Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 11 February 2022
Black Arrow Cyber Threat Briefing 11 February 2022:
-UK, US, Australia Issue Joint Advisory: Ransomware on the Loose, Critical National Infrastructure Affected
-Ransomware Groups and APT Actors Laser-Focused on Financial Services
-Why the C-Suite Should Focus on Understanding Cybersecurity and Investing Appropriately
-Almost $1.3bn Paid to Ransomware Actors Since 2020
-Cyber Crooks Frame Targets by Planting Fabricated Digital Evidence
-Highly Evasive Adaptive Threats (HEAT) Bypassing Traditional Security Defenses
-LockBit, BlackCat, Swissport, Oh My! Ransomware Activity Stays Strong
-2021 Was The Most Prolific Year On Record For Data Breaches
-$1.3 Billion Lost to Romance Scams in the Past Five Years
-Cyber Security Compliance Still Not A Priority For Many
-The World is Falling Victim to the Growing Trickbot Attacks in 2022
-“We Absolutely Do Not Care About You”: Sugar Ransomware Targets Individuals
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
UK, US, Australia Issue Joint Advisory: Ransomware on the Loose, Critical National Infrastructure Affected
Firms shelled out $5bn in Bitcoin in 6 months
Ransomware attacks are proliferating as criminals turn to gangs providing turnkey post-compromise services, Britain's National Cyber Security Centre (NCSC) has warned.
In a joint UK-US-Australia advisory issued this week, the three countries said they had "observed an increase in sophisticated, high-impact ransomware incidents against critical infrastructure organisations globally."
The warning comes hot on the heels of several high-profile attacks against oil distribution companies and also businesses that operate ports in the West – though today's note insists there was a move by criminals away from "big game hunting" against US targets.
Among the main threats facing Western organisations were the use of "cybercriminal services-for-hire". These, as detailed in the advisory, include "independent services to negotiate payments, assist victims with making payments, and arbitrate payment disputes between themselves and other cyber criminals."
https://www.theregister.com/2022/02/09/uk_us_au_ransomware_warning/
Ransomware Groups and APT Actors Laser-Focused on Financial Services
Trellix released a report, examining cybercriminal behaviour and activity related to cyber threats in the third quarter (Q3) of 2021. Among its findings, the research reports that despite a community reckoning to ban ransomware activity from online forums, hacker groups used alternate personas to continue to proliferate the use of ransomware against an increasing spectrum of sectors – hitting the financial, utilities and retail sectors most often, accounting for nearly 60% of ransomware detections.
“While we ended 2021 focused on a resurgent pandemic and the revelations around the Log4j vulnerability, our third-quarter deep dive into cyber threat activity found notable new tools and tactics among ransomware groups and advanced global threat actors,” said Trellix.
https://www.helpnetsecurity.com/2022/02/07/cyber-threats-q3-2021/
Why the C-Suite Should Focus on Understanding Cyber Security and Investing Appropriately
Trend Micro has published a research revealing that persistently low IT/C-suite engagement may imperil investments and expose organisations to increased cyber risk. Over 90% of the IT and business decision makers surveyed expressed particular concern about ransomware attacks.
Despite widespread concern over spiralling threats, the study found that only 57% of responding IT teams discuss cyber risks with the C-suite at least weekly.
Vulnerabilities used to go months or even years before being exploited after their discovery.
“Now it can be hours, or even sooner. More executives than ever understand that they have a responsibility to be informed, but they often feel overwhelmed by how rapidly the cyber security landscape evolves. IT leaders need to communicate with their board in such a way that they can understand where the organisation’s risk is and how they can best manage it.”
https://www.helpnetsecurity.com/2022/02/10/c-suite-engagement/
Almost $1.3bn Paid to Ransomware Actors Since 2020
Cryptocurrency experts have identified $602m of ransomware payments made in 2021, but warned the real figure will likely surpass the $692m paid to cybercrime groups in 2020.
The findings come from the Ransomware Crypto Crime Report produced by blockchain investigations and analytics company Chainalysis. It reveals some fascinating insight into current industry trends.
Average payment size has soared over recent years, from $25,000 in 2019 to $88,000 a year later and $118,000 in 2021. That’s due in part to a surge in targeted attacks on major organisations, known as “big-game hunting,” which can net threat actors tens of millions in a single compromise.
