Black Arrow Cyber Threat Briefing 24 May 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Human Error and AI Tops Cyber Threats as 70% of CISOs Worry About Risk

According to a survey of 1,600 CISOs, 70% worry about the risk of a material cyber attack over the next 12 months. Additionally, nearly 31% believe an attack is very likely, compared to 25% in 2023.  Amongst the largest concerns were human error, with 75% of CISOs identifying it as their most significant cyber vulnerability, up from 60% in 2023. Furthermore, 80% anticipate that human risk and employee negligence in particular will be major cyber security issues in the next two years.  Additionally, artificial intelligence was identified as an emerging concern for 54% of CISOs.

Sources: [The Register] [Infosecurity Magazine] [Cryptopolitan]

The State of Cyber Security: AI and Geopolitics Mean a Bigger Threat Than Ever

A recent report by Check Point reveals that global organisations faced an average of 1,158 weekly cyber attacks in 2023, an increase from 2022. In the UK, 50% of businesses experienced cyber attacks in the past year, with medium and large-sized businesses more affected at 70% and 74%, respectively. A ClubCISO survey found 62% of CISOs believe organisations are ill-equipped for AI-driven attacks, yet 77% haven't increased cyber security spending.

Additionally, a British Foreign Policy Group (BFPG) article highlights cyber threats from geopolitical tensions, with a recent attack on the Ministry of Defence exposing HR and payroll data. The National Cyber Security Centre attributes such attacks to state-affiliated actors like China and Russia. Despite efforts to establish international cyber norms, enforcement remains challenging. Businesses must recognise that cyber security is now deeply intertwined with geopolitics, affecting strategic partnerships and procurement.

Sources: [Verdict] [BFPG]

Threat Research Highlights Growing Mobile Security Risks

A recent report by a cloud security vendor focusing on the mobile threat landscape found that in the first quarter of 2024, the number of phishing, malicious, denylisted and offensive links delivered to their customers’ mobile devices tripled compared to Q1 2023. The report, which bases its data on 220 million devices, 325 million apps and billions of web items, found that the most common misconfiguration in mobiles was out of date operating systems (37%). When it came to the prevalence of attacks, 75% of organisations reported experiencing mobile phishing attempts targeting their employees.

This comes as a representative from the US Cybersecurity and Infrastructure Security Agency told the Federal Communications Commission earlier this year that there had been “numerous incidents of successful, unauthorised attempts” to steal location data, monitor voice and text messages, and deliver spyware.

Sources: [Economist] [Business Wire]

Family Offices Become Prime Targets for Cyber Hacks and Ransomware

A recent Dentons survey reveals that nearly 80% of family offices perceive a dramatic increase in cyber attack threats, with a quarter experiencing an attack in 2023, up from 17% in 2020. Despite their wealth, family offices often lack the staff and technology to manage these risks effectively. Less than a third report well-developed cyber risk management processes, and only 29% believe their cyber training programs are sufficient. This gap between awareness and action highlights the need for family offices to prioritise comprehensive cyber security measures, including better training, updated policies, and secure communication practices.

Source: [CNBC]

Ransomware Fallout: 94% Experience Downtime, 40% Face Work Stoppage

According to a report by cyber security provider Arctic Wolf, within the last 12 months 48% of organisations identified evidence of a successful breach within their environment and 70% of organisations were the targets of attempted Business Email Compromise (BEC) attacks, with 29% of these targets becoming victims of one or more successful BEC occurrences.

In its survey, the company says “45% of the organizations we spoke with admitted to being the victim of a ransomware attack within the last 12 months”,  an increase from the prior year. Of those impacted by ransomware, 86% of attacks including successful data exfiltration and 94% of those impacted by a ransom event experienced a significant downtime and delays. 40% of victims stated they experienced a period of total work stoppage due to ransomware.

Source: [Help Net Security]

Employee Discontent: Insider Threat No. 1

Chief Information Security Officers (CISOs) must integrate human factors into insider risk management (IRM), not just rely on detection technologies. IRM must consider factors such as those raised by recent research where only half of US workers are very satisfied with their jobs, and 28% feel their employers don't care about them. CISOs themselves are affected by job satisfaction; the 2024 IANS/Artico report shows three out of four CISOs are ready to leave their roles. DTEX Systems found 77% of malicious insiders concealed their activities, emphasising the importance of human engagement and feedback in mitigating risks.

Source: [CSO]

Report Reveals 341% Rise in Advanced Phishing Attacks

A recent report has revealed malicious emails increased by 341% over the past 6 months. This included a 217% increase in credential harvesting phishing attacks and a 29% increase in Business Email Compromise (BEC) attacks. The report highlighted the impact of artificial intelligence, noting that since the launch of ChatGPT in November 2022, there has been a 4,151% surge in malicious phishing messages.

Source: [Security Magazine] [ Infosecurity Magazine]

Ransomware and GenAI Raise Security Challenges, Driving Cyber Investment

A recent study by Infosecurity Europe reveals that nearly 40% of cyber security leaders are increasing investments to combat the growing threats of ransomware and AI-generated attacks. A separate survey found 94% of organisations have or plan to implement generative AI use policies, and a third strictly forbid AI tech in their environment. This data highlights the ongoing effort to balance AI benefits with security risks, indicating that there isn’t a one-size-fits-all strategy for formalising AI adoption and usage policies.

