Black Arrow Cyber Threat Briefing 21 April 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• March 2023 Broke Ransomware Attack Records with a 91% Increase from the Previous Month

March 2023 was the most prolific month recorded by cyber security analysts in recent years, measuring 459 attacks, an increase of 91% from the previous month and 62% compared to March 2022. According to NCC Group, which compiled the report based on statistics derived from its observations, the reason last month broke all ransomware attack records was CVE-2023-0669. This is a vulnerability in Fortra's GoAnywhere MFT secure file transfer tool that the Clop ransomware gang exploited as a zero-day to steal data from 130 companies within ten days.

Regarding the location of last month's victims, almost half of all attacks (221) breached entities in North America. Europe followed with 126 episodes, and Asia came third with 59 ransomware attacks.

The recorded activity spike in March 2023 highlights the importance of applying security updates as soon as possible, mitigating potentially unknown security gaps like zero days by implementing additional measures and monitoring network traffic and logs for suspicious activity.

https://www.bleepingcomputer.com/news/security/march-2023-broke-ransomware-attack-records-with-459-incidents/

• Organisations Overwhelmed with Cyber Security Alerts, Threats and Attack Surfaces

Many organisations are struggling to manage key security projects while being overwhelmed with volumes of alerts, increasing cyber threats and growing attack surfaces, a new report has said. Compounding that problem is a tendency by an organisation’s top brass to miss hidden risks associated with digital transformation projects and compliance regulations, leading to a false sense of confidence in their awareness of these vulnerabilities.

The study comprised IT professionals from the manufacturing, government, healthcare, financial services, retail and telecommunications industries. Five of the biggest challenges they face include:

• Keeping up with threat intelligence (70%)

• Allocating cyber security resources and budget (47%)

• Visibility into all assets connected to the network (44%)

• Compliance and regulation (39%)

• Convergence of IT and OT (32%)

The report also focused on breaches within organisations, finding that 64% had suffered a breach or ransomware attack in the last five years; 43% said it had been caused by employee phishing.

https://www.msspalert.com/cybersecurity-news/organizations-overwhelmed-with-cybersecurity-alerts-threats-and-attack-surfaces-armis-study-shows/

• One in Three Businesses Faced Cyber Attacks Last Year

Nearly a third of businesses and a quarter of charities have said they were the subject of cyber attacks or breaches last year, new data has shown. Figures collected for the UK Government by polling company Ipsos show a similar proportion of larger and medium-sized companies and high-income charities faced attacks or breaches last year as in 2021.

Overall, 32% of businesses said they had been subject to attacks or breaches over a 12-month period, with 24% of charities saying the same. Meanwhile, about one in ten businesses (11%) and 8% of charities said they had been the victims of cyber crime – which is defined more narrowly – over the 12-month period. This rose to a quarter (26%) of medium-sized businesses, 37% of large businesses and 25% of high-income charities. The UK Government estimated there had been 2.4 million instances of cyber crime against UK businesses, costing an average of £15,300 per victim.

https://www.aol.co.uk/news/one-three-businesses-faced-cyber-105751822.html

• Why Your Anti-Fraud, Identity & Cyber Security Efforts Should Be Merged

Across early-stage startups and mature public companies alike, organisations are increasingly moving to a convergence of fraud prevention, identity and access management (IdAM), and cyber security. To improve an organisation's overall security posture, business, IT, and fraud leaders must realise that their areas shouldn't be treated as separate line items. Ultimately, these three disciplines serve the same purpose — protecting the business — and they must converge. This is a simple statement, but complex in practice, due mainly to the array of people, strategies, and tooling that today's organisations have built.

The convergence of these three functions comes at a seminal moment, as global threats are heightened due to several factors: geopolitical tensions like the war on Ukraine, the economic downturn, and a never-ending barrage of sophisticated attacks on businesses and consumers. At the same time, companies are facing slowing revenues, rising inflation, and increased pressure from investors, causing layoffs and budget reductions in the name of optimisation. Cutting back in the wrong areas, however, increases risk.

https://www.darkreading.com/vulnerabilities-threats/why-your-anti-fraud-identity-cybersecurity-efforts-should-be-merged

• Tight Budgets and Burnout Push Enterprises to Outsource Cyber Security

With cyber security teams struggling to manage the remediation process and monitor for vulnerabilities, organisations are at a higher risk for security breaches, according to cyber security penetration test provider Cobalt. As enterprises prioritise efficiencies, security leaders increasingly turn to third-party vendors to alleviate the pressures of consistent testing and to fill in talent gaps.

Cobalt’s recent report found:

• Budget cuts and layoffs plague security teams: 63% of US cyber security professionals had their department’s budget cut in 2023.

• Cyber security professionals deprioritise responsibilities to stay afloat: 79% of US cyber security professionals admit to deprioritising responsibilities leading to a backlog of unaddressed vulnerabilities.

• Inaccurate security configurations cause vulnerabilities: 40% of US respondents found the most security vulnerabilities were related to server security misconfigurations.

https://www.helpnetsecurity.com/2023/04/19/cybersecurity-professionals-responsibilities/

• Complex 8 Character Passwords Can Be Cracked in as Little as 5 Minutes

Recently, security vendor Hive released their findings on the time it takes to brute force a password in 2023. This year’s study included the emergence of AI tools. The vendor found that a complex 8 character password could be cracked in as little as 5 minutes. This number rose to 226 years when 12 characters were used and 1 million years when 14 characters were used. A complex password involves the use of numbers, upper and lower case letters and symbols.

Last year, the study found the same 8 and 12 character passwords would have taken 39 minutes and 3,000 years, showing the significant drop in the time it takes to brute force a password. The study highlights the importance for organisations to be aware of their password security and the need for consistent review and updates to the policy.

https://www.hivesystems.io/blog/are-your-passwords-in-the-green

• 83% of Organisations Paid Up in Ransomware Attacks

A report this week found that 83% of victim organisations paid a ransom at least once. The report found that while entities like the FBI and CISA argue against paying ransoms, many organisations decide to eat the upfront cost of paying a ransom, costing an average of $925,162, rather than enduring the further operational disruption and data loss.

Organisations are giving ransomware attackers leverage over their data by failing to address vulnerabilities created by unpatched software, unmanaged devices and shadow IT. For instance, 77% of IT decision makers argue that outdated cyber security practices have contributed to at least half of security incidents. Over time, these unaddressed vulnerabilities multiply, giving threat actors more potential entry points to exploit and greater leverage to force companies into paying up.

https://venturebeat.com/security/83-of-organizations-paid-up-in-ransomware-attacks/

• Security is a Revenue Booster, Not a Cost Centre

Security has historically been seen as a cost centre, which has led to it being given as little money as possible. Many CISOs, CSOs, and CROs fed into that image by primarily talking in terms of disaster avoidance, such as data breaches hurting the enterprise and ransomware potentially shutting it down. But what if security presented itself instead as a way to boost revenue and increase market share? That could easily shift those financial discussions into something much more comfortable.

For example, Apple touted its investments into the secure enclave to claim that it offers users better privacy. Specifically, the company argued that it couldn't reveal information to federal authorities because the enclave was just that secure. Apple turned that into a powerful competitive argument against rival Android creator Google, which makes much of its revenue by monetising users' data.

In another scenario, bank regulations require financial institutions to reimburse customers who are victimised by fraudsters, but they carve out an exception for wire fraud. Imagine if a bank realises that covering all fraud — even though it is not required to do so — could be a powerful differentiator that would boost its market share by supporting customers better than competitors do.

https://www.darkreading.com/edge-articles/security-is-a-revenue-booster-not-a-cost-center

• Ex-CEO Gets Prison Sentence for Bad Security

A clinic was recently subject to a cyber attack and even though the clinic was itself the victim, the ex-CEO of the clinic faced criminal charges, too. It would appear that the CEO was aware of the clinic’s failure to employ data security precautions and was aware of this for up to two years before the attack took place.

Worse still, the CEO allegedly knew about the problems because the clinic suffered breaches in 2018 and 2019, and failed to report them; presumably hoping that no traceable cyber crimes would arise as a result, and thus that the company would never get caught out. However, modern breach disclosure and data protection regulations, such as GDPR in Europe, make it clear that data breaches can’t simply be “swept under the carpet” any more, and must be promptly disclosed for the greater good of all.

The former CEO has now been convicted and given a prison sentence, reminding business leaders that merely promising to look after other people’s personal data is not enough. Paying lip service alone to cyber security is insufficient, to the point that you can end up being treated as both a cyber crime victim and a perpetrator at the same time.

https://nakedsecurity.sophos.com/2023/04/18/ex-ceo-of-breached-pyschotherapy-clinic-gets-prison-sentence-for-bad-data-security/

• Warning From UK Cyber Agency for a New ‘Class’ of Russian Hackers

There is a new ‘class’ of Russian hackers, the UK cyber-agency NCSC warns. Due to an increased danger of attacks by state-aligned Russian hackers, the NCSC is encouraging all businesses to put the recommended protection measures into place. The NCSC alert states, “during the past 18 months, a new kind of Russian hacker has developed.” These state-aligned organisations frequently support Russia’s incursion and are driven more by ideology than money. These hacktivist organisations typically concentrate their harmful online activity on launching DDoS (distributed denial of service) assaults against vital infrastructure, including airports, the legislature, and official websites. The NCSC has released a special guide with a list of steps businesses should take when facing serious cyber threats. System patching, access control confirmation, functional defences, logging, and monitoring, reviewing backups, incident plans, and third-party access management are important steps.

https://informationsecuritybuzz.com/warning-uk-cyberagency-russian-hackers/

• KnowBe4 Q1 Phishing Report Reveals IT and Online Services Emails Drive Dangerous Attack Trend

KnowBe4 announced the results of its Q1 2023 top-clicked phishing report, and the results included the top email subjects clicked on in phishing tests.

The report found that phishing tactics are changing with the increasing trend of cyber criminals using email subjects related to IT and online services such as password change requirements, Zoom meeting invitations, security alerts and more. These are effective because they would impact an end users’ daily workday and subsequent tasks to be completed.

71% of the most effective phishing lures related to HR (including leave, dress code, expenses, pay and performance) or tax, and these types of emails continue to be very effective.

Emails that are disguised as coming from an internal source such as the IT department or HR are especially dangerous because they appear to come from a more trusted, familiar place where an employee would not necessarily question it or be as sceptical. Building up an organisation’s human firewall by fostering a strong security culture is essential to outsmart bad actors.

https://www.itsecurityguru.org/2023/04/19/knowbe4-q1-phishing-report-reveals-it-and-online-services-emails-drive-dangerous-attack-trend/

• Outsourcing Group Capita Admits Customer Data May Have Been Breached During Cyber Attack

Capita, which runs crucial services for the UK NHS, Government, Military and Financial Services, has for the first time admitted that hackers accessed potential customer, staff and supplier data during a cyber attack last month. The company said its investigation into the attack – which caused major IT outages for clients – found that hackers infiltrated its systems around 22 March, meaning they had around nine days before Capita “interrupted” the breach on 31 March.

While Capita has admitted that data was breached during the incident, it raises the possibility that public sector information was accessed by hackers. Capita, which employs more than 50,000 people in Britain, is one of the government’s most important suppliers and holds £6.5bn-worth of public sector contracts. Capita stopped short of disclosing how many customers were potentially affected by the breach, and is still notifying anyone whose data might be at risk.

https://www.theguardian.com/business/2023/apr/20/capita-admits-customer-data-may-have-been-breached-during-cyber-attack

• Outdated Cyber Security Practices Leave Door Open for Criminals

A recent report found that as organisations increasingly find themselves under attack, they are drowning in cyber security debt – unaddressed security vulnerabilities like unpatched software, unmanaged devices, shadow IT, and insecure network protocols that act as access points for bad actors. The report found a worrying 98% of respondents are running one or more insecure network protocols and 47% had critical devices exposed to the internet. Despite these concerning figures, fewer than one-third said they have immediate plans to address any of the outdated security practices that put their organisations at risk.

https://www.helpnetsecurity.com/2023/04/20/outdated-cybersecurity-practices/

• Quantifying Cyber Risk Vital for Business Survival

Organisations are starting to wake up to the fact that the impact of ransomware and other cyber attacks cause long term issues. The financial implications are far reaching and creating barriers for companies to continue operations after these attacks. As such, quantifying cyber risk is business-specific, and organisations must assess what type of loss they may face, which includes revenue, remediation, legal settlement, or otherwise.

https://www.helpnetsecurity.com/2023/04/19/cyber-attacks-financial-impact/

• Recycled Network Devices Exposing Corporate Secrets

Over half of corporate network devices sold second-hand still contain sensitive company data, according to a new study. The study involved the purchase of recycled routers, finding that 56% contained one or more credentials as well as enough information to identify the previous owner.

Some of the analysed data included customer data, credentials, connection details for applications and authentication keys. In some cases, the data allowed for the location of remote offices and operators, which could be used in subsequent exploitation efforts.

In a number of cases the researchers were able to determine with high confidence — based on the data still present on the devices — who their previous owner was. The list included a multinational tech company and a telecoms firm, both with more than 10,000 employees and over $1 billion in revenue.

The study informed organisations who had owned the routers. Unfortunately, when contacted, some of the organisations failed to respond or acknowledge the findings.

https://www.infosecurity-magazine.com/news/recycled-network-exposing/

---

Threats

Ransomware, Extortion and Destructive Attacks

• 83% of organisations paid up in ransomware attacks  | VentureBeat

• March 2023 broke ransomware attack records with 459 incidents (bleepingcomputer.com)

• Hackers start abusing Action1 RMM in ransomware attacks (bleepingcomputer.com)

• Vice Society ransomware uses new PowerShell data theft tool in attacks (bleepingcomputer.com)

• RTM Locker: Emerging Cyber crime Group Targeting Businesses with Ransomware (thehackernews.com)

• Western Digital Hackers Demand 8-Figure Ransom Payment for Data (darkreading.com)

• UK Education Sector Suffered Most from Ransomware in 2022 - Infosecurity Magazine (infosecurity-magazine.com)

• NCR was the victim of BlackCat/ALPHV ransomware gang - Security Affairs

• Darktrace Denies Getting Hacked After Ransomware Group Names Company on Leak Site - SecurityWeek

• LockBit ransomware encryptors found targeting Mac devices (bleepingcomputer.com)

• Abuse victims' data stolen in ransomware attack (rte.ie)

• Hackers publish sensitive employee data stolen during CommScope ransomware attack | TechCrunch

• Vice Society is using custom PowerShell tool for data exfiltrationSecurity Affairs

• Black Basta claims it's selling off stolen Capita data • The Register

• An Analysis of the BabLock Ransomware (trendmicro.com)

• Ransomware reinfection and its impact on businesses - Help Net Security

• Microsoft SQL servers hacked to deploy Trigona ransomware (bleepingcomputer.com)

• Play ransomware gang uses custom Shadow Volume Copy data-theft tool (bleepingcomputer.com)

• Ransomware gangs abuse Process Explorer driver to kill security software (bleepingcomputer.com)

• Medusa ransomware crew boasts of Microsoft code leak • The Register

• New Ransomware Attack Hits Health Insurer Point32Health (informationsecuritybuzz.com)

Phishing & Email Based Attacks

• Phishing Attacks Surge as Threat Actors Leverage New AI Tools - Infosecurity Magazine (infosecurity-magazine.com)

• New Qbot campaign delivers malware by hijacking business emails | CSO Online

• KnowBe4 Q1 Phishing Report reveals IT and online services emails drive dangerous attack trend - IT Security Guru

• AI tools like ChatGPT expected to fuel BEC attacks - Help Net Security

• Marketing biz sent 107M spam emails in a year, says watchdog • The Register

• Phishing FAQ: How to Spot Scams and Stop Them in Their Tracks - CNET

• UK government employees receive average of 2,246 malicious emails per year - IT Security Guru

BEC – Business Email Compromise

• Crypto phishing attacks up by 40% in one year: Kaspersky (cointelegraph.com)

• AI tools like ChatGPT expected to fuel BEC attacks - Help Net Security

• US charges three men with six million dollar business email compromise plot | Tripwire

2FA/MFA

• How to Prevent 2 Common Attacks on MFA (darkreading.com)

