Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 11 August 2023
Black Arrow Cyber Threat Intelligence Briefing 11 August 2023:
-75% of Organisations Worldwide Set to Ban ChatGPT and Generative AI Apps on Work Devices
-How an Eight-Character Password Could be Cracked in Just a Few Minutes
-Ransomware Victims Surge 143% as Threat Actors Pivot to Zero-Day Exploits
-How Executives’ Personal Devices Threaten Business Security
-77% of Financial Firms Saw an Increase in Cyber Attack Frequency
-Protecting Against Sophisticated Cyber Attacks Requires Layered Defences
-Managing Human Cyber Risks Matters Now More Than Ever
-Hackers are Targeting Top Executives’ Microsoft 365 Accounts to Steal Work Logins
-UK Shaken by Major Data Breaches
-Threat of Cyber Attacks to UK National Security Upgraded: Compared to Chemical Weapons or Nuclear Attack
-Mac Users are Facing More Dangerous Security Threats Than Ever Before
-Cyber Attack to Cost Outsourcing Firm Capita up to £25m
-Government and Public Services Face 40% More Cyber Attacks and Struggle to Protect Due to Lack of Resources
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
75% of Organisations Worldwide Set to Ban ChatGPT and Generative AI Apps on Work Devices
Newly released research found that 75% of organisations worldwide are currently implementing or considering bans on ChatGPT and other generative Artificial Intelligence (AI) applications within the workplace, with 61% stating that it will be a long term or permanent solution. Despite this, the majority recognised the opportunity such applications bring to the workplace, with 55% believing it would increase efficiency. All in all, 81% remained in favour of AI, highlighting that whilst organisations see the benefit, they are not ready to take the plunge for fear of being caught flat-footed.
Many organisations may simply not have the expertise-in house or confidence to employ AI effectively. These organisations lack an effective AI management plan, which governs the usage of AI in the corporate environment, rather than banning it outright. By having a clear-set AI plan, organisations can use AI to improve their efficiency, whilst maintaining cyber resilience. An increasing number of organisations have approached us at Black Arrow to discuss how to embrace AI securely; contact us to see how we can help you.
Source: [Dark Reading]
How an Eight-Character Password Could be Cracked in Just a Few Minutes
Strong and complex passwords are necessary to protect online accounts and data from cyber criminals. Complex passwords typically use lowercase and uppercase characters, numbers, and special characters. But complexity by itself can still open your password to cracking if it doesn’t contain enough characters, according to research by security firm Hive Systems. The report found that a complex password of eight characters can be cracked in only five minutes, and other weaker or shorter passwords are cracked instantly. However, passwords that have a greater number of characters are less vulnerable: for example an 18 character password, even if only lowercase letters, would take 481,000 years for a computer to crack.
Since creating and remembering multiple complex and lengthy passwords on your own is impossible, a password manager is your best bet. By using a password manager for yourself or within your organisation, you can generate, store and apply strong passwords for websites and online accounts.
Source: [Techrepublic]
Ransomware Victims Surge 143% as Threat Actors Pivot to Zero-Day Exploits
The number of organisations that became victims of ransomware attacks surged 143% between the first quarter of 2022 and first quarter of this year, as attackers increasingly leveraged zero-day vulnerabilities to break into target networks.
In many of these attacks, threat actors did not bother to encrypt data belonging to victim organisations. Instead, they focused solely on stealing their sensitive data and extorting victims by threatening to sell or leak the data to others. The tactic left even those with otherwise robust backup and restoration processes backed into a corner; this highlights the need for organisations to be able to detect and ideally block anomalous exfiltration of data, and have effective and rehearsed incident response plans to address the concept of pure exfiltration, because having backups is not enough.
The costs of these types of controls continue to fall making them viable for even smaller businesses. Without tools like Managed Detection and Response (MDR) and Data Loss Prevention (DLP), attacks of this nature cannot be detected until it is too late to do anything to stop them.
Source: [Dark Reading]
How Executives’ Personal Devices Threaten Business Security
Individuals, including executives, are considered a major target for cyber attacks. Motivated attackers know the right individual people they want to go after to achieve their larger organisational goal, and they’ll use any means necessary to be successful.
A recent report found that most executives are using their personal devices for work, creating a “backdoor” for cyber criminals to access large organisations. 50% of executive respondents reported receiving work-related scams in their personal emails.
Personal device use can be effective for organisations, however they need to implement an effective bring-your-own-device (BYOD) procedure and provide employees, including executives, with frequent user awareness and education training. All users at all levels within an organisation need to understand the risks, and importantly the role they play in keeping the organisation secure.
Sources: [Help Net Security] [Security Affairs]
77% of Financial Firms Saw an Increase in Cyber Attack Frequency
According a recent report on the financial services sector, 77% of firms reported an increase in attack frequency, and 87% said attacks were more severe. These firms unanimously said they would look to outsource their cyber security programs to third-party providers to shore up their cyber defences. Among the respondents, firms need to protect hybrid work environments (62%), consolidate cyber security and managed IT services (41%) and tap industry-specific and regulatory expertise (33%).
Source: [SecurityMagazine]
Protecting Against Sophisticated Cyber Attacks Requires Layered Defences
Faced with an influx of sophisticated cyber threats, including usage of AI to further enhance the efficacy of social engineering attacks, and the growth of both malware-as-a-service (MaaS) and ransomware-as-a-service (RaaS), it is critical for organisations to invest in layered security defences.
Services like managed detection and response (MDR) are integral to monitoring, investigating and responding to threats in real time. But without a strong and comprehensive foundational cyber security posture, managed services alone cannot effectively mitigate threats. To ensure comprehensive defences against emerging threats, organisations must prioritise proactive measures that can stop attacks before they even start. As adversaries continue to refine their attack techniques, layered protection that covers every stage in the attack chain becomes imperative.
Source: [Forbes]
Managing Human Cyber Risks Matters Now More Than Ever
As artificial intelligence (AI) amplifies the sophistication and reach of phishing, vishing, and smishing attacks, understanding and managing human cyber risks has become increasingly vital, according to the SANS Institute. It makes sense as no matter the technological advancement, the human element has always been a point of entry for attackers.
A recent study found that mature security programs, marked by robust teams and leadership support, are characterised by having at least three full-time employees in their security awareness teams. In some cases, this isn’t feasible for an organisation and this is where outsourcing comes in. By outsourcing security awareness, organisations can ensure that they have access to security awareness experts, to keep their organisation educated. Here at Black Arrow we offer regular security and awareness training, bespoke to your organisation, for your employees and leadership team.
Source: [Help Net Security]
Hackers are Targeting Top Executives’ Microsoft 365 Accounts to Steal Work Logins
Cyber security provider Proofpoint reported that high-level execs at some of the world’s leading companies are repeatedly targeted with credential-stealing attacks. More alarmingly, according to Proofpoint, around one-third (35%) of the compromised users had multi-factor authentication (MFA) enabled.
The attacks come amid a rise in cases of EvilProxy, a phishing tool that allows attackers to steal even MFA-protected credentials. In the three months to June 2023, around 120,000 EvilProxy phishing emails were observed being sent to hundreds of targeted organisations globally, with many targeting Microsoft 365 user accounts in particular. Approximately 39% of the victims were C-level executives of which 17% were Chief Financial Officers, and 9% were Presidents and CEOs. Users must be trained effectively, to help mitigate the chance of them suffering a phishing attack. The C-suite is no exception.
Sources: [Help Net Security] [Security Affairs]
UK Shaken by Major Data Breaches
Recent major data breaches impacting crucial institutions like the UK Electoral Commission (which exposed the data of 40 million UK voters) and the Police Service of Northern Ireland, have brought attention to potential risks. Following a recent freedom of information request 10,000 police officers and staff details where published including details such as first name and surname, their rank or grade and the unit and where they are based. This breach occurred when a junior member of staff forgot to remove the master spreadsheet containing sensitive data when responding to the request.
Sources: [Telegraph] [Tech Crunch]
Threat of Cyber Attacks to UK National Security Upgraded: Compared to Chemical Weapons or Nuclear Attack
The UK government has raised the threat level posed by cyber attacks, now deeming the risk of cyber attacks to be more severe than that presented by small-scale chemical, biological, radiological, or nuclear (CBRN) attacks according to the latest National Risk Register (NRR) report for 2023. The report also highlighted artificial intelligence (AI) as a “chronic risk” – that is, one that poses “continuous challenges that erode our economy, community, way of life, and/or national security”.
Sources: [ITPro] [Infosecurity Magazine]
Mac Users are Facing More Dangerous Security Threats Than Ever Before
Apple’s MacBook Pro or iPhone devices are often perceived as safer, from a cyber security standpoint, compared to those from Microsoft or Google, mostly because of its “walled garden” approach. However, another key reason why hackers were not historically as interested in Apple was the smaller market share Apple held. That is no longer the case and as attacks are rising against Apple devices, this is something we expect to see continuing to accelerate.
In the last 10 years, Apple’s market share on desktop has increased from less than 7.5% to just over 20% today. Apple frequently patches actively exploited vulnerabilities, with overall 261 security vulnerabilities addressed so far this year. A recent report found that Mac users are targeted by three key threats: Trojans, Adware, and Potentially Unwanted Applications (PUA). Of the three, Trojans are the biggest single threat, making up more than half of all threat detections. Of all those detections, around half (52.7%) were for the EvilQuest encryption malicious software.
Source: [Techradar]
Cyber Attack to Cost Outsourcing Firm Capita up to £25m
Capita expects to take a financial hit of as much as £25m as a result of a cyber attack that began in March, pushing the outsourcing group to a pre-tax loss of almost £68m for the first half of the year. The group is still recovering from the attack by the Black Basta ransomware group, which hacked its Microsoft Office 365 software and accessed the personal data of staff working for the company and dozens of clients. Capita, which runs crucial services for local councils, the military, and the NHS, estimated that the financial costs associated with what it called the “cyber incident” would be between £20m and £25m. Previous estimates had put the cost at £15m to £20m.
The group said this new figure reflected the complexities of analysing the “exfiltrated” data, as well as costs of recovery and remediation and new investment to improve its cyber security. However, Capita said it was not currently able to estimate the level of any potential fine related to the incident and had not yet made any provision to cover any future costs. The company’s shares fell by more than 12% in morning trading on Friday after the release of its results, making it the biggest faller on the FTSE 250.
Source: [Guardian]
Government and Public Services Face 40% More Cyber Attacks and Struggle to Protect Due to Lack of Resources
A report published by BlackBerry noted a 40% rise in cyber attacks against public sector organisations and government institutions. One of the reasons is the limited resources and resistance that these government and public have; this makes it much easier for an attacker. An easy target is an attractive target.