Source: [Security Boulevard] [Infosecurity Magazine]

New Rules Prompt 93% of Organisations to Rethink Cyber Security Plans

A recent report reveals that 93% of organisations have re-evaluated their cyber security strategies due to new regulations, with 58% reconsidering their entire approach. The survey, which included 500 cyber security decision-makers from the US and UK, found that 92% reported increased security budgets, with 36% seeing rises of 20-49% and 23% experiencing over 50% increases. Despite this, only 40% feel confident in their resources to comply with regulations, and just one-third believe they can meet all requirements, highlighting significant gaps in preparedness.

Source: [security magazine]

HR and IT Related Phishing Scams Still Most Popular According to KnowBe4’s Latest Phishing Report

A recent KnowBe4 report reveals that HR-related phishing emails account for 42% of top-clicked phishing attempts, followed by IT-related emails at 30%. These phishing tactics exploit employees' trust and evoke immediate responses by mimicking legitimate business communications about dress code changes, tax updates, and training notifications. The report also highlights that nearly a third of users are vulnerable to phishing, emphasising the need for robust security awareness training. A well-trained workforce is essential in defending against increasingly sophisticated phishing attacks that leverage AI and emotional manipulation.

Source: [IT Security Guru]

80% of Exposures from Misconfigurations, as 15 Vendors Account for 62% of Global Attack Surface

A recent XM Cyber report highlights a significant gap in cyber security focus with identity and credential misconfigurations accounting for 80% of security exposures. The study, based on hundreds of thousands of attack path assessments, found that 62% of the global attack surface is concentrated in just 15 vendors. Furthermore, 41% of organisations had at least one compromised device, and 11% experienced ransomware incidents. The report underscores the need for a shift from patching all vulnerabilities to addressing high-impact exposures, especially those around identity management and critical asset protection.

Sources: [Security Magazine] [The Hacker News]

UK to Propose Mandatory Reporting for Ransomware Attacks and Licensing Regime for all Payments

A forthcoming proposal in Britain aims to overhaul the response to ransomware by mandating victims to report incidents and obtain a license before making extortion payments. This initiative, part of a public consultation, includes a ban on ransom payments for critical national infrastructure to deter attacks. The National Cyber Security Centre has highlighted concerns over underreporting, with a 2023 increase in ransomware-related data breaches. The plan’s success hinges on replacing the delayed Action Fraud reporting platform. This proposal marks a significant step in global ransomware policy, with Britain leading international efforts against cyber criminals.

Source: [The Record Media]

UK’s Legal Sector Needs to Improve its Cyber Security, Says Experts

One in ten UK data breaches in 2023 occurred in the legal sector, highlighting that UK law firms are attractive targets for cyber criminals. A recent analysis of the UK’s Information Commissioner's Office (ICO) data found that the legal sector is one of the worst performing sectors for data breaches, with nearly 86 per cent of the incidents within the legal sector involving breaches of personal identifiable information, including instances also affecting sensitive economic and financial data.

Sources [CITY AM]

---

Governance, Risk and Compliance

• 70% of CISOs Expect Cyber Attacks in Next Year, Report Finds - Infosecurity Magazine (infosecurity-magazine.com)

• UK's legal sector needs to improve its cyber security, say experts (cityam.com)

• How to stay on top of evolving cyber security legislation | RSM UK

• New rules prompt 93% of organisations to rethink cyber security plans | Security Magazine

• Ransomware and AI-Powered Hacks Drive Cyber Investment - Infosecurity Magazine (infosecurity-magazine.com)

• One CISO Can’t Fill Your Board’s Cyber Security Gaps (mit.edu)

• Security Compliance 101: What It Is and How to Master It - Security Boulevard

• Family offices become prime targets for cyber hacks and ransomware (cnbc.com)

• Worried about job security, cyber teams hide security incidents - Help Net Security

• Law firms warn global risks on the rise (emergingrisks.co.uk)

• Financial companies must have data breach incident plans, SEC says | SC Media (scmagazine.com)

• Businesses must overcome security communication roadblocks – Channel EYE

• Why Culture is the Bedrock of Cyber Security - Infosecurity Magazine (infosecurity-magazine.com)

• 10 Leadership Challenges For An AI World (forbes.com)

• IT Security Leaders Are Failing to Close a Boardroom Credibility Gap (prnewswire.com)

• Effective GRC programs rely on team collaboration - Help Net Security

• Are AI and Cyber Security the New Driving Forces Behind Mergers and Acquisitions in the Coming Years? - The Global Treasurerputty

• Understanding cyber risks beyond data breaches - Help Net Security

• De-risking the business - how to evolve your approach to security | TechRadar

• IT and security data is siloed in most organisations (betanews.com)

• Can Cyber Security Be a Unifying Factor in Digital Trade Negotiations? (darkreading.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Family offices become prime targets for cyber hacks and ransomware (cnbc.com)

• Ransomware fallout: 94% experience downtime, 40% face work stoppage - Help Net Security

• Ransomware Attacks Evolve as Average Ransom Demand Tops $1.26 Million - Security Boulevard

• UK to propose mandatory reporting for ransomware attacks and licensing regime for all payments (therecord.media)

• Ransomware gang targets Windows admins via PuTTy, WinSCP malvertising (bleepingcomputer.com)

• Cyber criminals shift tactics to pressure more victims into paying ransoms - Help Net Security

• Unpatched vulnerabilities making bad ransomware outcomes worse: What you need to know | SC Media (scmagazine.com)

