipeline that led to a major fuel supply disruption along the US East Coast in 2021 highlighted the risk that ransomware attacks can have against critical infrastructure and led to increased efforts to combat this threat at the highest levels of government. This heightened attention from law enforcement made the owners of underground cyber crime forums reconsider their relationship with ransomware groups, with some forums banning the advertising of such threats. DarkSide ceased operations soon thereafter and was followed later in the year by REvil, also known as Sodinokibi, whose creators were indicted and one was even arrested. REvil was one of the most successful ransomware groups since 2019.
Russia's invasion of Ukraine in February 2022 quickly put a strain on the relationship between many ransomware groups who had members and affiliates in both Russia and Ukraine, or other former USSR countries. Some groups, such as Conti, rushed to take sides in the war, threatening to attack Western infrastructure in support of Russia. This was a departure from the usual business-like apolitical approach in which ransomware gangs had run their operations and drew criticism from other competing groups.
This was also followed by a leak of internal communications that exposed many of Conti's operational secrets and caused uneasiness with its affiliates. Following a major attack against the Costa Rican government the US State Department put up a reward of $10 million for information related to the identity or location of Conti's leaders, which likely contributed to the group's decision to shut down operations in May.
Conti's disappearance led to a drop in ransomware activity for a couple of months, but it didn't last long as the void was quickly filled by other groups, some of them newly set up and suspected to be the creation of former members of Conti, REvil and other groups that ceased operations over the past two years.
Attackers Evolve Strategies to Outmanoeuvre Security Teams
Attackers are expected to broaden their targeting strategy beyond regulated verticals such as financial services and healthcare. Large corporations (41%) will be the top targeted sector for cyber attacks in 2023, favoured over financial institutions (36%), government (14%), healthcare (9%), and education (8%), according to cyber security solution provider Titaniam.
The fast pace of change has introduced new vulnerabilities into corporate networks, making them an increasingly attractive target for cyber attackers. To compete in the digital marketplace, large companies are adopting more cloud services, aggregating data, pushing code into production faster, and connecting applications and systems via APIs.
As a result, misconfigured services, unprotected databases, little-tested applications, and unknown and unsecured APIs abound, all of which can be exploited by attackers.
The top four threats in 2022 were malware (30%), ransomware and extortion (27%), insider threats (26%), and phishing (17%).
The study found that enterprises expected malware (40%) to be their biggest challenge in 2023, followed by insider threats (26%), ransomware and related extortion (21%), and phishing (16%).
Malware, however, has more enterprises worried for 2023 than it did for 2022. It is important to note that these threats can overlap, where insiders can have a hand in ransomware attacks, phishing can be a source of malware, etc.
Attackers are evolving their strategies to surprise and outmanoeuvre security teams, which have hardened ransomware defences and improved phishing detection. They’re using new malware, such as loaders, infostealers, and wipers to accelerate attacks, steal sensitive data and create mayhem.
They’re also buying and stealing employee credentials to walk in through the front door of corporate networks.
https://www.helpnetsecurity.com/2023/01/04/attackers-evolve-strategies-outmaneuver-security-teams/
Building a Security-First Culture: The Key to Cyber Success
Everyone has heard a car alarm go off in the middle of the night, but how often does that notification actually lead to action? Most people will hear the alarm, glance in its direction and then hope the owner will quickly remedy the situation.
Cars alarms often fail because they go off too often, leading to apathy and annoyance instead of being a cause for emergency. For many, cyber security has also become this way. While we see an increase in the noise surrounding the need for organisations to improve the security skillset and knowledge base of employees, there continues to be little proactive action on this front. Most organisations only provide employees with elementary-grade security training, often during their initial onboarding process or as part of a standard training requirement.
At the same time, many organisations also make the grave mistake of leaving all of their security responsibilities and obligations in the hands of IT and security teams. Time and time again, this approach has proven to be highly ineffective, especially as cyber criminals refine their social engineering tactics and target user accounts to execute their attacks.
Alarmingly, recent research found that 30% of employees do not think that they play a role in maintaining their company’s cyber security posture. The same report also revealed that only 39% of employees say they are likely to report a security incident.