Source: [Financial Express]
Governance, Risk and Compliance
Protecting Against Sophisticated Cyber attacks Requires Layered Defense (forbes.com)
Managing human cyber risks matters now more than ever - Help Net Security
Executives 'sleepwalking into cyber catastrophe', warns cyber security boss (cityam.com)
How To Deal With the Vagueness in New Cyber Regulations (darkreading.com)
Digital skills gap is challenging the cyber security of UK businesses - IT Security Guru
Cyber attack to cost outsourcing firm Capita up to £25m | Capita | The Guardian
9 common risk management failures and how to avoid them | TechTarget
Alarming survey: Many tech experts fail a test of their cyber security knowledge - SiliconANGLE
Safeguarding Businesses From Data Privacy And Cyber security Risk (forbes.com)
How Do Some Companies Get Compromised Again and Again? (securityintelligence.com)
What happens if cyber insurance becomes unviable? - Raconteur
NIST announces rare overhaul of security framework, focusing on organisational leadership | ITPro
Cyber Security Must Focus on the Goals of Criminals (informationweek.com)
Going Up! How to Handle Rising Cyber Security Costs (securityintelligence.com)
Maintaining Data Security Amidst Rising Concerns of Cyber attacks (techreport.com)
Why it’s time for everyone to reorient their thinking about cyber security | Federal News Network
It's Time for Cyber security to Talk About Climate Change (darkreading.com)
Threats
Ransomware, Extortion and Destructive Attacks
Healthcare and Finance Firms Ranked as Leading Targets for Cyber Attacks - MSSP Alert
Ransomware victim numbers surge as attackers target zero-day vulnerabilities | CSO Online
Definitive Guide to Ransomware 2023 | IBM whitepaper | ITPro | ITPro
Data exfiltration is now the go-to cyber extortion strategy - Help Net Security
Clop ransomware now uses torrents to leak data and evade takedowns (bleepingcomputer.com)
Spot Fake Extortion Attacks Without Wasting Time and Money (securityintelligence.com)
New Yashma Ransomware Variant Targets Multiple English-Speaking Countries (thehackernews.com)
Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits (darkreading.com)
Recent ransomware attacks share curiously similar tactics - Help Net Security
Ransomware Attacks: 20 Essential Considerations For Prep And Response (forbes.com)
Navigating the gray zone of ransomware payment practices - Help Net Security
Anatomy of a Black Basta Ransomware Attack on BankCard USA - MSSP Alert
Mallox Ransomware Group Revamps Malware Variants, Evasion Tactics (darkreading.com)
Clop Gang Offers Data Downloads Via Torrents - Infosecurity Magazine (infosecurity-magazine.com)
New Report Exposes Vice Society's Collaboration with Rhysida Ransomware (thehackernews.com)
Dallas pays millions for ransomware expenses after May attack – NBC 5 Dallas-Fort Worth (nbcdfw.com)
Strong authentication best defence against Ransomware: Yubico (securitybrief.co.nz)
Best practices for reporting ransomware attacks | TechTarget
Ransomware, healthcare and incident response: Lessons from the Allscripts attack | CSO Online
Microsoft OneDrive is a willing 'ransomware double agent' • The Register
Threat Report: Ransomware Down, Targeted Attacks on the Rise (inforisktoday.com)
Rasnake: Ransomware Now Threatens All, Not Just Elites | Newsmax.com
Ransomware Victims
Hospital System Goes Back To Paper Following Ransomware Attack (forbes.com)
Cyber attack forces hospitals to divert ambulances in Connecticut and Pennsylvania | CNN Politics
Dallas pays millions for ransomware expenses after May attack – NBC 5 Dallas-Fort Worth (nbcdfw.com)
Colorado Department of Higher Education warns of massive data breach (bleepingcomputer.com)
Bnei Brak hospital hit by cyber attack, bringing down computers | The Times of Israel
LockBit posts Siemens company Varian to its victim blog (techmonitor.ai)
Hacker stole more than $6 million from New Haven Public Schools (wfsb.com)
Phishing & Email Based Attacks
Hackers are targeting top executives to steal their work logins | TechRadar
Microsoft 365 accounts of execs, managers hijacked through EvilProxy - Help Net Security
9 of 10 Cyber attacks Start with a Phish, Comcast Study Shows - MSSP Alert
Microsoft Teams used in phishing campaign to bypass multi-factor authentication (malwarebytes.com)
AI tools like ChatGPT increasingly used by cyber criminals for phishing, experts warn | NL Times
First quarter of 2023 saw 88% rise in phishing attacks: Kaspersky | The Peninsula Qatar
RTL Today - Up to 80% of all cyber attacks: Phishing attempts surge in post-pandemic age
100K+ VIP Microsoft 365 users got targeted by phishers - OnMSFT.com
Microsoft’s Role in Email Breach to Be Part of US Cyber Inquiry - BNN Bloomberg
Interpol takes down phishing-as-a-service platform used by 70,000 people (therecord.media)
BEC – Business Email Compromise
Other Social Engineering; Smishing, Vishing, etc
Artificial Intelligence
When your teammate is a machine: 8 questions CISOs should be asking about AI | CSO Online
Generative AI In Cyber Should Worry Us, Here’s Why (forbes.com)
How to Prepare for ChatGPT's Risk Management Challenges (darkreading.com)
Experience: scammers used AI to fake my daughter’s kidnap | Family | The Guardian
White House offers prize money for hacker-thwarting AI (techxplore.com)
AI tools like ChatGPT increasingly used by cyber criminals for phishing, experts warn | NL Times
Data attacks set to enter new era under 'FraudGPT', warn cyber security execs (cityam.com)
Hackers Released New Black Hat AI Tool Evil-GPT (cybersecuritynews.com)
In the age of ChatGPT, Macs are under malware assault | Digital Trends
AI can now steal your passwords with almost 100% accuracy | Digital Trends
Microsoft AI Red Team building future of safer AI | Microsoft Security Blog
ChatGPT Security Concerns: Credentials on the Dark Web and More (techrepublic.com)
AI hacking gets White House backing; some already go rogue (9to5mac.com)
OpenAI to Unleash New Web Crawler to Devour More of the Open Web - Decrypt
5 Pitfalls and Possibilities AI Brings to Cyber Insurance (informationweek.com)
2FA/MFA
Microsoft Teams used in phishing campaign to bypass multi-factor authentication (malwarebytes.com)
Microsoft Authenticator will soon provide codes via WhatsApp - gHacks Tech News
Malware
In the age of ChatGPT, Macs are under malware assault | Digital Trends
Mac users are facing more dangerous security threats than ever before | TechRadar
Threat intelligence's key role in mitigating malware threats - Help Net Security
This PowerPoint could help hackers empty your bank account | Digital Trends
Latest Batloader Campaigns Use Pyarmor Pro for Evasion (trendmicro.com)
Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems (thehackernews.com)
Malicious npm Packages Found Exfiltrating Sensitive Data from Developers (thehackernews.com)
Fake VMware vConnector package on PyPI targets IT pros (bleepingcomputer.com)
Ukrainian state agencies targeted with open-source malware MerlinAgent (therecord.media)
QakBot Malware Operators Expand C2 Network with 15 New Servers (thehackernews.com)
Hackers use open source Merlin post-exploitation toolkit in attacks (bleepingcomputer.com)
New Statc Stealer Malware Emerges: Your Sensitive Data at Risk (thehackernews.com)
Gafgyt malware exploits five-years-old flaw in EoL Zyxel router (bleepingcomputer.com)
CISA: New Whirlpool backdoor used in Barracuda ESG hacks (bleepingcomputer.com)
Mobile
Google explains how Android malware slips onto Google Play Store (bleepingcomputer.com)
Czech cyber security experts warn against BaiRBIE.me app | Radio Prague International
Removing Spyware From Your Android Phone: A How-To Guide (slashgear.com)
How executives' personal devices threaten business security - Help Net Security
Invisible Ad Fraud Targets Korean Android Users - Infosecurity Magazine (infosecurity-magazine.com)
Google Play apps with 2.5M installs load ads when screen's off (bleepingcomputer.com)
40 Vulnerabilities Patched in Android With August 2023 Security Updates - Security Week
Android 14 to let you block connections to unencrypted cellular networks (bleepingcomputer.com)
Botnets
QakBot Malware Operators Expand C2 Network with 15 New Servers (thehackernews.com)
Two-Thirds of UK Sites Vulnerable to Bad Bots - Infosecurity Magazine (infosecurity-magazine.com)
Denial of Service/DoS/DDOS
Analysing Network Chaos Leads to Better DDoS Detection (darkreading.com)
How to accelerate and access DDoS protection services using GRE - Help Net Security
Researchers Strengthen Defences Against Common Cyber attack - CleanTechnica
Internet of Things – IoT
Panasonic Warns That IoT Malware Attack Cycles Are Accelerating | WIRED
Disposed-of Gadgets Can Lead to Wi-Fi Network Hacks, Kaspersky Says (darkreading.com)
The new technology that is making cars easier for criminals to steal, or crash (techxplore.com)
Data Breaches/Leaks
Executives 'sleepwalking into cyber catastrophe', warns cyber security boss (cityam.com)
The Top 10 Countries Being Bombarded by Data Breaches (gizmodo.com)
UK Electoral Commission hacked by 'hostile actors' | Reuters
PSNI officers who work with MI5 face relocation after ‘humongous’ security breach (telegraph.co.uk)
Burger King Serves Up Sensitive Data, No Mayo (darkreading.com)
Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian
TunnelCrack attack may cause vulnerable VPNs to leak traffic • The Register
Phishing-resistant authentication a key to breach prevention (securitybrief.co.nz)
Organised Crime & Criminal Actors
Cloud Company Assisted 17 Different Government Hacking Groups: US Researchers | NTD
IRS confirms takedown of bulletproof hosting provider Lolek (therecord.media)
Interpol Shuts Down African Cyber crime Group, Seizes $2 Million (darkreading.com)
Cyber security Must Focus on the Goals of Criminals (informationweek.com)
How fame-seeking teenagers hacked some of the world’s biggest targets | Ars Technica
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
BlackBerry Discloses Major Crypto-Based Malware - The Tech Report
FBI warns of phishing scams and social media account hijackers (cointelegraph.com)
Only 6 out of 45 crypto wallet brands have undergone penetration testing: Report (cointelegraph.com)
Insider Risk and Insider Threats
Managing human cyber risks matters now more than ever - Help Net Security
US Navy sailors charged with stealing secret info for China • The Register
Get consent before you monitor your staff, UK MPs suggest • The Register
Fraud, Scams & Financial Crime
Rise in fraudsters spoofing the websites of leading UK banks | Computer Weekly
Extended warranty robocallers fined $300 million after 5 billion scam calls (bleepingcomputer.com)
Experience: scammers used AI to fake my daughter’s kidnap | Family | The Guardian
Data attacks set to enter new era under 'FraudGPT', warn cyber security execs (cityam.com)
Impersonation Attacks
Insurance
What happens if cyber insurance becomes unviable? - Raconteur
Cyber Insurance Experts Make a Case for Coverage, Protection (darkreading.com)
5 Pitfalls and Possibilities AI Brings to Cyber Insurance (informationweek.com)
10 Key Controls to Show Your Organisation Is Worthy of Cyber Insurance (darkreading.com)
Lower Data Breach Insurance Costs with These Tips (trendmicro.com)
Dark Web
Dark web activity targeting the financial sector - Help Net Security
ChatGPT Security Concerns: Credentials on the Dark Web and More (techrepublic.com)
Supply Chain and Third Parties
Government contractor plunges after £25m cyber attack - The Mail (mailplus.co.uk)
37% of third-party applications have high-risk permissions - Help Net Security
Software Supply Chain
Unravelling the importance of software supply chain security - Help Net Security
OWASP Lead Flags Gaping Hole in Software Supply Chain Security (darkreading.com)
37% of third-party applications have high-risk permissions - Help Net Security
Cloud/SaaS
Attackers Use EvilProxy to target C-suite Executives (inforisktoday.com)
100K+ VIP Microsoft 365 users got targeted by phishers - OnMSFT.com
Cloud Company Assisted 17 Different Government Hacking Groups: US Researchers | NTD
Microsoft OneDrive is a willing 'ransomware double agent' • The Register
Managing and Securing Distributed Cloud Environments - Security Week
Microsoft 365 guests + Power Apps = security nightmare • The Register
Containers
Identity and Access Management
CrowdStrike observes massive spike in identity-based attacks | TechTarget
Keeper Security reveals SMBs at risk due to lack of PAM (securitybrief.co.nz)
Understanding Active Directory Attack Paths to Improve Security (thehackernews.com)
91% of IT leaders better protected with PAM but want more affordable solutions - IT Security Guru
Strong authentication best defence against Ransomware: Yubico (securitybrief.co.nz)
WhatsApp is working on phishing-proof passkey authentication (androidpolice.com)
Phishing-resistant authentication a key to breach prevention (securitybrief.co.nz)
Encryption
UK minister defends plan to demand access to encrypted messages | Privacy | The Guardian
Quantum computing: A threat to asymmetric encryption. (thecyberwire.com)
Open Source
Is Open Source Security a Ticking Cyber Time Bomb? (securityintelligence.com)
Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems (thehackernews.com)
Kemba Walden: We need to secure open source software | TechTarget
Passwords, Credential Stuffing & Brute Force Attacks
How an 8-character password could be cracked in just a few minutes (techrepublic.com)
AI can now steal your passwords with almost 100% accuracy | Digital Trends
US Dept. of the Interior Employees Use Accounts That Are Easily Hacked (businessinsider.com)
Biometrics
Social Media
Malvertising
Invisible Ad Fraud Targets Korean Android Users - Infosecurity Magazine (infosecurity-magazine.com)
Google Play apps with 2.5M installs load ads when screen's off (bleepingcomputer.com)
Not so fast: Don’t click that fake Amazon or Microsoft ad. Here’s why | Fox News
Training, Education and Awareness
Managing human cyber risks matters now more than ever - Help Net Security
Why Do Cyber security Awareness Programs Often Fail? (databreachtoday.co.uk)
Travel
Parental Controls and Child Safety
Cyber Bullying, Cyber Stalking and Sextortion
Regulations, Fines and Legislation
How To Deal With the Vagueness in New Cyber Regulations (darkreading.com)
What does the Data Protection and Digital Information (DPID) Bill mean for small businesses? | ITPro
The Problem With Cyber security (and AI Security) Regulation (darkreading.com)
CISA Unveils Cyber security Strategic Plan for Next 3 Years - Security Week
The 5 Ways The SEC Failed Investors On Cyber security (forbes.com)
America’s messy cyber regulations are no match for its adversaries | Financial Times (ft.com)
Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian
Banks hit with $549 million in fines for using Signal and WhatsApp to evade regulators (nbcnews.com)
ICO threatens enforcement action against websites with 'harmful' cookie banners | ITPro
UK minister defends plan to demand access to encrypted messages | Privacy | The Guardian
Models, Frameworks and Standards
NIST Drafts Major Update to Its Widely Used Cyber security Framework | NIST
Understanding NIST CSF and MITRE ATT&CK Security Frameworks - The New Stack
OWASP Lead Flags Gaping Hole in Software Supply Chain Security (darkreading.com)
Understanding Changes in the OWASP API Security Top 10 List - IT Security Guru
5 steps to ensure HIPAA compliance on mobile devices | TechTarget
Data Protection
Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian
ICO threatens enforcement action against websites with 'harmful' cookie banners | ITPro
Careers, Working in Cyber and Information Security
Digital skills gap is challenging the cyber security of UK businesses - IT Security Guru
Alarming survey: Many tech experts fail a test of their cyber security knowledge - SiliconANGLE
6 Essential Strategies for Enterprise Cyber security Workforce Development (govinfosecurity.com)
Seasoned cyber pros are more complacent in their skills than junior staff - Help Net Security
Law Enforcement Action and Take Downs
IRS confirms takedown of bulletproof hosting provider Lolek (therecord.media)
Interpol takes down phishing-as-a-service platform used by 70,000 people (therecord.media)
Privacy, Surveillance and Mass Monitoring
Missing persons NGO alliance kicks off global facial recognition initiative | Biometric Update
China drafts rules for using facial recognition data - Japan Today
Norway to fine Meta $98,500 a day over user privacy breach from 14 August | Meta | The Guardian
ICO threatens enforcement action against websites with 'harmful' cookie banners | ITPro
Woman Falsely Arrested Sues Detroit Over Facial Recognition (govtech.com)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare and Cyber Espionage
Russia
BlueCharlie changes attack infrastructure in response to reports on its activity - Security Affairs
Microsoft Teams used in phishing campaign to bypass multi-factor authentication (malwarebytes.com)
SpaceX's private control of satellite internet concerns military leaders | Space
Analysts Say Use of Spyware During Conflict Is Chilling (voanews.com)
Ukrainian state agencies targeted with open-source malware MerlinAgent (therecord.media)
Cyber security experts discuss wins, losses and lessons at western Ukraine gathering : NPR
Ukrainian official: Russian hackers change tactics from disruptive attacks | CyberScoop
Ukraine Fends Off Sandworm Battlefield Espionage Ploy (govinfosecurity.com)
