Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 17 September 2021
Black Arrow Cyber Threat Briefing 17 September 2021
-Ransomware Preparedness Is Low Despite Executives’ Concerns
-MSPs That Cannot Modernize Will Find Themselves And Their Clients Falling Behind
-Two-Thirds Of Cloud Attacks Could Be Stopped By Checking Configurations, Research Finds
-Open Source Software Cyber Attacks Increasing By 650%, Popular Projects More Vulnerable
-Third-Party Cloud Providers: Expanding The Attack Surface
-Ransomware Encrypts South Africa's Entire Dept Of Justice Network
-2021’s Most Dangerous Software Weaknesses
-46% Of All On-Prem Databases Are Vulnerable To Attack, Breaches Expected To Grow
-Most Fortune 500 Companies’ External IT Infrastructure Considered At Risk
-Thousands Of Internet-Connected Databases Contain High Or Critical Vulnerabilities
-Only 30% Of Enterprises Use Cloud Services With End to End Encryption For External File Sharing
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Ransomware Preparedness Is Low Despite Executives’ Concerns
86.7% of C-suite and other executives say they expect the number of cyber attacks targeting their organisations to increase over the next 12 months, according to a recent poll conducted by researchers. While 64.8% of polled executives say that ransomware is a cyber threat posing major concern to their organisations over the next 12 months, only 33.3% say that their organisations have simulated ransomware attacks to prepare for such an incident. https://www.helpnetsecurity.com/2021/09/15/ransomware-preparedness/
MSPs That Cannot Modernize Will Find Themselves And Their Clients Falling Behind
Researchers sought feedback from IT professionals to explore the performance of modern (and not-so-modern) managed service providers (MSPs). The survey found that even satisfactory MSPs are falling short in certain key areas: cloud strategy, security, and IT spending. https://www.helpnetsecurity.com/2021/09/16/msps-falling-behind/
Two-Thirds Of Cloud Attacks Could Be Stopped By Checking Configurations, Research Finds
On Wednesday, researchers published its latest Cloud Security Threat Landscape report, spanning Q2 2020 through Q2 2021. According to the research, two out of three breached cloud environments observed by the tech giant "would likely have been prevented by more robust hardening of systems, such as properly implementing security policies and patching systems." https://www.zdnet.com/article/two-thirds-of-cloud-attacks-could-be-stopped-by-checking-configurations-research-finds/
Open Source Software Cyber Attacks Increasing By 650%, Popular Projects More Vulnerable
Researchers released a report that revealed continued strong growth in open source supply and demand dynamics. Further, with regard to open source security risks, the report reveals a 650% year over year increase in supply chain attacks aimed at upstream public repositories, and a fascinating dichotomy pertaining to the level of known vulnerabilities present in popular and non-popular project versions. https://www.helpnetsecurity.com/2021/09/17/open-source-cyberattacks/
Third-Party Cloud Providers: Expanding The Attack Surface
In the era of digital transformation, which is essentially an organisation’s way of stating they are increasing their reliance on cloud-based services—enterprises’, digital landscapes are more interconnected than ever before. This means that the company you buy a technology function from may have downstream third-party providers that enable plumbing, infrastructure and development technology that drive their business. With modern computing environments moving further away from the enterprise, the safety assumption paradigm is shifting. This has impacted the threat landscape because as organisations increase migration to the cloud (a third party), they must now consider that these newly onboarded third parties may have serious security issues that could present adversaries with opportunities to infiltrate your network. https://www.helpnetsecurity.com/2021/09/13/third-party-cloud-providers/
Ransomware Encrypts South Africa's Entire Dept Of Justice Network
The justice ministry of the South African government is working on restoring its operations after a recent ransomware attack encrypted all its systems, making all electronic services unavailable both internally and to the public. As a consequence of the attack, the Department of Justice and Constitutional Development said that child maintenance payments are now on hold until systems are back online. https://www.bleepingcomputer.com/news/security/ransomware-encrypts-south-africas-entire-dept-of-justice-network/
2021’s Most Dangerous Software Weaknesses
Researchers recently updated a list of the top 25 most dangerous software bugs, and it’s little surprise that a number of them have been on that list for years. The Common Weakness Enumeration (CWE) list represents vulnerabilities that have been widely known for years, yet are still being coded into software and being bypassed by testing. Both developers and testers presumably know better by now, but keep making the same mistakes in building applications. https://threatpost.com/2021-angerous-software-weaknesses/169458/
46% Of All On-Prem Databases Are Vulnerable To Attack, Breaches Expected To Grow
A five-year longitudinal study comprising nearly 27,000 scanned databases discovered that the average database contains 26 existing vulnerabilities. 56% of the Common Vulnerabilities and Exposures (CVEs) found were ranked as ‘High’ or ‘Critical’ severity, aligned with guidelines from the National Institute of Standards and Technology (NIST). This indicates that many organisations are not prioritizing the security of their data and neglecting routine patching exercises. Based on Imperva scans, some CVEs have gone unaddressed for three or more years. https://www.helpnetsecurity.com/2021/09/15/on-prem-databases-vulnerable/