Malware

• Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor (securityintelligence.com)

• New Chameleon banking trojan is stealing account info — what you need to know | Tom's Guide (tomsguide.com)

• US, UK warn of govt hackers using custom malware on Cisco routers (bleepingcomputer.com)

• New QBot campaign delivered hijacking business correspondenceSecurity Affairs

• Hard-to-detect malware loader distributed via AI-generated YouTube videos | CSO Online

• Hackers Storing Malware in Google Drive as Encrypted ZIP Files (gbhackers.com)

• Raspberry Robin Adopts Unique Evasion Techniques - Infosecurity Magazine (infosecurity-magazine.com)

• MacStealer - newly-discovered malware steals passwords and exfiltrates data from infected Macs • Graham Cluley

• 'AuKill' Malware Hunts & Kills EDR Processes (darkreading.com)

• What Are Computer Worms And How To Prevent Them (informationsecuritybuzz.com)

Mobile

• Android malware infiltrates 60 Google Play apps with 100M installs (bleepingcomputer.com)

• CISA warns of Android bug exploited by Chinese app to spy on users (bleepingcomputer.com)

• Crooks’ Mistaken Bet on Encrypted Phones | The New Yorker

• NSO Group is Back in Business With 3 New iOS Zero-Click Exploits (darkreading.com)

• Conversational Attacks Fastest Growing Mobile Threat - Infosecurity Magazine (infosecurity-magazine.com)

• Global Spyware Attacks Spotted Against Both New & Old iPhones (darkreading.com)

Botnets

• 'Zaraza' Bot Targets Google Chrome to Extract Login Credentials (darkreading.com)

Internet of Things – IoT

• Military helicopter crash blamed on missing software patch • The Register

• Why xIoT Devices Are Cyberattackers' Gateway Drug for Lateral Movement (darkreading.com)

• Hikvision: Chinese surveillance tech giant denies leaked Pentagon spy claim - BBC News

• The Car Thieves Using Tech Disguised Inside Old Nokia Phones and Bluetooth Speakers (vice.com)

• Popular Fitness Apps Leak Location Data Even When Users Set Privacy Zones (darkreading.com)

• Five Eye nations release new guidance on smart city cyber security | CSO Online

Data Breaches/Leaks

• Ex-CEO of breached psychotherapy clinic gets prison sentence for bad data security – Naked Security (sophos.com)

• Kodi Confirms Data Breach: 400K User Records and Private Messages Stolen (thehackernews.com)

• Volvo retailer leaks sensitive files - Security Affairs

• Rheinmetall suffers cyber attack, military business unaffected, spokesperson says | Reuters

• Jack Teixeira's charges in full: 'Top secret' access, leak searches and the Espionage Act - BBC News

• Online Gaming Chats Have Long Been Spy Risk for US Military - SecurityWeek

• Cyber attack on Insurance Information Bureau of India; data at risk - The Economic Times (indiatimes.com)

• Air Force Unit in Document Leaks Case Loses Intel Mission - SecurityWeek

Organised Crime & Criminal Actors

• Inside look at cyber criminal organisations: Why size matters | SC Media (scmagazine.com)

• Crooks’ Mistaken Bet on Encrypted Phones | The New Yorker

• Standardized data collection methods can help fight cyber crime | TechTarget

• Why Cyber criminals Love The Rust Programming Language (informationsecuritybuzz.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Crypto phishing attacks up by 40% in one year: Kaspersky (cointelegraph.com)

• On the hunt for the businessmen behind a billion-dollar scam - BBC News

• Hundred Finance loses $7 million in Optimism hack (cointelegraph.com)

Insider Risk and Insider Threats

• Human-Centered Approach Can Reduce Cyber security Failures, Gartner Predicts - MSSP Alert

• HR Magazine - UK government plans to make businesses liable for employee fraud

• Top risks and best practices for securely offboarding employees | CSO Online

• Critical Infrastructure Firms Concerned Over Insider Threat - Infosecurity Magazine (infosecurity-magazine.com)

• How to Strengthen your Insider Threat Security - IT Security Guru

Fraud, Scams & Financial Crime

• Pre-pandemic techniques are fueling record fraud rates - Help Net Security

• HR Magazine - UK government plans to make businesses liable for employee fraud

• Why Your Anti-Fraud, Identity & Cyber security Efforts Should Be Merged (darkreading.com)

• Police disrupts $98M online fraud ring with 33,000 victims (bleepingcomputer.com)

• Trial and error in Kuwait | CyberScoop

• US extradites Nigerian charged in $6m email fraud scam • The Register

• Crypto phishing attacks up by 40% in one year: Kaspersky (cointelegraph.com)

• Three charged over banking fraud for hire website | Computer Weekly

• On the hunt for the businessmen behind a billion-dollar scam - BBC News

• Hundred Finance loses $7 million in Optimism hack (cointelegraph.com)

• Dennis Kozlowski and the Infamous $6,000 Shower Curtain | Entrepreneur

• FTC orders payments firm to pay $650k over tech support scam • The Register

• Conversational Attacks Fastest Growing Mobile Threat - Infosecurity Magazine (infosecurity-magazine.com)

• Fraudsters impersonating genuine providers cost £177.6m in 2022, UK Finance data suggests | Business News | Sky News

• Scammers using social media to dupe people into becoming money mules - Help Net Security

AML/CFT/Sanctions

• Police Crack Comms to Bust Money Laundering Group - Infosecurity Magazine (infosecurity-magazine.com)

Insurance

• Bank of America warns Lloyd’s over state-backed cyber attack exclusion | Financial Times (ft.com)

• Cyber insurance Backstop: Can the Industry Survive Without One? - SecurityWeek

• Cyber insurer launches InsurSec solution to help SMBs improve security, risk management | CSO Online

Dark Web

• Stolen ChatGPT premium accounts up for sale on the dark web | CSO Online

• How 'Operation Cookie Monster' took down a major dark web market | World Economic Forum (weforum.org)

Supply Chain and Third Parties

• Capita PLC falls on reports cyber attack was worse than admitted (proactiveinvestors.co.uk)

• 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible | Mandiant

• Capita admits customer, supplier or colleague data may have been accessed by hackers | Business News | Sky News

• Lazarus APT group employed Linux Malware in recent attacks-Security Affairs

• Hackers start abusing Action1 RMM in ransomware attacks (bleepingcomputer.com)

Software Supply Chain

• CISA Introduces Secure-by-design and Secure-by-default Development Principles – Security Week

Cloud/SaaS

• Cloud Security Alerts Take Six Days to Resolve - Infosecurity Magazine (infosecurity-magazine.com)

• Linux kernel logic allowed Spectre attack on major cloud • The Register

• Western Digital Hackers Demand 8-Figure Ransom Payment for Data (darkreading.com)

• Is there really a march from the public cloud back on-prem? | TechCrunch

• Uncovering (and Understanding) the Hidden Risks of SaaS Apps (thehackernews.com)

• Hackers Storing Malware in Google Drive as Encrypted ZIP Files (gbhackers.com)

• Microsoft 365 outage blocks access to web apps and services (bleepingcomputer.com)

• Experts disclosed 2 critical flaws in Alibaba cloud database services Security Affairs

Attack Surface Management

• Recycled Core Routers Expose Sensitive Corporate Network Info (darkreading.com)

Shadow IT

• The staying power of shadow IT, and how to combat risks related to it - Help Net Security

Identity and Access Management

• Why Your Anti-Fraud, Identity & Cyber security Efforts Should Be Merged (darkreading.com)

• The Attacks that can Target your Windows Active Directory (bleepingcomputer.com)

• The biggest data security blind spot: Authorization - Help Net Security

Encryption

• Crime agencies condemn Facebook and Instagram encryption plans | Meta | The Guardian

• Crooks’ Mistaken Bet on Encrypted Phones | The New Yorker

API

• Triple-digit Increase in API and App Attacks on Tech and Retail - Infosecurity Magazine (infosecurity-magazine.com)

• There's Been a 400% Increase in Unique API Attackers - The New Stack

Open Source

• Linux kernel logic allowed Spectre attack on major cloud • The Register

• Security beyond software: The open source hardware security evolution - Help Net Security

• Report: Most IT Teams Can't Fix Open Source Software Security - DevOps.com

Passwords, Credential Stuffing & Brute Force Attacks

• How Long It Would Take A Hacker To Brute Force Your Password In 2023, Ranked | Digg

Social Media

• LinkedIn deploys new secure identity verification for all members | SC Media (scmagazine.com)

• Hard-to-detect malware loader distributed via AI-generated YouTube videos | CSO Online

• Crime agencies condemn Facebook and Instagram encryption plans | Meta | The Guardian

• Scammers using social media to dupe people into becoming money mules - Help Net Security

Regulations, Fines and Legislation

• Human rights groups raise alarm over UN Cyber crime Treaty • The Register

• EU privacy regulators to create task force to investigate ChatGPT | Computerworld

• What Business Needs to Know About the New U.S. Cybersecurity Strategy (hbr.org)

• Marketing biz sent 107M spam emails in a year, says watchdog • The Register

• As Consumer Privacy Evolves, Here's How You Can Stay Ahead of Regulations (darkreading.com)

• Brit cops rapped over app that recorded 200k phone calls • The Register

• Three Effective Ways For Boards To Prepare For Imminent SEC Cyber Rules (forbes.com)

• US imposes $300m penalty over hard disk drive exports to Huawei - BBC News

Governance, Risk and Compliance

• Security Is a Revenue Booster, Not a Cost Centre (darkreading.com)

• Tight budgets and burnout push enterprises to outsource cyber security - Help Net Security

• Ex-CEO of breached psychotherapy clinic gets prison sentence for bad data security – Naked Security (sophos.com)

• 'One in three firms faced cyber attacks last year' (aol.co.uk)

• Skills shortage puts Europe’s cyber resilience to the test – EURACTIV.com

• Quantifying cyber risk vital for business survival - Help Net Security

• Wargaming an effective data breach playbook - Help Net Security

• Outdated cyber security practices leave door open for criminals - Help Net Security

• CISOs struggling to protect sensitive data records - Help Net Security

• Why Your Anti-Fraud, Identity & Cyber security Efforts Should Be Merged (darkreading.com)

• Gartner Top Strategic Cyber security Trends 2023

• 3 Flaws, 1 War Dominated Cyber-Threat Landscape in 2022 (darkreading.com)

• Lack of Breach Info on Notices Surges in Q1 - Infosecurity Magazine (infosecurity-magazine.com)

• Ex-CIO must pay £81k over Total Shambles Bank migration • The Register

• Economic uncertainty drives upskilling as a key strategy for organisations - Help Net Security

• Top risks and best practices for securely offboarding employees | CSO Online

• How companies are struggling to build and run effective cyber security programs - Help Net Security

• Three Effective Ways For Boards To Prepare For Imminent SEC Cyber Rules (forbes.com)

• Small Business Interest in Cyber-Hygiene Wanes - Infosecurity Magazine (infosecurity-magazine.com)

Secure Disposal

• Recycled Network Devices Exposing Corporate Secrets - Infosecurity Magazine (infosecurity-magazine.com)

• Enterprises Exposed to Hacker Attacks Due to Failure to Wipe Discarded Routers - SecurityWeek

Backup and Recovery

• CISOs struggling to protect sensitive data records - Help Net Security

Data Protection

• Government reprimanded for serious breaches of data protection law - Jersey Evening Post

• Marketing biz sent 107M spam emails in a year, says watchdog • The Register

• Brit cops rapped over app that recorded 200k phone calls • The Register

• ChatGPT's Data Protection Blind Spots and How Security Teams Can Solve Them (thehackernews.com)

Careers, Working in Cyber and Information Security

• Skills shortage puts Europe’s cyber resilience to the test – EURACTIV.com

Law Enforcement Action and Take Downs

• Ex-CEO of hacked therapy clinic sentenced for failing to protect patients' session notes (bitdefender.com)

• Police disrupts $98M online fraud ring with 33,000 victims (bleepingcomputer.com)

• US extradites Nigerian charged in $6m email fraud scam • The Register

• How 'Operation Cookie Monster' took down a major dark web market | World Economic Forum (weforum.org)

• Three charged over banking fraud for hire website | Computer Weekly

• Police Crack Comms to Bust Money Laundering Group - Infosecurity Magazine (infosecurity-magazine.com)

• US citizens charged with pushing pro-Kremlin disinformation • The Register

Privacy, Surveillance and Mass Monitoring

• Human rights groups raise alarm over UN Cyber crime Treaty • The Register

• What the Recent Collapse of SVB Means for Privacy (darkreading.com)

• As Consumer Privacy Evolves, Here's How You Can Stay Ahead of Regulations (darkreading.com)

• Popular Fitness Apps Leak Location Data Even When Users Set Privacy Zones (darkreading.com)

Artificial Intelligence

• Phishing Attacks Surge as Threat Actors Leverage New AI Tools - Infosecurity Magazine (infosecurity-magazine.com)

• AI tools like ChatGPT expected to fuel BEC attacks - Help Net Security

• Stolen ChatGPT premium accounts up for sale on the dark web | CSO Online

• Pen testing amid the rise of AI-powered threat actors | TechTarget

• EU privacy regulators to create task force to investigate ChatGPT | Computerworld

• Cyber crims hop geofences, clamor for stolen ChatGPT accounts • The Register

• AI-created malware sends shockwaves through cybersecurity world | Fox News

• Hard-to-detect malware loader distributed via AI-generated YouTube videos | CSO Online

• Tech Insight: Dangers of Using Large Language Models Before They Are Baked (darkreading.com)

• ChatGPT-Related Malicious URLs on the Rise - Infosecurity Magazine (infosecurity-magazine.com)

• ChatGPT's Data Protection Blind Spots and How Security Teams Can Solve Them (thehackernews.com)

Misinformation, Disinformation and Propaganda

• US citizens charged with pushing pro-Kremlin disinformation • The Register

---

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• Russian hackers targeting UK more frequently (thetimes.co.uk)

• UK NCSC warns of new class of Russian cyber adversary threatening critical infrastructure | CSO Online

• Russian hackers want to ‘disrupt or destroy’ UK infrastructure, minister warns | Hacking | The Guardian

• CISA warns of Android bug exploited by Chinese app to spy on users (bleepingcomputer.com)

• Jack Teixeira's charges in full: 'Top secret' access, leak searches and the Espionage Act - BBC News

• Russian SolarWinds Culprits Launch Fresh Barrage of Espionage Cyberattacks (darkreading.com)

• Meet the hacker armies on Ukraine's cyber front line - BBC News

• Offensive cyber company QuaDream shutting down amidst spyware accusations | Ctech (calcalistech.com)

• Genius hackers help Russia’s neighbors thwart cyber incursions | Cybernews

• NSO Group is Back in Business With 3 New iOS Zero-Click Exploits (darkreading.com)

• UK, US sound the alarm on Russians exploiting Cisco flaws • The Register

• Microsoft: Iranian hackers behind retaliatory cyber attacks on US orgs (bleepingcomputer.com)

• US citizens charged with pushing pro-Kremlin disinformation • The Register

• Heightened threat of state-aligned groups against western... - NCSC.GOV.UK

• Microsoft shifts to a new threat actor naming taxonomy - Microsoft Security Blog

• How cyber support to Ukraine can build its democratic future | CyberScoop

• Google TAG Warns of Russian Hackers Conducting Phishing Attacks in Ukraine (thehackernews.com)

• Blind Eagle Cyber Espionage Group Strikes Again: New Attack Chain Uncovered (thehackernews.com)

• Britain sounds alarm on spyware, mercenary hacking market | Reuters

• Global Spyware Attacks Spotted Against Both New & Old iPhones (darkreading.com)

• The UK will need more than words in this cyber war | Financial Times (ft.com)

• Google: Ukraine targeted by 60% of Russian phishing attacks in 2023 (bleepingcomputer.com)

Nation State Actors

• BT holds China-Taiwan war game to stress test supply chains | Financial Times (ft.com)

• 3CX Supply Chain Attack Tied to Financial Trading App Breach (darkreading.com)

• UK security chief’s alert over threat from China (thetimes.co.uk)

• Russia accuses NATO of launching 5,000 cyberattacks since 2022 (bleepingcomputer.com)