Satellite hack on eve of Ukraine war was a coordinated, multi-pronged assault | CyberScoop
US, Ukraine cyber leaders talk resilience, collaboration | TechTarget
Kyiv Cyber Defenders Spot Open-Source RAT in Phishing Emails (govinfosecurity.com)
North Korea compromised Russian missile engineering firm NPO Mashinostroyeniya - Security Affairs
LockBit posts Siemens company Varian to its victim blog (techmonitor.ai)
China
China-Linked Hackers Strike Worldwide: 17 Nations Hit in 3-Year Cyber Campaign (thehackernews.com)
Electric vehicle threat: China will use its EV dominance to spy: UK warning (afr.com)
UK security must not be sacrificed to net zero (telegraph.co.uk)
Chinese cyber attacks on Japan prompts US push for stronger defences - Nikkei Asia
China reportedly had ‘deep, persistent access’ to Japanese networks for months | Engadget
Why the China cyber threat demands an airtight public-private response (federaltimes.com)
China not ahead of US in cyber and surveillance, NSA head says - Nextgov/FCW
China drafts rules for using facial recognition data - Japan Today
US Navy sailors charged with stealing secret info for China • The Register
RedHotel Checks in as Dominant China-Backed Cyber Spy Group (darkreading.com)
US Navy sailors charged with stealing secret info for China • The Register
Microsoft’s Role in Email Breach to Be Part of US Cyber Inquiry - BNN Bloomberg
Iran
North Korea
Reptile Rootkit: Advanced Linux Malware Targeting South Korean Systems (thehackernews.com)
North Korea compromised Russian missile engineering firm NPO Mashinostroyeniya - Security Affairs
Misc/Other/Unknown
Vulnerability Management
Five Eyes Agencies Call Attention to Most Frequently Exploited Vulnerabilities - Security Week
Will CVSS 4.0 be a vulnerability-scoring breakthrough or is it broken? | CSO Online
Microsoft hits back at Tenable’s criticism of its infosec • The Register
The Four Pillars of Vulnerability Management - GovInfoSecurity
Has Microsoft cut security corners once too often? | Computerworld
Why Shellshock Remains a Cyber security Threat After 9 Years (darkreading.com)
The 7 Worst Software Vulnerabilities of All Time (makeuseof.com)
Vulnerabilities
Microsoft Patch Tuesday for August 2023 fixed 2 actively exploited flaws - Security Affairs
Microsoft, Intel lead this month's security fix emissions • The Register
Raft of TETRA Zero-Day Vulnerabilities Endanger Industrial Communications (darkreading.com)
Nearly every AMD CPU since 2017 vulnerable to Inception bug • The Register
Microsoft fixes flaw after being called irresponsible by Tenable CEO (bleepingcomputer.com)
New PaperCut critical bug exposes unpatched servers to RCE attacks (bleepingcomputer.com)
Google Chrome will get weekly security updates - gHacks Tech News
Downfall: New Intel CPU Attack Exposing Sensitive Information - Security Week
Adobe Releases Security Updates for Multiple Products | CISA
New 'Inception' Side-Channel Attack Targets AMD Processors - Security Week
Dell Credentials Bug Opens VMWare Environments to Takeover (darkreading.com)
Tools and Controls
Managing human cyber risks matters now more than ever - Help Net Security
Windows Defender-Pretender Attack Dismantles Flagship Microsoft EDR (darkreading.com)
MDR: Empowering Organisations with Enhanced Security (thehackernews.com)
9 common risk management failures and how to avoid them | TechTarget
Why Do Cyber security Awareness Programs Often Fail? (databreachtoday.co.uk)
Here’s Why You Need Identity, Privacy, and Device Protection (finextra.com)
Attacker Breakout Time Shrinks Again, Underscoring Need for Automation (darkreading.com)
Managing and Securing Distributed Cloud Environments - Security Week
How to handle API sprawl and the security threat it poses - Help Net Security
Threat intelligence's key role in mitigating malware threats - Help Net Security
Phishing-resistant authentication a key to breach prevention (securitybrief.co.nz)
10 Key Controls to Show Your Organisation Is Worthy of Cyber Insurance (darkreading.com)
Lower Data Breach Insurance Costs with These Tips (trendmicro.com)
AI Risk Database Tackles AI Supply Chain Risks (darkreading.com)
Other News
UK Sounds Warning Over Targeted Healthcare Attack (databreachtoday.co.uk)
Budget constraints threaten cybersecurity in government bodies - Help Net Security
Threat of cyber attacks to national security compared to that of chemical weapons | ITPro
Cyber Security A Major Vulnerability In The Not For Profit Sector | Scoop News
Hacker attacks on Mac users are 10x as high as they were in 2019, report says | iMore
Cyber Security Threats From Online Gaming – Analysis – Eurasia Review
Cyber attack cost Interserve more than £11m | News | Building
Environmental Regulations, OT & the Maritime Industry's New Challenges (darkreading.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory - 12 June 2023 – Organisations Urged to Address Critical Vulnerabilities Found Fortinet and PaperCut Products
Black Arrow Cyber Advisory - 12 June 2023 – Organisations Urged to Address Critical Vulnerabilities Found Fortinet and Papercut Products
Executive summary
A recent report has highlighted the most notable software vulnerabilities in the first half of 2023, which included 2 critical actively exploited vulnerabilities in PaperCut MF and NG and Fortinet FortiOS products. This comes as Fortinet have recently released a patch for a separate critical vulnerability in FortiOS. All three vulnerabilities allow an attacker to remotely execute unauthorised code and compromise the confidentiality, integrity and availability of data.
Fortinet
CVE-2023-27997 – This recent critical vulnerability targets an secure socket layer virtual private network (SSL-VPN) flaw which allows an unauthenticated attacker remote code execution and to interfere with VPN connections even if Mulit-Factor Authentication (MFA) is in place. SSL-VPN is used to allow users to establish a secure, encrypted connection between the public internet and the corporate network.
CVE-2022-41328 – This is a vulnerability in improper limitation of a pathname, allowing an attacker to access restricted files with read and write access. Exploitation allows the attacker to remotely install and execute malware.
What can I do?
Fortinet has released fixes that address the vulnerability CVE-2023-27997. Customers must immediately apply the firmware updates as a matter of urgency. The following versions of FortiOS include patches for the vulnerability: 7.2.5, 7.0.12, 6.4.13, 6.2.15. An advisory has not been publicly announced yet. Results from Shodan indicate around 250,000 publicly discoverable devices are vulnerable.
For CVE-2022-41328, customers are recommended to update the affected products immediately as this is being actively exploited.
Affected products include:
- FortiOS version 7.2.0 through 7.2.3 (Patched in version 7.2.4 or above)
- FortiOS version 7.0.0 through 7.0.9 (Patched in version 7.0.10 or above)
- FortiOS version 6.4.0 through 6.4.11 (Patched in version 6.4.12 or above)
- FortiOS version 6.2.0 through 6.2.13 (Patched in version 6.2.14 or above)
- FortiOS 6.0 all versions (No longer supported)
PaperCut
CVE – 2023-27350 – This vulnerability allows an unauthenticated attacker to pull information about a user stored within PaperCut MF or NG. This data includes usernames, full names, email addresses, office/department info and any card numbers associated with the user. The attacker can also retrieve the hashed passwords for internal PaperCut created users only.
The following PaperCut MF and NG versions and components are affected by CVE-2023-27350 on all OS platforms:
- version 8.0.0 to 19.2.7
- version 20.0.0 to 20.1.6
- version 21.0.0 to 21.2.10
- version 22.0.0 to 22.0.8
What can I do?
PaperCut has recommended that customers upgrade all application servers and site servers and to patch any of the affected products. This vulnerability has been addressed in Papercut MF and NG versions 20.1.7, 21.2.11, and 22.0.9 and later.
Further details on the Fortinet vulnerability can be found here:
Further details on the Fortinet CVE-2022-41328 vulnerability can be found here:
https://www.fortiguard.com/psirt/FG-IR-22-369
Further details on the PaperCut vulnerability can be found here:
Black Arrow Cyber Threat Briefing 19 May 2023
Black Arrow Cyber Threat Briefing 19 May 2023:
-Triple Threat: Insecure Economy, Cyber Crime Recruitment and Insider Threats
-Insured Companies More Likely to be Ransomware Victims, Sometimes More Than Once
-Ensuring Security Remains/Becomes Everyone’s Responsibility
-Software Supply Chain Attacks Hit 61% of Firms
-More than 2.25 Million Exposed Assets on the Dark Web Tied to Fortune 1000 Employees
-Law Enforcement Crackdowns and New Techniques are Forcing Cyber Criminals to Pivot
-Talking Security Strategy: Why Cyber Security Requires a Seat at the Boardroom Table
-How Incident Response Rehearsals and Readiness Exercises Can Aid Incident Response
-Ransomware’s Real Goals are to Exploit Internet Facing Apps, Mine Intellectual Property and Grab Sensitive Information
-Organisations’ Cyber Resilience Efforts Fail to Keep Up with Evolving Threats
-Fraudsters Send Fake Invoice, Follow Up with Fake Executive Confirmation
-Capita Warns Customers They Should Assume Data was Stolen
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Triple Threat: Insecure Economy, Cyber Crime Recruitment and Insider Threats
Across all sectors employees are feeling the ramifications of economic uncertainty, coupled with ransomware attacks continuing to evolve and become more sophisticated, and with this, cyber crime gangs are increasing their recruitment efforts. All the while, the cyber security skills gap persists and continues to widen for most organisations. This has the potential to create a perfect storm in terms of insider threats.
Insider threats can be malicious or unintentional, and they might come from current or former employees, business partners, board members or consultants. A recent report found that the past two years have seen a 44% rise in insider incidents. There is no quick fix to solve the insider threat problem. At a time when many businesses are struggling with visibility issues brought on by digital transformation and vendor sprawl, what’s needed is planning. Reducing the risk associated with insider threats requires a multifaceted approach.
Ensuring Security Remains/Becomes Everyone’s Responsibility
In the same way as organisations believe that everyone is somewhat responsible for keeping costs reasonable, why would an organisation not think the same of cyber security, especially as cyber security is not just a technology problem: it is a business problem. One of the best methods for ensuring that security is everyone’s responsibility is to make cyber a top-down issue, with the board and C-suite setting the tone for security; they should provide clear direction and guidance, prioritising security as a business objective.
Other methods that can help ensure security as everyone’s responsibility include integrating it into the functions of roles, creating a security culture, providing awareness and training and rewarding employees for responses such as reporting phishing attacks.
https://cisoseries.com/20-ways-to-ensure-security-remains-becomes-everyones-responsibility/
Insured Companies More Likely to be Ransomware Victims, Sometimes More Than Once
Companies with cyber insurance are more likely to get hit by ransomware, more likely to be attacked multiple times, and more likely to pay ransoms, according to a recent survey of IT decision makers.
According to the survey by Barracuda Networks, 77% of organisations with cyber insurance were hit at least once, compared to 65% without insurance. Of those with insurance, 39% paid the ransom. Worryingly, the survey found that insured companies were also 70% more likely to be hit multiple times. Repeat victims were also more likely to pay the ransom, and less likely to use backup systems to help them recover.
Software Supply Chain Attacks Hit 61% of Firms
More than three-fifths (61%) of businesses have been directly impacted by a software supply chain threat over the past year, according to a new report. The report pointed to open source software as a key source of supply chain risk. Open source is now used by 94% of companies in some form, with over half (57%) using multiple open source platforms, the report revealed.
Organisations may be putting themselves at further risk by not having a full view of the software which is used within their corporate environment. One of the first things an organisation seeking to reduce their risk of a software supply chain attack should do is to understand their attack surface and maintain a record of the software which they use.
https://www.infosecurity-magazine.com/news/software-supply-chain-attacks-hit/
More than 2.25 Million Exposed Assets on the Dark Web Tied to Fortune 1000 Employees
In a newly released 2023 Fortune 1000 Identity Exposure Report, an analysis of the dark net exposure of employees across 21 industries, including technology, financial, retailing and media, researchers analysed 2.27 billion exposed dark web assets. These assets included more than 423 million records containing personally identifiable information (PII) found in data breaches and exfiltrated from malware-infected devices tied directly to Fortune 1000 employees’ email addresses.
Additional findings include 27.48 million pairs of credentials with Fortune 1000 corporate email addresses and plain text passwords, and a 62% re-use rate of passwords amongst Fortune 1000 employees. Whilst the research focuses on Fortune 1000 employees, it is unlikely that these are the only employees who are exposed on the dark web. Organisations should be aware of how such PII could include their own employees, and how to avoid password re-use in the corporate environment.
Law Enforcement Crackdowns and New Techniques are Forcing Cyber Criminals to Pivot
Researchers say that law enforcement crackdowns and new investigative tools are putting pressure on cyber criminals, but challenges for defenders remain. It can seem like cyber criminals are running rampant across the world's digital infrastructure, launching ransomware attacks, scams, and outright thefts with impunity. Over the last year, however, US and global authorities seized $112 million from cryptocurrency investment scams, disrupted the Hive ransomware group, broke up online illegal drug marketplaces, and sanctioned crypto money launderers, among other operations to crack down on internet-enabled crimes. With such pressure, financially motivated threat actors are pivoting to crimes that have a higher rate of success, such as selling data instead of extorting, and romance scams and pig butchering (building rapport and trust with victims over time only to steal from them) are replacing the old get-rich schemes.
Talking Security Strategy: Why Cyber Security Requires a Seat at the Boardroom Table
Cyber security is no longer a fringe issue for businesses. What was once a siloed function is now woven into the fabric of any successful business. Any business still treating its cyber security initiatives as a side project is setting itself up to fail. The US Securities and Exchange Commission (SEC) has laid to rest any doubts about the importance of cyber security with new regulations around how boards of directors should approach it. The regulations, which are in the process of being finalised, will require companies to openly report any serious cyber security attack and explain who on their board is responsible for dealing with it. The regulations also will require businesses to include board of directors' cyber security experience and credentials as part of any public disclosure.
How Incident Response Rehearsals and Readiness Exercises Can Aid Incident Response
Incident response rehearsals and readiness exercises can aid organisations by identifying security gaps, testing communications in the event of a cyber attack, and understanding roles in reducing response times. All of which benefits the business objectives of the organisation.
The importance for organisations to understand who their adversaries are and how they operate against their enterprise environments cannot be overstated. An organisation's approach to cyber security testing and resilience improvements in the face of an increasingly volatile threat landscape must be underpinned around this perspective.
Rehearsals should look to leverage scenarios based on evolving and emerging attacker techniques, tactics and procedures (TTPs), with different levels of complexity; this allows an organisation to constantly sharpen their technique and update rehearsals to reflect the current attack environment. These TTPs should be driven by an intelligence-led and risk-based approach. Additionally, organisations need to set metrics for understanding the results of rehearsals, which in turn should be used in established feedback channels to drive improvement in the organisation’s incident response.
https://www.darkreading.com/edge-articles/5-ways-security-testing-can-aid-incident-response
Ransomware’s Real Goals are to Exploit Internet Facing Apps, Mine Intellectual Property and Grab Sensitive Information
The majority of ransomware attacks in 2022 were intended to unearth personal data, mine intellectual property and grab other sensitive information rather than financial extortion or data encryption, Kaspersky said in a new report.