• Cyber Attacks Over Work Email Most Used; Ransomware Hits Victims Hard: Artic Wolf (insurancejournal.com)

• This wiper malware takes data destruction to a whole new level | TechRadar

• A Surge in Ransomware: Insights from Our 2024 Cyber Threat Report | Huntress

• New ransomware group abusing BitLocker | Securelist

• Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard

• LockBit takedown taking toll as gang plummets down rankings • The Register

• First LockBit, now BreachForums: Are cops winning the war? • The Register

• 2024 sees continued increase in ransomware activity - Help Net Security

• Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern (thehackernews.com)

• What role does an initial access broker play in the RaaS model? | TechTarget

• Casino cyber attacks put a bullseye on Scattered Spider • The Register

• Ransomware innovation slowdown a product of crims' success • The Register

Ransomware Victims

• National Records of Scotland reveals its data stolen in 'distressing' NHS health board cyber attack (scotsman.com)

• OmniVision Says Personal Information Stolen in Ransomware Attack - Security Week

• Blackbasta group claims to have hacked Atlas, one of the largest US oil distributors (securityaffairs.com)

• LockBit says they stole data in London Drugs ransomware attack (bleepingcomputer.com)

Phishing & Email Based Attacks

• HR and IT related phishing scams still most popular according to KnowBe4’s latest Phishing Report - IT Security Guru

• Report Reveals 341% Rise in Advanced Phishing Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide (thehackernews.com)

• Phishing statistics that will make you think twice before clicking - Help Net Security

• Cyber Attacks Over Work Email Most Used; Ransomware Hits Victims Hard: Artic Wolf (insurancejournal.com)

• Q1 2024 Global Phishing Report (knowbe4.com)

• Phishing, BEC, and Beyond: Tackling the Top Cyber Threats to UK Banks (prnewswire.co.uk)

• Two-stage Dropbox spear phishing | Kaspersky official blog

• Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns (thehackernews.com)

• Only 60 percent of brands can protect their customers from digital impersonation (betanews.com)

• A phish by any other name should still not be clicked – Computerworld

• Active Chinese Cyber espionage Campaign Rifling Email Servers (inforisktoday.com)

• YouTube has become a significant channel for cyber crime - Help Net Security

BEC

• The last six months shows a 341% increase in malicious emails | Security Magazine

• Phishing, BEC, and Beyond: Tackling the Top Cyber Threats to UK Banks (prnewswire.co.uk)

• Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard

• 10 Years in Prison for $4.5 million BEC Scammer Who Bought Ferrari to Launder Money | Tripwire

Other Social Engineering

• ‘Unblockable’ HMRC scam message on iPhones sparks warning (yahoo.com)

• Cyber criminals Exploit Cloud Storage For SMS Phishing Scams - Infosecurity Magazine (infosecurity-magazine.com)

Artificial Intelligence

• The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict

• Three Questions Every Leader Needs To Ask About AI Cyber Security (forbes.com)

• Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard

• Beware – Your Customer Chatbot is Almost Certainly Insecure: Report - Security Week

• Human Error and AI Tops Cyber Security Threats in CISO Survey | Cryptopolitan

• Consumers continue to overestimate their ability to spot deepfakes - Help Net Security

• CIO’s 2024 Checklist: Generative AI, Digital Transformation And More (forbes.com)

• Are AI and Cyber Security the New Driving Forces Behind Mergers and Acquisitions in the Coming Years? - The Global Treasurer

• Deepfakes Rank As the Second Most Common Cyber Security Incident for US Businesses (darkreading.com)

• Data regulator looking into Microsoft’s AI Recall feature | The Independent

• New Microsoft Recall feature is a 'security nightmare' and could make Copilot+ PCs a top target for cyber criminals | ITPro

• Why We Need to Get a Handle on AI - Security Week

• CISOs pursuing AI readiness should start by updating the org’s email security policy - Help Net Security

• 10 Leadership Challenges For An AI World (forbes.com)

• US Intelligence Agencies’ Embrace of Generative AI Is at Once Wary and Urgent - Security Week

• User Outcry as Slack Scrapes Customer Data for AI Model Training - Security Week

• Balancing generative AI cyber security risks and rewards | TechTarget

• AI Is The Past, Present And Future Of Cyber Security (forbes.com)

• US AI Experts Targeted in SugarGh0st RAT Campaign (darkreading.com)

• The ‘dead internet theory’ makes eerie claims about an AI-run web. The truth is more sinister (theconversation.com)

• Transparency is sorely lacking amid growing AI interest | ZDNET

• UK Government in £8.5m Bid to Tackle AI Cyber Threats - Infosecurity Magazine (infosecurity-magazine.com)

2FA/MFA

• Microsoft to Mandate Multi-Factor Authentication for All Azure Users (cybersecuritynews.com)

• Here's why you should get a YubiKey (xda-developers.com)

• Zero-Day Attacks and Supply Chain Compromises Surge, MFA Remains Underutilized: Rapid7 Report - Security Week

Malware

• Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide (thehackernews.com)

• Ukraine blackouts caused by malware attacks warn against evolving cyber security threats to the physical world (techxplore.com)

• 400K Linux Servers Recruited by Resurrected Ebury Botnet (darkreading.com)

• Another nasty Mac malware is spoofing legitimate software to target macOS users | TechRadar

• Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal (thehackernews.com)

• What Does Malware Look Like? Check Out These Real-World Examples (pcmag.com)