• Human rights groups raise alarm over UN Cyber crime Treaty • The Register

• CISA warns of Android bug exploited by Chinese app to spy on users (bleepingcomputer.com)

• Google Uncovers APT41's Use of Open Source GC2 Tool to Target Media and Job Sites (thehackernews.com)

• APT41 Taps Google Red Teaming Tool in Targeted Info-Stealing Attacks (darkreading.com)

• China starts ‘surgical’ retaliation against foreign companies after US-led tech blockade | Financial Times

• Iranian-Russian cooperation on hack attacks may challenge Israeli cyber supremacy | The Times of Israel

• US charges 44 members of alleged Chinese troll army • The Register

• Hikvision: Chinese surveillance tech giant denies leaked Pentagon spy claim - BBC News

• Iranian Hackers Using SimpleHelp Remote Support Software for Persistent Access (thehackernews.com)

• Microsoft: Iranian hackers behind retaliatory cyber attacks on US orgs (bleepingcomputer.com)

• Heightened threat of state-aligned groups against western... - NCSC.GOV.UK

• Microsoft shifts to a new threat actor naming taxonomy - Microsoft Security Blog

• Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets - Microsoft Security Blog

• MuddyWater Uses SimpleHelp to Target Critical Infrastructure Firms - Infosecurity Magazine (infosecurity-magazine.com)

• Killnet Boss Exposes Rival Leader in Kremlin Hacktivist Beef (darkreading.com)

• Iranian Nation-State Actor "Mint Sandstorm" Weaponizes N-day Flaws - Infosecurity Magazine (infosecurity-magazine.com)

• Iranian Government-Backed Hackers Targeting U.S. Energy and Transit Systems (thehackernews.com)

• Lazarus Group Adds Linux Malware to Arsenal in Operation Dream Job (thehackernews.com)

• US imposes $300m penalty over hard disk drive exports to Huawei - BBC News

---

Vulnerability Management

• Military helicopter crash blamed on missing software patch • The Register

• Google Outlines Initiatives to Fortify Vulnerability Management - MSSP Alert

• Beyond CVEs: The Key to Mitigating High-Risk Security Exposures (darkreading.com)

Vulnerabilities

• UK, US sound the alarm on Russians exploiting Cisco flaws • The Register

• Thousands at risk from critical RCE bug in legacy MS service | Computer Weekly

• CISA: Patch Bug Exploited by Chinese E-commerce App - Infosecurity Magazine (infosecurity-magazine.com)

• Critical Flaws in vm2 JavaScript Library Can Lead to Remote Code Execution (thehackernews.com)

• Hackers actively exploit critical RCE bug in PaperCut servers (bleepingcomputer.com)

• Google patches another actively exploited Chrome zero-day (bleepingcomputer.com)

• Experts disclosed 2 critical flaws in Alibaba cloud database services - Security Affairs

• VMware Patches Pre-Auth Code Execution Flaw in Logging Product - SecurityWeek

• Cisco and VMware Release Security Updates to Patch Critical Flaws in their Products (thehackernews.com)

• Microsoft Defender update causes Windows Hardware Stack Protection mess (bleepingcomputer.com)

---

Tools and Controls

• CISA Asks Manufacturers to Prioritize Cybersecurity in Product Design - Infosecurity Magazine (infosecurity-magazine.com)

• Pen testing amid the rise of AI-powered threat actors | TechTarget

• 7 countries unite to push for secure-by-design development | CSO Online

• Wargaming an effective data breach playbook - Help Net Security

• Where There's No Code, There's No SDLC (darkreading.com)

• Cloud Security Alerts Take Six Days to Resolve - Infosecurity Magazine (infosecurity-magazine.com)

• DFIR via XDR: How to expedite your investigations with a DFIRent approach (thehackernews.com)

• Microsoft opens up Defender with file hash, URL search • The Register

• Beyond CVEs: The Key to Mitigating High-Risk Security Exposures (darkreading.com)

• How to build a cybersecurity deception program | TechTarget

• Enterprises Exposed to Hacker Attacks Due to Failure to Wipe Discarded Routers - SecurityWeek

• Threat Posed by 'Irresponsible' Use of Commercial Hacking Tools Increasing, NCSC Warns - Infosecurity Magazine (infosecurity-magazine.com)

• CISOs struggling to protect sensitive data records - Help Net Security

• Generative AI in SecOps and how to prepare | TechTarget

• AI defenders ready to foil AI-armed attackers • The Register

• Newer Authentication Tech a Priority for 2023 (darkreading.com)

---

Other News

• Recycled Network Devices Exposing Corporate Secrets - Infosecurity Magazine (infosecurity-magazine.com)

• Misconfiguration leaves thousands of servers vulnerable to attack, researchers find | CyberScoop

• Fortra shares findings on GoAnywhere MFT zero-day attacks (bleepingcomputer.com)

• How to defend against TCP port 445 and other SMB exploits | TechTarget

• Criminal Records Service still disrupted 4 weeks after hack - BBC News

• Attackers use abandoned WordPress plugin to backdoor websites (bleepingcomputer.com)

• Cyberspace Solarium Commission says space systems should be considered critical infrastructure | CyberScoop

• UK Strengthens Cyber security Audits for Government Agencies - Infosecurity Magazine (infosecurity-magazine.com)

• EU launches Cyber Solidarity Act to respond to large-scale attacks – EURACTIV.com

---

 Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 03 February 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• Business Leaders Need a Hands-on Approach to Stop Cyber Crime, Says Spy Chief

Business leaders must not see cyber crime as “just a technical issue” that can be left up to IT departments, said Lindy Cameron, chief executive of the National Cyber Security Centre (NCSC).  Ms Cameron later commented that “In the world of cyber security, the new year has brought with it some sadly familiar themes - a continuation of cyber incidents affecting organisations large and small as well as the British public”.

Along with this, came the urge for business leaders to step up their efforts in combating cyber crime by taking an active interest and educating themselves on the subject.  When commenting upon board members’ level of understanding, Ms Cameron said “I’d also encourage board members to develop a basic understanding of cyber security, which can help when seeking assurances from IT teams about the resilience of an organisation - in a similar way that leaders have a certain level of understanding of finance to assess financial health”.

https://www.telegraph.co.uk/news/2023/01/28/business-leaders-need-hands-on-approach-stop-cyber-crime-says/

• Rising ‘Firebrick Ostrich’ BEC Group Launches Industrial Scale Cyber Attacks

Business email compromise (BEC) has become one of the most popular methods of financially motivated hacking. And over the past year, one group in particular has demonstrated just how quick, easy, and lucrative it really is.

"Firebrick Ostrich" is a threat actor that's been performing BEC at a near-industrial scale. Since April 2021, the group has carried out more than 350 BEC campaigns, impersonating 151 organisations and utilising 212 malicious domains in the process. This volume of attacks is made possible by the group's wholesale gunslinging approach. Firebrick Ostrich doesn't discriminate much when it comes to targets, or gather exceptional intelligence in order to craft the perfect phishing bait. It throws darts at a wall because, evidently, when it comes to BEC at scale, that's enough.

BEC is attractive to bad actors due to the lower barriers to entry than malware, less risk, faster scaling opportunities, and way more profit potential to higher echelons than other methods of attack. These factors may explain why such attacks are absolutely the emerging trend, potentially even leaving even ransomware in the dust. There are literally hundreds, if not thousands, of these groups out there.

https://www.darkreading.com/remote-workforce/rising-firebrick-ostrich-bec-group-launches-industrial-scale-cyberattacks

• The Corporate World is Losing its Grip on Cyber Risk

Lloyd's of London’s insurance market prides itself on being able to put a price on anything, from Tina Turner’s legs or Bruce Springsteen’s vocal cords, to the risk that a bounty hunter might claim the reward from Cutty Sark Whisky in the 1970s for capturing the Loch Ness monster.

But from the end of March, there will be something it won’t price: systemic cyber risk, or the type of major, catastrophic disruption caused by state-backed cyber warfare. In one sense, this isn’t surprising. Insurance policies typically exclude acts of war. Russia’s NotPetya attack on Ukraine in 2017 showed how state-backed cyber assaults can surpass traditional definitions of armed conflict and overspill their sovereign target to hit global businesses. It caused an estimated $10bn in damages and years of wrangling between companies like pharma group Merck and snack maker Mondelez and their insurers.

But the move is prompting broader questions about the growing pains in this corner of the insurance world. “Cyber insurance isn’t working anywhere at the moment as a public good for society,” says Ciaran Martin, former head of the UK National Cyber Security Centre. “It has a huge role to play in improving defences in a market-based economy and it has been a huge disappointment in that sense so far.”

The Lloyd’s move is designed, say insurers, to clarify rather than restrict coverage. Whether it succeeds is another matter: this is a murky world, where cyber crime groups operate with impunity in certain jurisdictions.

https://www.ft.com/content/78bfdf29-1e20-4c12-a348-06e98d5ae906

• Microsoft Reveals Over 100 Threat Actors are Deploying Ransomware in Attacks

Microsoft revealed this week that its security teams are tracking over 100 threat actors deploying ransomware during attacks. In all, the company says it monitors over 50 unique ransomware families, with some of the most prominent ransomware payloads in recent campaigns including Lockbit, BlackCat (aka ALPHV), Play, Vice Society, Black Basta, and Royal.

Microsoft said that defence strategies should focus less on payloads themselves but more on the chain of activities that lead to their deployment, since ransomware gangs are still targeting servers and devices not yet patched against common or recently addressed vulnerabilities.

Furthermore, while new ransomware families launch all the time, most threat actors utilise the same tactics when breaching and spreading through networks, making the effort of detecting such behaviour even more helpful in thwarting their attacks.

Attackers are increasingly relying on tactics beyond phishing to conduct their attacks, with threat actors for example capitalising on recently patched Exchange Server vulnerabilities to hack vulnerable servers and deploy Cuba and Play ransomware.

https://www.bleepingcomputer.com/news/security/microsoft-over-100-threat-actors-deploy-ransomware-in-attacks/

• Ransomware Conversations: Why the CFO is Pivotal to Discussing and Preparing for Risk

With the amount of cyber attacks in all industries, organisations are beginning to grasp the significance of cyber risk and how it is integral to protecting and maintaining an efficient business. In fact, the first half of 2022 alone saw 236.1 million cases of ransomware.

Whilst the expectation for responsibility has typically fallen on Chief Information Security Officers (CISOs), Chief Financial Officers (CFOs) are just as vital in managing cyber risk, which is now inherently also business risk.  The CFO plays an important part in determining whether cyber security incidents will become material and affect the business more seriously. Their insight is critical across many areas which include ransomware, cyber insurance, regulatory compliance and budget management.

https://www.itsecurityguru.org/2023/02/02/ransomware-conversations-why-the-cfo-is-pivotal-to-discussing-and-preparing-for-risk

• Greater Incident Complexity, a Shift in How Threat Actors Use Stolen Data Will Drive the Cyber Threat Landscape in 2023

Insurance provider Beazley released their Cyber Services Snapshot Report which claims the cyber security landscape will be influenced by greater complexity and the way threat actors use stolen data. The report also found that as a category, fraudulent instruction experienced a growth as a cause of loss in 2022, up 13% year-over year. 

In response to vulnerabilities such as fraudulent instructions, the report suggests organisations must get smarter about educating users to spot things such as spoofed emails or domain names. The report also cautions organisations to watch for social engineering, spear phishing, bypassing of multi-factor authentication (MFA), targeting of managed service providers (MSP) and the compromise of cloud environments as areas of vulnerability.

https://www.darkreading.com/attacks-breaches/greater-incident-complexity-a-shift-in-the-way-threat-actors-use-stolen-data-and-a-rise-in-us-class-actions-will-drive-the-cyber-threat-landscape-in-2023-according-to-beazley-report

• The Threat from Within: 71% of Business Leaders Surveyed Think Next Cyber Security Breach Will Come from the Inside

A survey conducted by IT provider EisnerAmper found that 71% of business executives worry about accidental internal staff error as one of the top threats facing their organisation and 23% of these worried about malicious intent by an employee. In comparison, 75% of business executives had concerns about external hackers. The survey also asked about current safety measures, with 51% responding that they were “somewhat prepared”. Despite this, only 50% of respondents reported conducting regular cyber security training. 

https://www.darkreading.com/vulnerabilities-threats/the-threat-from-within-71-of-business-leaders-surveyed-think-next-cybersecurity-breach-will-come-from-the-inside

• 98% of Organisations Have a Supply Chain Relationship That Has Been Breached

A report from SecurityScorecard found that 98% of organisations have a relationship with at least one third party that has experienced a breach in the last two years, while more than 50% have an indirect relationship with more than 200 fourth parties that have been breached. Of course, this is keeping in mind that not all organisations disclose or even know they have been breached.

https://www.securityweek.com/98-of-firms-have-a-supply-chain-relationship-that-has-been-breached-analysis/

• New Survey Reveals 40% of Companies Experienced a Data Leak in the Past Year

Software provider SysKit has published a report on the effects of digital transformation on IT administrators and the current governance landscape. The report found that 40% of organisations experienced a data leak in the previous year. A data leak can have severe consequences on an organisation's efficiency and the impact can lead to large fines, downtime, and loss of business-critical certifications and customers.

In addition, the Survey found that the biggest challenge for IT administrators was a lack of understanding from superiors, huge workloads and misalignment of IT and business strategies.

https://www.darkreading.com/attacks-breaches/new-survey-reveals-40-of-companies-experienced-a-data-leak-in-the-past-year

• Russian Hackers Launch Cyber Attack on Germany in Leopard Tank Retaliation

The websites of key German administrations, including companies and airports, have been targeted by cyber attacks, the German Federal Office for Information Security (BSI) stated.

The BSI commented they had been informed of DDoS (distributed denial of service) attacks “currently in progress against targets in Germany". This was followed by the statement that “Individual targets in the financial sector” and federal government sites were also attacked, with some websites becoming temporarily unavailable.  It is believed that this is due to the approved deployment of Leopard 2 tanks to Ukraine, with Russian hacker site Killnet taking credit.

https://www.euronews.com/2023/01/26/russian-hackers-launch-cyberattack-on-germany-in-leopard-retaliation

• Financial Services Targeted in 28% of UK Cyber Attacks Last Year

Based on data from security provider Imperva, security researchers have identified that over a quarter (28%) of all cyber attacks in the UK hit the financial services and insurance (FSI) industry in the last 12 months. The data also found that Application Programme Interface (API) attacks, malicious automated software and distributed denial of service (DDoS) attacks were the most challenging for the industry. In addition, the data found that roughly 40% of all account takeover attempts were targeted at the FSI industry.

https://www.infosecurity-magazine.com/news/quarter-cyber-attacks-uk-financial/

• Phishing Attacks are Getting Scarily Sophisticated. Here’s What to Watch Out For

Hackers are going to great lengths, including mimicking real people and creating and updating fake social media profiles, to trick victims into clicking phishing links and handing over usernames and passwords. The National Cyber Security Centre (NCSC) warns that these phishing attacks are targeting a range of sectors.

The NCSC has also released mitigation advice to help organisations and individuals protect themselves online. The mitigation advice included the use of strong passwords, separate to other accounts; enabling multi-factor authentication (MFA); and applying the latest security updates.

https://www.zdnet.com/article/phishing-attacks-are-getting-scarily-sophisticated-heres-what-to-watch-out-for/

• City of London on High Alert After Ransomware Attack

A suspected ransomware attack on a key supplier of trading software to the City of London this week appears to have disrupted activity in the derivatives market. The company impacted, Ion Cleared Derivatives, is investigating. It is reported that 42 clients were impacted by the attack.

https://www.infosecurity-magazine.com/news/city-of-london-high-alert/

• JD Sports Warns of 10 Million Customers Put at Risk in Cyber Attack

Sportswear retailer JD Sports said it was the victim of a cyber attack that exposed the data of 10 million customers, in the latest spate of hacks on UK companies.