Most attacks started off as exploiting public facing applications (43%), data from compromised user accounts (24%) and malicious emails (12%). The goal was to snatch information the cyber crews could leverage into bigger and more lucrative scores. The report also revealed that the longest-running ransomware attacks began with the exploitation of public-facing applications, with just over 2% of them lasting for a year and more.
Organisations’ Cyber Resilience Efforts Fail to Keep Up with Evolving Threats
A steady increase in cyber attacks and an evolving threat landscape are resulting in more organisations turning their attention to building long-term cyber resilience; however, many of these programs are falling short and fail to prove teams’ real-world cyber capabilities, according to Immersive Labs. The report found that while 86% of organisations have a cyber resilience program, 52% of respondents say their organisation lacks a comprehensive approach to assessing cyber resilience.
Organisations have taken steps to deploy cyber resilience programs; however, 53% of respondents indicate the organisation’s workforce is not well-prepared for the next cyber attack and just over half say they lack a comprehensive approach to assessing cyber resilience. These statistics indicate that although cyber resilience is a priority and programs are in place, their current structure and training are ineffective.
https://www.helpnetsecurity.com/2023/05/18/cyber-resilience-programs-shortcomings/
Fraudsters Send Fake Invoice, Follow Up with Fake Executive Confirmation
Fraudsters are trying out a new approach to convince companies to pay bogus invoices: instead of hijacking existing email threads, they are creating convincing ones themselves. The fraud attempt begins with an email containing a payment request for a fake invoice. The recipient, an employee in a company’s finance department, reads the email and checks who sent it. The sender’s email address looks like it belongs to one of the company’s trusted vendors, and the VP of Finance has been CC-ed. Soon after, the “VP of Finance” replies to the email thread, and asks the employee (by name) to pay this at the earliest convenience.
Most organisations view social engineering methods as a one step process; however, threat actors are employing multiple layers. In this case, adding management to increase authenticity. Businesses looking to bolster their resilience should look to ensure that these kinds of attacks are addressed in their organisation’s user education and awareness training.
https://www.helpnetsecurity.com/2023/05/16/payment-request-fraud/
Capita Warns Customers They Should Assume Data was Stolen
Outsourcing giant Capita is warning customers to assume that their data was stolen in a cyber attack that affected its systems in early April. This includes the Universities Superannuation Scheme (USS), the largest private pension scheme in the UK, which holds pensions of over 500,000 individuals. A total of 350 UK corporate retirement schemes are believed to be impacted. The cyber attack, originally described to be a technical problem, has been reported to the UK’s Information Commissioner’s Office.
Governance, Risk and Compliance
Cyber security Often Overlooked as Key Factor for Business Success, New Study Says - MSSP Alert
Cyber Risk Management in 2023: The People Element (trendmicro.com)
Is Your Cyber security “Too” Good? (securityintelligence.com)
Cyber risk: Can banks win the arms race? | Financial Times (ft.com)
Security breaches push digital trust to the fore | CSO Online
5 Ways Security Testing Can Aid Incident Response (darkreading.com)
Organisations reporting cyber resilience are hardly resilient: Study | CSO Online
Organisations' cyber resilience efforts fail to keep up with evolving threats - Help Net Security
Keeping a competitive edge in the cyber security ‘game’ | CyberScoop
UK NCSC, ICO debunk 6 cyber attack reporting myths | CSO Online
An Executive's Guide To The Cyber crime Underground (forbes.com)
Law enforcement crackdowns and new techniques are forcing cyber criminals to pivot | CSO Online
20 Ways to Ensure Security Remains/Becomes Everyone’s Responsibility (cisoseries.com)
Talking Security Strategy: Cyber security Has a Seat at the Boardroom Table (darkreading.com)
Triple Threat: Insecure Economy, Cyber crime Recruitment and Insider Threats - SecurityWeek
Threats
Ransomware, Extortion and Destructive Attacks
Insured companies more likely to be ransomware victims, sometimes more than once | CSO Online
Ransomware payments nearly double in one year | Cyber crime | The Guardian
The Week in Ransomware - May 12th 2023 - New Gangs Emerge (bleepingcomputer.com)
New trends in ransomware attacks shape the future of cyber security - Help Net Security
ABB 'suffers cyber attack' by ransomware gang Black Basta (techmonitor.ai)
Why Amazon S3 is a ransomware target and how to protect it | TechTarget
Experts question San Bernardino's $1.1M ransom payment | TechTarget
Ransomware corrupts data, making restoration harder • The Register
CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware (thehackernews.com)
VPN vulnerability linked to ransomware attack on Law Society: PDPC - CNA (channelnewsasia.com)
Philadelphia Inquirer operations disrupted after cyber attack (bleepingcomputer.com)
Ransomware gang steals data of 5.8 million PharMerica patients (bleepingcomputer.com)
New RA Group ransomware targets US orgs in double-extortion attacks (bleepingcomputer.com)
Ransomware Prevention – Are Meeting Password Security Requirements Enough (bleepingcomputer.com)
Qilin Ransomware Operation Outfits Affiliates With Sleek, Turnkey Cyber attacks (darkreading.com)
Ransomware-as-a-service groups pay affiliates top dollar • The Register
Russian ransomware affiliate charged with attacks on critical infrastructure (bleepingcomputer.com)
This new ransomware group is targeting big businesses - here's what you need to know | TechRadar
Warning Issued About BianLian Ransomware Attacks By CISA & FBI (informationsecuritybuzz.com)
FBI confirms BianLian ransomware switch to extortion only attacks (bleepingcomputer.com)
'Strictly limit' remote desktop to avoid BianLian ransomware • The Register
MalasLocker ransomware targets Zimbra servers, demands charity donation (bleepingcomputer.com)
Russian national indicted for ransomware attacks against the US | CSO Online
A different kind of ransomware demand: Donate to charity to get your data back | CyberScoop
Phishing & Email Based Attacks
What the Email Security Landscape Looks Like in 2023-Security Affairs
Ongoing Facebook phishing campaign without a sender and (almost) without links
Google's .zip Top Level domain is already used in phishing attacks - gHacks Tech News
New ZIP domains spark debate among cyber security experts (bleepingcomputer.com)
Exploring the tactics of phishing and scam websites in 2023 - Help Net Security
Trojan-Rigged Phishing Attacks Pepper China-Taiwan Conflict (darkreading.com)
Other Social Engineering; Smishing, Vishing, etc
Fraudsters send fake invoice, follow up with fake exec confirmation - Help Net Security
Insider threats surge across US CNI as attackers exploit human factors | CSO Online
Microsoft Teams Features Amp Up Orgs' Cyber attack Exposure (darkreading.com)
Researchers show ways to abuse Microsoft Teams accounts for lateral movement | CSO Online
Artificial Intelligence
New Google search tool will distinguish real images from AI-generated phonies | ZDNET
AI-Powered Tools Threaten Password Strength, New Study Finds - MSSP Alert
AI Is About to Be Everywhere: Where Will Regulators Be? (darkreading.com)
Generative AI Empowers Users but Challenges Security (darkreading.com)
Security Vulnerabilities of ChatGPT-Generated Code (trendmicro.com)
3 Ways Hackers Use ChatGPT to Cause Security Headaches (darkreading.com)
ChatGPT is about to revolutionize cyber security | VentureBeat
Mitigating Dark Web Risks: The Role Of AI And Machine Learning (forbes.com)
2FA/MFA
Malware
Microsoft is scanning the inside of password-protected zip files for malware | Ars Technica
XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks (thehackernews.com)
Atomic malware steals Mac passwords, crypto wallets, and more • Graham Cluley
CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware (thehackernews.com)
No more macros? No problem, say attackers, we'll adapt • The Register
The new info-stealing malware operations to watch out for (bleepingcomputer.com)
DangerousPassword - A Malware Attack Pattern to Infect Devices (gbhackers.com)
Stealthy MerDoor malware uncovered after five years of attacks (bleepingcomputer.com)
Hackers Using Golang Variant of Cobalt Strike to Target Apple macOS Systems (thehackernews.com)
New ZIP domains spark debate among cyber security experts (bleepingcomputer.com)
Infamous cyber crime marketplace offers pre-order service for stolen credentials - Help Net Security
Once Again, Malware Discovered Hidden in npm (darkreading.com)
Trojan-Rigged Phishing Attacks Pepper China-Taiwan Conflict (darkreading.com)
Mobile
Parental control app with 5 million downloads vulnerable to attacks (bleepingcomputer.com)
Apple blocked 1.7 million apps for privacy, security issues in 2022 (bleepingcomputer.com)
Converso walks back E2EE claims, yanks app from stores • The Register
OilAlpha: Emerging Houthi-linked Cyber Threat Targets Arabian Android Users (thehackernews.com)
Google Announces New Rating System for Android and Device Vulnerability Reports - SecurityWeek
Millions of Smartphones Distributed Worldwide With Preinstalled 'Guerrilla' Malware - SecurityWeek
Botnets
Latest variant of RapperBot botnet adds cryptojacking capabilities-Security Affairs
Spanish cops arrest 69 in immigration bot scheme • The Register
Denial of Service/DoS/DDOS
Internet of Things – IoT
Netgear Routers' Flaws Expose Users to Malware, Remote Attacks, and Surveillance (thehackernews.com)
Why 2.4GHz Wi-Fi is both the savior and the scourge of the smart home - The Verge
Hackers infect TP-Link router firmware to attack EU entities (bleepingcomputer.com)
Chinese Hackers Mustang Panda Attacks TP-Link Routers (informationsecuritybuzz.com)
Unpatched Wemo Smart Plug Bug Opens Countless Networks to Cyber attacks (darkreading.com)
Is your car safe from a cyber attack? | E&T Magazine (theiet.org)
Data Breaches/Leaks
UK's largest private pension scheme hit by Capita attack • The Register
Capita warns customers they should assume data was stolen (bleepingcomputer.com)
More than 2.25 Million Exposed Assets on the Dark Web Tied to Fortune 1000 Employees - MSSP Alert
MP’s laptop stolen from Welcome Break spot 'not covered by CCTV' | UK News | Metro News
Discord discloses data breach after support agent got hacked (bleepingcomputer.com)
Data of 237,000 US government employees breached - CNA (channelnewsasia.com)
Toyota: Car location data of 2 million customers exposed for ten years (bleepingcomputer.com)
Toyota's bungling of customer privacy is becoming a pattern • The Register
WordPress Plugin Vulnerability Exposed Ferrari Website to Hackers - SecurityWeek
Personal info of 90k hikers leaked by French tourism company La Malle Postale-Security Affairs
Ransomware gang steals data of 5.8 million PharMerica patients (bleepingcomputer.com)
Airline exposes passenger info to others due to a 'technical error' (bleepingcomputer.com)
University admission platform exposed student passports-Security Affairs
Millions of deleted files recovered in hard drives purchased online | TechRadar
Organised Crime & Criminal Actors
Law enforcement crackdowns and new techniques are forcing cyber criminals to pivot | CSO Online
An Executive's Guide To The Cyber crime Underground (forbes.com)
Hacker marketplace still active despite police 'takedown' claim - BBC News
How Cyber criminals Adapted to Microsoft Blocking Macros by Default (darkreading.com)
Darknet Carding Kingpin Pleads Guilty: Sold Financial Info of Tens of Thousands (thehackernews.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Atomic malware steals Mac passwords, crypto wallets, and more • Graham Cluley
Hacker admits he was connected to 'tens of thousands’ laptops to mine crypto (finbold.com)
CLR SqlShell Malware Targets MS SQL Servers for Crypto Mining and Ransomware (thehackernews.com)
Latest variant of RapperBot botnet adds cryptojacking capabilities-Security Affairs
North Korean hackers stole $721 million in cryptocurrency from Japan - Nikkei | Reuters
DangerousPassword - A Malware Attack Pattern to Infect Devices (gbhackers.com)
Landmark crypto rules make exchanges liable for customer losses in EU | Ars Technica
Insider Risk and Insider Threats
Triple Threat: Insecure Economy, Cyber crime Recruitment and Insider Threats - SecurityWeek
Avoiding Reputational Damage By Conquering Insider Threats (informationsecuritybuzz.com)
Insider threats surge across US CNI as attackers exploit human factors | CSO Online
Ex-Apple engineer accused of stealing self-driving car secrets - BBC News
Identity crimes: Too many victims, limited resources - Help Net Security
Fraud, Scams & Financial Crime
Fraudsters send fake invoice, follow up with fake exec confirmation - Help Net Security
Exploring the tactics of phishing and scam websites in 2023 - Help Net Security
How To Avoid Mother's Day Scams By Protecting Your Purse And Heart (informationsecuritybuzz.com)
Spanish cops arrest 69 in immigration bot scheme • The Register
Admin of the darknet carding platform Skynet Market pleads guilty-Security Affairs
18-year-old charged with hacking 60,000 sports betting accounts (bleepingcomputer.com)
AML/CFT/Sanctions
Insurance
Dark Web
Hacker marketplace still active despite police 'takedown' claim - BBC News
Infamous cyber crime marketplace offers pre-order service for stolen credentials - Help Net Security
Darknet Carding Kingpin Pleads Guilty: Sold Financial Info of Tens of Thousands (thehackernews.com)
Mitigating Dark Web Risks: The Role Of AI And Machine Learning (forbes.com)
Supply Chain and Third Parties
Capita warns customers they should assume data was stolen (bleepingcomputer.com)
Capita hit by new data breach incident | Financial Times (ft.com)
Another security calamity for Capita: Unsecured AWS bucket • The Register
UK's largest private pension scheme hit by Capita attack • The Register
Discord Informs Users of Data Breach Involving Customer Support Provider - SecurityWeek
Preparing for federal supply chain security standardization - Help Net Security
Software Supply Chain
Cloud/SaaS
Security experts share cloud auditing best practices | TechTarget
Stop worrying about cloud-lock-in, and outages: Gartner • The Register
Microsoft Azure VMs Hijacked in Cloud Cyber attack (darkreading.com)
Why High Tech Companies Struggle with SaaS Security (thehackernews.com)
Capita hit by new data breach incident | Financial Times (ft.com)
Why Amazon S3 is a ransomware target and how to protect it | TechTarget
Microsoft lets Azure AD choose authentication method • The Register
Encryption
Converso walks back E2EE claims, yanks app from stores • The Register
Protect against current and future threats with encryption | TechTarget
API
Open Source
EU attempts to secure software could hurt open source • The Register
CISA: Several Old Linux Vulnerabilities Exploited in Attacks - SecurityWeek
Open-source Cobalt Strike port 'Geacon' used in macOS attacks (bleepingcomputer.com)
Malicious open-source components threatening digital infrastructure - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Time Taken For Hackers to Crack Passwords Revealed - IT Security Guru