“This big-game hunting strategy is enabled in part by ransomware attackers’ usage of tools provided by third-party providers to make their attacks more effective,” the report explained. “Usage of these services by ransomware operators spiked to its highest ever levels in 2021.”
https://www.infosecurity-magazine.com/news/almost-13bn-paid-to-ransomware/
Cyber Crooks Frame Targets by Planting Fabricated Digital Evidence
The ‘ModifiedElephant’ threat actors are technically unimpressive, but they’ve evaded detection for a decade, hacking human rights advocates’ systems with dusty old keyloggers and off-the-shelf RATs.
Threat actors are hijacking the devices of India’s human rights lawyers, activists and defenders, planting incriminating evidence to set them up for arrest, researchers warn.
The actor, dubbed ModifiedElephant, has been at it for at least 10 years, and it’s still active. It’s been shafting targets since 2012, if not sooner, going after hundreds of groups and individuals – some repeatedly – according to SentinelLabs researchers.
The operators aren’t what you’d call technical prodigies, but that doesn’t matter. Threat researchers at SentinelOne, said that the advanced persistent threat (APT) group – which may be tied to the commercial surveillance industry – has been muddling along just fine using rudimentary hacking tools such as commercially available remote-access trojans (RATs)
https://threatpost.com/cybercrooks-frame-targets-plant-incriminating-evidence/178384/
Highly Evasive Adaptive Threats (HEAT) Bypassing Traditional Security Defences
Menlo Security announced it has identified a surge in cyberthreats, termed Highly Evasive Adaptive Threats (HEAT), that bypass traditional security defences.
HEAT attacks are a class of cyber threats targeting web browsers as the attack vector and employs techniques to evade detection by multiple layers in current security stacks including firewalls, Secure Web Gateways, sandbox analysis, URL Reputation, and phishing detection. HEAT attacks are used to deliver malware or to compromise credentials, that in many cases leads to ransomware attacks.
In an analysis of almost 500,000 malicious domains, the research team discovered that 69% of these websites used HEAT tactics to deliver malware. These attacks allow bad actors to deliver malicious content to the endpoint by adapting to the targeted environment. Since July 2021, there was a 224% increase in HEAT attacks.
“With the abrupt move to remote working in 2020, every organisation had to pivot to a work from an anywhere model and accelerate their migration to cloud-based applications. An industry report found that 75% of the working day is spent in a web browser, which has quickly become the primary attack surface for threat actors, ransomware and other attacks. The industry has seen an explosion in the number and sophistication of these highly evasive attacks and most businesses are unprepared and lack the resources to prevent them,” said Menlo Security.
https://www.helpnetsecurity.com/2022/02/08/cyberthreats-bypass-security-defences/
LockBit, BlackCat, Swissport, Oh My! Ransomware Activity Stays Strong
However, groups are rebranding and recalibrating their profiles and tactics to respond to law enforcement and the security community’s focus on stopping ransomware attacks.
Law enforcement, C-suite executives and the cyber security community at-large have been laser-focused on stopping the expensive and disruptive barrage of ransomware attacks — and it appears to be working, at least to some extent. Nonetheless, recent moves from the LockBit 2.0 and BlackCat gangs, plus this weekend’s hit on the Swissport airport ground-logistics company, shows the scourge is far from over.
It’s more expensive and riskier than ever to launch ransomware attacks, and ransomware groups have responded by mounting fewer attacks with higher ransomware demands, Coveware has reported, finding that the average ransomware payment in the fourth quarter of last year climbed by 130 percent to reach $322,168. Likewise, Coveware found a 63 percent jump in the median ransom payment, up to $117,116.
“Average and median ransom payments increased dramatically during Q4, but we believe this change was driven by a subtle tactical shift by ransomware-as-a-service (RaaS) operations that reflected the increasing costs and risks previously described,” Coveware analysts said. “The tactical shift involves a deliberate attempt to extort companies that are large enough to pay a ‘big game’ ransom amount but small enough to keep attack operating costs and resulting media and law enforcement attention low.”
https://threatpost.com/lockbit-blackcat-swissport-ransomware-activity/178261/
2021 Was The Most Prolific Year On Record For Data Breaches
Spirion released a guide which provides a detailed look at sensitive data breaches in 2021 derived from analysis conducted against the Identity Theft Resource Center (ITRC) database of publicly reported data breaches in the United States.
The guide is based on the analysis of more than 1,500 data incidents that occurred in the United States during 2021 that specifically involved sensitive data, including personally identifiable information (PII). The report identifies the top sensitive data breaches by the number of individuals impacted, number of records compromised, threat actor, exposure vector, and types of sensitive data exposed by industry sector.