Most Fortune 500 Companies’ External IT Infrastructure Considered At Risk
Nearly three quarters of Fortune 500 companies’ IT infrastructure exists outside their organisation, a quarter of which was found to have a known vulnerability that threat actors could infiltrate to access sensitive employee or customer data, as research reveal. https://www.helpnetsecurity.com/2021/09/15/external-it-infrastructure-risk/
Thousands Of Internet-Connected Databases Contain High Or Critical Vulnerabilities
After spending five years poring over port scan results, researchers reckon there's about 12,000 vulnerability-containing databases accessible through the internet. The study also found that of the 46 per cent of 27,000 databases scanned, just over half that number contained "high" or "critical" vulns as defined by their CVE score. https://www.theregister.com/2021/09/14/imperva_12k_database_vuln_report/
Only 30% Of Enterprises Use Cloud Services With End to End Encryption For External File Sharing
A recent study of enterprise IT security decision makers conducted by researchers shows that majority of enterprises use additional encryption methods to boost the security of cloud collaboration and file transfer, however, tools with built-in end-to-end encryption are still less frequent despite the growing popularity of this privacy and security enhancing technology. https://www.helpnetsecurity.com/2021/09/13/external-file-sharing/
Threats
Ransomware
The State Of Ransomware: National Emergencies And Million-Dollar Blackmail
Ransomware Attackers Targeted App Developers With Malicious Office Docs, Says Microsoft
Microsoft: Windows MSHTML Bug Now Exploited By Ransomware Gangs
Ransomware Gang Threatens To Wipe Decryption Key If Negotiator Hired
US General In Charge Of Cyber Security Pledges ‘Surge’ To Address Ransomware Attacks
REvil Ransomware Is Back In Full Attack Mode And Leaking Data
Ransomware-Hit Law Firm Secures High Court Judgment Against Unknown Criminals
Ransomware Encrypts South Africa's Entire Dept Of Justice Network
BEC
Phishing
Other Social Engineering
Brits Open Doors For Tech-Enabled Fraudsters Because They 'Don't Want To Seem Rude'
Scammers In Russia Offer Free Bitcoin On A Hacked Government Website
Malware
Mobile
Cyber Security Expert: Israeli Spyware Company NSO Group Poses ‘A Serious Threat To Phone Users’
After The T-Mobile Breach, Companies Are Preventing Customers From Securing Their Accounts
IOT
Vulnerabilities
Microsoft September 2021 Patch Tuesday Fixes 2 Zero-Days, 60 Flaws
Third Critical Bug Affects Netgear Smart Switches — Details And PoC Released
Patch Now! PrintNightmare Over, MSHTML Fixed, A New Horror Appears … OMIGOD
No Patch For High-Severity Bug In Legacy IBM System X Servers
Experts Warn About Vulnerabilities of U.S. GPS System To Cyber Terrorists
Data Breaches/Leaks
Organised Crime & Criminal Actors
Cryptocurrency/Cryptojacking
DoS/DDoS
Nation State Actors
Cloud
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 19 March 2021
Black Arrow Cyber Threat Briefing 19 March 2021: Tens Of Thousands Of Microsoft Exchange Customers Under Attack, Targeted By Multiple Hacker Groups; Over $4.2 Billion Officially Lost To Cyber Crime In 2020; Cyber Attacks Multiply On HNWIs; Largest Ransomware Demand Now Stands At $30 Million; 71 Percent Of Office 365 Users Suffer Malicious Account Takeovers; More Than 16 Million Covid-Themed Cyber Attacks Launched In 2020; Cyber Now Key To National Security;
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Tens Of Thousands Of Microsoft Exchange Customers Are Under Assault From Hackers, Experts Warning Of Unprecedented Damage, Exploits Being Targeted By "At Least 10 Hacker Groups"
Four exploits in Microsoft Exchange Server hit the news last week, when we heard that a Chinese hacking group had targeted the email servers of some 30,000 U.S. government and commercial organisations. The exploits had been patched by Microsoft, but the hacking group known as “Hafnium” had doubled-up on efforts targeting unpatched servers. Security researchers found that at least 10 APT groups are taking advantage of the exploits in an attempt to compromise servers around the world. Winniti Group, Calypso, Tick, and more are among the groups identified.
https://www.techspot.com/news/88913-microsoft-exchange-server-exploits-targeted-least-10-hacker.html
Over $4.2 Billion Officially Lost To Cyber Crime In 2020
Cyber crime affecting victims in the U.S., noting a record number of complaints and financial losses in 2020 compared to the previous year. The Internet Crime Complaint Center (IC3) received last year 791,790 complaints - up by 69% from 2019 - of suspected internet crime causing more than $4 billion in losses. While most complaints were for phishing, non-payment/non-delivery scams, and extortion, about half of the losses are accounted by business email compromise (BEC), romance and confidence scams, and investment fraud.
Cyber Attacks Multiply On Wealthy Investors
An email nearly cost a wealthy British art collector £6m, after hackers monitored email correspondence between the client and an art dealer the client had been negotiating with for a year, with hackers impersonating the genuine art dealer, learning to impersonate the tone and language used — even gleaning private family news and the names of partners and children.