• Cyber Criminals Exploit GitHub and FileZilla to Deliver Malware Cocktail (thehackernews.com)

• Dangerous nostalgia: Taking Windows XP online will result in auto-installed viruses in a matter of minutes | TechSpot

• Malware Delivery via Cloud Services Exploits Unicode Trick to Deceive Users (thehackernews.com)

• MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks (thehackernews.com)

• Keylogger Embedded Microsoft Exchange Server Steals Login Credentials (cybersecuritynews.com)

• Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns (thehackernews.com)

• Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica

• US AI Experts Targeted in SugarGh0st RAT Campaign (darkreading.com)

• New BiBi Wiper version also destroys the disk partition table (bleepingcomputer.com)

• Novel EDR-Killing 'GhostEngine' Malware Is Built for Stealth (darkreading.com)

• Malicious actors are cat-phishing targets in order to spread malware | Security Magazine

Mobile

• It is dangerously easy to hack the world’s phones (economist.com)

• How often should you turn off your phone? Here's what the NSA says | PCWorld

• New Android Banking Trojan Mimics Google Play Update App - Infosecurity Magazine (infosecurity-magazine.com)

• North Korea-linked Kimsuky APT attack targets victims via Messenger (securityaffairs.com)

• US Official Warns a Cell Network Flaw Is Being Exploited for Spying | WIRED

• How to recognise if the security of your work device has been breached (siliconrepublic.com)

• Vultur Malware Mimic As Mobile Antivirus Steals Login Credentials (cybersecuritynews.com)

• ‘Unblockable’ HMRC scam message on iPhones sparks warning (yahoo.com)

• Lookout Threat Research Highlights Growing Mobile Security Risks | Business Wire

Internet of Things – IoT

• Teslas Can Still Be Stolen With a Cheap Radio Hack—Despite New Keyless Tech | WIRED

Data Breaches/Leaks

• Aon reveals cyber attack/data breach as top risk for financial institutions - Reinsurance News

• PSNI Faces £750,000 Data Breach Fine After Spreadsheet Leak - Infosecurity Magazine (infosecurity-magazine.com)

• NYSE parent fined $10M for breach reporting failure • The Register

• Were The Ashley Madison Hackers Ever Caught? (screenrant.com)

• 2.4 Million Impacted by WebTPA Data Breach - Security Week

• National Records of Scotland reveals its data stolen in 'distressing' NHS health board cyber attack (scotsman.com)

• 49 Million Customers Impacted by API Security Flaw - Security Boulevard

• Army personnel fear for their jobs after huge MoD cyber attack | The Independent

• Criminal record database of millions of Americans dumped online | Malwarebytes

• Optus denies claims of ‘cloaking’ Deloitte cyber attack report findings - Lawyers Weekly

• Record breaking number of data breaches reported | Bailiwick Express

• 400,000 Impacted by CentroMed Data Breach - Security Week

• 55,000 Impacted by Cyber Attack on California School Association  - Security Week

Organised Crime & Criminal Actors

• Were The Ashley Madison Hackers Ever Caught? (screenrant.com)

• HP Catches Cyber Criminals 'Cat-Phishing' Users (darkreading.com)

• Cyber crime on the rise as account takeovers become leading method (investmentnews.com)

• Moroccan cyber crime group impersonates nonprofits and abuses cloud services to rake in gift card cash | CyberScoop

• YouTube has become a significant channel for cyber crime - Help Net Security

• Ransomware innovation slowdown a product of crims' success • The Register

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking (thehackernews.com)

• Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam (thehackernews.com)

• Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica

• Dutch police tracked a crypto theft to one of world’s worst botnets (thenextweb.com)

• He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market | WIRED

Insider Risk and Insider Threats

• Human Error and AI Tops Cyber Security Threats in CISO Survey | Cryptopolitan

• Employee discontent: Insider threat No. 1 | CSO Online

• Can we fix the human error problem in cyber security? (siliconrepublic.com)

Insurance

• Cyber insurance Company Offers MDR to MSPs | MSSP Alert

• Should You Buy Cyber Insurance in 2024? Pros & Cons (techopedia.com)

• Cyber insurance trends: reshaping the industry - SiliconANGLE

Supply Chain and Third Parties

• Implementing Third-Party Risk Management Workflows | UpGuard

• Managing third-party risk with cyber security | RSM UK

• Zero-Day Attacks and Supply Chain Compromises Surge, MFA Remains Underutilized: Rapid7 Report - Security Week

• JAVS courtroom recording software backdoored in supply chain attack (bleepingcomputer.com)

Cloud/SaaS

• Critical Bug Allows DoS, RCE, Data Leaks in All Major Cloud Platforms (darkreading.com)

• Veeam 2024 Cloud Protection Trends Report Provides New Insight into Cloud‑Powered Data Protection Strategies | Business Wire

• Security concerns impeding cloud migration | SC Media (scmagazine.com)

• Malware Delivery via Cloud Services Exploits Unicode Trick to Deceive Users (thehackernews.com)

• Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)

• Cyber Criminals Exploit Cloud Storage For SMS Phishing Scams - Infosecurity Magazine (infosecurity-magazine.com)

Identity and Access Management

• Report: Organisations Are Scrambling to Overhaul Their Identity Security Frameworks Amidst Surge in Recent Attacks (globenewswire.com)

• 77 percent of organisations suffer cyber attacks due to identity issues (betanews.com)