2021 was the most prolific year on record for data breaches, surpassing 2017’s all-time high. Last year a total of 1,862 data compromises were reported by US organisations—a 68 percent increase over 2020. ITRC data revealed that 83% of the year’s incidents exposed 889 million sensitive data records that impacted more than 150 million individuals.
https://www.helpnetsecurity.com/2022/02/09/2021-sensitive-data-breaches/
$1.3 Billion Lost to Romance Scams in the Past Five Years
Romance scams are reaching record-highs, regulators warn.
Netflix's new documentary, The Tinder Swindler, is a wild ride.
The show examines how an alleged fraudster impacted the lives of multiple women, matching with them on Tinder and treating them to expensive dates to gain their trust -- and eventually asking for huge sums of money.
While you may watch the show and wonder how someone -- no matter their gender -- could allow themselves to be swindled out of their savings, romance scams are common, breaking hearts and wiping bank balances around the world every day.
We've moved on from the days of "lonely hearts" columns to dating apps, and they're popular channels to conduct fraud.
Fake profiles, stolen photos and videos, and sob stories from fraudsters (their car has broken down, they can't afford to meet a match, or, in The Tinder Swindler's case, their "enemies" are after them) are all weapons designed to secure interest and sympathy.
https://www.zdnet.com/article/1-3-billion-lost-to-romance-scams-in-the-past-five-years-ftc/
Cyber Security Compliance Still Not A Priority For Many
IBM survey suggests that cyber security still isn't a priority for many companies
The most consistent data point in the IBM i Marketplace Survey Results over recent years has been the ever-present cyber security threat. This year is no exception. The study shows that 62% of organisations consider cyber security a number one concern as they plan their IT infrastructure. 22% cite regulations and compliance in their top five. While companies that prioritise security seem to be implementing multiple solutions, it’s still alarming that nearly half of them do not plan to implement them.
The complexity of cyber security often leaves industry leaders confused and overwhelmed, unable to produce the sound, proactive stance that is so essential.
Cyber security standards can be confusing, but they are necessary. Tighter security can be encouraged with an understanding of cyber security guidelines
For many organisations, cyber security standards are just too complex to wrap their hands around, but that doesn’t mean it’s not necessary. Understanding how cyber security guidelines affect companies’ legal standing can help encourage tighter security.
https://www.itsecurityguru.org/2022/02/07/cybersecurity-compliance-still-not-a-priority-for-many/
The World is Falling Victim to the Growing Trickbot Attacks in 2022
The malware goons are back again. The cybercrime operators behind the notorious TrickBot malware have once again upped the ante by fine-tuning its techniques by adding multiple layers of defence to slip past antimalware products.
TrickBot, which started out as a banking trojan, has evolved into a multi-purpose crimeware-as-a-service (CaaS) that’s employed by a variety of actors to deliver additional payloads such as ransomware. Over 100 variations of TrickBot have been identified to date, one of which is a “Trickboot” module that can modify the UEFI firmware of a compromised device. In the fall of 2020, Microsoft along with a handful of U.S. government agencies and private security companies teamed up to tackle the TrickBot botnet, taking down much of its infrastructure across the world in a bid to stymie its operations. But TrickBot has proven to be impervious to takedown attempts, what with the operators quickly adjusting their techniques to propagate multi-stage malware through phishing and malspam attacks, not to mention expanding their distribution channels by partnering with other affiliates like Shathak (aka TA551) to increase scale and drive profits.
Russian-based criminals behind the notorious malware known as Trickbot appear to be working overtime to upgrade the threat’s capabilities. Researchers announced last week the discovery of new malware components that enable monitoring and intelligence gathering on victims. The research findings include the detection of a VNC module that uses a custom communications protocol to obfuscate any data being transmitted between the command-and-control (C2) servers and the victims, making the attacks harder to find. The module is in active development and is being updated by criminals at a rapid pace.
“We Absolutely Do Not Care About You”: Sugar Ransomware Targets Individuals
Ransomware tends to target organisations. Corporations not only house a trove of valuable data they can’t function without, but they are also expected to cough up a considerable amount of ransom money in exchange for their encrypted files. And while corporations struggle to keep up with attacks, ransomware groups have left the average consumer relatively untouched—until now.
Sugar ransomware, a new strain recently discovered by the Walmart Security Team, is a ransomware-as-a-service (RaaS) that targets single computers and (likely) small businesses, too. Sugar, also known to many as Encoded01, has been in operation since November 2021.