JD Sports explained that the attack involved unauthorised access to a system that contained “the name, billing address, delivery address, phone number, order details and the final four digits of payment cards”. The data related to customers’ orders made between November 2018 and October 2020, with outdoor gear companies Millets and Blacks also impacted. A full review with cyber security and external specialists is underway.

https://www.ft.com/content/afe00f2f-afcd-478f-9e4d-1cf9c943fa79

---

Threats

Ransomware, Extortion and Destructive Attacks

• City Of London Traders Hit By Russia-Linked Cyber Attack (informationsecuritybuzz.com)

• New Nevada Ransomware targets Windows and VMware ESXi systems (bleepingcomputer.com)

• City of London on High Alert After Ransomware Attack - Infosecurity Magazine (infosecurity-magazine.com)

• Ransomware conversations: Why the CFO is pivotal to discussing and preparing for risk - IT Security Guru

• US puts a $10m bounty on Hive while Russia shuts down access • The Register

• Copycat Criminals mimicking Lockbit gang in northern Europe security affairs

• Ransom-what? Learning from Hacked Hackers (secureworld.io)

• Most criminal cryptocurrency is funneled through just 5 exchanges | Ars Technica

• Council leader 'put her foot down' and refused to pay multi-million pound ransom demand from hackers - Teesside Live (gazettelive.co.uk)

• 6 Ransomware Trends & Evolutions For 2023 (trendmicro.com)

• Cyber Attack Hits Derivatives Unit of Trading Software Firm ION - Bloomberg

• Regulators weigh in on ION attack as LockBit takes credit • The Register

• New Mimic Ransomware Abuses Windows Search Engine (cyber securitynews.com)

• Stratford University discloses ransomware attack — but which ransomware attack? (databreaches.net)

• Schools don't pay, but ransomware attacks still increasing | TechTarget

• Poser Hackers Impersonate LockBit in SMB Cyber attacks (darkreading.com)

• Risk & Repeat: The FBI's Hive ransomware takedown | TechTarget

• Nevada Ransomware Has Released Upgraded Locker security affairs

• LockBit Green ransomware variant borrows code from Conti one security affairs

• Arnold Clark customer data stolen in attack claimed by Play ransomware (bleepingcomputer.com)

• Ransomware attacks on public sector persist in January | TechTarget

• Ransomware attack on data firm ION could take days to fix -sources | Reuters

• APT groups use ransomware TTPs as cover for intelligence gathering and sabotage | CSO Online

Phishing & Email Based Attacks

• Phishing attacks are getting scarily sophisticated. Here's what to watch out for | ZDNET

• BEC Group Uses Open Source Tactics in Hundreds of Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Rising ‘Firebrick Ostrich’ BEC Group Launches Industrial-Scale Cyber attacks (darkreading.com)

• Porsche halts NFT launch, phishing sites fill the void (bleepingcomputer.com)

• Phishers Trick Microsoft Into Granting Them 'Verified' Cloud Partner Status (darkreading.com)

• DocuSign Brand Impersonation Attack Bypasses Security Measures, Targets Over 10,000 - Infosecurity Magazine (infosecurity-magazine.com)

BEC – Business Email Compromise

• BEC Group Uses Open Source Tactics in Hundreds of Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Rising ‘Firebrick Ostrich’ BEC Group Launches Industrial-Scale Cyber attacks (darkreading.com)

Other Social Engineering; Smishing, Vishing, etc

• New 'Pig Butchering' Scam in West Africa Impersonates US Financial Advisors - Infosecurity Magazine (infosecurity-magazine.com)

• Long Con Impersonates Financial Advisers to Target Victims (darkreading.com)

2FA/MFA

• Facebook Bug Allows 2FA Bypass Via Instagram (darkreading.com)

Malware

• How Can Disrupting DNS Communications Thwart a Malware Attack? (darkreading.com)

• Hackers use new IceBreaker malware to breach gaming companies (bleepingcomputer.com)

• New Threat: Stealthy HeadCrab Malware Compromised Over 1,200 Redis Servers (thehackernews.com)

• PoS malware can block contactless payments to steal credit cards (bleepingcomputer.com)

• Experts Uncover the Identity of Mastermind Behind Golden Chickens Malware Service (thehackernews.com)

• New APT34 Malware Targets The Middle East (trendmicro.com)

• HeadCrab malware targets Redis to mine cryptocurrency | TechTarget

• Malvertising attacks are distributing .NET malware loaders • The Register

• Hackers weaponize Microsoft Visual Studio add-ins to push malware (bleepingcomputer.com)

Mobile

• Google Fi data breach let hackers carry out SIM swap attacks (bleepingcomputer.com)

• Over 1,800 Android phishing forms for sale on cyber crime market (bleepingcomputer.com)

• Mobile phone fraud: 'They stole £22,500 using my banking app' - BBC News

Botnets

• New Threat: Stealthy HeadCrab Malware Compromised Over 1,200 Redis Servers (thehackernews.com)

Denial of Service/DoS/DDOS

• Killnet Attackers DDoS US and Dutch Hospitals - Infosecurity Magazine (infosecurity-magazine.com)

• New DDoS-as-a-Service platform used in recent attacks on hospitals (bleepingcomputer.com)

Internet of Things – IoT

• IoT, connected devices biggest contributors to expanding application attack surface | CSO Online

• European IoT Manufacturers Lag in Vulnerability Disclosure (databreachtoday.co.uk)

• Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices (thehackernews.com)

• Anker finally comes clean about its Eufy security cameras - The Verge

Data Breaches/Leaks

• JD Sports warns data of 10mn customers put at risk in cyber attack | Financial Times (ft.com)

• New Survey Reveals 40% of Companies Experienced a Data Leak in the Past Year (darkreading.com)

• Planet Ice hacked! 240,000 skating fans' details stolen (bitdefender.com)

• If a locked filing cabinet is stolen along with its key, can you still say it’s locked? GoTo thinks you can • Graham Cluley

Organised Crime & Criminal Actors

• Cyber crime job ads on the dark web pay up to $20k per month (bleepingcomputer.com)

• Most criminal cryptocurrency is funneled through just 5 exchanges | Ars Technica

• How $6 Can Buy Hacked Social Media & Streaming Accounts From the Dark Web, Whizcase Study Reveals (darkreading.com)

• Cyber crime Ecosystem Spawns Lucrative Underground Gig Economy (darkreading.com)

• Cyber crime job ads on the dark web pay up to $20k per month (bleepingcomputer.com)

• Developers, Attackers Top List of Most In Demand Dark Web Jobs, Kaspersky Reports - MSSP Alert

• Report on hackers' salaries shows poor wages for developers • The Register

• 6 Examples of the Evolution of a Scam Site (darkreading.com)

• Cyber Insights 2023: Criminal Gangs - SecurityWeek

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• ‘Everything is fake’: how global crime gangs are using UK shell companies in multi-million pound crypto scams | Organised crime | The Guardian

• Most criminal cryptocurrency is funneled through just 5 exchanges | Ars Technica

• FBI: North Korea’s Lazarus Group behind $100m crypto attack • The Register

• Oxford student jailed for £2m crypto theft after PhD blunder | News | The Times

• Porsche halts NFT launch, phishing sites fill the void (bleepingcomputer.com)

• Crypto theft: North Korea-linked hackers stole $1.7b in 2022 - BBC News

• HeadCrab malware targets Redis to mine cryptocurrency | TechTarget

Insider Risk and Insider Threats

• Insider attacks becoming more frequent, more difficult to detect - Help Net Security

• The Threat from Within: 71% of Business Leaders Surveyed Think Next Cyber security Breach Will Come from the Inside (darkreading.com)

• Are Your Employees Thinking Critically About Their Online Behaviours? (darkreading.com)

• The next cyber threat may come from within - Help Net Security

• Insider threats: The cyber risks lurking in the dark (betanews.com)

• Executives Worry Equally About Insider Cyber Errors, Outsider Threats: How MSSPs Can Help - MSSP Alert

• Former Ubiquiti dev pleads guilty to data theft, extortion • The Register

Fraud, Scams & Financial Crime

• ‘Everything is fake’: how global crime gangs are using UK shell companies in multi-million pound crypto scams | Organised crime | The Guardian

• New 'Pig Butchering' Scam in West Africa Impersonates US Financial Advisors - Infosecurity Magazine (infosecurity-magazine.com)

• FBI: North Korea’s Lazarus Group behind $100m crypto attack • The Register

• Oxford student jailed for £2m crypto theft after PhD blunder | News | The Times

• Porsche halts NFT launch, phishing sites fill the void (bleepingcomputer.com)

• Russian Millionaire on Trial in Hack, Insider Trade Scheme - SecurityWeek

• 6 Examples of the Evolution of a Scam Site (darkreading.com)

• Mobile phone fraud: 'They stole £22,500 using my banking app' - BBC News

• Crypto theft: North Korea-linked hackers stole $1.7b in 2022 - BBC News

• Romance fraud losses rose 91% during the pandemic, claims UK's TSB bank | Tripwire

• Romance Fraudsters Have Stolen £65m From Brits Since 2020 (informationsecuritybuzz.com)

Impersonation Attacks

• DocuSign Brand Impersonation Attack Bypasses Security Measures, Targets Over 10,000 - Infosecurity Magazine (infosecurity-magazine.com)

• Why CISOs Should Care About Brand Impersonation Scam Sites (darkreading.com)

AML/CFT/Sanctions

• As the anti-money laundering perimeter expands, who needs to be compliant, and how? - Help Net Security

Insurance

• 4 Cyber Insurance Requirement Predictions for 2023 (trendmicro.com)

Dark Web

• There’s a Wild Scramble for Control of the Dark Web Taking Place in Russia (vice.com)

• How $6 Can Buy Hacked Social Media & Streaming Accounts From the Dark Web, Whizcase Study Reveals (darkreading.com)

• Cyber crime job ads on the dark web pay up to $20k per month (bleepingcomputer.com)

• Developers, Attackers Top List of Most In Demand Dark Web Jobs, Kaspersky Reports - MSSP Alert

• Report on hackers' salaries shows poor wages for developers • The Register

Supply Chain and Third Parties

• 98% of Firms Have a Supply Chain Relationship That Has Been Breached: Analysis - SecurityWeek

• Almost all Organisations are Working with Recently Breached Vendors - Infosecurity Magazine (infosecurity-magazine.com)

• 50% of organisations have indirect relationships with 200+ breached fourth-party vendors - Help Net Security

• Cyber attack Impact “Catastrophic” for Third Parties, New Study Finds MSSPs at Risk? - MSSP Alert

• New “MITRE ATT&CK-like” framework outlines software supply chain attack TTPs | CSO Online

• CISA to Open Supply Chain Risk Management Office (darkreading.com)

• Cyber Insights 2023 | Supply Chain Security - SecurityWeek

Cloud/SaaS

• Misconfiguration and vulnerabilities biggest risks in cloud security: Report | CSO Online

• Hybrid cloud storage security challenges - Help Net Security

• Short-staffed SOCs struggle to gain visibility into cloud activities - Help Net Security

Containers

• Researchers Claim High-Risk Vulnerabilities Found in 87% of All Container Images - Infosecurity Magazine (infosecurity-magazine.com)

Encryption

• Serious Security: The Samba logon bug caused by outdated crypto – Naked Security (sophos.com)

• Encryption Explained: At Rest, In Transit & End-To-End Encryption | Splunk

• Cyber Insights 2023 | Quantum Computing and the Coming Cryptopocalypse - SecurityWeek

API

• The emergence of trinity attacks on APIs - Help Net Security

• API management (APIM): What It Is and Where It’s Going security affairs

Open Source

• Microsoft upgrades Defender to lock down Linux devices • The Register

Passwords, Credential Stuffing & Brute Force Attacks

• Bitwarden Password Manager users are being targeted by phishing ads on Google- gHacks Tech News

• KeePass disputes vulnerability allowing stealthy password theft (bleepingcomputer.com)

Social Media

• Inside TikTok’s proposal to address US national security concerns | CyberScoop

• Facebook Bug Allows 2FA Bypass Via Instagram (darkreading.com)

Malvertising

• Malvertising attacks are distributing .NET malware loaders • The Register

Training, Education and Awareness

• Are Your Employees Thinking Critically About Their Online Behaviours? (darkreading.com)

Regulations, Fines and Legislation

• Regulators weigh in on ION attack as LockBit takes credit • The Register

• New UN cyber crime convention has a long way to go in a tight timeframe | CSO Online

Governance, Risk and Compliance

• Business leaders need hands-on approach to stop cyber crime, says spy chief (telegraph.co.uk)

• New Survey Reveals 40% of Companies Experienced a Data Leak in the Past Year (darkreading.com)

• Financial Services Targeted in 28% of UK Cyber-Attacks Last Year - Infosecurity Magazine (infosecurity-magazine.com)

• 70% of CIOs anticipate their involvement in cyber security to increase - Help Net Security

• Cyber security Budgets Are Going Up. So Why Aren't Breaches Going Down? (thehackernews.com)

• Ransomware conversations: Why the CFO is pivotal to discussing and preparing for risk - IT Security Guru

• You Don't Know Where Your Secrets Are (thehackernews.com)

• Inability to prevent bad things from happening seen as the worst part of a security job - Help Net Security

• The corporate world is losing its grip on cyber risk | Financial Times (ft.com)

• IT and Security Professionals Spend an Average of 4,300 Hours Annually Achieving or Maintaining Compliance (darkreading.com)

Careers, Working in Cyber and Information Security

• Inability to prevent bad things from happening seen as the worst part of a security job - Help Net Security

• Thriving Dark Web Trade in Fake Security Certifications - Infosecurity Magazine (infosecurity-magazine.com)

• The Effect of Cyber security Layoffs on Cyber security Recruitment - SecurityWeek

• Economic headwinds could deepen the cyber security skills shortage | CSO Online

Law Enforcement Action and Take Downs

• 7 Ways Hive Ransomware Gang Caused Chaos Before FBI Hacked It (gizmodo.com)

• US puts a $10m bounty on Hive while Russia shuts down access • The Register

• Hacker accused of having stolen personal data of all Austrians security affairs

• Alleged ShinyHunters gang member in US court • The Register

• Risk & Repeat: The FBI's Hive ransomware takedown | TechTarget

Privacy, Surveillance and Mass Monitoring

• On Data Privacy Day, Organisations Fail Data Privacy Expectations (darkreading.com)

• Hacker accused of having stolen personal data of all Austrians security affairs

• Enterprises Need to Do More to Assure Consumers About Privacy (darkreading.com)

Artificial Intelligence

• Foreign states already using ChatGPT maliciously, UK IT leaders believe | CSO Online

• OpenAI releases tool to detect AI-written text (bleepingcomputer.com)

• Reality check: Is ChatGPT really the next big cyber security threat? | CyberScoop

• Cyber Insights 2023: Artificial Intelligence - SecurityWeek

Misinformation, Disinformation and Propaganda

• Google deletes 50,000 pro-China fake-news vids and blogs • The Register

• Google: Influence Operator Dragonbridge Floods Social Media in Sprawling Cyber Campaign (darkreading.com)

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• Iranian APT Leaks Data From Saudi Arabia Government Under New Persona - SecurityWeek

• Ukraine Links Media Centre Attack to Russian Intelligence (govinfosecurity.com)

• Latvia confirms phishing attack on Ministry of Defence, linking it to Russian hacking group - The Record from Recorded Future News

• British Cyber Agency Warns of Russian and Iranian Hackers Targeting Key Industries (thehackernews.com)

• Russia-Linked APT29 Uses New Malware in Embassy Attacks - SecurityWeek

• Russia's Sandworm APT Launches Swarm of Wiper Attacks in Ukraine (darkreading.com)

• Russia-linked Hackers Launch DDoS Attacks on Germany and US. Hospitals, Threaten Canada - MSSP Alert

• Latvia says Russian hackers tried to phish its Ministry of Defence (bitdefender.com)

• Inside Killnet: Pro-Russia Hacktivist Group's Support and Influence Grows (darkreading.com)

• New APT34 Malware Targets The Middle East (trendmicro.com)

• Lazarus Group Attack Identified After Operational Security Fail - Infosecurity Magazine (infosecurity-magazine.com)

• Crypto theft: North Korea-linked hackers stole $1.7b in 2022 - BBC News

• North Korean hackers stole research data in two-month-long breach (bleepingcomputer.com)

• APT groups use ransomware TTPs as cover for intelligence gathering and sabotage | CSO Online