As traditional boundaries of access disintegrate and more employees obtain permissions to sensitive company data and systems to carry out their tasks, business leaders must change the mindset of their employees when it comes to the role they play in keeping the organisation safe from cyber crime. The key is developing an integrated cyber security strategy that incorporates all aspects—including all stakeholders—of the organisation. This should be a strategy that breaks down departmental barriers and creates a culture of security responsibility where every team member plays a part.
Adobe, Apple, Cisco, Microsoft Flaws Make Up Half of Known Exploited Vulnerabilities Catalogue
Back in November 2021, the US Cybersecurity and Infrastructure Security Agency (CISA) published the Known Exploited Vulnerabilities (KEV) Catalogue to help federal agencies and critical infrastructure organisations identify and remediate vulnerabilities that are actively being exploited. CISA added 548 new vulnerabilities to the catalogue across 58 updates from January to end of November 2022, according to cyber security solution provider Grey Noise in its first-ever "GreyNoise Mass Exploits Report."
Including the approximately 300 vulnerabilities added in November and December 2021, CISA listed approximately 850 vulnerabilities in the first year of the catalogue's existence.
Actively exploited vulnerabilities in Microsoft, Adobe, Cisco, and Apple products accounted for over half of the updates to the KEV catalogue in 2022, Grey Noise found. Seventy-seven percent of the updates to the KEV catalogue were older vulnerabilities dating back to before 2022. Many of these vulnerabilities have been around for two decades.
Several of the vulnerabilities in the KEV catalogue are from products that have already entered end-of-life (EOL) and end-of-service-life (EOSL), according to an analysis by a team from cyber security solution provider Cyber Security Works. Even though Windows Server 2008 and Windows 7 are EOSL products, the KEV catalogue lists 127 Server 2008 vulnerabilities and 117 Windows 7 vulnerabilities.
Even though the catalogue was originally intended for critical infrastructure and public-sector organisations, it has become the authoritative source on which vulnerabilities are – or have been – exploited by attackers. This is key because the National Vulnerability Database (NVD) assigned Common Vulnerabilities and Exposures (CVE) identifiers for over 12,000 vulnerabilities in 2022, and it would be unwieldy for enterprise defenders to assess every single one to identify the ones relevant to their environments. Enterprise teams can use the catalogue's curated list of CVEs under active attack to create their priority lists.
First LastPass, Now Slack and CircleCI. The Hacks Go On (and will likely worsen)
In the past week, the world has learned of serious breaches hitting chat service Slack and software testing and delivery company CircleCI, though giving the companies' opaque wording—“security issue” and “security incident,” respectively—you'd be forgiven for thinking these events were minor.
The compromises—in Slack’s case, the theft of employee token credentials and for CircleCI, the possible exposure of all customer secrets it stores—come two weeks after password manager LastPass disclosed its own security failure: the theft of customers’ password vaults containing sensitive data in both encrypted and clear text form. It’s not clear if all three breaches are related, but that’s certainly a possibility.
The most concerning of the two new breaches is the one hitting CircleCI. The company reported a “security incident” that prompted it to advise customers to rotate “all secrets” they store on the service. The alert also informed customers that it had invalidated their Project API tokens, an event requiring them to go through the hassle of replacing them.
CircleCI says it’s used by more than 1 million developers in support of 30,000 organisations and runs nearly 1 million daily jobs. The potential exposure of all those secrets—which could be login credentials, access tokens, and who knows what else—could prove disastrous for the security of the entire Internet.
It’s possible that some or all of these breaches are related. The Internet relies on a massive ecosystem of content delivery networks, authentication services, software development tool makers, and other companies. Threat actors frequently hack one company and use the data or access they obtain to breach that company's customers or partners. That was the case with the August breach of security provider Twilio. The same threat actor targeted 136 other companies. Something similar played out in the last days of 2020 when hackers compromised Solar Winds, gained control of its software build system, and used it to infect roughly 40 Solar Winds customers.
For now, people should brace themselves for additional disclosures from companies they rely on. Checking internal system logs for suspicious entries, turning on multifactor authentication, and patching network systems are always good ideas, but given the current events, those precautions should be expedited. It’s also worth checking logs for any contact with the IP address 54.145.167.181, which one security practitioner said was connected to the CircleCI breach.
Data of 235 Million Twitter Users Leaked Online
A data leak containing email addresses for 235 million Twitter users has been published on a popular hacker forum. Many experts have immediately analysed it and confirmed the authenticity of many of the entries in the huge leaked archive.