Threats
Ransomware
NCSC Joins US and Australian Partners to Reveal Latest Ransomware Trends - NCSC.GOV.UK
Russian Ransomware Attacks Increased During 2021, Joint Review Finds | Cybercrime | The Guardian
FBI: Watch Out For LockBit 2.0 Ransomware, Here's How To Reduce The Risk To Your Network | ZDNet
Law Enforcement Action Push Ransomware Gangs To Surgical Attacks (bleepingcomputer.com)
Europe's Biggest Car Dealer Hit With Ransomware Attack | ZDNet
Swissport Ransomware Incident Delayed Flights - Infosecurity Magazine
How a Texas Hack Changed the Ransomware Business Forever - The Record by Recorded Future
Puma Hit By Data Breach After Kronos Ransomware Attack (bleepingcomputer.com)
Vodafone Portugal Hit By A Massive Cyber Attack - Security Affairs
Fortune 500 Service Provider Says Ransomware Attack Led To Leak Of More Than 500k SSNs | ZDNet
Phishing
Hackers Using Fake Job Offers in Latest Catfishing Scheme - ClearanceJobs
Threat Actors Revive 20-Year-Old Tactic in Microsoft 365 Phishing Attacks (darkreading.com)
ICO Hit by 2650% Rise in Email Attacks - Infosecurity Magazine
Other Social Engineering
Roaming Mantis SMSishing Campaign Now Targets Europe - Security Affairs
FBI: SIM Swapping Attacks Have Surged Five-Fold - Infosecurity Magazine
Malware
Qbot Needs Only 30 Minutes To Steal Your Credentials, Emails (bleepingcomputer.com)
Linux Malware Attacks Are On The Rise, And Businesses Aren't Ready For It | ZDNet
This Password-Stealing Malware Posed As A Windows 11 Download | ZDNet
Several Malware Families Using Pay-Per-Install Service to Expand Their Targets (thehackernews.com)
Qbot, Lokibot Malware Switch Back To Windows Regsvr32 Delivery (bleepingcomputer.com)
Mobile
Medusa Malware Joins Flubot's Android Distribution Network | Threatpost
Critical Android 12 Bug Fixed In February Security Patches • The Register
Data Breaches/Leaks
Organised Crime & Criminal Actors
Cryptocurrency/Cryptomining/Cryptojacking
Insider Risk and Insider Threats
Fraud, Scams & Financial Crime
Supply Chain
DoS/DDoS
Nation State Actors
Russian APT Steps Up Malicious Cyber Activity in Ukraine (darkreading.com)
Iran Malware in HPE Server Stuns Cyber Security Experts - Bloomberg
Iranian Hackers Using New Marlin Backdoor in 'Out to Sea' Espionage Campaign (thehackernews.com)
Cloud
Privacy
Meta Threatens to Shut Down Facebook and Instagram in Europe | The Independent
Facebook Exposes 'God Mode' Token Miscreants Could Use • The Register
Spyware, Espionage & Cyber Warfare
Vulnerabilities
Microsoft, Oracle, Apache and Apple vulnerabilities added to CISA catalog | ZDNet
CISA Says 'HiveNightmare' Windows Vulnerability Exploited in Attacks | SecurityWeek.Com
Microsoft Fixes Defender Flaw Letting Hackers Bypass Antivirus Scans (bleepingcomputer.com)
Microsoft and Other Major Software Firms Release February 2022 Patch Updates (thehackernews.com)
Apple Patches New Zero-Day Exploited To Hack iPhones, iPads, Macs (bleepingcomputer.com)
CISA Urges Orgs To Patch Actively Exploited Windows SeriousSAM Bug (bleepingcomputer.com)
CISA Warns Admins To Patch Maximum Severity SAP Vulnerability (bleepingcomputer.com)
Adobe Patches 13 Vulnerabilities in Illustrator | SecurityWeek.Com
PHP Everywhere RCE Flaws Threaten Thousands of WordPress Sites (bleepingcomputer.com)
Sector Specific
Financial Services Sector
Defence
Health/Medical/Pharma Sector
Retail/eCommerce
Wave of MageCart Attacks Target Hundreds Of Outdated Magento Sites (bleepingcomputer.com)
Threat Actors Compromised +500 Magento-Based E-Stores With E-Skimmers - Security Affairs
Transport and Aviation
Education and Academia
Other News
A "light" February 2022 Patch Tuesday That Should Not Be Ignored - Help Net Security
Organisations Still Struggling To Use APIs Effectively - Help Net Security
Threat Hunting: Your Best Defence Against Unknown Threats - MSSP Alert
UK Foreign and Commonwealth Office Suffered Serious Cyber Attack Earlier This Year | Reuters
European Police Flag 500+ Pieces of “Terrorist” Content - Infosecurity Magazine
A Quarter of New Online Accounts Are Fake – Report - Infosecurity Magazine
Microsoft To Make Enabling 'Untrusted' Office Macros Tougher In The Name Of Security | ZDNet
Cyber Terrorism Is a Growing Threat & Governments Must Take Action (darkreading.com)