• Cyber Insights 2023: The Geopolitical Effect - SecurityWeek

---

Nation State Actors

Nation State Actors – Russia

• Russian Nuisance Hacking Group KillNet Targets Germany (govinfosecurity.com)

• Russian hackers launch cyber attack on Germany in Leopard retaliation | Euronews

• Ukraine Links Media Centre Attack to Russian Intelligence (govinfosecurity.com)

• Latvia confirms phishing attack on Ministry of Defence, linking it to Russian hacking group - The Record from Recorded Future News

• A Link to News Site Meduza Can (Technically) Land You in Russian Prison | WIRED

• British Cyber Agency Warns of Russian and Iranian Hackers Targeting Key Industries (thehackernews.com)

• Russia-Linked APT29 Uses New Malware in Embassy Attacks - SecurityWeek

• Russia's Sandworm APT Launches Swarm of Wiper Attacks in Ukraine (darkreading.com)

• Russia-linked Hackers Launch DDoS Attacks on Germany and US. Hospitals, Threaten Canada - MSSP Alert

• Latvia says Russian hackers tried to phish its Ministry of Defence (bitdefender.com)

• Killnet Attackers DDoS US and Dutch Hospitals - Infosecurity Magazine (infosecurity-magazine.com)

• IT Army of Ukraine gained access to 1.5GB archive from Gazprom security affairs

• There’s a Wild Scramble for Control of the Dark Web Taking Place in Russia (vice.com)

• Inside Killnet: Pro-Russia Hacktivist Group's Support and Influence Grows (darkreading.com)

Nation State Actors – China

• Google deletes 50,000 pro-China fake-news vids and blogs • The Register

• Google: Influence Operator Dragonbridge Floods Social Media in Sprawling Cyber Campaign (darkreading.com)

• TikTok CEO to testify before US. Congress over security concerns | Reuters

Nation State Actors – North Korea

• FBI: North Korea’s Lazarus Group behind $100m crypto attack • The Register

• Lazarus Group Attack Identified After Operational Security Fail - Infosecurity Magazine (infosecurity-magazine.com)

• Crypto theft: North Korea-linked hackers stole $1.7b in 2022 - BBC News

• North Korean hackers stole research data in two-month-long breach (bleepingcomputer.com)

Nation State Actors – Iran

• Iranian APT Leaks Data From Saudi Arabia Government Under New Persona - SecurityWeek

• British Cyber Agency Warns of Russian and Iranian Hackers Targeting Key Industries (thehackernews.com)

Nation State Actors – Misc

• Foreign states already using ChatGPT maliciously, UK IT leaders believe | CSO Online

• New APT34 Malware Targets The Middle East (trendmicro.com)

• APT groups use ransomware TTPs as cover for intelligence gathering and sabotage | CSO Online

---

Vulnerability Management

• The future of vulnerability management and patch compliance - Help Net Security

• What is the CVSS (Common Vulnerability Scoring System)? (techtarget.com)

Vulnerabilities

• Researchers to release VMware vRealize Log RCE exploit, patch now (bleepingcomputer.com)

• Patch management is crucial to protect Exchange servers, Microsoft warns security affairs

• Realtek Vulnerability Under Attack: Over 134 Million Attempts to Hack IoT Devices (thehackernews.com)

• QNAP Fixes Critical Vulnerability in NAS Devices with Latest Security Updates (thehackernews.com)

• Over 29,000 QNAP devices unpatched against new critical flaw (bleepingcomputer.com)

• Firmware Flaws Could Spell 'Lights Out' for Servers (darkreading.com)

• Why you might not be done with your January Microsoft security patches | CSO Online

• Researcher drops Lexmark RCE zero-day rather than sell vuln ‘for peanuts’ | The Daily Swig (portswigger.net)

• HPE, NetApp warn of critical open-source bug | SC Media (scmagazine.com)

• High-severity bug in F5 BIG-IP can lead to code execution and DoS security affairs

• Cisco fixes bug allowing backdoor persistence between reboots (bleepingcomputer.com)

• Atlassian's Jira Software Found Vulnerable to Critical Authentication Vulnerability (thehackernews.com)

• CISA Alert: Oracle E-Business Suite and SugarCRM Vulnerabilities Under Attack (thehackernews.com)

• Threat activity increasing around Fortinet VPN vulnerability | TechTarget

• Remote code execution exploit chain available for VMware vRealize Log Insight | CSO Online

Tools and Controls

• Gartner report shows zero trust isn’t a silver bullet | VentureBeat

Other News

• We can't rely on goodwill to protect our critical infrastructure - Help Net Security

• Playing Military Sim War Thunder May Get You Classed as a National Security Risk

• Cyber attacks in space: How safe are our satellites? | Metro News

• Threat Actors Use ClickFunnels to Bypass Security Services - Infosecurity Magazine (infosecurity-magazine.com)

• Massive Microsoft 365 outage caused by WAN router IP change (bleepingcomputer.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 20 January 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• Experts at Davos 2023 Call for a Global Response to the Gathering 'Cyber Storm'

As economic and geopolitical instability spills into the new year, experts predict that 2023 will be a consequential year for cyber security. The developments, they say, will include an expanded threat landscape and increasingly sophisticated cyber attacks.

"There's a gathering cyber storm," Sadie Creese, a Professor of Cyber Security at the University of Oxford, said during an interview at the World Economic Forum’s Annual Meeting 2023 in Davos, Switzerland. "This storm is brewing, and it's really hard to anticipate just how bad that will be."

Already, cyber attacks such as phishing, ransomware and distributed denial-of-service (DDoS) attacks are on the rise. Cloudflare, a major US cyber security firm that provides protection services for over 30% of Fortune 500 companies, found that DDoS attacks—which entail overwhelming a server with a flood of traffic to disrupt a network or webpage—increased last year by 79% year-over-year.

"There's been an enormous amount of insecurity around the world," Matthew Prince, the CEO of Cloudflare, stated during the Annual Meeting. "I think 2023 is going to be a busy year in terms of cyber attacks."

https://www.weforum.org/agenda/2023/01/cybersecurity-storm-2023-experts-davos23/

• Cost of Data Breaches to Global Businesses at Five-Year High

Research from business insurer Hiscox shows that the cost of dealing with cyber events for businesses has more than tripled since 2018. The study, which collated data from the organisation’s previous five annual Cyber Readiness reports, has revealed that:

• Since 2018 the median IT budgets for cyber security more than tripled.

• Between 2020 and 2022 cyber-attacks increased by over a quarter.

• Businesses are increasing their cyber security budgets year-on-year.

In the Hiscox 2022 Cyber Readiness report, the financial toll of cyber incidents, including data breaches, was estimated to be $16,950 (£15,265) on average. As the cost of cyber crime grew, so did organisations’ cyber security budgets – average spending on cyber security tripled from 2018 to 2022, rocketing from $1,470,196 (£1,323,973) to $5,235,162 (£4,714,482).

Hiscox has also revealed that half of all companies surveyed suffered at least one cyber attack in 2022, up 11% from 2020. Financial Services, as well as Technology, Media and Telecom (TMT) sectors even reported a minimum of one attack for three consecutive years. Financial Services firms, however, seemed to be hit the hardest, with 66% reporting being impacted by cyber attacks in 2021-2022.

Cyber risk has risen to the same strategic level as traditional financial and operational risks, thanks to a growing realisation by businesses that the impact can be just as severe.

https://www.itsecurityguru.org/2023/01/18/cost-of-data-breaches-to-global-businesses-at-five-year-high/

• European Data Protection Authorities Issue Record €2.92 Billion in GDPR Fines, an Increase of 168%

European data regulators issued a record €2.92 billion in fines last year, a 168% increase from 2021. That’s according to the latest GDPR and Data Breach survey from international law firm DLA Piper, which covers all 27 Member States of the European Union, plus the UK, Norway, Iceland, and Liechtenstein. This year’s biggest fine of €405 million was imposed by the Irish Data Protection Commissioner (DPC) against Meta Platforms Ireland Limited relating to Instagram for alleged failures to protect children’s personal data. The Irish DPC also fined Meta €265 million for failing to comply with the GDPR obligation for Data Protection by Design and Default. Both fines are currently under appeal.

Despite the overall increase in fines since January 28, 2022, the fine of €746 million that Luxembourg authorities levied against Amazon last year remains the biggest to be issued by an EU-based data regulator to date (though the retail giant is still believed to be appealing).

The report also revealed a notable increase in focus by supervisory authorities on the use of artificial intelligence (AI), while the volume of data breaches reported to regulators decreased slightly against the previous year’s total.

https://www.csoonline.com/article/3685789/european-data-protection-authorities-issue-record-2-92-billion-in-gdpr-fines.html#tk.rss_news

• PayPal Accounts Breached in Large-Scale Credential Stuffing Attack

PayPal is sending out data breach notifications to thousands of users who had their accounts accessed through credential stuffing attacks that exposed some personal data.

Credential stuffing are attacks where hackers attempt to access an account by trying out username and password pairs sourced from data leaks on various websites. This type of attack relies on an automated approach with bots running lists of credentials to "stuff" into login portals for various services. Credential stuffing targets users that employ the same password for multiple online accounts, which is known as "password recycling."

PayPal explains that the credential stuffing attack occurred between December 6 and December 8, 2022. The company detected and mitigated it at the time but also started an internal investigation to find out how the hackers obtained access to the accounts. By December 20, 2022, PayPal concluded its investigation, confirming that unauthorised third parties logged into the accounts with valid credentials. The electronic payments platform claims that this was not due to a breach on its systems and has no evidence that the user credentials were obtained directly from them.

According to the data breach reporting from PayPal, 34,942 of its users have been impacted by the incident. During the two days, hackers had access to account holders' full names, dates of birth, postal addresses, social security numbers, and individual tax identification numbers. Transaction histories, connected credit or debit card details, and PayPal invoicing data are also accessible on PayPal accounts.

https://www.bleepingcomputer.com/news/security/paypal-accounts-breached-in-large-scale-credential-stuffing-attack/

• Royal Mail Boss to Face MPs’ Questions Over Russian Ransomware Attack

Royal Mail’s chief executive faced questions from MPs last week over the Russia-linked ransomware attack that caused international deliveries to grind to a halt.

Simon Thompson, chief executive of Royal Mail, was asked about the recent cyber attack when he appeared before the Commons Business Select Committee to discuss Royal Mail’s response to the cyber attack at the evidence session on Tuesday Jan 17.

A Royal Mail spokesman said: “Royal Mail has been subject to a cyber incident that is affecting our international export service. We are focused on restoring this service as soon as we are able.”

Royal Mail was forced to suspend all outbound international post after machines used for printing customs dockets were disabled by the Russia-linked Lockbit cyber crime gang. Lockbit’s attackers used ransomware, malicious software that scrambles vital computer files before the gang demands payment to unlock them again. The software also took over printers at Royal Mail’s international sorting offices and caused ransom notes to “spout” from them, according to reports.

Cyber security industry sources cautioned that while Lockbit is known to be Russian in origin, it is not known whether a stolen copy of the gang’s signature ransomware had been deployed by rival hackers.

https://www.telegraph.co.uk/business/2023/01/13/royal-mail-boss-face-mps-questions-russian-ransomware-attack/

• Third-Party Risk Management: Why 2023 Could be the Perfect Time to Overhaul your TPRM Program

Ensuring risk caused by third parties does not occur to your organisation is becoming increasingly difficult. Every business outsources some aspects of its operations, and ensuring these external entities are a strength and not a weakness isn’t always a straightforward process.

In the coming years we’ll see organisations dedicate more time and resources to developing detailed standards and assessments for potential third-party vendors. Not only will this help to mitigate risk within their supply chain network, it will also provide better security.

As demand for third-party risk management (TPRM) grows, there are key reasons why we believe 2023 could be pivotal for the future of your organisation’s TPRM program, cyber risk being principal amongst them.

Forrester predicted that 60% of security incidents in 2022 would stem from third parties. In 2021 there was a 300% increase in supply chain attacks, a trend that has continued to increase over the past 12 months also. For example, Japanese car manufacturer Toyota was forced to completely shut down its operations due to a security breach with a third-party plastics supplier.

It’s not only the frequency of third-party attacks that has increased, but also the methods that cyber criminals are using are becoming increasingly sophisticated. For example, the SolarWinds cyber breach in 2020 was so advanced that Microsoft estimated it took over a thousand engineers to stop the impact of the attack.

As the sophistication and frequency of supply chain attacks increases, the impact they have on businesses reputations and valuations is also becoming apparent. There is a need for organisations to conduct thorough due diligence of the third parties they choose to work with, otherwise the consequences could be disastrous.

Remember always that cyber security should be a non-negotiable feature of all business transactions.

https://informationsecuritybuzz.com/third-party-risk-management-why-2023-could-be-the-perfect-time-to-overhaul-your-tprm-program/

• EU Cyber Resilience Regulation Could Translate into Millions in Fines

The EU Commission’s Cyber Resilience Act (CRA) is intended to close the digital fragmentation problem surrounding devices and systems with network connections – from printers and routers to smart household appliances and industrial control systems. Industrial networks and critical infrastructures require special protection.

According to the European Union, there is currently a ransomware attack every eleven seconds. In the last few weeks alone, among others, a leading German children’s food manufacturer and a global Tier1 automotive supplier headquartered in Germany were hit, with the latter becoming the victim of a massive ransomware attack. Such an attack even led to insolvency at the German manufacturer Prophete in January 2023. To press manufacturers, distributors and importers into action, they face significant penalties if security vulnerabilities in devices are discovered and not properly reported and closed.

“The pressure on the industry – manufacturers, distributors and importers – is growing immensely. The EU will implement this regulation without compromise, even though there are still some work packages to be done, for example regarding local country authorities,” says Jan Wendenburg, CEO, ONEKEY.

The financial fines for affected manufacturers and distributors are therefore severe: up to 15 million euros or 2.5 percent of global annual revenues in the past fiscal year – the larger number counts. “This makes it absolutely clear: there will be substantial penalties on manufacturers if the requirements are not implemented,” Wendenburg continues.

Manufacturers, distributors and importers are required to notify ENISA – the European Union’s cyber security agency – within 24 hours if a security vulnerability in one of their products is exploited. Exceeding the notification deadlines is already subject to sanctions.

https://www.helpnetsecurity.com/2023/01/19/eu-cyber-resilience-regulation-fines/

• Russian Hackers Try to Bypass ChatGPT's Restrictions for Malicious Purposes

Russian cyber-criminals have been observed on dark web forums trying to bypass OpenAI’s API restrictions to gain access to the ChatGPT chatbot for nefarious purposes.

Various individuals have been observed, for instance, discussing how to use stolen payment cards to pay for upgraded users on OpenAI (thus circumventing the limitations of free accounts). Others have created blog posts on how to bypass the geo controls of OpenAI, and others still have created tutorials explaining how to use semi-legal online SMS services to register to ChatGPT.

“Generally, there are a lot of tutorials in Russian semi-legal online SMS services on how to use it to register to ChatGPT, and we have examples that it is already being used,” wrote Check Point Research (CPR). “It is not extremely difficult to bypass OpenAI’s restricting measures for specific countries to access ChatGPT,” said Check Point. “Right now, we are seeing Russian hackers already discussing and checking how to get past the geofencing to use ChatGPT for their malicious purposes.”

They added that they believe these hackers are most likely trying to implement and test ChatGPT in their day-to-day criminal operations. “Cyber-criminals are growing more and more interested in ChatGPT because the AI technology behind it can make a hacker more cost-efficient,” they explained.

Case in point, just last week, Check Point Research published a separate advisory highlighting how threat actors had already created malicious tools using ChatGPT. These included infostealers, multi-layer encryption tools and dark web marketplace scripts.

More generally, the cyber security firm is not the only one believing ChatGPT could democratise cyber crime, with various experts warning that the AI bot could be used by potential cyber-criminals to teach them how to create attacks and even write ransomware.

https://www.infosecurity-magazine.com/news/russian-hackers-to-bypass-chatgpt/

• New Report Reveals CISOs Rising Influence

Cyber security firm Coalfire this week unveiled its second annual State of CISO Influence report, which explores the expanding influence of Chief Information Security Officers (CISOs) and other security leaders.