In January 2022, a report claimed the discovery of a vulnerability that can be exploited by an attacker to find a Twitter account by the associated phone number/email, even if the user has opted to prevent this in the privacy options. The vulnerability was exploited by multiple threat actors to scrape Twitter user profiles containing both private (phone numbers and email addresses) and public data, and was present within the social media platforms application programming interface (API) from June 2021 until January 2022.
At the end of July 2022, a threat actor leaked data of 5.4 million Twitter accounts that were obtained by exploiting the forementioned, now-fixed vulnerability in the popular social media platform. The scraped data was then put up for sale on various online cyber crime marketplaces. In August, Twitter confirmed that the data breach was caused by a now-patched zero-day flaw.
In December another Twitter data leak made the headlines, a threat actor obtained data of 400,000,000 Twitter users and attempted to sell it. The seller claimed the database is private, and he provided a sample of 1,000 accounts as proof of claims which included the private information of prominent users such as Donald Trump JR, Brian Krebs, and many more. The seller, who is a member of a popular data breach forum, claimed the data was scraped via a vulnerability. The database includes emails and phone numbers of celebrities, politicians, companies, normal users, and a lot of special usernames.
https://securityaffairs.com/140352/data-breach/twitter-data-leak-235m-users.html
16 Car Makers, including BMW, Ferrari, Ford, Honda, Kia, Land Rover, Mercedes and Toyota, and Their Vehicles Hacked via Telematics, APIs, and Infrastructure
A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car functions and start or stop the engine.
Multiple other security defects, the researchers say, allowed them to access a car maker’s internal applications and systems, leading to the exposure of personally identifiable information (PII) belonging to customers and employees, and account takeover, among others. The hacks targeted telematic systems, automotive APIs, and infrastructure.
Impacted car models include Acura, BMW, Ferrari, Ford, Genesis, Honda, Hyundai, Infiniti, Jaguar, Kia, Land Rover, Mercedes-Benz, Nissan, Porsche, Rolls Royce, and Toyota. The vulnerabilities were identified over the course of 2022. Car manufacturers were informed about the security holes and they released patches.
According to the researchers, they were able to send commands to Acura, Genesis, Honda, Hyundai, Kia, Infiniti, Nissan, and Porsche vehicles.
Using only the VIN (vehicle identification number), which is typically visible on the windshield, the researchers were able to start/stop the engine, remotely lock/unlock the vehicle, flash headlights, honk vehicles, and retrieve the precise location of Acura, Honda, Kia, Infiniti, and Nissan cars.
They could also lock users out of remote vehicle management and could change car ownership.
https://www.securityweek.com/16-car-makers-and-their-vehicles-hacked-telematics-apis-infrastructure
Ransomware Gang Apologises, and Gives SickKids Hospital Free Decrypter
The LockBit ransomware gang has released a free decrypter for the Hospital for Sick Children (SickKids), saying one of its members violated rules by attacking the healthcare organisation. SickKids is a teaching and research hospital in Toronto that focuses on providing healthcare to sick children.
On December 18th, the hospital suffered a ransomware attack that impacted internal and corporate systems, hospital phone lines, and the website. While the attack only encrypted a few systems, SickKids stated that the incident caused delays in receiving lab and imaging results and resulted in longer patient wait times.
On December 29th, SickKids announced that it had restored 50% of its priority systems, including those causing diagnostic or treatment delays. Two days after SickKids' latest announcement, the LockBit ransomware gang apologised for the attack on the hospital and released a decrypter for free.
“We formally apologise for the attack on sikkids.ca and give back the decrypter for free, the partner who attacked this hospital violated our rules, is blocked and is no longer in our affiliate programme," stated the ransomware gang.