Hackers Have Begun Adapting To Wider Use Of Multi-Factor Authentication | TechRepublic
The Race To Save The Internet From Quantum Hackers (nature.com)
Disaster Recovery Is Critical For Business Continuity - Help Net Security
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 02 February 2022
Black Arrow Cyber Threat Briefing 02 February 2022:
-Why Cyber Change Outpaces Boardroom Engagement
-NCSC Alerts UK Orgs To Brace For Destructive Russian Cyber Attacks
-Ransomware: Over Half Of Attacks Are Targeting These Three Industries
-Third of Employees Admit to Exfiltrating Data When Leaving Their Job
-Massive Social Engineering Waves Have Impacted Banks In Several Countries
-Ransomware Is Terrifying – But Never Underestimate The Damage An Employee With Unmonitored Access Can Do
-People Working In IT Related Roles Equally Susceptible To Phishing Attempts As The General Population
-FBI Says More Cyber Attacks Come From China Than Everywhere Else Combined
-Managing Detections Is Not the Same as Stopping Breaches
-From War to Web Security, Protect Your Attack Surface from the Weakest Link
-Number Of Data Compromises Reaching All-Time High
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Cyber Change Outpaces Boardroom Engagement
We all know the story of the past two years. Mass digital investments in SaaS collaboration suites, cloud infrastructure and other tools helped to keep organisations operational when they needed it most. The money continues to flow today, as those same companies realize they must keep on pumping funds into digital to stay competitive amidst rising customer expectations. Gartner predicted public cloud spending growth would hit 23% year-on-year in 2021 and increase 20% this year to top $397bn.
From a cyber security perspective, these business decisions are loaded with risk if protections are not built into projects from the start. A recent global poll revealed that of 90% of business and IT decision makers are concerned about the impact of ransomware. It also found generally poor levels of cyber-awareness among board members. Less than half (46%) of respondents claimed concepts like “cyber risk” and “cyber risk management” were known extensively in their organisation.
The truth is that many board leaders do understand the need for greater investment in security as a strategic growth driver. But they find it hard to keep pace with a threat landscape that moves at the speed of light. Vulnerabilities used to go months or years before they were exploited, for example, but today threat actors are working on exploits for bugs like Log4Shell within hours of their discovery. That makes the fast-changing risk landscape difficult to grasp for even tech-savvy C-suite leaders. As a result, cyber risk continues to be managed reactively, which puts the organisation perpetually on the back foot.
https://www.trendmicro.com/en_us/research/22/b/why-cyber-change-outpaces-boardroom-engagement.html
NCSC Alerts UK Orgs to Brace for Destructive Russian Cyber Attacks
The UK’s National Cyber Security Centre (NCSC) is urging organisations to bolster security and prepare for a potential wave of destructive cyber attacks after recent breaches of Ukrainian entities.
The NCSC openly warns that Russian state-sponsored threat actors will likely conduct the attacks and reminds of the damage done in previous destructive cyber attacks, like NotPetya in 2017 and the GRU campaign against Georgia in 2019.
These warnings come after Ukrainian government agencies and corporate entities suffered cyber attacks where websites were defaced, and data-wiping malware was deployed to destroy data and make Windows devices inoperable.
The cause for the resurgence of attacks is the tensions between Russia and Ukraine, and attempts to negotiate a way out of the Ukraine crisis have failed so far.
Ukraine and Russia have engaged in cyber warfare for many years, but recent Russian military mobilization was accompanied by new waves of attacks, with European countries and the USA expected to be targeted next.
Over Half of Ransomware Attacks are Targeting Financial Services, Utilities and Retail
Three sectors have been the most common target for ransomware attacks, but researchers warn "no business or industry is safe".