Encryption

• Yet more ransomware uses BitLocker to encrypt victims' files • The Register

Linux and Open Source

• The economic model that made the internet, and the hack that almost broke it : Planet Money : NPR

• 400K Linux Servers Recruited by Resurrected Ebury Botnet (darkreading.com)

• Are all Linux vendor kernels insecure? A new study says yes, but there's a fix | ZDNET

Passwords, Credential Stuffing & Brute Force Attacks

• Cyber crime on the rise as account takeovers become leading method (investmentnews.com)

Social Media

• YouTube has become a significant channel for cyber crime - Help Net Security

• How Secure Is The Metaverse? (A Look At Cyber Threats And Defences) (forbes.com)

• Russia’s DoppelGänger Campaign Manipulates Social Media - Infosecurity Magazine (infosecurity-magazine.com)

Malvertising

• Ransomware gang targets Windows admins via PuTTy, WinSCP malvertising (bleepingcomputer.com)

• The mystery of the targeted ad and the library patron • The Register

• Windows admins targeted with clever malvertising scam | TechRadar

Training, Education and Awareness

• Three Psychological Theories to Ensure Cyber Security Training Sticks - Infosecurity Magazine (infosecurity-magazine.com)

Regulations, Fines and Legislation

• PSNI Faces £750,000 Data Breach Fine After Spreadsheet Leak - Infosecurity Magazine (infosecurity-magazine.com)

• NYSE parent fined $10M for breach reporting failure • The Register

• Intercontinental Exchange Will Pay $10 Million to Resolve SEC Cyber Probe (wsj.com)

• UK considering mandatory reporting for ransomware attacks (computing.co.uk)

• How to stay on top of evolving cyber security legislation | RSM UK

• SEC requires financial institutions to notify customers of breaches within 30 days - Help Net Security

• Security Compliance 101: What It Is and How to Master It - Security Boulevard

• Singapore updates cyber security law to expand regulatory oversight | ZDNET

• Avoiding Cyber Security Incident Overdisclosure:  Helpful Guidance | Mayer Brown Free Writings + Perspectives - JDSupra

• Counting Down to the EU NIS2 Directive - Security Boulevard

• The Dawn of DORA: Building a Resilient Financial Infrastructure (finextra.com)

• What American Enterprises Can Learn From Europe's GDPR Mistakes (darkreading.com)

• Preparing Your Organisation for Upcoming Cyber Security Deadlines (darkreading.com)

Backup and Recovery

• Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)

Data Protection

• 87% of medical practice data is digital | Security Magazine

Careers, Working in Cyber and Information Security

• The IT skills shortage situation is not expected to get any better - Help Net Security

• UK Government ramps up efforts to bridge cyber security skills gap (holyrood.com)

• IT Essentials: Sun, stress and security (computing.co.uk)

• Persistent Burnout Is Still a Crisis in Cyber Security (darkreading.com)

• 5 Ways SMBs Can Bridge the Cyber Security Skills Gap | Mimecast

Law Enforcement Action and Take Downs

• Dutch police tracked a crypto theft to one of world’s worst botnets (thenextweb.com)

• Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam (thehackernews.com)

• Police caught circumventing city bans on face recognition • The Register

• 10 Years in Prison for $4.5 million BEC Scammer Who Bought Ferrari to Launder Money | Tripwire

• LockBit takedown taking toll as gang plummets down rankings • The Register

• He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market | WIRED

• Casino cyber attacks put a bullseye on Scattered Spider • The Register

• First LockBit, now BreachForums: Are cops winning the war? • The Register

• No time to take eye of the ball despite recent cyber success – report (emergingrisks.co.uk)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• World War War III May Already Have Started—in the Shadows (reason.com)

• Britons should have three days' worth of tinned food and water, government says | Politics News | Sky News

• The Balance of Power in Cyber Space – What it Means for UK Business - British Foreign Policy Group (bfpg.co.uk)

• The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict

Nation State Actors

China

• The Security Interviews: What is the real cyber threat from China? | Computer Weekly

• UK not heeding warning over China threat, says ex-cyber security chief (yahoo.com)

• Newly Detected Chinese Group Targeting Military, Government Entities - Security Week

• Escalating Chinese cyber threats drive US efforts to secure critical infrastructure | SC Media (scmagazine.com)

• Inside Operation Diplomatic Specter: Chinese APT Group's Stealthy Tactics Exposed (thehackernews.com)

• Spies, trade and tech: China’s relationship with Britain (economist.com)

• Chinese, Iranian, and Russian gangs are attacking the U.S's drinking water and officials are alarmed | Fortune

• Google, Meta warned that undersea internet cables at risk for Chinese espionage: report (nypost.com)

• UK military in data breach - and other cyber security news | World Economic Forum (weforum.org)

• Researchers Warn of Chinese-Aligned Hackers Targeting South China Sea Countries (thehackernews.com)

• Active Chinese Cyberespionage Campaign Rifling Email Servers (inforisktoday.com)

• State hackers turn to massive ORB proxy networks to evade detection (bleepingcomputer.com)

• New Frontiers, Old Tactics: Chinese Espionage Group Targets Africa & Caribbean Govts (thehackernews.com)

• Stronger critical infrastructure defence aimed by Army Cyber Command | SC Media (scmagazine.com)

• Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam (thehackernews.com)

• Former Royal Marine charged with spying for China found dead (thetimes.co.uk)