Threats
Ransomware, Extortion and Destructive Attacks
Rackspace: Ransomware Attack Bypassed ProxyNotShell Mitigations (darkreading.com)
Rackspace: Customer email data accessed in ransomware attack (bleepingcomputer.com)
Ransomware gang cloned victim’s website to leak stolen data (bleepingcomputer.com)
Rackspace identifies hacking group responsible for early December ransomware attack | TPR
Ransomware ecosystem becoming more diverse for 2023 | CSO Online
Rackspace Sunsets Email Service Downed in Ransomware Attack (darkreading.com)
December ransomware disclosures reveal high-profile victims | TechTarget
The Guardian ransomware attack hits week two as staff WFH • The Register
Unraveling the techniques of Mac ransomware - Microsoft Security Blog
Bitdefender releases free MegaCortex ransomware decryptor (bleepingcomputer.com)
Ransomware Research: More than 200 US Infrastructure Organisations Attacked in 2022 - MSSP Alert
Ransomware impacts over 200 govt, edu, healthcare orgs in 2022 (bleepingcomputer.com)
Guardian ransomware attack: Staff told work from home to 23 Jan (pressgazette.co.uk)
Rail giant Wabtec discloses data breach after Lockbit ransomware attack (bleepingcomputer.com)
Christmas Eve 'cyber attack' forced Arnold Clark's network down | STV News
Royal ransomware claims attack on Queensland University of Technology (bleepingcomputer.com)
LockBit: Sorry for SickKids, but not housing authority • The Register
Canadian mining firm shuts down mill after ransomware attack (bleepingcomputer.com)
Phishing & Email Based Attacks
Data of 235 million Twitter users leaked online - Security Affairs
Is NHS The Most Impersonated UK Government "Brand"? (informationsecuritybuzz.com)
The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media (thehackernews.com)
Ongoing Flipper Zero phishing attacks target infosec community (bleepingcomputer.com)
Other Social Engineering; Smishing, Vishing, etc
Malware
Raspberry Robin Worm Evolves to Attack Financial and Insurance Sectors in Europe (thehackernews.com)
Hackers abuse Windows error reporting tool to deploy malware (bleepingcomputer.com)
New SHC-compiled Linux malware installs cryptominers, DDoS bots (bleepingcomputer.com)
Bluebottle hackers used signed Windows driver in attacks on banks (bleepingcomputer.com)
Dridex Returns, Targets MacOS Using New Entry Method (trendmicro.com)
New Linux malware uses 30 plugin exploits to backdoor WordPress sites (bleepingcomputer.com)
PyTorch discloses malicious dependency chain compromise over holidays (bleepingcomputer.com)
WordPress Sites Under Attack from Newly Found Linux Trojan (darkreading.com)
Blind Eagle Hackers Return with Refined Tools and Sophisticated Infection Chain (thehackernews.com)
Raspberry Robin Worm Hatches a Highly Complex Upgrade (darkreading.com)
The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media (thehackernews.com)
Denial of Service/DoS/DDOS
Internet of Things – IoT
Data Breaches/Leaks
Data of over 200 million Deezer users stolen, leaks on hacking forum • Graham Cluley
Five Guys Data Breach Puts HR Data Under a Heat Lamp (darkreading.com)
Analysis Of Top 10 Countries Mostly Targeted By Data Breaches (informationsecuritybuzz.com)
I bought a $15 router at Goodwill — and found a millionaire's dirty secrets (nypost.com)
Critical flaws found in Ferrari, BMW, Porsche, and other carmakers - Security Affairs
Toyota, Mercedes, BMW API flaws exposed owners’ personal info (bleepingcomputer.com)
Threat actors stole Slack private source code repositories - Security Affairs
Data of over 200 million Deezer users stolen, leaks on hacking forum • Graham Cluley
Organised Crime & Criminal Actors
Threat Actors Evade Detection Through Geofencing & Fingerprinting (darkreading.com)
Attackers create 130K fake accounts to abuse limited-time cloud computing resources | CSO Online
Ukrainian Cops Bust Prolific Fraud Call Centre - Infosecurity Magazine (infosecurity-magazine.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Insider Risk and Insider Threats
Software engineer busted after being inspired by Office Space scam | PC Gamer
Are Meta and Twitter Ushering in a New Age of Insider Threats? (darkreading.com)
Ex-GE engineer sentenced for stealing turbine tech for China • The Register
Fraud, Scams & Financial Crime
Avast: Expect Cyber crime "Scamdemic" to Continue in 2023 - MSSP Alert
Software engineer busted after being inspired by Office Space scam | PC Gamer
US regulators warn banks over cryptocurrency risks - BBC News
RedZei Chinese Scammers Targeting Chinese Students in the UK (thehackernews.com)