Just when the collector and the art dealer finally reached a conclusion on price, the client received an email to say something along the lines of, I hope the children are recovering from their colds — we have just amended our bank details for security and here they are. As it matched the tone of previous emails the art-loving client didn't think anything was amiss.
Fortunately, his family office phoned the real dealer to check the transaction before approving a transfer and the scam was discovered in time, but many people are not so lucky.
https://www.ft.com/content/cdfe8d97-6431-48e2-a8a7-7d760c6e9ed6
Cyber Strength Now Key To National Security, Says UK
In what has been billed as the largest security and foreign policy strategy revamp since the Cold War, the UK government has outlined new defence priorities – with at their heart, the imperative to boost the use of new technologies to safeguard the country. Prime minister Boris Johnson unveiled the integrated review this week, which has been in the making for over a year and will be used as a guide for spending decisions in the future. Focusing on foreign policy, defense and security, the review sets goals for the UK to 2025; and underpinning many of the targets is the objective of modernizing the country's armed forces.
https://www.zdnet.com/article/cyber-strength-now-key-to-national-security-says-uk/
Largest Ransomware Demand Now Stands At $30 Million As Crooks Get Bolder
Ransomware shows no sign of slowing down as the average ransom paid to cyber criminals by organisations that fall victim to these attacks has nearly tripled over the past year. Cyber security researchers analysed ransomware attacks targeting organisations across North America and Europe and found that the average ransom paid in exchange for a decryption key to unlock encrypted networks rose from $115,123 in 2019 to $312,493 in 2020.
Mimecast: SolarWinds Attackers Stole Source Code
Hackers who compromised Mimecast networks as part of the SolarWinds espionage campaign have swiped some of the security firm’s source code repositories, according to an update by the company. The email security firm initially reported that a certificate compromise in January was part of the sprawling SolarWinds supply-chain attack that also hit Microsoft, FireEye and several U.S. government agencies.
https://threatpost.com/mimecast-solarwinds-attackers-stole-source-code/164847/
71 Percent Of Office 365 Users Suffer Malicious Account Takeovers
88 percent of companies have accelerated their cloud and digital transformation projects due to COVID-19. But it also finds that 71 percent of Microsoft Office 365 deployments have suffered an account takeover of a legitimate user's account, not just once, but on average seven times in the last year.
https://betanews.com/2021/03/17/office-365-malicious-account-takeovers/
More Than 16 Million Covid-Themed Cyber Attacks Launched In 2020
COVID-19 dominated everyone's lives throughout 2020 but a new report from a cyber security company found that the pandemic was also the main theme of nearly 16.5 million threats and attacks launched against its customers. Researchers wrote that they dealt with 16,393,564 threats that had a COVID-19-related tint to them, with 88% of the threats coming in spam emails and another 11% coming in the form of URLs. Malware accounted for 0.2%, or nearly 33,000, of the threats
“Expert” Hackers Used 11 0-Days To Infect Windows, iOS, And Android Users
Using novel exploitation and obfuscation techniques, a mastery of a wide range of vulnerability types, and a complex delivery infrastructure, the group exploited four zero-days in February 2020. The hackers’ ability to chain together multiple exploits that compromised fully patched Windows and Android devices led members of Google’s Project Zero and Threat Analysis Group to call the group “highly sophisticated.”
Cyber Attacks: Is The ‘Big One’ Coming Soon?
2020 was the year that the COVID-19 crisis also brought a cyber pandemic. Late last year, the security industry’s top experts from global cyber security company leadership predicted even worse cyber security outcomes for 2021 compared to what we saw in 2020. In December, we learned about how SolarWinds’ Orion vulnerability was compromised, causing one of the worst data breaches in history that is still evolving for about 18,000 organisations.
Threats
Ransomware
Phishing
Ongoing Office 365-themed phishing campaign targets executives, assistants, financial departments
Phishing sites now detect virtual machines to bypass detection
Malware
New botnet targets network security devices with critical exploits
New ZHtrap botnet malware deploys honeypots to find more targets
Latest Mirai Variant Targets SonicWall, D-Link and IoT Devices
IOT
Vulnerabilities
DuckDuckGo browser extension vulnerability leaves Edge users open to potential cyber-snooping
“Expert” hackers used 11 zerodays to infect Windows, iOS, and Android users
Google fixes the third actively exploited Chrome 0-Day since January
Experts found 15 flaws in Netgear JGS516PE switch, including a critical RCE
Microsoft Exchange Server: These quarterly updates include fixes for security flaws
Data Breaches
Journalists’ personal and bank details made public after publisher data breach
This years-old Microsoft Office vulnerability is still popular with hackers, so patch now
Organised Crime & Criminal Actors
18-Year-Old Hacker Gets 3 Years in Prison for Massive Twitter 'Bitcoin Scam' Hack
Criminal data breach site WeLeakInfo just leaked customer payment details
OT, ICS, IIoT and SCADA
Nation-State Actors
Denial of Service
Privacy
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.