Russia

• Ukraine blackouts caused by malware attacks warn against evolving cyber security threats to the physical world (techxplore.com)

• Chinese, Iranian, and Russian gangs are attacking the U.S's drinking water and officials are alarmed | Fortune

• Russia’s DoppelGänger Campaign Manipulates Social Media - Infosecurity Magazine (infosecurity-magazine.com)

• US says Russia likely launched space weapon - BBC News

• New Star Wars Plan: Pentagon Rushes to Counter Threats in Orbit - The New York Times

• British man, 64, charged with assisting Russian intelligence service | The Independent

Iran

• Chinese, Iranian, and Russian gangs are attacking the U.S's drinking water and officials are alarmed | Fortune

• Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel (thehackernews.com)

North Korea

• North Korea-linked Kimsuky APT attack targets victims via Messenger (securityaffairs.com)

• US Official Warns a Cell Network Flaw Is Being Exploited for Spying | WIRED

• North Korea-linked IT workers infiltrated hundreds of US firms (securityaffairs.com)

• High-ranking military officials' e-mail hacked, possibly by N. Korea (koreaherald.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict

• Government tells Britons to stockpile as part of emergency planning

• Spyware found on US hotel check-in computers | TechCrunch

---

Vulnerability Management

• New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs (thehackernews.com)

• Unpatched vulnerabilities making bad ransomware outcomes worse: What you need to know | SC Media (scmagazine.com)

• Over 60% of Network Security Appliance Flaws Exploited as Zero Days - Infosecurity Magazine (infosecurity-magazine.com)

• 93% of vulnerabilities unanalysed by NVD since February | TechTarget

• Zero-Day Attacks and Supply Chain Compromises Surge, MFA Remains Underutilized: Rapid7 Report - Security Week

• How AI-driven patching could transform cyber security | TechTarget

Vulnerabilities

• Microsoft Edge gets fixes for five more security vulnerabilities - Neowin

• Over 60% of Network Security Appliance Flaws Exploited as Zero Days - Infosecurity Magazine (infosecurity-magazine.com)

• Critical Bug Allows DoS, RCE, Data Leaks in All Major Cloud Platforms (darkreading.com)

• Veeam warns of critical Backup Enterprise Manager auth bypass bug (bleepingcomputer.com)

• Microsoft Has Yet to Patch 7 Pwn2Own Zero-Days (darkreading.com)

• Critical Flaw in AI Python Package Can Lead to System and Data Compromise - Security Week

• This devious Wi-Fi security flaw could let hackers eavesdrop on your network with ease | TechRadar

• Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal (thehackernews.com)

• Intel's Max Severity Flaw Affects AI Model Compressor Users (govinfosecurity.com)

• 15 QNAP NAS bugs and one PoC disclosed, update ASAP! (CVE-2024-27130) - Help Net Security

• Keylogger Embedded Microsoft Exchange Server Steals Login Credentials (cybersecuritynews.com)

• Chrome 125 Update Patches High-Severity Vulnerabilities - Security Week

• Ivanti Patches Critical Code Execution Vulnerabilities in Endpoint Manager - Security Week

• Unauthenticated RCE Vulnerability in Fortinet FortiSIEM: PoC Published (cybersecuritynews.com)

• Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern (thehackernews.com)

• VMware Abused in Recent MITRE Hack for Persistence, Evasion - Security Week

• High-severity GitLab flaw lets attackers take over accounts (bleepingcomputer.com)

• CISA Warns of Actively Exploited Apache Flink Security Vulnerability (thehackernews.com)

Tools and Controls

• Network Outages Hit 59% of Multi-Site Businesses Monthly - Infosecurity Magazine (infosecurity-magazine.com)

• New rules prompt 93% of organisations to rethink cyber security plans | Security Magazine

• Ransomware and AI-Powered Hacks Drive Cyber Investment - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft to Mandate Multi-Factor Authentication for All Azure Users (cybersecuritynews.com)

• What is a Third-Party Risk Assessment in Cyber Security? | UpGuard

• Should You Buy Cyber Insurance in 2024? Pros & Cons (techopedia.com)

• The Critical Role Of Web Filtering To Secure A Modern Workplace (forbes.com)

• We put too much faith in our web browsers, here's why we shouldn't (xda-developers.com)

• Windows 11 to Deprecate NTLM, Add AI-Powered App Controls and Security Defences (thehackernews.com)

• Google says Microsoft can’t be trusted after email security blunders | ITPro

• CISOs pursuing AI readiness should start by updating the org’s email security policy - Help Net Security

• Fighting identity fraud? Here's why we need better tech - Help Net Security

• Report: Organisations Are Scrambling to Overhaul Their Identity Security Frameworks Amidst Surge in Recent Attacks (globenewswire.com)

• 77 percent of organisations suffer cyber attacks due to identity issues (betanews.com)

• Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica

• Microsoft's latest Windows 11 security features aim to make it 'more secure out of the box' | ZDNET

• Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)

• Cyber insurance trends: reshaping the industry - SiliconANGLE

• The Evolution of Security Operations Centres in the Past Decade | Information Security Buzz

• Incident response: a useful guide - Tech Monitor

• Here's why you should get a YubiKey (xda-developers.com)

• Mastercard Doubles Speed of Fraud Detection with Generative AI - Infosecurity Magazine (infosecurity-magazine.com)

• When to Automate and When Not to Automate Security - Security Boulevard

• Critical Capabilities of Cyber Security Risk Assessment Tools (cybersaint.io)