The report revealed that the CISO role is maturing quickly, and the position is experiencing more equity in the boardroom. In the last year alone, there was a 10-point uptick in CISOs doing monthly reporting to the board. These positive outcomes likely stem from the increasingly metrics-driven reporting CISOs provide, where data is more effectively leveraged to connect security outcomes to business objectives.

An especially promising development in this year's report is how security teams are being looped into corporate projects. Of the security leaders surveyed, 78% say they are consulted early in project development when business objectives are first identified, and two-thirds are now making presentations to the highest levels of enterprise authority. 56% of CISOs present security metrics to their CEOs, up from 43% in 2021.

Cloud migration was universally identified as one of those top business objectives. The move to the cloud saddles CISOs with many challenges. The top priorities listed by CISOs include dealing with an expanding attack surface, staffing, and new compliance requirements — all within constrained budgets. In fact, 43% of security leaders said their budgets remained static or were reduced following business migration to the cloud.

Given these challenges, leading CISOs are transforming their approaches. To address multiple cloud compliance requirements, security leaders are focusing on the most onerous set of rules and creating separate environments for different requirements. Risk assessments were identified as the key tool used to secure funding for these and other cyber initiatives and to set top priorities.

"Costs and risks are up, while at the same time, cyber budgets are trending flat or down," said Colefire. "Cyber security has historically been lower in priority for organisations, but we are witnessing a big shift in enterprise cyber expectations. CISOs are rising to meet those expectations, speaking to the business, and as a result, solidifying their role in the C-suite."

https://www.darkreading.com/threat-intelligence/new-coalfire-report-reveals-cisos-rising-influence

• ChatGPT and its Perilous Use as a "Force Multiplier" for Cyber Attacks

As a form of OpenAI technology, ChatGPT has the ability to mimic natural language and human interaction with remarkable efficiency. However, from a cyber security perspective, this also means it can be used in a variety of ways to lower the bar for threat actors.

One key method is the ability for ChatGPT to draft cunning phishing emails en masse. By feeding ChatGPT with minimal information, it can create content and entire emails that will lure unsuspecting victims to provide their passwords. With the right API setup, thousands of unique, tailored, and sophisticated phishing emails can be sent almost simultaneously.

Another interesting capability of ChatGPT is the ability to write malicious code. While OpenAI has put some controls in place to prevent ChatGPT from creating malware, it is possible to convince ChatGPT to create ransomware and other forms of malware as code that can be copied and pasted into an integrated development environment (IDE) and used to compile actual malware. ChatGPT can also be used to identify vulnerabilities in code segments and reverse engineer applications.

ChatGPT will expedite a trend that is already wreaking havoc across sectors – lowering the bar for less sophisticated threat actors, enabling them to conduct attacks while evading security controls and bypassing advanced detection mechanisms. And currently, there is not much that organisations can do about it. ChatGPT represents a technological marvel that will usher in a new era, not just for the cyber security space.

https://www.calcalistech.com/ctechnews/article/sj0lfp11oi

• Mailchimp Discloses a New Security Breach, the Second One in 6 Months

The popular email marketing and newsletter platform Mailchimp was hacked twice in the past six months. The news of a new security breach was confirmed by the company; the incident exposed the data of 133 customers.

Threat actors targeted the company’s employees and contractors to gain access to an internal support and account admin tool.

“On January 11, the Mailchimp Security team identified an unauthorised actor accessing one of our tools used by Mailchimp customer-facing teams for customer support and account administration. The unauthorised actor conducted a social engineering attack on Mailchimp employees and contractors, and obtained access to select Mailchimp accounts using employee credentials compromised in that attack.” reads the notice published by the company. “Based on our investigation to date, this targeted incident has been limited to 133 Mailchimp accounts.”

The malicious activity was discovered on January 11, 2023; in response to the intrusion the company temporarily suspended access for impacted accounts. The company also notified the primary contacts for all affected accounts less than 24 hours after the initial discovery.

https://securityaffairs.com/140997/data-breach/mailchimp-security-breach.html

---

Threats

Ransomware, Extortion and Destructive Attacks

• Yum Brands says nearly 300 restaurants in UK impacted due to cyber attack | Reuters

• Royal Mail boss to face MPs’ questions over Russian ransomware attack (telegraph.co.uk)

• What is LockBit ransomware and how does it operate? | Royal Mail | The Guardian

• How cyber-attack on Royal Mail has left firms in limbo - BBC News

• Royal Mail restarts limited overseas post after cyber-attack - BBC News

• How Royal Mail’s hacker became the world’s most prolific ransomware group | Financial Times (ft.com)

• Ransomware Trends In Q4 2022: Key Findings And Recommendations (informationsecuritybuzz.com)

• Microsoft: Cuba ransomware hacking Exchange servers via OWASSRF flaw (bleepingcomputer.com)

• Microsoft retracts its report on Mac ransomware (techrepublic.com)

• Royal Mail operations hub in Mallusk hit by ‘cyber attack’ as printer spurts out ransom demands - BelfastTelegraph.co.uk

• Ransomware Dips During 2022: Are Cyber attacks Slowing or Just a Blip? - MSSP Alert

• Up to 1,000 ships affected by DNV ransomware attack - Splash247

• Avast releases free BianLian ransomware decryptor (bleepingcomputer.com)

• Vice Society ransomware leaks University of Duisburg-Essen’s data (bleepingcomputer.com)

• Ransomware attack cuts 1,000 ships off from on-shore servers • The Register

• Royal Mail promises ‘workarounds’ to restore services after ransomware attack | Computer Weekly

• Cyber-crime gangs' earnings slide as victims refuse to pay - BBC News

• Ransomware gang steals data from KFC, Taco Bell, and Pizza Hut brand owner (bleepingcomputer.com)

Phishing & Email Based Attacks

• How AI chatbot ChatGPT changes the phishing game | CSO Online

• The big risk in the most-popular, and aging, big tech email programs (cnbc.com)

• Why encrypting emails isn't as simple as it sounds - Help Net Security

• Is it your bank or a scam? How to deal with phishing attacks | Economy and Business | EL PAÍS English Edition

• Fake DHL emails allow hackers to breach Microsoft 365 accounts (msn.com)

Other Social Engineering; Smishing, Vishing, etc

• Techniques that attackers use to trick victims into visiting malicious content - Help Net Security

• Mailchimp slips up again, suffers security breach after falling on social engineering banana skin • Graham Cluley

• As Social Engineering Tactics Change, So Must Your Security Training (darkreading.com)

2FA/MFA

• CircleCI's hack caused by malware stealing engineer's 2FA-backed session (bleepingcomputer.com)

• The Importance of Multi-Factor Authentication (MFA) - MSSP Alert

Malware

• Qbot Overtakes Emotet in December 2022's Most Wanted Malware List - Infosecurity Magazine (infosecurity-magazine.com)

• IcedID Malware Strikes Again: Active Directory Domain Compromised in Under 24 Hours (thehackernews.com)

• New Backdoor Created Using Leaked CIA's Hive Malware Discovered in the Wild (thehackernews.com)

• CircleCI Confirms Data Breach Was Caused By Infostealer on Employee Laptop - Infosecurity Magazine (infosecurity-magazine.com)

• Experts spotted a backdoor that borrows code from CIA's Hive malware - Security Affairs

• ChatGPT Creates Polymorphic Malware - Infosecurity Magazine (infosecurity-magazine.com)

• Attackers Crafted Custom Malware for Fortinet Zero-Day (darkreading.com)

• New Chinese Malware Spotted Exploiting Recent Fortinet Firewall Vulnerability (thehackernews.com)

• Malicious ‘Lolip0p’ PyPi packages install info-stealing malware (bleepingcomputer.com)

• Hackers exploit Cacti critical bug to install malware, open reverse shells (bleepingcomputer.com)

• Hackers can use GitHub Codespaces to host and deliver malware (bleepingcomputer.com)

• Batloader Malware Abuses Legitimate Tools Uses Obfuscated JavaScript Files in Q4 2022 Attacks (trendmicro.com)

• Hackers turn to Google search ads to push info-stealing malware (bleepingcomputer.com)

• How to spot a cyberbot – five tips to keep your device safe (theconversation.com)

Mobile

• New 'Hook' Android malware lets hackers remotely control your phone (bleepingcomputer.com)

• Roaming Mantis’ Android malware adds DNS changer to hack WiFi routers (bleepingcomputer.com)

Botnets

• How to spot a cyberbot – five tips to keep your device safe (theconversation.com)

Denial of Service/DoS/DDOS

• Russian hacktivists NoName057 offer cash for DDoS attacks (techmonitor.ai)

Internet of Things – IoT

• Smart appliances could stop working after two years, says Which? - BBC News

Data Breaches/Leaks

• 6,000+ Customer Accounts Breached, NortonLifeLock Alert Users (informationsecuritybuzz.com)

• 1.7 TB of data from digital intelligence firm Cellebrite leaked online - Security Affairs

• CircleCI Confirms Data Breach Was Caused By Infostealer on Employee Laptop - Infosecurity Magazine (infosecurity-magazine.com)

• LastPass faces mounting criticism over recent breach | TechTarget

• Mailchimp Suffers Another Security Breach Compromising Some Customers' Information (thehackernews.com)

• Mailchimp discloses a new incident, the second one in 6 months - Security Affairs

• Timeline of the latest LastPass data breaches | CSO Online

• PayPal Breach Exposed PII of Nearly 35K Accounts (darkreading.com)

• T-Mobile US says hacker accessed personal data of 37 million customers • TechCrunch

• Twitter says leaked emails not hacked from its systems - BBC News

• Hacked! My Twitter user data is out on the dark web -- now what? | ZDNET

• Twitter sued over data leak that it denied was caused by a flaw | Business

• Nissan North America data breach caused by vendor-exposed database (bleepingcomputer.com)

• 18k Nissan Customers Affected by Data Breach at Third-Party Software Developer | SecurityWeek.Com

• Third-party administrator hack leads to theft of patient data for over 251K | SC Media (scmagazine.com)

Organised Crime & Criminal Actors

• Russia's Ukraine War Drives 62% Slump in Stolen Cards - Infosecurity Magazine (infosecurity-magazine.com)

• Europol arrested cryptocurrency scammers that stole millions from victims - Security Affairs

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Crypto exchanges freeze accounts tied to North Korea • The Register

• Europol arrested cryptocurrency scammers that stole millions from victims - Security Affairs

• FTX Says $415 Million Of Its Crypto Assets Was Hacked (informationsecuritybuzz.com)

• Google Ads-delivered malware drains NFT influencer’s entire crypto wallet (cointelegraph.com)

• Bitcoin is a ‘hyped-up fraud’, says JP Morgan chief (telegraph.co.uk)

• International Arrests Over 'Criminal' Crypto Exchange | SecurityWeek.Com

Fraud, Scams & Financial Crime

• A $175 Million Dollar Blunder: How A 30-Year-Old Entrepreneur Allegedly Defrauded JP Morgan With 4 Million Fake Email Accounts | Celebrity Net Worth

• Opinion: These online scams to steal your money will shock you -- even if you think you've seen them all - MarketWatch

• Young people warned not to be exploited as ‘money mules’ for UK criminal gangs | Crime | The Guardian

• Hacker stole credit cards from Canada alcohol retailer LCBO - Security Affairs

• Europol arrested cryptocurrency scammers that stole millions from victims - Security Affairs

• New York man defrauded thousands using credit cards sold on dark web (bleepingcomputer.com)

• FTX Says $415 Million Of Its Crypto Assets Was Hacked (informationsecuritybuzz.com)

• The US Has a Massive Money Transfer Surveillance Apparatus (gizmodo.com)

• The threat of location spoofing and fraud - Help Net Security

• HUMAN Security Stops VASTFLUX Digital Ad Fraud Operation - MSSP Alert

• International Arrests Over 'Criminal' Crypto Exchange | SecurityWeek.Com

Insurance

• Millions of Insurance Customers Compromised Via Supplier - Infosecurity Magazine (infosecurity-magazine.com)

Dark Web

• Russia's Ukraine War Drives 62% Slump in Stolen Cards - Infosecurity Magazine (infosecurity-magazine.com)

• New York man defrauded thousands using credit cards sold on dark web (bleepingcomputer.com)

• Illegal Solaris darknet market hijacked by competitor Kraken (bleepingcomputer.com)

Supply Chain and Third Parties

• CircleCI, LastPass, Okta, and Slack: Cyber attackers Pivot to Target Core Enterprise Tools (darkreading.com)

• Third-Party Risk Management: Why 2023 Could Be The Perfect Time To Overhaul Your TPRM Program (informationsecuritybuzz.com)

Cloud/SaaS

• The Dangers of Default Cloud Configurations (darkreading.com)

• Report: Cloud-based networks under growing attack • The Register

• Data Security in Multicloud: Limit Access, Increase Visibility (darkreading.com)

Hybrid/Remote Working

• Training, endpoint management reduce remote working cyber security risks - Help Net Security

Encryption

• Vulnerabilities in cryptographic libraries found through modern fuzzing - Help Net Security

• teiss - Cyber Threats - Managing the treat from quantum computers

• Threats Of Quantum: The Solution Lies In Quantum Cryptography (informationsecuritybuzz.com)

• Why encrypting emails isn't as simple as it sounds - Help Net Security

• TLS Connection Cryptographic Protocol Vulnerabilities (trendmicro.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Compromise of employee device, credentials led to CircleCI breach | SC Media (scmagazine.com)

• PayPal accounts breached in large-scale credential stuffing attack (bleepingcomputer.com)

• Timeline of the latest LastPass data breaches | CSO Online

• NortonLifeLock: threat actors breached Norton Password Manager accounts - Security Affairs

Social Media

• Twitter says leaked emails not hacked from its systems - BBC News

• Hacked! My Twitter user data is out on the dark web -- now what? | ZDNET

• French CNIL fined Tiktok $5.4 Million for violating cookie laws - Security Affairs

Malvertising

• Hackers turn to Google search ads to push info-stealing malware (bleepingcomputer.com)

• Google Ads-delivered malware drains NFT influencer’s entire crypto wallet (cointelegraph.com)

• HUMAN Security Stops VASTFLUX Digital Ad Fraud Operation - MSSP Alert

Training, Education and Awareness

• Training, endpoint management reduce remote working cyber security risks - Help Net Security

• As Social Engineering Tactics Change, So Must Your Security Training (darkreading.com)

Regulations, Fines and Legislation

• GDPR Fines Surge 168% in a Year - Infosecurity Magazine (infosecurity-magazine.com)

• European data protection authorities issue record €2.92 billion in GDPR fines | CSO Online

• State of data privacy laws in 2023 | TechTarget

• How data protection is evolving in a digital world - Help Net Security

• EU cyber resilience regulation could translate into millions in fines - Help Net Security

• UN Hearing On Proposed Cyber Crime Treaty: Legal Measures To Tackle Cyber Crimes (informationsecuritybuzz.com)

• Online safety bill: Attempt to jail tech bosses ‘could backfire’ | News | The Times

• Culture secretary examines plans to punish tech bosses over online harms | Financial Times (ft.com)

• French CNIL fined Tiktok $5.4 Million for violating cookie laws - Security Affairs

• State legislators aren't waiting for Congress to regulate children's online privacy - CyberScoop

• How Would the FTC Rule on Noncompetes Affect Data Security? (darkreading.com)

• The US Has a Massive Money Transfer Surveillance Apparatus (gizmodo.com)

• What are International Traffic in Arms Regulations and Export Administration Regulations? (techtarget.com)

Governance, Risk and Compliance

• Technology is a fragile machine that seems to power everything | Android Central

• Third-Party Risk Management: Why 2023 Could Be The Perfect Time To Overhaul Your TPRM Program (informationsecuritybuzz.com)

• Training, endpoint management reduce remote working cyber security risks - Help Net Security

• New Coalfire Report Reveals CISOs Rising Influence (darkreading.com)

• Cost of data breaches to global businesses at five-year high- IT Security Guru

• Experts at Davos 2023 sound the alarm on cyber security | World Economic Forum (weforum.org)

• Why Mean Time to Repair Is Not Always A Useful Security Metric (darkreading.com)

• Why are there so many cyber attacks lately? An explainer on the rising trend | Globalnews.ca