Over half of ransomware attacks are targeting one of three industries; banking, utilities and retail, according to analysis by cyber security researchers – but they've also warned that all industries are at risk from attacks.
The data has been gathered by Trellix – formerly McAfee Enterprise and FireEye – from detected attacks between July and September 2021, a period when some of the most high-profile ransomware attacks of the past year happened.
According to detections by Trellix, banking and finance was the most common target for ransomware during the reporting period, accounting for 22% of detected attacks. That's followed by 20% of attacks targeting the utilities sector and 16% of attacks targeting retailers. Attacks against the three sectors in combination accounted for 58% of all of those detected.
https://www.zdnet.com/article/ransomware-over-half-of-attacks-are-targeting-these-three-industries/
Third of Employees Admit to Exfiltrating Data When Leaving Their Job
Nearly one-third (29%) of employees admitted taking data with them when they leave their job, according to new research from Tessian.
The findings follow the ‘great resignation’ of 2021, when workers quit their jobs in huge waves following the COVID-19 pandemic. Unsurprisingly, close to three-quarters (71%) of IT leaders believe this trend has increased security risks in their organisations.
In addition, nearly half (45%) of IT leaders said they had seen incidents of data exfiltration increase in the past year due to staff taking data with them when they left.
The survey of 2000 UK workers also looked at employees' motives for taking such information. The most common reason was that the data would help them in their new job (58%). This was followed by the belief that the information belonged to them because they worked on the document (53%) and to share it with their new employer (44%).
The employees most likely to take data with them when leaving their job worked in marketing (63%), HR (37%) and IT (37%).
https://www.infosecurity-magazine.com/news/third-employees-exfiltrating-data/
Massive Social Engineering Waves Have Impacted Banks in Several Countries
A massive social engineering campaign has been delivered in the last two years in several countries, including Portugal, Spain, Brazil, Mexico, Chile, the UK, and France. According to Segurança Informática publication, the malicious waves have impacted banking organisations with the goal of stealing the users’ secrets, accessing the home banking portals, and also controlling all the operations on the fly via Command and Control (C2) servers geolocated in Brazil.
In short, criminal groups are targeting victims’ from different countries to collect their home banking secrets and payment cards. The campaigns are carried out by using social engineering schemas, namely smishing, and spear-phishing through fake emails.
Criminals obtain lists of valid and tested phone numbers and emails from other malicious groups, and the process is performed on underground forums, Telegram channels or Discord chats.
The spear-phishing campaigns try to lure victims with fake emails that impersonate the banking institutions. The emails are extremely similar to the originals, exception their content, mainly related to debts or lack of payments.
https://securityaffairs.co/wordpress/127516/cyber-crime/massive-social-engineering-banks.html
Ransomware is Terrifying – But Never Underestimate the Damage an Employee with Unmonitored Access Can Do
Is the biggest threat to your data a mysterious ransomware merchant or an advanced persistent threat cartel?
Or is it a security system that will show you that data has been exfiltrated from your organisation – but only after the fact, leaving open the possibility that your valuable IP could have already been shared with unauthorized parties?
It was the latter scenario that allegedly resulted in 12,000 internal documents being lifted from Pfizer’s systems by a soon-to-depart employee last year. Those documents reportedly included details of COVID-19 vaccine research and a new melanoma drug.
The incident shows how today’s cloud infrastructure can exacerbate security gaps and why simply detecting a potential data leak isn’t enough. Companies need to have deep insight into what their employees are doing, as well as technology that can actively enforce policy and prevent unencrypted data from ever leaving the enterprise.
https://www.theregister.com/2022/02/03/ransomware_terrifying/
People Working in IT Related Roles Equally Susceptible to Phishing Attempts as the General Population
Phishing emails that mimic HR announcements or ask for assistance with invoicing get the most clicks from recipients, according to a study from F-Secure.
The study, which included 82,402 participants, tested how employees from four different organisations responded to emails that simulated one of four commonly used phishing tactics.
22% of recipients that received an email simulating a human resources announcement about vacation time clicked, making emails that mimic those sent by HR the most frequent source of clicks in the study.
An email asking the recipient to help with an invoice (referred to as CEO Fraud in the report) was the second most frequently engaged with email type, receiving clicks from 16% of recipients.
https://www.helpnetsecurity.com/2022/02/03/phishing-emails-clicks/
FBI Says More Cyber Attacks Come from China than Everywhere Else Combined
US Federal Bureau of Investigation director Christopher Wray has named China as the source of more cyber-attacks on the USA than all other nations combined.