• How AI-driven patching could transform cyber security | TechTarget

---

Reports Published in the Last Week

• 2024 Cloud Protection Trends (veeam.com)

• Arctic Wolf Labs 2024 Threat Report | Arctic Wolf

• Q1 2024 Global Phishing Report (knowbe4.com)

• 2024 Cyber Threat Report | Huntress

• 2024 Q1 Mobile Landscape Threat Report (lookout.com)

• State of Cyber Security Trends Report 2024 | Ivanti

---

Other News

• Aon reveals cyber attack/data breach as top risk for financial institutions - Reinsurance News

• 15 companies account for 62% of global attack surface | Security Magazine

• Google Deletes $125 Billion UniSuper Pension Fund Account; Impacts Over Half a Million Australians - Goodreturns

• Cyber attacks are soaring—treat them as an 'act of war', health care exec warns | Fortune Well

• If the Lights Went Out: Exploring a Power Grid Failure (greydynamics.com)

• Wars in Ukraine and Gaza raise UK infrastructure cyber threat level | New Civil Engineer

• Malware power threat real and growing – researchers (emergingrisks.co.uk)

• Microsoft’s President to Testify to House Panel on Cyber Security (bloomberglaw.com)

• Microsoft outage affects Bing, Copilot, DuckDuckGo and ChatGPT internet search (bleepingcomputer.com)

• 5 Ways SMBs Can Bridge the Cyber Security Skills Gap | Mimecast

• Why cyber security is front and centre for rail - Railway Technology (railway-technology.com)

• Mitigating cyber security risks in the technology sector | TechRadar

• New EU tool to counter hybrid threats - Ministry of Foreign Affairs Republic of Poland - Gov.pl website (www.gov.pl)

• Cyber attacks on construction firms jump, new report finds | News | Building

• FUD: How Fear, Uncertainty, and Doubt can ruin your security program - Security Boulevard

• Cyber Security in the legal sector | Law Gazette

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 15 October 2021

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

---

Top Cyber Stories of the Last Week

The Human Element Is the Weakest Link

Within the last week, Facebook has become the subject of a whistleblowing campaign featuring thousands of documents alleging malpractice. Despite their size and expected security controls, these documents have been exfiltrated without detection, lending credence to the idea of the insider threat. https://www.darkreading.com/risk/the-human-element-is-the-weakest-link

Ransomware is the Biggest Cyber Threat to Business But Most Firms Still Aren't Ready for It

Ransomware is still the most significant cyber security threat facing organisations – ranging from critical national infrastructure providers and large enterprises to schools and local businesses – but it's a threat that can be countered. https://www.zdnet.com/article/ransomware-is-now-the-most-urgent-cyber-threat-to-business-but-most-firms-arent-ready-for-it/

Most Known Ransomware Targets Windows Devices

Recently conducted research shows that 95% of identified ransomware is targeting Windows machines. Furthermore, the stats show that Israel are submitting by far the most ransomware samples, followed by South Korea, Vietnam, and China, with the UK in 10th place. https://www.theregister.com/2021/10/14/googles_virustotal_malware/

67% of Organisations Have Been Hit by Ransomware at Least Once

A recent report found that two-thirds of surveyed organizations have suffered a ransomware attack, with about half having been hit multiple times, and 16% having been hit three or more times. https://threatpost.com/podcast-67-percent-orgs-ransomware/175339/

Russian Cyber Crime Gang Targets Finance Firms With Stealthy Macros

A new phishing campaign dubbed MirrorBlast is deploying weaponized Excel documents that are extremely difficult to detect to compromise financial service organizations. The most notable feature of MirrorBlast is the low detection rates of the campaign's malicious Excel documents by security software, putting firms that rely solely upon detection tools at high risk. https://www.bleepingcomputer.com/news/security/russian-cybercrime-gang-targets-finance-firms-with-stealthy-macros/  

70% of Businesses Can’t Ensure the Same Level of Protection for Every Endpoint

Recent research found that 86% of UK respondents believe it is not possible to fully prevent ransomware and malware attacks from compromising their organisations. It also found that the rise in the number of endpoints that businesses need to protect continues to be a key source of risk exposure. https://www.helpnetsecurity.com/2021/10/15/endpoint-protection-level/

Over 90% of Firms Suffered Supply Chain Breaches Last Year

A recent survey polled 1200 IT and procurement leaders responsible for supply chain and cyber risk management. Those polled came from global companies with 1,000+ employees and were used to compile its report: Managing Cyber Risk Across the Extended Vendor Ecosystem. The report revealed the average number of breaches experienced in the past 12 months grew from 2.7 in 2020 to 3.7 in 2021 – a 37% year-on-year increase. https://www.infosecurity-magazine.com/news/90-firms-supply-chain-breaches/

Cyber Security Shortcomings Exposed By The Pandemic

According to a survey by SecureAge, 48% of businesses have experienced a cyber breach during the COVID-19 pandemic and another 8% ‘were not sure’. In addition, 16% of employees said they personally had to deal with a cyber security incident during the same period. https://www.helpnetsecurity.com/2021/10/13/cybersecurity-shortcomings/