Ukrainian Cops Bust Prolific Fraud Call Centre - Infosecurity Magazine (infosecurity-magazine.com)
Impersonation Attacks
AML/CFT/Sanctions
Insurance
Cyber safety premiums holding firms to ransom | Business | The Times
How can businesses decrease cyber insurance premiums while maintaining coverage? - Help Net Security
Dark Web
Supply Chain and Third Parties
Software Supply Chain
Cloud/SaaS
Encryption
API
Car companies massively exposed to web vulnerabilities | The Daily Swig (portswigger.net)
16 Car Makers and Their Vehicles Hacked via Telematics, APIs, Infrastructure | SecurityWeek.Com
What Are Some Ways to Make APIs More Secure? (darkreading.com)
Critical flaws found in Ferrari, BMW, Porsche, and other carmakers - Security Affairs
Open Source
New SHC-compiled Linux malware installs cryptominers, DDoS bots (bleepingcomputer.com)
New Linux malware uses 30 plugin exploits to backdoor WordPress sites (bleepingcomputer.com)
Social Media
Data of 235 million Twitter users leaked online - Security Affairs
The Evolving Tactics of Vidar Stealer: From Phishing Emails to Social Media (thehackernews.com)
Are Meta and Twitter Ushering in a New Age of Insider Threats? (darkreading.com)
Meta fined €390m over use of data for targeted ads - BBC News
More Political Storms for TikTok After US Government Ban | SecurityWeek.Com
Parental Controls and Child Safety
Regulations, Fines and Legislation
Governance, Risk and Compliance
Cyber safety premiums holding firms to ransom | Business | The Times
Attackers never let a critical vulnerability go to waste - Help Net Security
Attackers evolve strategies to outmanoeuvre security teams - Help Net Security
How to start planning for disaster recovery - Help Net Security
Building A Security-First Culture: The Key To Cyber Success (forbes.com)
Data backup is no longer just about operational fallback - Help Net Security
Threat Actors Evade Detection Through Geofencing & Fingerprinting (darkreading.com)
How can businesses decrease cyber insurance premiums while maintaining coverage? - Help Net Security
Secure Disposal
Backup and Recovery
Data Protection
Law Enforcement Action and Take Downs
Privacy, Surveillance and Mass Monitoring
National security fears over police using Chinese tech | News | The Times
Meta fined €390m over use of data for targeted ads - BBC News
Artificial Intelligence
ChatGPT: An Easy Cyber crime Target For Cyber attacks (informationsecuritybuzz.com)
OpenAI's ChatGPT previews how AI can help hackers breach more networks (axios.com)
NATO tests AI’s ability to protect critical infrastructure against cyber attacks | CSO Online
Misinformation, Disinformation and Propaganda
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
War and Geopolitical Conflict: The New Battleground for DDoS Attacks (darkreading.com)
Cyber attacks against governments jumped 95% in last half of 2022, CloudSek says | CSO Online
It's time to focus on information warfare's hard questions (cyberscoop.com)
National security fears over police using Chinese tech | News | The Times
Ex-GE engineer sentenced for stealing turbine tech for China • The Register
Pro-Russia cyber attacks aim at destabilizing Poland - Security Affairs
Poland warns of attacks by Russia-linked Ghostwriter hacking group (bleepingcomputer.com)
Nation State Actors
Nation State Actors – Russia
Nation State Actors – China
National security fears over police using Chinese tech | News | The Times
Ex-GE engineer sentenced for stealing turbine tech for China • The Register
Nation State Actors – Iran
Nation State Actors – Misc
Vulnerability Management
Adobe, Apple, Cisco, Microsoft Flaws Make Up Half of KEV Catalog (darkreading.com)
Attackers never let a critical vulnerability go to waste - Help Net Security
Vulnerabilities
Over 60,000 Exchange servers vulnerable to ProxyNotShell attacks (bleepingcomputer.com)
Adobe, Apple, Cisco, Microsoft Flaws Make Up Half of KEV Catalog (darkreading.com)
Rackspace: Ransomware Attack Bypassed ProxyNotShell Mitigations (darkreading.com)
Zoho urges admins to patch severe ManageEngine bug immediately (bleepingcomputer.com)
Android's First Security Updates for 2023 Patch 60 Vulnerabilities | SecurityWeek.Com
Fortinet and Zoho Urge Customers to Patch Enterprise Software Vulnerabilities (thehackernews.com)
Qualcomm, Lenovo flag multiple high impact firmware vulnerabilities | SC Media (scmagazine.com)
Netgear Wi-Fi routers need to be patched immediately | TechRadar
Other News
The cyber security industry will undergo significant changes in 2023 - Help Net Security