• How To Build A Network Of Security Champions In Your Organisation (forbes.com)

• EU cyber resilience regulation could translate into millions in fines - Help Net Security

• What is Business Attack Surface Management? (trendmicro.com)

• How to build a cyber-resilience culture in the enterprise | TechTarget

• Why Businesses Need to Think Like Hackers This Year (darkreading.com)

• How to prioritize resilience in the face of cyber-attacks | World Economic Forum (weforum.org)

• #WEF23: Geopolitical Instability Means a Cyber “Catastrophe” is Imminent - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber-attack contributes to major Harrogate district firm posting £4.1m loss - The Stray Ferret

Data Protection

• GDPR Fines Surge 168% in a Year - Infosecurity Magazine (infosecurity-magazine.com)

• European data protection authorities issue record €2.92 billion in GDPR fines | CSO Online

• How data protection is evolving in a digital world - Help Net Security

• State legislators aren't waiting for Congress to regulate children's online privacy - CyberScoop

• European Businesses Admit Major Privacy Skills Gap - Infosecurity Magazine (infosecurity-magazine.com)

Careers, Working in Cyber and Information Security

• New Coalfire Report Reveals CISOs Rising Influence (darkreading.com)

• IT Burnout may be Putting Your Organisation at Risk (bleepingcomputer.com)

• Sophos Joins List of Cyber security Companies Cutting Staff | SecurityWeek.Com

Law Enforcement Action and Take Downs

• Europol arrested cryptocurrency scammers that stole millions from victims - Security Affairs

Privacy, Surveillance and Mass Monitoring

• AI and privacy: Experts worry users may have already ‘traded a lot’ for services - National | Globalnews.ca

• State of data privacy laws in 2023 | TechTarget

• How data privacy and automation offer both challenges and opportunities in a fintech future | Kyndryl: The Heart of Progress | The Guardian

• UK supermarket uses facial recognition tech to track shoppers - Coda Story

• State legislators aren't waiting for Congress to regulate children's online privacy - CyberScoop

• European Businesses Admit Major Privacy Skills Gap - Infosecurity Magazine (infosecurity-magazine.com)

Artificial Intelligence

• Russian Hackers Try to Bypass ChatGPT's Restrictions For Malicious Purposes - Infosecurity Magazine (infosecurity-magazine.com)

• How AI chatbot ChatGPT changes the phishing game | CSO Online

• ChatGPT Opens New Opportunities for Cyber criminals: 5 Ways for Organisations to Get Ready (darkreading.com)

• ChatGPT and its perilous use as a "Force Multiplier" for cyber attacks | Ctech (calcalistech.com)

• AI and privacy: Experts worry users may have already ‘traded a lot’ for services - National | Globalnews.ca

• Potential threats and sinister implications of ChatGPT - Help Net Security

• Criminals seek OpenAI guardrail bypass, use ChatGPT for evil • The Register

• ChatGPT Creates Polymorphic Malware - Infosecurity Magazine (infosecurity-magazine.com)

• Is ChatGPT a cyber security threat? | TechCrunch

Misinformation, Disinformation and Propaganda

• Over Four Billion People Affected By Internet Censorship in 2022 - Infosecurity Magazine (infosecurity-magazine.com)

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• Russian Hackers Try to Bypass ChatGPT's Restrictions For Malicious Purposes - Infosecurity Magazine (infosecurity-magazine.com)

• Putin’s Russian cyber attacks could target UK’s infrastructure | News | The Times

• From phishing scams to propaganda: How Russia, rogue nations utilize cyber capabilities against the US | Fox News

• Industrial espionage: How China sneaks out America's technology secrets - BBC News

• Russia's Ukraine War Drives 62% Slump in Stolen Cards - Infosecurity Magazine (infosecurity-magazine.com)

• Ukraine blames Russia for most of over 2,000 cyber attacks in 2022 | Reuters

• Cyber  attacks have tripled in past year, says Ukraine’s cyber security agency | Ukraine | The Guardian

• Pro-Russian Hacktivist Group Targets Czech Presidential Election - Infosecurity Magazine (infosecurity-magazine.com)

• Beware: Tainted VPNs Being Used to Spread EyeSpy Surveillanceware (thehackernews.com)

• Is Elon Musk’s Starlink winning the war for Ukraine? | World | The Sunday Times (thetimes.co.uk)

• Pro-Russia Hacktivist Group NoName057(16) Strikes Again (informationsecuritybuzz.com)

• Earth Bogle Group Targets Middle East With NjRAT, Geopolitical Lures - Infosecurity Magazine (infosecurity-magazine.com)

• Russian hacktivists NoName057 offer cash for DDoS attacks (techmonitor.ai)

• Chinese APT Group Vixen Panda Targets Iranian Government Entities - Infosecurity Magazine (infosecurity-magazine.com)

• Ukraine links data-wiping attack on news agency to Russian hackers (bleepingcomputer.com)

• Russian hackers target Ukrainian press briefing about cyber attacks (axios.com)

• Chinese hackers targeted Iranian government entities for months: Report | CSO Online

• Myanmar Acquired Spyware From Israeli Cyber-intelligence Firm Cognyte, New Docs Reveal - National Security & Cyber - Haaretz.com

---

Nation State Actors

Nation State Actors – Russia

• Russian Hackers Try to Bypass ChatGPT's Restrictions For Malicious Purposes - Infosecurity Magazine (infosecurity-magazine.com)

• Putin’s Russian cyber attacks could target UK’s infrastructure | News | The Times

• From phishing scams to propaganda: How Russia, rogue nations utilize cyber capabilities against the US | Fox News

• Russia's Ukraine War Drives 62% Slump in Stolen Cards - Infosecurity Magazine (infosecurity-magazine.com)

• Ukraine blames Russia for most of over 2,000 cyber attacks in 2022 | Reuters

• Cyber attacks have tripled in past year, says Ukraine’s cyber security agency | Ukraine | The Guardian

• Pro-Russian Hacktivist Group Targets Czech Presidential Election - Infosecurity Magazine (infosecurity-magazine.com)

• Is Elon Musk’s Starlink winning the war for Ukraine? | World | The Sunday Times (thetimes.co.uk)

• Pro-Russia Hacktivist Group NoName057(16) Strikes Again (informationsecuritybuzz.com)

• Russian hacktivists NoName057 offer cash for DDoS attacks (techmonitor.ai)

• Ukraine links data-wiping attack on news agency to Russian hackers (bleepingcomputer.com)

• Russian hackers target Ukrainian press briefing about cyber attacks (axios.com)

• Russians say they can download software from Intel again • The Register

• Nation State Actors – China

• Industrial espionage: How China sneaks out America's technology secrets - BBC News

• Attackers Crafted Custom Malware for Fortinet Zero-Day (darkreading.com)

• New Chinese Malware Spotted Exploiting Recent Fortinet Firewall Vulnerability (thehackernews.com)

• China wants 30 percent CAGR for its infosec industry • The Register

• Chinese APT Group Vixen Panda Targets Iranian Government Entities - Infosecurity Magazine (infosecurity-magazine.com)

• Chinese hackers targeted Iranian government entities for months: Report | CSO Online

Nation State Actors – North Korea

• Crypto exchanges freeze accounts tied to North Korea • The Register

Nation State Actors – Iran

• Chinese APT Group Vixen Panda Targets Iranian Government Entities - Infosecurity Magazine (infosecurity-magazine.com)

• Chinese hackers targeted Iranian government entities for months: Report | CSO Online

Nation State Actors – Misc

• Earth Bogle Group Targets Middle East With NjRAT, Geopolitical Lures - Infosecurity Magazine (infosecurity-magazine.com)

---

Vulnerability Management

• The Top 10 Vulnerabilities of 2022: Mastering Vulnerability Management - Security Boulevard

• Why you don’t have to fix every vulnerability | CSO Online

• 3 Lessons Learned in Vulnerability Management (darkreading.com)

Vulnerabilities

• Cisco won’t fix critical flaw in small business routers • The Register

• Unpatched Zoho ManageEngine Products Under Active Cyber attack (darkreading.com)

• Oracle's First Security Update for 2023 Includes 327 New Patches | SecurityWeek.Com

• Why it's time to review your on-premises Microsoft Exchange patch status | CSO Online

• Attackers Crafted Custom Malware for Fortinet Zero-Day (darkreading.com)

• New Chinese Malware Spotted Exploiting Recent Fortinet Firewall Vulnerability (thehackernews.com)

• Cacti Servers Under Attack as Majority Fail to Patch Critical Vulnerability (thehackernews.com)

• PoC exploits released for critical bugs in popular WordPress plugins (bleepingcomputer.com)

• Vulnerabilities in cryptographic libraries found through modern fuzzing - Help Net Security

• Microsoft: Exchange Server 2013 reaches end of support in 90 days (bleepingcomputer.com)

• AMD Revealed 31 Vulnerabilities Within Its Processor Lines, Ryzen & EPYC CPUs Included (wccftech.com)

• Hackers are using this old trick to dodge security protections | ZDNET

• Attackers deploy sophisticated Linux implant on Fortinet network security devices | CSO Online

• Researchers to release PoC exploit for critical Zoho RCE bug, patch now (bleepingcomputer.com)

• MSI accidentally breaks Secure Boot for hundreds of motherboards (bleepingcomputer.com)

• Git security vulnerabilities announced | The GitHub Blog

• Microsoft fixes SSRF vulnerabilities found in Azure services | TechTarget

• Over 4,000 Sophos Firewall devices vulnerable to RCE attacks (bleepingcomputer.com)

• Mozilla Releases Security Updates for Firefox | CISA

• Critical Security Vulnerabilities Discovered in Netcomm and TP-Link Routers (thehackernews.com)

• Exploited Control Web Panel Flaw Added to CISA 'Must-Patch' List | SecurityWeek.Com

• Two critical flaws discovered in Git system - Security Affairs

• Vendors Actively Bypass Security Patch for Year-Old Magento Vulnerability | SecurityWeek.Com

• Cisco Patches High-Severity SQL Injection Vulnerability in Unified CM | SecurityWeek.Com

• CVE-2022-47966: Rapid7 Observed Exploitation of Critical ManageEngine Vulnerability | Rapid7 Blog

• Critical Microsoft Azure RCE flaw impacted multiple services - Security Affairs

• New Microsoft Azure Vulnerability Uncovered — EmojiDeploy for RCE Attacks (thehackernews.com)

• Cross-site forgery bug would facilitate remote code execution in Microsoft Azure services | SC Media (scmagazine.com)

---

Tools and Controls

• Training, endpoint management reduce remote working cyber security risks - Help Net Security

• Why encrypting emails isn't as simple as it sounds - Help Net Security

• As Social Engineering Tactics Change, So Must Your Security Training (darkreading.com)

• Zero trust network access for Desktop as a Service - Help Net Security

• How to prioritize resilience in the face of cyber-attacks | World Economic Forum (weforum.org)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 13 January 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• Quarter of UK SMBs Hit by Ransomware in 2022

Over one in four (26%) British SMBs have been targeted by ransomware over the past year, with half (47%) of those compromised paying their extorters, according to new data from anti-virus provider Avast. The security vendor polled 1000 IT decision makers from UK SMBs back in October, to better understand the risk landscape over the previous 12 months.

More than two-thirds (68%) of respondents said they are more concerned about being attacked since the start of the war in Ukraine, fuelling concerns that have led to half (50%) investing in cyber-insurance. They’re wise to do so, considering that 41% of those hit by ransomware lost data, while 34% lost access to devices, according to Avast.

Given that SMBs comprise over 99% of private sector businesses in the country, it’s reassuring that cyber is now being viewed as a major business risk. Nearly half (48%) ranked it as one of the biggest threats they currently face, versus 66% who cited financial risk stemming from surging operational cost. More respondents cited cyber as a top threat than did physical security (35%) and supply chain disruption (33%).

Avast argued that SMBs are among the groups most vulnerable to cyber-threats as they often have very limited budget and resources, and many don’t have somebody on staff managing security holistically. As a result, not only are SMB’s lacking in their defence, but they’re also slower and less able to react to incidents.

https://www.infosecurity-magazine.com/news/quarter-of-uk-smbs-hit-ransomware/

• Global Cyber Attack Volume Surges 38% in 2022

The number of cyber attacks recorded last year was nearly two-fifths (38%) greater than the total volume observed in 2021, according to Check Point.

The security vendor claimed the increase was largely due to a surge in attacks on healthcare organisations, which saw the largest year-on-year (YoY) increase (74%), and the activities of smaller, more agile hacking groups.

Overall, attacks reached an all-time high in Q4 with an average of 1168 weekly attacks per organisation. The average weekly figures for the year were highest for education sector organisations (2314), government and military (1661) and healthcare (1463).

Threat actors appear to have capitalised on gaps in security created by the shift to remote working. The ransomware ecosystem is continuing to evolve and grow with smaller, more agile criminal groups that form to evade law enforcement. Hackers are also now increasingly widening their aim to target business collaboration tools such as Slack, Teams, OneDrive and Google Drive with phishing exploits. These make for a rich source of sensitive data given that most organisations’ employees continue to work remotely.

It is predicted that AI tools like ChatGPT would help to fuel a continued surge in attacks in 2023 by making it quicker and easier for bad actors to generate malicious code and emails.

Recorded cyber-attacks on US organisations grew 57% YoY in 2022, while the figure was even higher in the UK (77%). This chimes with data from UK ISP Beaming, which found that 2022 was the busiest year on record for attacks. It recorded 687,489 attempts to breach UK businesses in 2022 – the equivalent of one attack every 46 seconds.

https://www.infosecurity-magazine.com/news/global-cyberattack-volume-surges/

• 1 in 3 Organisations Do Not Provide Any Cyber Security Training to Remote Workers Despite the Majority of Employees Having Access to Critical Data

New research from cyber security provider Hornetsecurity has found that 33% of companies are not providing any cyber security awareness training to users who work remotely.

The study also revealed nearly three-quarters (74%) of remote staff have access to critical data, which is creating more risk for companies in the new hybrid working world.

Despite the current lack of training and employees feeling ill-equipped, almost half (44%) of respondents said their organisation plans to increase the percentage of employees that work remotely. The popularity of hybrid work, and the associated risks, means that companies must prioritise training and education to make remote working safe.

Traditional methods of controlling and securing company data aren't as effective when employees are working in remote locations and greater responsibility falls on the individual. Companies must acknowledge the unique risks associated with remote work and activate relevant security management systems, as well as empower employees to deal with a certain level of risk.

The independent survey, which quizzed 925 IT professionals from a range of business types and sizes globally, highlighted the security management challenges and employee cyber security risk when working remotely. The research revealed two core problems causing risk: employees having access to critical data, and not enough training being provided on how to manage cyber security or how to reduce the risk of a cyber-attack or breach.

https://www.darkreading.com/vulnerabilities-threats/1-in-3-organizations-do-not-provide-any-cybersecurity-training-to-remote-workers-despite-a-majority-of-employees-having-access-to-critical-data

• AI-Generated Phishing Attacks Are Becoming More Convincing

It's time for you and your colleagues to become more sceptical about what you read.

That's a takeaway from a series of experiments undertaken using GPT-3 AI text-generating interfaces to create malicious messages designed to spear-phish, scam, harass, and spread fake news.

Experts at WithSecure have described their investigations into just how easy it is to automate the creation of credible yet malicious content at incredible speed. Amongst the use cases explored by the research were the use of GPT-3 models to create:

• Phishing content – emails or messages designed to trick a user into opening a malicious attachment or visiting a malicious link

• Social opposition – social media messages designed to troll and harass individuals or to cause brand damage

• Social validation – social media messages designed to advertise or sell, or to legitimise a scam

• Fake news – research into how well GPT-3 can generate convincing fake news articles of events that weren’t part of its training set

All of these could, of course, be useful to cyber criminals hell-bent on scamming the unwary or spreading unrest.

https://www.tripwire.com/state-of-security/ai-generated-phishing-attacks-are-becoming-more-convincing

• Customer and Employee Data the Top Prize for Hackers

The theft of customer and employee data accounts for almost half (45%) of all stolen data between July 2021 and June 2022, according to a new report from cyber security solution provider Imperva.