6 Things to Know About 'Killware,' Cyber Security's Next Big Threat

Threat actors are adopting a “killware” cyber model, which launches attacks on critical infrastructure with the intent to cause harm. Alejandro Mayorkas, secretary for Homeland Security, told USA Today he is worried about killware because it has the potential to kill. Hackers breached a water system in February this year, which was considered an unsuccessful attempt to distribute contaminated water to residents of Florida. "[The] attack was not for financial gain but rather purely to do harm,” he said. https://www.beckershospitalreview.com/cybersecurity/6-things-to-know-about-killware-cybersecurity-s-next-big-threat.html

2021 Nastiest Malware: Here to Stay and Ever Evolving

This year was yet another year with COVID-19 and malware running rampant in the headlines. Be it in person or online, the world is still struggling in the fight against viruses. This year took another turn for the worse when attacks on critical infrastructure and supply chains became a hot trend. https://www.helpnetsecurity.com/2021/10/12/nastiest-malware-2021/

---

Threats

Ransomware

• Since 2020, At Least 130 Different Ransomware Families Have Been Active

• AWS Ransomware Attacks: Not A Question Of If, But When

• This New Ransomware Encrypts Your Data And Makes Some Nasty Threats, Too

• UK Cyber Head Says Russia Responsible For 'Devastating' Ransomware Attacks

• What Makes AWS Buckets Vulnerable To Ransomware

• The Netherlands Declares War On Ransomware Operations

• Weir Group Suffers 'Sophisticated' Ransomware Attack

• US Ransomware Law Would Require Victims To Disclose Ransom Payments Within 48 Hours

• Ransomware: Cyber Criminals Are Still Exploiting These Old Vulnerabilities, So Patch Now

BEC

• Analyzing Email Services Abused For Business Email Compromise

Phishing

• Human Hacking Increased As Apps And Browsers Moved Completely To The Cloud

• DocuSign Phishing Campaign Targets Low-Ranking Employees

• Phishing Campaign Uses Math Symbols To Evade Detection

Malware

• FreakOut Botnet Now Attacks Vulnerable Video DVR Devices

• FontOnLake Malware Strikes Linux Systems In Targeted Attacks

• Hackers Use Stealthy ShellClient Malware On Aerospace, Telco Firms

Vulnerabilities

• NSA Warns Of Alpaca TLS Attack, Use Of Wildcard TLS Certificates[RP1] 

• October Patch Tuesday: 3 Critical Bulletins Among 71

• Update Your Windows PCs Immediately To Patch New 0-Day Under Active Attack

• Microsoft Fixes Zero-Day Flaw In WIN32 Driver

• Windows Zero-Day Actively Exploited In Widespread Espionage Campaign

• Chinese Hackers Use Windows Zero-Day To Attack Defense, IT Firms

• Apple Releases Urgent iPhone And iPad Updates To Patch New Zero-Day Vulnerability

• Sky.Com Servers Exposed Via Misconfiguration

• Apache Patch Proves Patchy – Now You Need To Patch The Patch

Data Breaches/Leaks

• Data Breach Sees Millions Of Acer Customers' Data Being Sold By Hackers

Organised Crime & Criminal Actors

• Trickbot Rising — Gang Doubles Down on Infection Efforts to Amass Network Footholds

Cryptocurrency/Cryptojacking

• CryptoRom Scam Rakes In $1.4m By Exploiting Apple Enterprise Features

• Hackers Are Hijacking Copy And Paste To Steal Millions Of Dollars In Crypto Currency

Dark Web

• Dark Web: Many Cyber Crime Services Sell For Less Than $500

• What It Costs To Hire A Hacker On The Dark Web

• Warning: 24M Webcam Video Records Up For Grabs On The Dark Web

Supply Chain

• Worldwide Supply Chains Vulnerable As Businesses Lack Visibility Into Suppliers

DoS/DDoS

• Microsoft Says Azure Fended Off What Might Just Be The World's Biggest-Ever DDoS Attack

• Ukrainian Police Arrest DDoS Operator Controlling 100,000 Bots

OT, ICS, IIoT and SCADA

• Critical Infrastructure Security Dubbed 'Abysmal' By Researchers

Nation State Actors

• Google: We're Tracking 270 State-Sponsored Hacker Groups From Over 50 Countries

• Google Sent 50,000 Warnings Of State-Sponsored Attacks In 2021

• How Shape-Shifting Threat Actors Complicate Attack Attribution

• Google Warns Some Users That Fancybear’s Been Prowling Around

• Microsoft: Iran-Linked Hackers Breached Office 365 Customer Accounts

• We’re Not In Competition With China; We’re At War, Argues A Provocative New Book

Privacy

• Amazon's Ring Doorbell Can Violate Your Neighbour’s Privacy, A UK Judge Rules

• Amnesty International Links Cyber Security Firm To Spyware Operation

• Study Reveals Android Phones Constantly Snoop On Their Users

• How Apple Can Read Your Encrypted Messages

Other News

• This Is How Formula 1 Teams Fight Off Cyber Attacks

• Cyber Attack Shuts Down Ecuador's Largest Bank, Banco Pichincha[RP2] 

• 30 Mins Or Less: Rapid Attacks Extort Orgs Without Ransomware

• University Of Sunderland Is Latest To Be Hit By Cyber Attack

• Russia Excluded From 30-Country Meeting To Fight Ransomware And Cyber Crime

• Inside Apple: How MacOS Attacks Are Evolving

• Zero-Day Hunters Seek Laws To Prevent Vendors Suing Them For Helping Out And Doing Their Jobs

• Google To Give Security Keys To ‘High Risk’ Users Targeted By Government Hackers

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.