SecurityAffairs Top 10 cybersecurity posts of 2022 - Security Affairs
BleepingComputer's most popular cybersecurity stories of 2022
WordPress Security: 22 Ways To Protect Your Website (informationsecuritybuzz.com)
Cyber attacks against governments jumped 95% in last half of 2022, CloudSek says | CSO Online
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 29 October 2021
Black Arrow Cyber Threat Briefing 29 October 2021
-Protect Your Passwords, Warns Spy Chief, As Ransomware Cyber Attacks Double
-Graff Multinational Jeweller Hit by Conti Gang, Data of its Rich Clients Are At Risk
-Business Email Compromise (BEC) Costs UK Firms £140M Over Past Year
-Ransomware: It's A 'Golden Era' For Cyber Criminals - And It Could Get Worse Before It Gets Better
-Despite Increased Cyber Threats, Many Organisations Have No Defence Plans In Place
-Serious Warning Issued For Millions Of Apple iPhone Users
-Ransomware Attacks Are Evolving. Your Security Strategy Should, Too
-Solarwinds Hackers Are Targeting The Global It Supply Chain, Microsoft Says
-Defenders Worry Orgs Are More Vulnerable Than Last Year
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Protect Your Passwords, Warns Spy Chief, As Ransomware Cyber Attacks Double
Ransomware cyber attacks doubled in the past year, the chief of GCHQ has revealed - as he warned Britain must “pay attention” to attacks from China.
Sir Jeremy Fleming, director of the cyber spy agency, called for more action to "sort out" ransomware attacks across the UK, adding it was not "rocket science".
He said such attacks have doubled in the last year, with hackers using software to lock files on computers and stop victims from accessing their own data.
This essentially holds them hostage until the hackers receive payment and then give a decryption key to the victim, so they can regain access.
‘Criminals are making very good money from it’
Sir Jeremy said ransomware "just pays" and added that "criminals are making very good money from it and are often feeling that that's largely uncontested".
While cautious of “keeping up” with security challenges alongside European partners, he said the immediate priority was tackling “links between criminal and state actors” to defeat ransomware, which he said “is no mean feat in itself”. https://www.telegraph.co.uk/news/2021/10/25/ransomware-cyber-attacks-double-year-reveals-spy-chief/
Graff Multinational Jeweller Hit by Conti Gang. Data of its Rich Clients Are At Risk, Including Trump and Beckham, as the Gang Threaten to Release Private Details of World Leaders, Actors and Tycoons
The latest attack of the Conti ransomware gang makes the headlines, the threat actors hit high society jeweller Graff and asked the payment of a multi-million ransom to avoid leaking details of world leaders, actors and tycoons.
The customers of the company are the richest people on the globe, including Donald Trump, David Beckham, Tom Hanks, Samuel L Jackson, Alec Baldwin, and Sir Philip Green.
As proof of the hack, the group already published on its leak site files related to purchases made by David Beckham, Oprah, and Donald Trump.
The Conti gang has already leaked 69,000 confidential documents, leaked files include customer lists, invoices, receipts, and credit notes. https://securityaffairs.co/wordpress/123980/cyber-crime/conti-ransomware-graff-jeweller.html
Business Email Compromise (BEC) Costs UK Firms £140M Over Past Year
Reported business email compromise (BEC) incidents have hit 4600 cases over the past 12 months, costing individuals and businesses £138m in losses, according to new figures from the UK’s National Economic Crime Centre (NECC).
The government body is working with the National Crime Agency (NCA), City of London Police, banking group UK Finance and fraud prevention non-profit Cifas on a new campaign to raise awareness of the crime, also dubbed “mandate fraud” or “payment diversion fraud.”
It claimed that the average amount lost over those 4600 cases was £30,000, with criminals typically impersonating others and creating or amending invoices to trick victims into diverting money to accounts under their control. https://www.infosecurity-magazine.com/news/bec-costs-uk-firms-140m-past-year/
Ransomware: It's A 'Golden Era' For Cyber Criminals - And It Could Get Worse Before It Gets Better
Ransomware is the most significant cybersecurity threat facing organisations today as increasingly professional and sophisticated cyber criminals follow the money in order to maximise the profit from illicit campaigns.