AI-Powered Tools Threaten Password Strength, New Study Finds - MSSP Alert
Passkeys may not be for you, but they are safe and easy—here’s why | Ars Technica
Ransomware Prevention – Are Meeting Password Security Requirements Enough (bleepingcomputer.com)
KeePass 2.X Master Password Dumper allows retrieving the KeePass master password-Security Affairs
Social Media
Former TikTok official says China had access to app data | Al Arabiya English
Ongoing Facebook phishing campaign without a sender and (almost) without links
Twitter wrong to block tweets during Turkey election - Wikipedia founder - BBC News
Twitter sued over Saudi spying that allegedly landed popular user in prison [Updated] | Ars Technica
Training, Education and Awareness
Parental Controls and Child Safety
Regulations, Fines and Legislation
EU attempts to secure software could hurt open source • The Register
AI Is About to Be Everywhere: Where Will Regulators Be? (darkreading.com)
Preparing for federal supply chain security standardization - Help Net Security
Secure Disposal
Careers, Working in Cyber and Information Security
Open source and Linux skills are still in demand in a dark economy | ZDNET
Top 10 Ideas for Addressing the Cyber security Skills Gap in 2023 (analyticsinsight.net)
Google Cloud CISO on why the Google Cyber security Certificate matters - Help Net Security
Law Enforcement Action and Take Downs
Law enforcement crackdowns and new techniques are forcing cyber criminals to pivot | CSO Online
Hacker marketplace still active despite police 'takedown' claim - BBC News
Spanish cops arrest 69 in immigration bot scheme • The Register
Identity crimes: Too many victims, limited resources - Help Net Security
Darknet Carding Kingpin Pleads Guilty: Sold Financial Info of Tens of Thousands (thehackernews.com)
Admin of the darknet carding platform Skynet Market pleads guilty-Security Affairs
18-year-old charged with hacking 60,000 sports betting accounts (bleepingcomputer.com)
Russian national indicted for ransomware attacks against the US | CSO Online
Privacy, Surveillance and Mass Monitoring
The UK’s Secretive Web Surveillance Program Is Ramping Up | WIRED
WhatsApp allows users to lock sensitive chats - Help Net Security
Apple blocked 1.7 million apps for privacy, security issues in 2022 (bleepingcomputer.com)
Google details its next steps for wiping out Chrome tracking cookies | Engadget
Misinformation, Disinformation and Propaganda
Pakistan shut down the internet - but that didn't stop the protests - BBC News
Twitter wrong to block tweets during Turkey election - Wikipedia founder - BBC News
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Nation State Actors
Former TikTok official says China had access to app data | Al Arabiya English
Gatewatcher unveils research into advanced persistent threats | Data Centre Solutions
How China came to dominate the black market for money laundering (telegraph.co.uk)
North Korean hackers stole $721 million in cryptocurrency from Japan - Nikkei | Reuters
Hackers infect TP-Link router firmware to attack EU entities (bleepingcomputer.com)
Chinese Hackers Mustang Panda Attacks TP-Link Routers (informationsecuritybuzz.com)
Cyble — Cisco Routers Exploited by Russian State-Sponsored Attackers
DOJ links Iran, China and Russia to five IP theft-related cases | SC Media (scmagazine.com)
Trojan-Rigged Phishing Attacks Pepper China-Taiwan Conflict (darkreading.com)
Vulnerability Management
Microsoft will take nearly a year to finish patching new 0-day Secure Boot bug | Ars Technica
Remote updates on motherboards could lead to bricked servers • The Register
Hacking Groups Rapidly Weaponizing N-Day Vulnerabilities (gbhackers.com)
CISA: Several Old Linux Vulnerabilities Exploited in Attacks - SecurityWeek
How to build a better vulnerability management program | TechTarget
Google Announces New Rating System for Android and Device Vulnerability Reports - SecurityWeek
How to Protect Your Organisation From Vulnerabilities (darkreading.com)
Vulnerabilities
Hackers target Wordpress plugin flaw after PoC exploit released (bleepingcomputer.com)
Critical Flaws in Cisco Small Business Switches Could Allow Remote Attacks (thehackernews.com)
KeePass flaw allows retrieval of master password, PoC is public (CVE-2023-32784) - Help Net Security
Apple fixes three new zero-days exploited to hack iPhones, Macs (bleepingcomputer.com)
XWorm Malware Exploits Follina Vulnerability in New Wave of Attacks (thehackernews.com)
Details Disclosed for Exploit Chain That Allows Hacking of Netgear Routers - SecurityWeek
Arm confident Cortex-M is secure after side-channel attack • The Register
Microsoft Follina Bug Is Back in Meme-Themed Cyber attacks Against Travel Orgs (darkreading.com)
CISA: Several Old Linux Vulnerabilities Exploited in Attacks - SecurityWeek
Remote updates on motherboards could lead to bricked servers • The Register
Microsoft will take nearly a year to finish patching new 0-day Secure Boot bug | Ars Technica
Microsoft pulls Defender update fixing Windows LSA Protection bug (bleepingcomputer.com)
WordPress 6.2.1 Released with Fixes for 5 Security Vulnerabilities – WP Tavern
Cisco Says PoC Exploits Available for Newly Patched Enterprise Switch Vulnerabilities - SecurityWeek
Tools and Controls
Organisations' cyber resilience efforts fail to keep up with evolving threats - Help Net Security
Hacking Groups Rapidly Weaponizing N-Day Vulnerabilities (gbhackers.com)
5 Ways Security Testing Can Aid Incident Response (darkreading.com)
Organisations reporting cyber resilience are hardly resilient: Study | CSO Online
Passkeys may not be for you, but they are safe and easy—here’s why | Ars Technica
The Ultimate Guide to Multi-Factor Authentication - Security Boulevard
Open-source Cobalt Strike port 'Geacon' used in macOS attacks (bleepingcomputer.com)
Protect against current and future threats with encryption | TechTarget
Can AI Decision-Making Be Trusted for Cyber security? (analyticsinsight.net)
'Strictly limit' remote desktop to avoid BianLian ransomware • The Register
Millions of deleted files recovered in hard drives purchased online | TechRadar
Key Metrics In Evaluating DevOps Threat Matrix (informationsecuritybuzz.com)
ChatGPT is about to revolutionize cyber security | VentureBeat
A Requirements-Driven Approach to Cyber Threat Intelligence | Mandiant
Embedding Security by Design: A Shared Responsibility (darkreading.com)
Reports Published in the Last Week
Other News
Heightened cyber attacks threat before Council of Europe summit in Reykjavik – EURACTIV.com
12 common network protocols and their functions explained | TechTarget
Pentagon Hacking Fears Fueled by Microsoft's Monopoly on Military IT (newsweek.com)
Ukraine, Ireland, Japan and Iceland join NATO CCDCOE-Security Affairs
Web entity activity reveals insights into internet security - Help Net Security
Microsoft Security highlights from RSAC 2023 - Microsoft Security Blog
Top 5 Cyber security Predictions and Statistics for 2023 (analyticsinsight.net)
No more macros? No problem, say attackers, we'll adapt • The Register
Researchers show ways to abuse Microsoft Teams accounts for lateral movement | CSO Online
Rebinding Attacks Persist With Spotty Browser Defences (darkreading.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 12 May 2023
Black Arrow Cyber Threat Briefing 12 May 2023:
-79% of Cyber Pros Make Decisions Without Threat Intelligence
-61% of Business Leadership Overlook the Role of Cyber Security as a Business Enabler and as being Key to Business Success
-Risk Managers Warn Cyber Insurance Could Become ‘Unviable Product’
-Small and Medium-Sized Businesses: Don’t Give up on Cyber Security
-AI Has Been Dubbed a 'Nuclear' Threat to Cyber Security, but It Can Also Be Used for Defence
-Paying Cyber Hijackers’ Ransoms Doubles Cost of Recovery, Sophos Study Shows
-Majority of US, UK CISOs Unable to Protect Company 'Secrets'
-Company Executives Can’t Afford to Ignore Cyber Security Anymore
-BEC Campaign via Israel Spotted Targeting Multinational Companies
-CISOs Worried About Personal Liability for Breaches
-UK, US and International Allies Uncover Russian Snake Malware Network in 50+ Countries
-Plug-and-Play Microsoft 365 Phishing Tool 'Democratizes' Attack Campaigns
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
79% of Cyber Pros Make Decisions Without Threat Intelligence
In a recent report, 79% of security pros say they make decisions without adversary insights “at least the majority of the time.” Why aren’t companies effectively leveraging threat intelligence? And does the C-Suite know this is going on?
Threat intelligence helps organisations stay informed about the latest cyber threats and vulnerabilities. By gathering and analysing information about potential attacks, threat intelligence can provide organisations with valuable insights into the tactics, techniques and procedures (TTPs) used by cyber criminals.
Given the deep value provided by threat intelligence, why aren’t more cyber pros taking advantage of it?
61% of Business Leadership Overlook the Role of Cyber Security as a Business Enabler and as being Key to Business Success
A recent report found only 39% of respondents think their company's leadership has a sound understanding of cyber security's role as a business enabler. Cyber security can be a huge business enabler; executive leaders need to think of cyber security in terms of the value it can deliver at a more strategic level.
Risk Managers Warn Cyber Insurance Could Become ‘Unviable Product’
The Federation of European Risk Management Associations (FERMA), an umbrella body representing 22 trade associations, said the cyber insurance market is “evolving in isolation from the industries it serves”.
It highlighted a move by Lloyd’s of London, the specialist insurance market and hub for cyber insurance, demanding that standard cyber policies have an exemption for big state-backed attacks.
“Without a more collaborative approach to cyber balancing the risk appetite of the insurance market with the coverage requirements of the corporate buyers, there is a risk that cyber insurance becomes an unviable product for many organisations,” FERMA said in a statement shared with the Financial Times.
The intervention is the strongest yet by the business lobby over the controversial exemption and wider concerns about cyber insurance.
https://www.ft.com/content/401629cc-e68a-41a4-8d50-e7c0d3e27835
Small and Medium-Sized Businesses: Don’t Give up on Cyber Security
In today’s increasingly hostile environment, every enterprise, big or small, should be concerned about cyber security and have access to protection from hackers, scammers, phishers, and all the rest of the host of bad actors who seem to be sprouting up around the world.
Yet time and again, small and medium-sized businesses (SMBs) are left out in the cold, an unaddressed market segment that finds real protection either too expensive or far too complex to adopt. Thus, cyber security becomes an “afterthought” or “add when we can” kind of service that leaves SMBs far more vulnerable than the corporate giants — just reading the news every day shows even they aren’t immune to ransomware, intrusions, and data theft. If you haven’t already, start thinking about security now.
AI Has Been Dubbed a 'Nuclear' Threat to Cyber Security, but It Can Also Be Used for Defence
Hackers using ChatGPT are faster and more sophisticated than before, and cyber security analysts who don’t have access to similar tools can very quickly find themselves outgunned and outsmarted by these AI-assisted attackers. However, corporations are stumbling to figure out governance around AI, and while they do so, their employees are clearly defying rules and possibly jeopardising company operations. According to a study of 1.6 million workers, 3.1% input confidential company information into ChatGPT. Although the number seems small, 11% of users' questions include private information. This is a fatal flaw for corporate use considering how hackers can manipulate the system into giving them previously hidden information. In another study, it was found that 80% of security professionals used AI, with 46% of these giving specialised capabilities as a reason.
Paying Cyber Hijackers’ Ransoms Doubles Cost of Recovery, Sophos Study Shows
In three out of four cyber attacks, the hijackers succeeded in encrypting victims’ data, cyber security provider Sophos said in its newly released State of Ransomware 2023 report.
The rate of data encryption amounted to the highest from ransomware since Sophos first issued the report in 2020. Overall, roughly two-thirds of the 3,000 cyber security/IT leaders’ organisations were infected by a ransomware attack in the first quarter of 2023, or the same percentage as last year.
Much advice has been doled out by cyber security providers and law enforcement urging organisations to not pay a ransom. According to Sophos’ survey, the data shows that when organisations paid a ransom to decrypt their data, they ended up doubling their recovery costs. On average, those organisations paying ransoms for decryption forked out $750,000 in recovery costs versus $375,000 for organisations that used backups to recover their data.
Moreover, paying the ransom usually meant longer recovery times, with 45% of those organisations that used backups recovering within a week, compared to 39% of those that paid the ransom.
Majority of US, UK CISOs Unable to Protect Company 'Secrets'
A recent study found 75% of organisations have experienced a data leak involving company secrets, including API keys, usernames, passwords, and encryption keys, in the past. It was found that about 52% of chief information and security officers (CISOs) in the US and UK organisations are unable to fully secure their company secrets. The study showed that a huge chunk of the IT sector realises the danger of exposed secrets. Seventy-five percent said that a secret leak has happened in their organisation in the past, with 60% acknowledging it caused serious issues for the company, employees, or both. The report has pointed out that even though secrets management practice across the US and the UK has seen some maturity, it still needs to go a long way.
Company Executives Can’t Afford to Ignore Cyber Security Anymore
In a recent survey, when asked about the Board and C-Suite‘s understanding of cyber security across the organisation, only 36% of respondents believe that it is considered important only in terms of compliance and regulatory demands, while 17% said it is not seen as a business priority. The disconnect between business and security goals appears to have caused at least one negative consequence to 89% of respondents’ organisations, with 26% also reporting it resulted in an increased number of successful cyber attacks at their company. On the misalignment of cyber security goals, respondents believed it contributed to delays in investments (35%), delays in strategic decision making (34%), and unnecessary increases in spending (27%).
https://www.helpnetsecurity.com/2023/05/10/cybersecurity-business-goals-alignment/
BEC Campaign via Israel Spotted Targeting Multinational Companies
An Israel-based threat group was discovered carrying out a business email compromise (BEC) campaign primarily targeting large and multinational enterprises. The group has conducted 350 BEC campaigns since February 2021, with email attacks targeting employees from 61 countries across six continents. The group operate through two personas — a CEO and an external attorney and spoofed email addresses using real domains.