In a Monday speech titled Countering Threats Posed by the Chinese Government Inside the US, Wray said the FBI is probing over 2,000 investigations of incidents assessed as attempts by China's government "to steal our information and technology."
"The Chinese government steals staggering volumes of information and causes deep, job-destroying damage across a wide range of industries – so much so that, as you heard, we're constantly opening new cases to counter their intelligence operations, about every 12 hours or so."
Wray rated China's online offensive as "bigger than those of every other major nation combined," adding it has "a lot of funding and sophisticated tools, and often joining forces with cyber criminals – in effect, cyber mercenaries."
https://www.theregister.com/2022/02/03/fbi_china_threat_to_usa/
Managing Detections is Not the Same as Stopping Breaches
Enterprises interested in managed detection and response (MDR) services to monitor endpoints and workloads should make sure the providers have rock-solid expertise in detecting and responding to threats.
The fundamental challenge in cyber security is that adversaries move quickly. We know from observation that attackers go from initial intrusion to lateral movement in a matter of a couple hours or less.
If security teams are going to successfully stop a breach, they need to operate within the same timeframe, containing and remediating threats within minutes, 24 hours a day, 7 days a week. Such constant vigilance can be challenging for in-house staff. This is why many organisations engage a provider of managed detection and response (MDR) security services, which monitors endpoints, workloads, and other systems to detect and monitor threats.
Unfortunately, even most managed services have several fundamental flaws that prevent them from executing on the core mission of stopping breaches.
https://www.darkreading.com/crowdstrike/managing-detections-is-not-the-same-as-stopping-breaches
From War to Web Security, Protect Your Attack Surface from the Weakest Link
With the rapid proliferation of data, increasing number of domains and subdomains as well as rise in third-party providers, the number of entry points through which attackers can infiltrate a company’s web environment is endless. Attacks are increasingly causing consequences felt beyond the perimeter of an organisation, as demonstrated earlier this year with the Colonial Pipeline breach, which caused fuel prices along the US East Coast to soar, and the attack on software provider Kaseya that forced hundreds of grocery stores in the Nordics to shut down business for days.
Security breaches often happen through an avenue that no one saw coming — a server no one knew existed, an old landing page, weak passwords or an application that was missing a patch. It’s perhaps never been clearer than today that a company is only as strong as the weakest link in its growing attack surface.
https://thenewstack.io/from-war-to-web-security-protect-your-attack-surface-from-the-weakest-link/
Number of Data Compromises Reaching All-Time High
According to an Identity Theft Resource Center (ITRC) report, the overall number of data compromises (1,862) is up more than 68 percent compared to 2020.
The new record number of data compromises is 23 percent over the previous all-time high (1,506) set in 2017. The number of data events that involved sensitive information (Ex: Social Security numbers) increased slightly compared to 2020 (83 percent vs. 80 percent). However, it remained well below the previous high of 95 percent set in 2017.
The number of victims continues to decrease (down five (5) percent in 2021 compared to the previous year) as identity criminals focus more on specific data types rather than mass data acquisition. However, the number of consumers whose data was compromised multiple times per year remains alarmingly high.