ENISNA, the European Union Agency for Cybersecurity, has released the latest edition of the ENISA Threat Landscape (ETL) report, which analyses cyber-criminal activity between April 2020 and July 2021. It warns of a surge in cyber criminality, much of it driven by the monetisation of ransomware attacks.
Although the paper warns that many different cybersecurity threats are on the rise, ransomware represents the 'prime threat' faced by organisations today, with a 150% rise in ransomware attacks during the reporting period. And there are fears that despite the problem of ransomware attracting the attention of world leaders, the problem will get worse before it gets better. https://www.zdnet.com/article/ransomware-its-a-golden-era-for-cyber-criminals-and-it-could-get-worse-before-it-gets-better/
Despite Increased Cyber Threats, Many Organisations Have No Defence Plans In Place
98% of US executives report that their organisations experienced at least one cyber event in the past year, compared to a slightly lower rate of 84% in non-US executives, according to a Deloitte survey.
Further, COVID-19 pandemic disruption led to increased cyber threats to US executives’ organisations (86%) at a considerably higher rate than non-US executives experienced (63%). Yet, 14% of US executives say their organisations have no cyber threat defence plans, a rate more than double that of non-US executives (6%).
The biggest fallout US execs report from cyber incidents or breaches at their organisations during the past year include operational disruption (28%), share price drop (24%), leadership change (23%), intellectual property theft (22%) and loss of customer trust (22%).
Increases in data management, perimeter and complexities (38%), inability to match rapid technology changes (35%) and a need for better prioritization of cyber risk across the enterprise (31%) all pose obstacles to US executives’ organisation-wide cybersecurity management programs.
“No CISO or CSO ever wants to tell organisational stakeholders that efforts to manage cyber risk aren’t keeping-up with the speed of digital transformations made, or bad actors’ improving tactics”. https://www.helpnetsecurity.com/2021/10/28/threat-defence-plans/
Serious Warning Issued For Millions Of Apple iPhone Users
While iPhone 13 sales continue to soar, iPhones owners have faced growing security threats, multiple App Store scams, potential privacy violations and zero day hacks. Now a shocking account of extreme iPhone hacking has been revealed.
In a remarkable report, New York Times senior reporter Ben Hubbard has revealed how his iPhone was hacked multiple times over a period of several years, and without any human interaction or knowledge the attacks were taking place. And the experience results in a stark warning: “the spyware used against me makes us all vulnerable”.
“It’s like being robbed by a ghost,” explains Hubbard, recounting the experience. “I didn’t even have to click on a link for my phone to be infected.” https://www.forbes.com/sites/gordonkelly/2021/10/27/apple-iphone-warning-pegasus-hack-upgrade-ios-15-security/
Ransomware Attacks Are Evolving. Your Security Strategy Should, Too
Ransomware is an intensifying problem for all organisations, and it’s only going to get worse. What started as a floppy disk-based attack with a $189 ransom demands has grown from a minor inconvenience for organisations into a multi-billion dollar cyber crime industry.
The organisational threat of these types of attacks goes well beyond encryption of sensitive or mission-critical data – for many companies, the thought of a breach and data becoming publicly available on the internet makes a high ransom seem worth it. No wonder ransomware is on the rise: Organisations pay an average of $220,298 and suffer 23 days of downtime following an attack. https://threatpost.com/ransomware-attacks-evolving-security-strategy/175835/
Solarwinds Hackers Are Targeting The Global IT Supply Chain, Microsoft Says
The Russian-linked hacking group that’s been blamed for an attack on the US government and a significant number of private US companies last year is targeting key players in the global technology supply chain, according to cybersecurity experts at Microsoft.
Nobelium, as the hacking group is known, is infamous for the SolarWinds hack.
On Monday, Tom Burt, Microsoft corporate vice president of customer security and trust, said Nobelium has “been attempting to replicate the approach it has used in past attacks by targeting organisations integral to the global IT supply chain.”
“This time, it is attacking a different part of the supply chain: resellers and other technology service providers that customize, deploy and manage cloud services and other technologies on behalf of their customers” https://www.cnbc.com/2021/10/25/solarwinds-hackers-targeting-global-it-supply-chain-microsoft-says.html
Defenders Worry Orgs Are More Vulnerable Than Last Year
Enterprise security defenders find themselves in a rough spot: The number of threats against their organisations is growing and that they're vulnerable to attacks. Data from Dark Reading's 2021 Strategic Security Survey suggest that even though most IT and security leaders are confident about the security defences they have implemented, they also believe their organisations are more vulnerable to attacks compared with a year ago.