CISOs Worried About Personal Liability for Breaches
Over three-fifths (62%) of global CISOs are concerned about being held personally liable for successful cyber attacks that occur on their watch, and a similar share would not join an organisation that fails to offer insurance to protect them, according to Proofpoint annual ‘Voice of the CISO’ survey for 2023. The security vendor polled 1600 CISOs from organisations of 200 employees or more across different industries in 16 countries to compile the report.
It revealed that CISOs in sectors with high volumes of sensitive data and/or heavy regulation such as retail (69%), financial services (65%) and manufacturing (65%) are most likely to demand insurance coverage.
Such concerns only add to the mental load on corporate IT security bosses. A combination of high-stress working environments, shrinking budgets and personal liability could be harming CISOs’ quality of life. Some 60% told Proofpoint they’ve experienced burnout in the past 12 months.
CISOs are most likely to experience burnout in the retail (72%) and IT, technology and telecoms (66%) industries.
https://www.infosecurity-magazine.com/news/cisos-worried-personal-liability/
UK, US and International Allies Uncover Russian Snake Malware Network in 50+ Countries
The UK NCSC along with the US National Security Agency (NSA) and various international partner agencies have discovered infrastructure connected with the sophisticated Russian cyber-espionage tool Snake in over 50 countries worldwide. Snake operations have been attributed to a specific unit within Russia’s Federal Security Service (FSB), Center 16.
Cyber criminals reportedly used Snake to retrieve and remove confidential documents related to international relations and diplomatic communications.
According to an advisory published by the agencies on Tuesday, the FSB targeted various industries, including education, small businesses, media, local government, finance, manufacturing and telecommunications. The Snake malware is installed on external infrastructure nodes for further exploitation.
According to the NSA Russian government actors have used this tool for years for intelligence collection and it is hoped that the technical details shared in the advisory will help many organisations find and shut down the malware globally.
https://www.infosecurity-magazine.com/news/nsa-uncovers-russian-snake-malware/
Plug-and-Play Microsoft 365 Phishing Tool 'Democratizes' Attack Campaigns
A new phishing-as-a-service tool called "Greatness" is being used in attacks targeting manufacturing, healthcare, technology, and other sectors.
Researchers at Cisco Talos detailed their findings on "Greatness," a one-stop-shop for all of a cyber criminal's phishing needs. With Greatness, anyone with even rudimentary technical chops can craft compelling Microsoft 365-based phishing lures, then carry out man-in-the-middle attacks that steal authentication credentials — even in the face of multifactor authentication (MFA) — and much more.
The tool has been in circulation since at least mid-2022 and has been used in attacks against enterprises in manufacturing, healthcare, and technology, among other sectors. Half of the targets thus far have been concentrated in the US, with further attacks occurring around Western Europe, Australia, Brazil, Canada, and South Africa.
https://www.darkreading.com/cloud/plug-and-play-microsoft-365-phishing-tool-democratizes-attacks
Threats
Ransomware, Extortion and Destructive Attacks
Make them pay: Hackers devise new tactics to ensure ransomware payment | CSO Online
Ransomware gangs display ruthless extortion tactics in April | TechTarget
Our appetite for data increases the risk of being held to ransom (thetimes.co.uk)
Paying Cyber Hijackers’ Ransoms Doubles Cost of Recovery, Sophos Study Shows - MSSP Alert
Refined methodologies of ransomware attacks - Help Net Security
Ranking ransomware: The gangs, the malware and the ever-present risks | CyberScoop
Ransomware Encryption Rates Reach New Heights - Infosecurity Magazine (infosecurity-magazine.com)
UK ‘increasingly concerned’ ransomware victims are keeping incidents secret (therecord.media)
Royal ransomware gang quickly expands reign | SC Media (scmagazine.com)
Legitimate Software Abuse: A Disturbing Trend in Ransomware Attacks (darkreading.com)
Ransomware attack confirmed at Rochester Public Schools, FBI alerted - Bring Me The News
Constellation Struck By Ransomware Attack, ALPHV Lays Claim (informationsecuritybuzz.com)
New Ransomware Strain 'CACTUS' Exploits VPN Flaws to Infiltrate Networks (thehackernews.com)
New Akira Ransomware Operation Hits Corporate Networks | Black Hat Ethical Hacking
Babuk code used by 9 ransomware gangs to encrypt VMWare ESXi servers (bleepingcomputer.com)
$1.1M Paid to Resolve Ransomware Attack on California County - SecurityWeek
Western Digital store offline due to March breach - Help Net Security
Western Digital Confirms Ransomware Group Stole Customer Information - SecurityWeek
Former Conti members are behind latest Royal ransomware hacking spree, report finds (axios.com)
Hackers Contacted Dragos CEO’s Son, Wife in Extortion Attempt - Bloomberg
Multiple Ransomware Groups Adapt Babuk Code to Target ESXi VMs (darkreading.com)
Australian software giant won’t say if customers affected by hack | TechCrunch
Multinational tech firm ABB hit by Black Basta ransomware attack (bleepingcomputer.com)
Phishing & Email Based Attacks
Gmail gets blue verification checks to protect against spoofing and phishing | ZDNET
Phishing Ring Bust, Spanish Police Have Arrested 40 People (informationsecuritybuzz.com)
BEC – Business Email Compromise
2FA/MFA
Malware
Chrome users, stay alert: Malware may be just one click away - gHacks Tech News
Microsoft issues optional fix for Secure Boot zero-day used by malware (bleepingcomputer.com)
56,000+ cloud-based apps at risk of malware exfiltration - Help Net Security
Millions of mobile phones come pre-infected with malware • The Register
Severe Ruckus RCE Flaws Utilized By Fresh DDoS Botnet Malware (informationsecuritybuzz.com)
Fake system update drops Aurora stealer via Invalid Printer loader (malwarebytes.com)
Stealthier version of Linux BPFDoor malware spotted in the wild (bleepingcomputer.com)
Mobile
Millions of mobile phones come pre-infected with malware • The Register
Mobile hacking and spyware – understanding the risks - TechHQ
Google Announces New Privacy, Safety, and Security Features Across Its Services (thehackernews.com)
Google Improves Android Security With New APIs - SecurityWeek
New Android FluHorse malware steals your passwords, 2FA codes (bleepingcomputer.com)
New Android updates fix kernel bug exploited in spyware attacks (bleepingcomputer.com)
Botnets
Fortinet warns of a spike of the activity linked to AndoryuBot botnet- Security Affairs
RapperBot DDoS malware adds cryptojacking as new revenue stream (bleepingcomputer.com)
Denial of Service/DoS/DDOS
FBI seizes 13 more domains linked to DDoS-for-hire services (bleepingcomputer.com)
Severe Ruckus RCE Flaws Utilized By Fresh DDoS Botnet Malware (informationsecuritybuzz.com)
Fortinet warns of a spike of the activity linked to AndoryuBot botnet- Security Affairs
RapperBot DDoS malware adds cryptojacking as new revenue stream (bleepingcomputer.com)
Internet of Things – IoT
Data Breaches/Leaks
Security researcher finds trove of Capita data exposed online | TechCrunch
In a new hacking crime wave, more personal data is being held hostage (cnbc.com)
Western Digital says hackers stole customer data in March cyber attack (bleepingcomputer.com)
Leak of MSI UEFI signing keys stokes fears of “doomsday” supply chain attack | Ars Technica
Boot Guard Keys From MSI Hack Posted, Many PCs Vulnerable | Tom's Hardware(tomshardware.com)
1 Million Impacted by Data Breach at NextGen Healthcare - SecurityWeek
Twitter admits 'security incident' broke Circle privacy • The Register
Food distribution giant Sysco warns of data breach after cyber attack (bleepingcomputer.com)
North Korean Hackers Stole 830K Data From Seoul's Top Hospital (informationsecuritybuzz.com)
Brightly warns of SchoolDude data breach exposing credentials (bleepingcomputer.com)
Simplify data hack cost the firm almost £7m - Property Industry Eye
Organised Crime & Criminal Actors
In a new hacking crime wave, more personal data is being held hostage (cnbc.com)
The Team of Sleuths Quietly Hunting Cyber attack-for-Hire Services | WIRED
Phishing Ring Bust, Spanish Police Have Arrested 40 People (informationsecuritybuzz.com)
Former Ubiquiti Employee Who Posed as Hacker Sentenced to Prison - SecurityWeek
UK cops score another legal win in EncroChat spying case • The Register
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Insider Risk and Insider Threats
Human Error Drives Most Cyber Incidents. Could AI Help? (hbr.org)
Overlooking These 4 Critical Measures Expose Your Company to Cyber Attacks | Entrepreneur
Fraud, Scams & Financial Crime
UK’s new fraud strategy too weak to tackle soaring crime, say experts | Financial Times (ft.com)
Your voice could be your biggest vulnerability - Help Net Security
QR codes used in fake parking tickets, surveys to steal your money (bleepingcomputer.com)
Deepfakes
Insurance
Dark Web
Supply Chain and Third Parties
Security researcher finds trove of Capita data exposed online | TechCrunch
Cyber hack to cost UK outsourcer Capita up to $25 mln | Reuters
Leak of MSI UEFI signing keys stokes fears of “doomsday” supply chain attack | Ars Technica
Software Supply Chain
Cloud/SaaS
56,000+ cloud-based apps at risk of malware exfiltration - Help Net Security
How to reduce risk with cloud attack surface management | TechTarget
ENISA leans into EU clouds with draft cyber security label • The Register
Hybrid/Remote Working
Attack Surface Management
Identity and Access Management
Top 3 trends shaping the future of cyber security and IAM - Help Net Security
Review your on-prem ADCS infrastructure before attackers do it for you | CSO Online
Why the FTX Collapse Was an Identity Problem (darkreading.com)
Asset Management
CISOs confront mounting obstacles in tracking cyber assets - Help Net Security
How Attack Surface Management Supports Continuous Threat Exposure Management (thehackernews.com)
Encryption
API
Open Source
India bans open source messaging apps on security grounds • The Register
Stealthier version of Linux BPFDoor malware spotted in the wild (bleepingcomputer.com)
Passwords, Credential Stuffing & Brute Force Attacks
83% of Americans’ Passwords Can Be Hacked in Less Than a Second, Study Shows (thedailybeast.com)
Top 5 Password Cracking Techniques Used by Hackers (bleepingcomputer.com)
Social Media
Twitter admits 'security incident' broke Circle privacy • The Register
TikTok tracked UK journalist via her cat's account - BBC News
Parental Controls and Child Safety
Regulations, Fines and Legislation
UK’s new fraud strategy too weak to tackle soaring crime, say experts | Financial Times (ft.com)
EU parliament report calls for tighter regulation of spyware | Surveillance | The Guardian
India bans open source messaging apps on security grounds • The Register
PEGA committee calls for EU level regulation of spyware • The Register
ENISA leans into EU clouds with draft cyber security label • The Register
Europe’s Moral Crusader Lays Down the Law on Encryption | WIRED
Scanning Plans On Europe's CSAM May Violate International Law (informationsecuritybuzz.com)
Governance, Risk and Compliance
Risk managers warn cyber insurance could become ‘unviable product’ | Financial Times (ft.com)
79% of Cyber Pros Make Decisions Without Threat Intelligence (securityintelligence.com)
Company executives can't afford to ignore cyber security anymore - Help Net Security
Majority of US, UK CISOs unable to protect company 'secrets': Report | CSO Online
Small- and medium-sized businesses: don’t give up on cyber security | CSO Online
(ISC)² Calls for Global Cyber security Standards, Collaboration, Frameworks - MSSP Alert
Organisations Reliant on Social Media For Threat Intelligence - TechRound
Recognizing Cyberthreat Trends For Effective Defence (forbes.com)
Digital trust can make or break an organisation - Help Net Security
Why more transparency around cyber attacks is good for everyone - NCSC
CISOs face mounting pressures, expectations post-pandemic | TechTarget
CISOs' confidence in post-pandemic security landscape fades - Help Net Security
Overlooking These 4 Critical Measures Expose Your Company to Cyber Attacks | Entrepreneur
NCSC and ICO Dispel Incident Reporting Myths - Infosecurity Magazine (infosecurity-magazine.com)
Models, Frameworks and Standards
(ISC)² Calls for Global Cyber security Standards, Collaboration, Frameworks - MSSP Alert
ENISA leans into EU clouds with draft cyber security label • The Register
Data Protection
Careers, Working in Cyber and Information Security
Law Enforcement Action and Take Downs
FBI seizes 13 more domains linked to DDoS-for-hire services (bleepingcomputer.com)
Phishing Ring Bust, Spanish Police Have Arrested 40 People (informationsecuritybuzz.com)
UK cops score another legal win in EncroChat spying case • The Register
Privacy, Surveillance and Mass Monitoring
The (Security) Cost of Too Much Data Privacy (darkreading.com)
Twitter admits 'security incident' broke Circle privacy • The Register
TikTok tracked UK journalist via her cat's account - BBC News
Artificial Intelligence
Top US cyber official warns AI may be the 'most powerful weapon of our time' | CyberScoop
Amazon Is Being Flooded With Books Entirely Written by AI (futurism.com)
Your voice could be your biggest vulnerability - Help Net Security
The security and privacy risks of large language models - Help Net Security
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
EU parliament report calls for tighter regulation of spyware | Surveillance | The Guardian
China targets foreign consulting companies in anti-spying raids | China | The Guardian
Mobile hacking and spyware – understanding the risks - TechHQ
New Android updates fix kernel bug exploited in spyware attacks (bleepingcomputer.com)
CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine (thehackernews.com)
PEGA committee calls for EU level regulation of spyware • The Register
FBI-led Operation Medusa kills Russian FSB malware network • The Register
How one of Vladimir Putin’s most prized hacking units got pwned by the FBI | Ars Technica
Nation State Actors
Microsoft warns Iran increasing its cyber-enabled influence operations | SC Media (scmagazine.com)
China labels USA ‘Empire of hacking’ citing old WikiLeaks • The Register
CERT-UA Warns of SmokeLoader and RoarBAT Malware Attacks Against Ukraine (thehackernews.com)
LinkedIn shuts service in China, lays off employees | Fortune
Microsoft: Iranian hacking groups join Papercut attack spree (bleepingcomputer.com)
FBI-led Operation Medusa kills Russian FSB malware network • The Register
China targets foreign consulting companies in anti-spying raids | China | The Guardian
Beijing raids consultancy firm Capvision, promises more • The Register
SideWinder Strikes Victims in Pakistan, Turkey in Multiphase Polymorphic Attack (darkreading.com)
North Korean Hackers Stole 830K Data From Seoul's Top Hospital (informationsecuritybuzz.com)
People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices | CISA
Vulnerability Management
Vulnerabilities
Microsoft's May Patch Tuesday Fixes 38 Flaws, Including Active Zero-Day Bug (thehackernews.com)
Microsoft warns of two bugs under active exploit • The Register
Light May Patch Tuesday will weigh heavily on Windows admins | TechTarget
Fortinet fixed two severe issues in FortiADC and FortiOS-Security Affairs
New PaperCut RCE exploit created that bypasses existing detections (bleepingcomputer.com)
Microsoft issues optional fix for Secure Boot zero-day used by malware (bleepingcomputer.com)