https://www.helpnetsecurity.com/2022/01/31/data-compromises-up/
Threats
Ransomware
Aggressive BlackCat Ransomware on the Rise (darkreading.com)
A Look At The New Sugar Ransomware Demanding Low Ransoms (bleepingcomputer.com)
BlackCat Ransomware - What You Need To Know | The State of Security (tripwire.com)
KP Snacks Giant Hit By Conti Ransomware, Deliveries Disrupted (bleepingcomputer.com)
Hacker Group 'Moses Staff' Using New StrifeWater RAT in Ransomware Attacks (thehackernews.com)
Financially Motivated Hackers Use Leaked Conti Ransomware Techniques in Attacks | SecurityWeek.Com
FBI Shares Lockbit Ransomware Technical Details, Defense Tips (bleepingcomputer.com)
BlackCat (ALPHV) Ransomware Linked To BlackMatter, DarkSide Gangs (bleepingcomputer.com)
Over 500,000 People Impacted By A Ransomware Attack That Hit Morley - Security Affairs
Scottish Agency Still Recovering from 2020 Ransomware Attack - Infosecurity Magazine
Conti Ransomware Encrypted 80% of Ireland's HSE IT Systems (bleepingcomputer.com)
Ransomware Wants You to Like and Subscribe, Or Else (vice.com)
Ransomware Means Your Database IS The Front Line. How Are You Defending It? • The Register
Phishing
Low-Detection Phishing Kits Increasingly Bypass MFA | Threatpost
MFA Adoption Pushes Phishing Actors To Reverse-Proxy Solutions (bleepingcomputer.com)
Intuit Warns Of Phishing Emails Threatening To Delete Accounts (bleepingcomputer.com)
Strong Authentication Protects Against Phishing. So Why Aren't More People Using It? | ZDNet
Microsoft Blocked Billions Of Brute-Force And Phishing Attacks Last Year (bleepingcomputer.com)
Other Social Engineering
Malware
Malicious CSV Text Files Used To Install BazarBackdoor Malware (bleepingcomputer.com)
New Malware Used by SolarWinds Attackers Went Undetected for Years (thehackernews.com)
Microsoft: This Mac Malware Is Getting Smarter And More Dangerous | ZDNet
Data Breaches/Leaks
The 3 Most Common Causes of Data Breaches in 2021 (darkreading.com)
British Council Exposed More Than 100,000 Files With Student Records (bleepingcomputer.com)
Insider Risk and Insider Threats
Fraud, Scams & Financial Crime
Supply Chain
DoS/DDoS
CNI, OT, ICS, IIoT and SCADA
Nation State Actors
Russian 'Gamaredon' Hackers Use 8 New Malware Payloads In Attacks (bleepingcomputer.com)
State Hackers' New Malware Helped Them Stay Undetected For 250 Days (bleepingcomputer.com)
Charming Kitten Sharpens Its Claws with PowerShell Backdoor | Threatpost
FBI's Warning About Iranian Firm Highlights Common Cyber Attack Tactics | CSO Online
Cloud
Passwords & Credential Stuffing
Spyware, Espionage & Cyber Warfare
Ukraine Continues to Face Cyber Espionage Attacks from Russian Hackers (thehackernews.com)
Gamaredon (Primitive Bear) Russian APT Group Actively Targeting Ukraine (paloaltonetworks.com)
Hackers Exploited 0-Day Vulnerability in Zimbra Email Platform to Spy on Users (thehackernews.com)
Cyber Spies Linked To Memento Ransomware Use New PowerShell Malware (bleepingcomputer.com)
NSO Group's Pegasus Spyware and Phantom Encryption Cracker Trigger Fresh Concerns - MSSP Alert
Vulnerabilities
Apple, SonicWall, Internet Explorer Vulnerabilities Added To CISA List | ZDNet
Samba 'Fruit' Bug Allows RCE, Full Root User Access | Threatpost
Tens of Thousands of Websites Vulnerable to RCE Flaw in WordPress Plug-in (darkreading.com)
Cisco Fixes Critical Bugs In SMB Routers, Exploits Available (bleepingcomputer.com)
UEFI Firmware Vulnerabilities Affect At Least 25 Computer Vendors (bleepingcomputer.com)
Google Patches 27 Vulnerabilities With Release of Chrome 98 | SecurityWeek.Com
Intel Patched 226 Vulnerabilities in 2021 | SecurityWeek.Com
600K WordPress Sites Impacted By Critical Plugin RCE Vulnerability (bleepingcomputer.com)
Critical Log4j Vulnerabilities Are the Ultimate Gift for Cyber Criminals (darkreading.com)
ESET Antivirus Bug Let Attackers Gain Windows SYSTEM Privileges (bleepingcomputer.com)
Sector Specific
Financial Services Sector
Retail
Transport and Aviation
Reports Published in the Last Week
Other News
Hackers Went Wild in 2021 — Every Company Should Do These 5 Things in 2022 (darkreading.com)
Rush To Remote Work Left Sysadmins Struggling To Keep Businesses Safe - Help Net Security
Telco Fined €9 Million For Hiding Cyber Attack Impact From Customers (bleepingcomputer.com)
90% of Security Leaders Warn of Skills Shortage - Infosecurity Magazine (infosecurity-magazine.com)
Hundreds Of Thousands Of Routers Exposed To Eternal Silence Campaign Via UPnP - Security Affairs
Social Security Numbers Most Targeted Sensitive Data - Infosecurity Magazine
NIST's New Cyber-Resiliency Guidance: 3 Steps For Getting Started | CSO Online
Organisations Neglecting Microsoft 365 Cyber Security Features - Help Net Security
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.