The reasons for this pessimism vary. For 67% of respondents, the biggest concern lies in the fact that there are more attacks this year than there were last year. However, 56% say the increased sophistication of the threats they are facing is why their organisations are more vulnerable to compromise. Other reasons include the surge in ransomware attacks and shortage of skilled security professionals to detect and respond to threats. https://www.darkreading.com/edge-threat-monitor/defenders-worry-orgs-are-more-vulnerable-than-last-year
Threats
Ransomware
These Companies Are Most at Risk for Ransomware Attacks | PCMag
As Fewer Victims Pay Ransoms, Conti Gang Looks To Sell Victim Data | Sc Media (Scmagazine.Com)
Europol Announces “Targeting” Of 12 Suspects In Ransomware Attacks – Naked Security (Sophos.Com)
Police Arrest Suspected Ransomware Hackers Behind 1,800 Attacks Worldwide (thehackernews.com)
SEO Poisoning Used to Distribute Ransomware (darkreading.com)
FBI Warns Of Ranzy Locker Ransomware Threat, As Over 30 Companies Hit (Tripwire.Com)
Ransomware Has Disrupted Almost 1,000 Schools in the US This Year (vice.com)
Chaos Ransomware Targets Gamers Via Fake Minecraft Alt Lists (Bleepingcomputer.Com)
Phishing
Phishing as a Ransomware Precursor - MSP Insights - MSSP Alert
Teen Rakes in $2.74M Worth of Bitcoin in Phishing Scam | Threatpost
Other Social Engineering
Malware
Squid Game Malware Might Be The Scariest Thing You See This Halloween | Techradar
TA575 Criminal Group Using 'Squid Game' Lures For Dridex Malware | ZDNet
Snake Malware Biting Hard On 50 Apps For Only $25 (Bleepingcomputer.Com)
New WSlink Malware Loader Runs as a Server and Executes Modules in Memory (thehackernews.com)
Mobile
6 Ways Your Cell Phone Can Be Hacked—Are You Safe? (makeuseof.com)
Millions Of Android Users Targeted In Subscription Fraud Campaign (Bleepingcomputer.Com)
New AbstractEmu Malware Roots Android Devices, Evades Detection (Bleepingcomputer.Com)
IOT
Vulnerabilities
All Windows Versions Impacted By New LPE Zero-Day Vulnerability (Bleepingcomputer.Com)
Google Releases Urgent Chrome Update to Patch 2 Actively Exploited 0-Day Bugs (thehackernews.com)
Adobe's Surprise Security Bulletin Dominated by Critical Patches | Threatpost
WordPress Plugin Bug Lets Subscribers Wipe Sites | Threatpost
Over 1 Million WordPress Sites Affected by OptinMonster Plugin Flaws - Security Affairs
Cisco SD-WAN Flaw Could Lead To Arbitrary Code Execution, Patch It Now! Security Affairs
Data Breaches/Leaks
Millions Of Healthcare Records Reportedly Exposed In Mega Data Breach | Techradar
Location Data Collection Firm Admits Privacy Breach - BBC News
HIV Scotland Reveals Patient-Advocates' Names In Email Fail • The Register
Organised Crime & Criminal Actors
Dark Web
Supply Chain
The SolarWinds Hackers Are Looking for Their Next Big Score | WIRED
North Korean Lazarus Attackers Turn to the IT Supply Chain | Threatpost
6 Eye-Opening Statistics About Software Supply Chain Security (darkreading.com)
Nation State Actors
Other News
All Sectors Are Now Prey as Cyber Threats Expand Targeting | Threatpost
Microsoft Warns Over Uptick In Password Spraying Attacks | ZDNet
Increased Risk Tolerances Are Making Digital Transformation Programs Vulnerable - Help Net Security
MITRE and CISA Publish The 2021 List of Most Common Hardware Weaknesses - Security Affairs
Enterprises Allocating More IT Dollars on Cybersecurity (darkreading.com)
Threat Actor Leaks Mercedes-Benz Platform’s Source Code | CyberNews
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.