Adobe Patches 14 Vulnerabilities in Substance 3D Painter - SecurityWeek
Severe Ruckus RCE Flaws Utilized By Fresh DDoS Botnet Malware (informationsecuritybuzz.com)
CyberGhost VPN patches command injection vulnerability | SC Media (scmagazine.com)
A Linux NetFilter kernel flaw allows escalating privileges to 'root'-Security Affairs
SAP Patches Critical Vulnerabilities With May 2023 Security Updates - SecurityWeek
Fortinet warns of a spike of the activity linked to AndoryuBot botnet-Security Affairs
Tools and Controls
Risk managers warn cyber insurance could become ‘unviable product’ | Financial Times (ft.com)
79% of Cyber Pros Make Decisions Without Threat Intelligence (securityintelligence.com)
Human Error Drives Most Cyber Incidents. Could AI Help? (hbr.org)
Identifying Compromised Data Can Be a Logistical Nightmare (darkreading.com)
Organisations Reliant on Social Media For Threat Intelligence - TechRound
Recognizing Cyberthreat Trends For Effective Defence (forbes.com)
Digital trust can make or break an organisation - Help Net Security
Prevent attackers from using legitimate tools against you - Help Net Security
How to implement principle of least privilege in Azure AD | TechTarget
What is Digital Forensics? Tools, Types, Phases & History (cybersecuritynews.com)
Microsoft enforces number matching to fight MFA fatigue attacks (bleepingcomputer.com)
AI Will Take Many Cyber security Jobs, But It's Not a Complete Disaster | PCMag
Google Broadens Dark Web Monitoring To Track All Gmail Users (informationsecuritybuzz.com)
5 SBOM tools to start securing the software supply chain | TechTarget
The Industrywide Consequences of Making Security Products Inaccessible (darkreading.com)
Top 3 trends shaping the future of cyber security and IAM - Help Net Security
Other News
The Team of Sleuths Quietly Hunting Cyber attack-for-Hire Services | WIRED
Why Should You Take IT Security Seriously? - IT Security Guru
To enable ethical hackers, a law reform is needed - Help Net Security
How datacentre operators can fend off cyber attacks | Computer Weekly
'Windows for Gamers' Rolls Dice With Your Security (vice.com)
Risk of cyber attack is main Eurovision worry, says BBC executive | Eurovision 2023 | The Guardian
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 28 April 2023
Black Arrow Cyber Threat Briefing 28 April 2023:
- Navigating The Future of Cyber: Business Strategy, Cyber Security Training, and Digital Transformation Are Key
- Shadow IT, SaaS Pose Security Liability for Enterprises
- The Strong Link Between Cyber Threat Intelligence and Digital Risk Protection
- Weak Credentials, Unpatched Vulnerabilities, Malicious Open Source Packages Causing Cloud Security Risks
- Over 70 billion Unprotected Files Available on Unsecured Web Servers
- Cyber Thieves Are Getting More Creative
- Modernising Vulnerability Management: The Move Toward Exposure Management
- Almost Three-quarters of Cyber Attacks Involve Ransomware
- Corporate Boards Pressure CISOs to Step Up Risk Mitigation Efforts
- NSA Sees ‘Significant’ Russian Intel Gathering on European, US Supply Chain Entities
- Email Threat Report 2023: Key Takeaways
- 5 Most Dangerous New Attack Techniques
- Many Public Salesforce Sites are Leaking Private Data
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Navigating the Future of Cyber: Business Strategy, Cyber Security Training, and Digital Transformation are Key
Cyber investments have become table stakes for businesses around the world. Cyber crime is increasing, with 91% of organisations reporting at least one cyber incident in the past year. Not only are they growing in numbers, but they are becoming more sophisticated and diverse, with new threats constantly emerging. According to the 2023 Deloitte Global Future of Cyber survey, business leaders are changing how they think of cyber, and it’s emerging as a larger strategic discussion tied to an organisation’s long-term success.
Cyber is about more than protecting information—risk management, incident response planning, threat intelligence and training can often be directly correlated to increasing trust within businesses.
Cyber security training is essential for employees to ensure the safety and security of a business. Employees are often the first line of defence against cyber-attacks and frequently the weakest link in an organisation's security posture. Cyber security training can help employees recognise and avoid common cyber threats, such as phishing attacks, malware, and social engineering. 89% of organisations cited as high-performing cyber organisations have implemented annual cyber awareness training among all employees. With increased digital dependency year over year—effective employee training can raise awareness, reduce risk, improve security posture, and support compliance.
Shadow IT, SaaS Pose Security Liability for Enterprises
There's no denying that software-as-a-service (SaaS) has entered its golden age. Software tools have now become essential to modern business operations and continuity. However, not enough organisations have implemented the proper procurement processes to ensure they're protecting themselves from potential data breaches and reputational harm.
A critical component contributing to concerns around SaaS management is the rising trend of shadow IT, which is when employees download and use software tools without notifying their internal IT teams. A recent study shows that 77% of IT professionals believe that shadow IT is becoming a major concern in 2023, with more than 65% saying their SaaS tools aren't being approved. Organisations are beginning to struggle with maintaining security as their SaaS usage continues to sprawl.
To combat shadow IT and the high risks that come along with it, organisations must gain greater visibility over their SaaS stacks and institute an effective procurement process when bringing on new software solutions.
https://www.darkreading.com/edge-articles/shadow-it-saas-pose-security-liability-for-enterprises
The Strong Link Between Cyber Threat Intelligence and Digital Risk Protection
While indicators of compromise and attackers’ tactics, techniques, and processes (TTPs) remain central to threat intelligence, cyber threat intelligence needs have grown over the past few years, driven by things like digital transformation, cloud computing and remote working. In fact, these changes have led to a cyber threat intelligence (CTI) subcategory focused on digital risk protection (DRP). DRP is broadly defined as, “telemetry, analysis, processes, and technologies used to identify and mitigate risks associated with digital assets”.
According to research provider ESG, the most important functions of DRP as part of a mature CTI programme are: vulnerability exploit intelligence, takedown services, leaked data monitoring, malicious mobile application monitoring, brand protection and attack surface management. It should be noted that a mature CTI programme can utilise service providers to help carry out threat intelligence, it doesn’t have to be spun up by the organisation from nothing. Regardless, an organisation employing these DRP functions as part of a CTI programme will be increasing its cyber resilience and reducing the chance of a cyber incident.
Weak Credentials, Unpatched Vulnerabilities, Malicious Open Source Packages Causing Cloud Security Risks
Threat actors are getting more adept at exploiting common everyday issues in the cloud, including misconfigurations, weak credentials, lack of authentication, unpatched vulnerabilities, and malicious open-source software (OSS) packages. Meanwhile, security teams take an average of 145 hours to solve alerts, with 80% of cloud alerts triggered by just 5% of security rules in most environments according to a recent report. The report, conducted by UNIT 42 analysed the workload of 210,000 cloud accounts across 1,300 organisations.
The report’s findings echoed similarities from the previous year, finding almost all cloud users, roles, services and resources grant excessive permissions. Some of the other key findings include as many as 83% of organisations having hard-coded credentials in their source control management systems, 53% of cloud accounts allowing weak password usage and 44% allowing password reuse and 71% of high or critical vulnerabilities exposed were at least two years old.
Over 70 Billion Unprotected Files Available on Unsecured Web Servers
A recent report found that more than 70 billion files, including intellectual property and financial information, are freely available and unprotected on unsecured web servers. Other key findings of the report included almost 1 in 10 of all detected internet-facing assets having an unpatched vulnerability, with the top 10 vulnerabilities found unpatched at least 12 million times each.
The report predicted that there will be a significant rise in information stealing malware; the report had found that 50% of emails associated with customers were plaintext and unencrypted. Additionally, there will be more incidents due to an increase in assets which are not known to IT, known as shadow IT.
Organisations should look to employ efficient patch management, have an up to date asset register, and use encryption to better increase their cyber defences.
https://www.helpnetsecurity.com/2023/04/24/critical-cybersecurity-exposures/
Cyber Thieves Are Getting More Creative
Cyber criminals are constantly changing their tactics and finding new ways to steal money from organisations. An example of this can be seen where criminals are breaking into systems to learn who is authorised to send payments and what the procedures are. Eventually, this leads to the criminal instructing payment to their own account.
Unfortunately, it is only after such events that some organisations are taking actions, such as verifying payments through phone calls. Whilst it is important for organisations to learn from attacks, it is beneficial to take a pro-active approach and employ procedures such as call back procedures before an incident has occurred.
https://hbr.org/2023/04/cyber-thieves-are-getting-more-creative
Modernising Vulnerability Management: The Move Toward Exposure Management
Managing vulnerabilities in the constantly evolving technological landscape is a difficult task. Although vulnerabilities emerge regularly, not all vulnerabilities present the same level of risk. Traditional metrics such as CVSS score or the number of vulnerabilities are insufficient for effective vulnerability management as they lack business context, prioritisation, and understanding of attackers' motivations, opportunities and means. Vulnerabilities only represent a small part of the attack surface that attackers can leverage.
Exposures are broader and can encompass more than just vulnerabilities. Exposures can result from various factors, such as human error, improperly defined security controls, and poorly designed and unsecured architecture. Organisations should consider that an attacker doesn’t just look at one exposure; attackers will often use a combination of vulnerabilities, misconfigurations, permissions and other exposures to move across systems and reach valuable assets.
As such, organisations looking to improve their cyber resiliency should consider their vulnerability management system and assess both whether it is taking into account exposures and the context in relation to the organisation.
https://thehackernews.com/2023/04/modernizing-vulnerability-management.html
Two-thirds of Cyber Attacks Involve Ransomware
A report from Sophos focusing on recent incident response cases, found that 68.4% of incidents resulted from ransomware. This was followed by network breaches, accounting for 18.4%. Regarding threat actor access, the report found that unpatched vulnerabilities were the single most common access method, followed by compromised credentials.
Corporate Boards Pressure CISOs to Step Up Risk Mitigation Efforts
A recent report found that the top challenges when implementing an effective cyber/IT risk management programme include an increase in the quantity (49%) and severity (49%) of cyber threats, a lack of funding (37%) and a lack of staffing/cyber risk talent (36%).
Cyber attacks have been increasing for several years now and resulting data breaches cost businesses an average of $4.35 million in 2022, according to the annual IBM ‘Cost of a Data Breach’ report. Given the financial and reputational consequences of cyber attacks, corporate board rooms are putting pressure on CISOs to identify and mitigate cyber/IT risk.
When it came to reporting to the board, 30% of CIO and CISO respondents say they do not communicate risk around specific business initiatives to other company leaders, indicating they may not know how to share that information in a constructive way.
https://www.helpnetsecurity.com/2023/04/26/effective-it-risk-management/
NSA Sees ‘Significant’ Russian Intel Gathering on European, US Supply Chain Entities
According to the US National Security Agency (NSA), Russian hackers could be looking to attack logistics targets more broadly. The NSA have noted a significant amount of intelligence gathering into western countries, including the UK and the US.
Although there is no indication yet regarding attacks from Russia in connection with the logistics related to Ukraine, organisations should be aware and look to improve their cyber security practices to be best prepared.
https://cyberscoop.com/nsa-russian-ukraine-supply-chain-ransomware/
Email Threat Report 2023: Key Takeaways
According to a recent report, email phishing made up 24% of all spam types in 2022, a significant increase in proportion from 11% in 2021. The finance industry was the most targeted by far, accounting for 48% of phishing incidents. It is followed by the construction sector at 17%, overtaking 2021’s second-place industry, e-commerce. Both the finance and construction industries saw an increase in phishing since last year. Of all the emails analysed in 2022, an enormous 90% were spam emails.
With phishing as prevalent as ever, organisations should look to implement training for their staff to not only be able to spot phishing emails, but to be able to report these and aid in improving the cyber security culture of their organisation.
https://www.itsecurityguru.org/2023/04/27/email-threat-report-2023-key-takeaways/
5 Most Dangerous New Attack Techniques
Experts from security training provider SANS Institute have revealed the 5 most dangerous new attack techniques: adversarial AI, ChatGPT-powered social engineering, third-party developer attacks (also known as software supply chain attacks), SEO, and paid advertising attacks.
The new techniques highlight the ever changing environment of the attack environment. SEO and paid advertising attacks are leveraging fundamental marketing strategies to gain initial access, heightening the importance for organisations to incorporate scalable user awareness training programmes, tailored to new threats.
https://www.csoonline.com/article/3694892/5-most-dangerous-new-attack-techniques.html
Many Public Salesforce Sites are Leaking Private Data
A shocking number of organisations — including banks and healthcare providers — are leaking private and sensitive information from their public Salesforce Community websites. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to access records that should only be available after logging in.
This included the US State of Vermont who had at least five separate Salesforce Community sites that allowed guest access to sensitive data, including a Pandemic Unemployment Assistance programme that exposed the applicant’s full name, social security number, address, phone number, email, and bank account number. Similar information was leaked by TCF Bank on their Salesforce Community Website.
It's not just Salesforce though; misconfigurations in general are responsible for a number of leaked documents and or exposures relating to an organisation.
https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/
Threats
Ransomware, Extortion and Destructive Attacks
New coercive tactics used to extort ransomware payments - Help Net Security
Almost three-quarters of cyber attacks involve ransomware | Computer Weekly
Ransomware attacks, human error main cause of cloud data breaches: Report (business-standard.com)
Effects of the Hive Ransomware Group Takedown (darkreading.com)
Microsoft Confirms PaperCut Servers Used to Deliver LockBit and Cl0p Ransomware (thehackernews.com)
Tank storage company Vopak hacked, Ransomware groups report | NL Times
Health insurer Point32Health suffered a ransomware attack-Security Affairs
Hacker demands ransom after 'taking control' of Wiltshire school's IT | Swindon Advertiser
RSAC speaker offers ransomware victims unconventional advice | TechTarget
How ransomware victims can make the best of a bad situation | TechTarget
Hackers Leaked Minneapolis Students' Psychological Reports, Allegations of Abuse (gizmodo.com)
Linux version of RTM Locker ransomware targets VMware ESXi servers (bleepingcomputer.com)
CommScope employees left in the dark after ransomware attack | TechCrunch
Phishing & Email Based Attacks
How Dangerous Is Phishing in 2023? - Duo Blog | Duo Security
The New Frontier in Email Security: Goodbye, Gateways; Hello, Behavioural AI (darkreading.com)
BEC – Business Email Compromise
2FA/MFA
CrowdStrike details new MFA bypass, credential theft attack | TechTarget
Phishing-resistant MFA shapes the future of authentication forms - Help Net Security
Malware
Malware-Free Cyber attacks Are On the Rise; Here's How to Detect Them (darkreading.com)
Ex-Conti and FIN7 Actors Collaborate with New Backdoor (securityintelligence.com)
EvilExtractor malware activity spikes in Europe and the US (bleepingcomputer.com)
Zaraza Malware Exploits Web Browsers To Steal Stored Passwords (latesthackingnews.com)
This evil malware disables your security software, then goes in for the kill | TechRadar
Decoy Dog malware toolkit found after analysing 70 billion DNS queries (bleepingcomputer.com)
Lazarus Subgroup Targeting Apple Devices with New RustBucket macOS Malware (thehackernews.com)
A Security Team Is Turning This Malware Gang’s Tricks Against It | WIRED
Evasive Panda APT group delivers malware via updates for popular Chinese software | WeLiveSecurity
Google banned 173K developer accounts to block malware, fraud rings (bleepingcomputer.com)
Chinese Cyber spies Delivered Malware via Legitimate Software Updates - SecurityWeek
Chinese hackers launch Linux variant of PingPull malware | CSO Online
Mobile
WhatsApp used in BEC scam to pilfer $6.4M | SC Media (scmagazine.com)
35M Downloads Of Android Minecraft Clones Spreads Adware (informationsecuritybuzz.com)
Botnets
Denial of Service/DoS/DDOS
New SLP bug can lead to massive 2,200x DDoS amplification attacks (bleepingcomputer.com)
'Anonymous Sudan' Claims Responsibility for DDoS Attacks Against Israel (darkreading.com)
Internet of Things – IoT
Data Breaches/Leaks
Over 70 billion unprotected files available on unsecured web servers - Help Net Security
Many Public Salesforce Sites are Leaking Private Data – Krebs on Security
American Bar Association data breach hits 1.4 million members (bleepingcomputer.com)
American Bar Association (ABA) suffered a data breach-Security Affairs
Shields Health Breach Exposes 2.3M Users' Data (darkreading.com)
Serving UK Armed Forces member charged under Official Secrets Act (telegraph.co.uk)
Yellow Pages Canada confirms cyber attack as Black Basta leaks data (bleepingcomputer.com)
Vantage Travel Experiences Data Security Incident (darkreading.com)
Organised Crime & Criminal Actors
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Insider Risk and Insider Threats
Fraud, Scams & Financial Crime
The IRS is sending four investigators across the world to fight cyber crime | TechCrunch
US deploys more cyber forces abroad to help fight hackers | Reuters
The ‘Your computer was locked’ scam is gaining traction (consumeraffairs.com)
Google banned 173K developer accounts to block malware, fraud rings (bleepingcomputer.com)
Deepfakes
AML/CFT/Sanctions
Insurance
Dark Web
Supply Chain and Third Parties
The Huge 3CX Breach Was Actually 2 Linked Supply Chain Attacks | WIRED
That 3CX supply chain attack keeps getting worse • The Register
NSA sees 'significant' Russian intel gathering on European, US supply chain entities | CyberScoop
North Korean hackers breach software firm in significant cyber attack | CNN Politics
SD Worx hack: Payroll firm for M&S hit by cyber attack (thetimes.co.uk)
A third-party’s perspective on third-party InfoSec risk management - Help Net Security
Software Supply Chain
Cloud/SaaS
Shadow IT, SaaS Pose Security Liability for Enterprises (darkreading.com)
14 Kubernetes and Cloud Security Challenges and How to Solve Them (thehackernews.com)
Ransomware attacks, human error main cause of cloud data breaches: Report (business-standard.com)
GhostToken Flaw Could Let Attackers Hide Malicious Apps in Google Cloud Platform (thehackernews.com)
Saas Security: The Need For Continuous Sustenance (informationsecuritybuzz.com)
How CISOs navigate security and compliance in a multi-cloud world - Help Net Security
Security experts found a major bug in Google Cloud | TechRadar
Most SaaS adopters exposed to browser-borne attacks - Help Net Security
Exposed Artifacts Seen In Misconfigured Cloud Software Registries (informationsecuritybuzz.com)
Google accounts attacked and hijacked by this devious security flaw | TechRadar
Containers
Kubernetes RBAC abused to create persistent cluster backdoors (bleepingcomputer.com)
Experts spotted first-ever crypto mining campaign leveraging Kubernetes RBAC-Security Affairs
Combating Kubernetes — the Newest IAM Challenge (darkreading.com)
Attack Surface Management
Over 70 billion unprotected files available on unsecured web servers - Help Net Security
Study of past cyber attacks can improve organisations' defence strategies - Help Net Security
Shadow IT
Identity and Access Management
Rethinking the effectiveness of current authentication initiatives - Help Net Security
Combating Kubernetes — the Newest IAM Challenge (darkreading.com)
Open Source
The double-edged sword of open-source software - Help Net Security
Linux Shift: Chinese APT Alloy Taurus Is Back With Retooling (darkreading.com)
Chinese hackers launch Linux variant of PingPull malware | CSO Online
Linux version of RTM Locker ransomware targets VMware ESXi servers (bleepingcomputer.com)
Passwords, Credential Stuffing & Brute Force Attacks
Password reset woes could cost FTSE 100 companies $156 million each month - Help Net Security
A '!password20231#' password may not be as complex as you think (bleepingcomputer.com)
Social Media
Malvertising
Google ads push BumbleBee malware used by ransomware gangs (bleepingcomputer.com)
35M Downloads Of Android Minecraft Clones Spreads Adware (informationsecuritybuzz.com)
Training, Education and Awareness
Digital Transformation
Parental Controls and Child Safety
Regulations, Fines and Legislation
Governance, Risk and Compliance
Corporate boards pressure CISOs to step up risk mitigation efforts - Help Net Security
How the Talent Shortage Impacts Cyber security Leadership (securityintelligence.com)
Is your bank account safe? Mass layoffs weaken cyber security across finance sector | Fox Business
The strong link between cyber threat intelligence and digital risk protection | CSO Online
Organisations are stepping up their game against cyber threats - Help Net Security
CISOs: unsupported, unheard, and invisible - Help Net Security
The Relationship Between Security Maturity and Business Enablement | CSO Online
CISOs Rethink Data Security with Info-Centric Framework (darkreading.com)
UK Cyber Pros Burnt Out and Overwhelmed - Infosecurity Magazine (infosecurity-magazine.com)
Good, Better And Best Security (informationsecuritybuzz.com)
SANS Reveals Top 5 Most Dangerous Cyber attacks for 2023 (darkreading.com)
Models, Frameworks and Standards
Careers, Working in Cyber and Information Security
UK Cyber Pros Burnt Out and Overwhelmed - Infosecurity Magazine (infosecurity-magazine.com)
How to Begin a Career in Ethical Hacking in the Year 2023? (analyticsinsight.net)
Law Enforcement Action and Take Downs
To combat cyber crime, US law enforcement increasingly prioritizes disruption | CyberScoop
US to focus on stifling cyber attacks, not convictions • The Register
US deploys more cyber forces abroad to help fight hackers | Reuters
Effects of the Hive Ransomware Group Takedown (darkreading.com)
Privacy, Surveillance and Mass Monitoring
Artificial Intelligence
The Growing Need for Cyber Security in an Age of AI Disruption (analyticsinsight.net)
Cyber security Survival: Hide From Adversarial AI (darkreading.com)
AI Experts: Account for AI/ML Resilience & Risk While There's Still Time (darkreading.com)
NSA Cyber security Director Says ‘Buckle Up’ for Generative AI | WIRED
From ChatGPT to HackGPT: Meeting the Cyber security Threat of Generative AI (mit.edu)
ChatGPT fans need 'defensive mindset' to avoid scammers • The Register
DHS announces AI task force, security sprint on China-related threats | SC Media (scmagazine.com)
The New Frontier in Email Security: Goodbye, Gateways; Hello, Behavioral AI (darkreading.com)
Nvidia releases a toolkit to make text-generating AI ‘safer’ | TechCrunch
Artificial intelligence takes RSA Conference by storm | SC Media (scmagazine.com)
Secureworks CEO weighs in on XDR landscape, AI concerns | TechTarget
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
FBI aiding Ukraine in collection of digital and physical war crime evidence | CyberScoop
NSA sees 'significant' Russian intel gathering on European, US supply chain entities | CyberScoop
UK undersea cables worth £7.4 trillion a day under ‘real threat’ from Russia | The Independent
Eurocontrol says website 'under attack' by pro-Russia crew • The Register
Iran cyberespionage group taps SimpleHelp for persistence on victim devices | CSO Online
Russian Hackers Tomiris Targeting Central Asia for Intelligence Gathering (thehackernews.com)
CISA, Cyber Command Collaboration Blocks Attempted Attacks on US Interests - MSSP Alert
Nation State Actors
Chinese Cyber spies Delivered Malware via Legitimate Software Updates - SecurityWeek
North Korean hackers breach software firm in significant cyber attack | CNN Politics
China building cyber weapons to hijack enemy satellites, says US leak | Financial Times (ft.com)
NCSC raises alert on cyber threat to infrastructure | UKAuthority
Iran cyberespionage group taps SimpleHelp for persistence on victim devices | CSO Online
DHS announces AI task force, security sprint on China-related threats | SC Media (scmagazine.com)
North Korea's Kimsuky APT Keeps Growing, Despite Public Outing (darkreading.com)
APT 'Mint Sandstorm' quickly exploits new PoC hacks | SC Media (scmagazine.com)
Russian Hackers Suspected in Ongoing Exploitation of Unpatched PaperCut Servers (thehackernews.com)
Lazarus Subgroup Targeting Apple Devices with New RustBucket macOS Malware (thehackernews.com)
US Cyberwarriors Thwarted 2020 Iran Election Hacking Attempt - SecurityWeek
Evasive Panda APT group delivers malware via updates for popular Chinese software | WeLiveSecurity
Linux Shift: Chinese APT Alloy Taurus Is Back With Retooling (darkreading.com)
Charming Kitten's New BellaCiao Malware Discovered in Multi-Country Attacks (thehackernews.com)
Iranian cyber spies deploy new malware implant on Microsoft Exchange Servers | CSO Online
Ukrainian arrested for selling data of 300M people to Russians (bleepingcomputer.com)
FIN7 Hackers Caught Exploiting Recent Veeam Vulnerability - SecurityWeek
Chinese hackers launch Linux variant of PingPull malware | CSO Online
CISA, Cyber Command Collaboration Blocks Attempted Attacks on US Interests - MSSP Alert
Lazarus, Scarcruft North Korean APTs Shift Tactics, Thrive (darkreading.com)
Vulnerabilities
New Google Chrome Zero-Day Bug Actively Exploited in Wide (gbhackers.com)
Flaw in Microsoft Process Explorer under active attack • The Register
APC warns of critical unauthenticated RCE flaws in UPS software (bleepingcomputer.com)
Double zero-day in Chrome and Edge – check your versions now! – Naked Security (sophos.com)
Security experts found a major bug in Google Cloud | TechRadar
TP-Link Archer WiFi router flaw exploited by Mirai malware (bleepingcomputer.com)
SolarWinds Platform Update Patches High-Severity Vulnerabilities - SecurityWeek
VMware Releases Critical Patches for Workstation and Fusion Software (thehackernews.com)
Cisco discloses XSS zero-day flaw in server management tool (bleepingcomputer.com)
Microsoft removes LSA Protection from Windows settings to fix bug (bleepingcomputer.com)
PaperCut says hackers are exploiting ‘critical’ security flaws in unpatched servers | TechCrunch
FIN7 Hackers Caught Exploiting Recent Veeam Vulnerability - SecurityWeek
Tools and Controls
Corporate boards pressure CISOs to step up risk mitigation efforts - Help Net Security
14 Kubernetes and Cloud Security Challenges and How to Solve Them (thehackernews.com)
Six Key Considerations When Choosing a Web Application Firewall - Security Boulevard
The Complexities of Cyber Insurance | Cyber Risk Management (telos.com)
Unified Endpoint Management: A Powerful Tool for Your Cyber security Arsenal | CSO Online
GitLab’s new security feature uses AI to explain vulnerabilities to developers | TechCrunch
Google Authenticator finally, mercifully adds account syncing for two-factor codes - The Verge
The Needs of a Modernized SOC for Hybrid Cloud (securityintelligence.com)
Rethinking the effectiveness of current authentication initiatives - Help Net Security
Google will add End-to-End encryption to Google Authenticator (bleepingcomputer.com)
Google 2FA Syncing Feature Could Put Your Privacy at Risk (darkreading.com)
CISOs struggle to manage risk due to DevSecOps inefficiencies - Help Net Security
Generative AI and security: Balancing performance and risk - Help Net Security
CISA aims to reduce email threats with serial CDR prototype | TechTarget
Threat Actor Names Proliferate, Adding Confusion (darkreading.com)
Reports Published in the Last Week
Other News
The threat from commercial cyber proliferation - NCSC.GOV.UK
Hackers could learn how to send fake terror threats on YouTube, warn experts (telegraph.co.uk)
Government launches new cyber security measures to tackle ever growing threats - GOV.UK (www.gov.uk)
Attackers are logging in instead of breaking in - Help Net Security
38 Countries Take Part in NATO's 2023 Locked Shields Cyber Exercise - SecurityWeek
The White House National Cyber security Strategy Has a Fatal Flaw (darkreading.com)
Threat Actor Names Proliferate, Adding Confusion (darkreading.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.