The data is part of a 12-month analysis by Imperva Threat Research on the trends and threats related to data security in its report “More Lessons Learned from Analysing 100 Data Breaches”.

Their analysis found that theft of credit card information and password details dropped by 64% compared to 2021. The decline in stolen credit card and password data pointing to the uptake of basic security tactics like multi-factor authentication (MFA). However, in the long term, PII data is the most valuable data to cyber-criminals. With enough stolen PII, they can engage in full-on identity theft which is hugely profitable and very difficult to prevent. Credit cards and passwords can be changed the second there is a breach, but when PII is stolen, it can be years before it is weaponised by hackers.

The research also revealed the root causes of data breaches, with social engineering (17%) and unsecured databases (15%) two of the biggest culprits. Misconfigured applications were only responsible for 2% of data breaches, but Imperva said that businesses should expect this figure to rise in the near future, particularly with cloud-managed infrastructure where configuring for security requires significant expertise.

It’s really concerning that a third (32%) of data breaches are down to unsecured databases and social engineering attacks, since they’re both straightforward to mitigate. A publicly open database dramatically increases the risk of a breach and, all too often, they are left like this not out of a failure of security practices but rather the total absence of any security posture at all.

https://www.infosecurity-magazine.com/news/customer-employee-data-hackers/

• Royal Mail hit by Ransomware Attack, Causes ‘Severe Disruption’ to Services

Royal Mail experienced “severe service disruption” to its international export services following a ransomware attack, the company has announced. A statement said it was temporarily unable to despatch export items including letters and parcels to overseas destinations.

Royal Mail said: “We have asked customers temporarily to stop submitting any export items into the network while we work hard to resolve the issue” and advising that “Some customers may experience delay or disruption to items already shipped for export.”

The attack was later attributed to LockBit, a prolific ransomware gang with close ties to Russia. Both the NCSC and the NCA were involved in responding to the incident.

https://www.independent.co.uk/business/royal-mail-cyber-attack-exports-b2260308.html

• The Guardian Confirms Personal Information Compromised in Ransomware Attack

British news organisation The Guardian has confirmed that personal information was compromised in a ransomware attack in December 2022.

The company fell victim to the attack just days before Christmas, when it instructed staff to work from home, announcing network disruptions that mostly impacted the print newspaper.

Right from the start, the Guardian said it suspected ransomware to have been involved in the incident, and this week the company confirmed that this was indeed the case. In an email to staff on Wednesday, The Guardian Media Group’s chief executive and the Guardian’s editor-in-chief said that the sophisticated cyber attack was likely the result of phishing.

They also announced that the personal information of UK staff members was compromised in the attack, but said that reader data and the information of US and Australia staff was not impacted. “We have seen no evidence that any data has been exposed online thus far and we continue to monitor this very closely,” the Guardian representatives said. While the attack forced the Guardian staff to work from home, online publishing has been unaffected, and production of daily newspapers has continued as well.

“We believe this was a criminal ransomware attack, and not the specific targeting of the Guardian as a media organisation,” the Guardian said.

The company continues to work on recovery and estimates that critical systems would be restored in the next two weeks. Staff, however, will continue to work from home until at least early February. “These attacks have become more frequent and sophisticated in the past three years, against organisations of all sizes, and kinds, in all countries,” the Guardian said.

https://www.securityweek.com/guardian-confirms-personal-information-compromised-ransomware-attack

• Ransomware Gang Releases Info Stolen from 14 UK Schools, Including Passport Scans

Another month, another release of personal information stolen from a school system. This time, it's a group of 14 schools in the United Kingdom.

Once again, the perpetrator appears to be Vice Society, which is well known for targeting educational systems in the US. As the Cybersecurity and Infrastructure Security Agency (CISA) pointed out in a bulletin from Sept. 6, "K-12 institutions may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers."

The UK hack may have turned up even more confidential information than the Los Angeles school system breach last year. As the BBC reported on Jan. 6, "One folder marked 'passports' contains passport scans for pupils and parents on school trips going back to 2011, whereas another marked 'contract' contains contractual offers made to staff alongside teaching documents on muscle contractions."

Some prominent school cyber attacks in the US include public school districts in Chicago, Baltimore, and Los Angeles. A new study from digital learning platform Clever claims that one in four schools experienced a cyber-incident over the past year, and according to a new report from security software vendor Emsisoft, at least 45 school districts and 44 higher learning institutions suffered ransomware attacks in 2022.

Schools are an attractive target as they are typically data-rich and resource-poor. Without proper resources in terms of dedicated staffing and the necessary tools and training to protect against cyber-attacks, schools can be a soft target. Many of the 14 schools hit by this latest leak are colleges and universities, but primary and secondary schools were also hit, according to the BBC's list.

https://www.darkreading.com/attacks-breaches/vice-society-releases-info-stolen-uk-schools-passport-scans

• The Dark Web’s Criminal Minds See Internet of Things as Next Big Hacking Prize

Cyber security experts say 2022 may have marked an inflection point due to the rapid proliferation of IoT (Internet of Things) devices.

Criminal groups buy and sell services, and one hot idea — a business model for a crime — can take off quickly when they realise that it works to do damage or to get people to pay. Attacks are evolving from those that shut down computers or stole data, to include those that could more directly wreak havoc on everyday life. IoT devices can be the entry points for attacks on parts of countries’ critical infrastructure, like electrical grids or pipelines, or they can be the specific targets of criminals, as in the case of cars or medical devices that contain software.

For the past decade, manufacturers, software companies and consumers have been rushing to the promise of Internet of Things devices. Now there are an estimated 17 billion in the world, from printers to garage door openers, each one packed with software (some of it open-source software) that can be easily hacked.

What many experts are anticipating is the day enterprising criminals or hackers affiliated with a nation-state figure out an easy-to-replicate scheme using IoT devices at scale. A group of criminals, perhaps connected to a foreign government, could figure out how to take control of many things at once – like cars, or medical devices. There have already been large-scale attacks using IoT, in the form of IoT botnets. In that case, actors leveraging unpatched vulnerabilities in IoT devices used control of those devices to carry out denial of service attacks against many targets. Those vulnerabilities are found regularly in ubiquitous products that are rarely updated.

In other words, the possibility already exists. It’s only a question of when a criminal or a nation decides to act in a way that targets the physical world at a large scale. There are a handful of companies, new regulatory approaches, a growing focus on cars as a particularly important area, and a new movement within the software engineering world to do a better job of incorporating cyber security from the beginning.

https://www.cnbc.com/2023/01/09/the-dark-webs-criminal-minds-see-iot-as-the-next-big-hacking-prize.html

• Corrupted File to Blame for Computer Glitch which Grounded Every US Flight

A corrupted file has been blamed for a glitch on the Federal Aviation Administration's computer system which saw every flight grounded across the US.

All outbound flights were grounded until around 9am Eastern Time (2pm GMT) on Wednesday as the FAA worked to restore its Notice to Air Missions (NOTAM) system, which alerts pilots of potential hazards along a flight route.

On Wednesday 4,948 flights within, into or out of the US had been delayed, according to flight tracker FlightAware.com, while 868 had been cancelled. Most delays were concentrated along the East Coast. Normal air traffic operations resumed gradually across the US following the outage to the NOTAM system that provides safety information to flight crews.

A corrupted file affected both the primary and the backup systems, a senior government official told NBC News on Wednesday night, adding that officials continue to investigate. Whilst Government officials said there was no evidence of a cyber attack, it shows the real world impacts that an outage or corrupted file can cause.

https://news.sky.com/story/all-flights-across-us-grounded-due-to-faa-computer-system-glitch-us-media-12784252

---

Threats

Ransomware, Extortion and Destructive Attacks

• Royal Mail unable to despatch items abroad after 'cyber incident' | UK News | Sky News

• Lorenz ransomware gang plants backdoors to use months later (bleepingcomputer.com)

• Quarter of UK SMBs Hit by Ransomware in 2022 - Infosecurity Magazine (infosecurity-magazine.com)

• Worldwide Ransomware Attacks Trend (informationsecuritybuzz.com)

• LastPass Faces Class-Action Lawsuit Over Password Vault Breach (pcmag.com)

• 10 of the biggest ransomware attacks of 2022 | TechTarget

• Rackspace: Ransomware actor accessed 27 customers' data | TechTarget

• Hackers demand £15 million ransom from Hull and Yorkshire schools after cyber attack - Hull Live (hulldailymail.co.uk)

• Rackspace Ransomware Incident Highlights Risks of Relying on Mitigation Alone (darkreading.com)

• Risk & Repeat: Analysing the Rackspace ransomware attack | TechTarget

• Guardian confirms it was hit by ransomware attack | The Guardian | The Guardian

• Post-ransomware attack, The Guardian warns staff their personal data was accessed • Graham Cluley

• The Guardian Confirms Personal Information Compromised in Ransomware Attack | SecurityWeek.Com

• Royal Mail cyber attack linked to LockBit ransomware operation (bleepingcomputer.com)

• The Guardian Confirms UK Members' Data Was Accessed in Ransomware Attack - Infosecurity Magazine (infosecurity-magazine.com)

• Hive Ransomware leaked 550 GB stolen from Consulate Health Care - Security Affairs

• Iowa’s largest school district cancels classes after cyber attack (bleepingcomputer.com)

• Hackers leak sensitive files after attack on San Francisco transit police (nbcnews.com)

• Vice Society ransomware claims attack on Australian firefighting service (bleepingcomputer.com)

• Ransomware attack at Hope Sentamu Learning Trust in York | York Press

Phishing & Email Based Attacks

• AI-generated phishing emails just got much more convincing • The Register

• Better Phishing, Easy Malicious Implants: How AI Could Change Cyber attacks (darkreading.com)

• AI-generated phishing attacks are becoming more convincing | Tripwire

• Twitter Data Leak: What the Exposure of 200 Million User Emails Means for You | WIRED

• New APT Dark Pink Hits Asia-Pacific, Europe With Spear Phishing Tactics - Infosecurity Magazine (infosecurity-magazine.com)

• Telegram Bot Abuse For Phishing Increased By 800% in 2022 - Infosecurity Magazine (infosecurity-magazine.com)

• Phishing campaign targets government institution in Moldova - Security Affairs

Malware

• Better Phishing, Easy Malicious Implants: How AI Could Change Cyber attacks (darkreading.com)

• Turla, a Russian Espionage Group, Piggybacked on Other Hackers' USB Infections | WIRED

• ChatGPT Used to Develop New Malicious Tools - Infosecurity Magazine (infosecurity-magazine.com)

• Russia’s Turla falls back on old malware C2 domains to avoid detection | Computer Weekly

• Many of 13 New Mac Malware Families Discovered in 2022 Linked to China | SecurityWeek.Com

• Dridex Malware Now Attacking macOS Systems with Novel Infection Method (thehackernews.com)

• New Spyware Variant with RAT Capabilities Targeting Financial Institutions, Social Media - MSSP Alert

• Over 1,300 fake AnyDesk sites push Vidar info-stealing malware (bleepingcomputer.com)

• Attackers abuse business-critical cloud apps to deliver malware - Help Net Security

• New Analysis Reveals Raspberry Robin Can be Repurposed by Other Threat Actors (thehackernews.com)

• 6 PyPI Packages Detour Firewall Using Cloudflare Tunnels (informationsecuritybuzz.com)

• Microsoft: Kubernetes clusters hacked in malware campaign via PostgreSQL (bleepingcomputer.com)

• Malicious PyPi packages create CloudFlare Tunnels to bypass firewalls (bleepingcomputer.com)

• Gootkit Loader Actively Targets Australian Healthcare Industry (trendmicro.com)

• Raspberry Robin's botnet second life - SEKOIA.IO Blog

• Telegram Bot Abuse For Phishing Increased By 800% in 2022 - Infosecurity Magazine (infosecurity-magazine.com)

• IcedID Malware Strikes Again: Active Directory Domain Compromised in Under 24 Hours (thehackernews.com)

• Android TV box on Amazon came pre-installed with malware (bleepingcomputer.com)

• VLC media player is being hiajcked to send out malware | TechRadar

• RAT malware campaign tries to evade detection using polyglot files (bleepingcomputer.com)

• Italian Users Warned of Malware Attack Targeting Sensitive Information (thehackernews.com)

• Hackers push fake Pokemon NFT game to take over Windows devices (bleepingcomputer.com)

• How to protect yourself from bot-driven account fraud - Help Net Security

Mobile

• Android spyware strikes again targeting financial institutions and your money | Fox News

• Messenger billed as better than Signal is riddled with vulnerabilities | Ars Technica

• StrongPity hackers target Android users via trojanized Telegram app (bleepingcomputer.com)

• Threema claims encryption flaws never had a real-world impact (bleepingcomputer.com)

• Latest Firmware Flaws in Qualcomm Snapdragon Need Attention (darkreading.com)

• Threat actors claim access to Telegram servers through insiders - Security Affairs

• $20K Buys Insider Access to Telegram Servers, Dark Web Ad Claims (darkreading.com)

Denial of Service/DoS/DDOS

• How to Defend Against any Type of DNS Attack | A10 Networks

• The most significant DDoS attacks in the past year - Help Net Security

• Multiple Danish Banks Disrupted By DDoS Cyber-Attack - Infosecurity Magazine (infosecurity-magazine.com)

• Big Prizes, Cash on Offer for Joining 'DDosia' Anti-Ukraine Cyber attack Project (darkreading.com)

• New Study Uncovers Text-to-SQL Model Vulnerabilities Allowing Data Theft and DoS Attacks (thehackernews.com)

• Serbia Slammed With DDoS Attacks (darkreading.com)

Internet of Things – IoT

• The dark web's criminal minds see IoT as the next big hacking prize (cnbc.com)

• Android TV box on Amazon came pre-installed with malware (bleepingcomputer.com)

• Hackers can trick Wi-Fi devices into draining their own batteries | New Scientist

Data Breaches/Leaks

• Twitter Data Leak: What the Exposure of 200 Million User Emails Means for You | WIRED

• 14 UK schools hit by cyber attack and documents leaked - BBC News

• Air France and KLM notify customers of account hacks (bleepingcomputer.com)

• Vice Society Releases Info Stolen From 14 UK Schools, Including Passport Scans (darkreading.com)

• Twitter's mushrooming data breach crisis could prove costly | CSO Online

• Twitter Denies Hacking Claims, Assures Leaked User Data Not from its System (thehackernews.com)

• 6 oversights that enable data breaches - Help Net Security

• CircleCI – code-building service suffers total credential compromise – Naked Security (sophos.com)

• Aflac's Japan says US partner leaked cancer customer info • The Register

• Data leak exposes information of 10,000 French social security beneficiaries | CSO Online

• Chick-fil-A investigates reports of hacked customer accounts (bleepingcomputer.com)

• Oxford University dating website for staff and students shut down after ‘huge data breach’ | News | The Times

• SolarWinds shareholders appeal Orion breach lawsuit to Delaware Supreme Court | SC Media (scmagazine.com)

Organised Crime & Criminal Actors

• JP Morgan must face suit over $272m cybertheft • The Register

• Cyber criminals are already using ChatGPT to own you | SC Media (scmagazine.com)

• Russian Cyber Crew Targets Ukraine Financial Sector Via Infected USB Drives - MSSP Alert

• 2022 Was the Biggest Year Yet for Crypto, if You're a Crook (gizmodo.com)

• Researchers Find 'Digital Crime Haven' While Investigating Magecart Activity (darkreading.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• 2022 Was the Biggest Year Yet for Crypto, if You're a Crook (gizmodo.com)

• European police takes down call centres behind cryptocurrency scams (bleepingcomputer.com)

• European cops shut down fake crypto call centres • The Register

• Kinsing Crypto Malware Hits Kubernetes Clusters via Misconfigured PostgreSQL (thehackernews.com)

Fraud, Scams & Financial Crime

• European police takes down call centres behind cryptocurrency scams (bleepingcomputer.com)

• Nationwide warns ‘checking is important’ as thousands targeted in online scam | Personal Finance |

• How to protect yourself from bot-driven account fraud - Help Net Security

Insurance

• Insurance Co. Beazley Launches $45M 'Cyber Catastrophe Bond' (gizmodo.com)

• Insurer Beazley launches first catastrophe bond for cyber threats | Financial Times (ft.com)

• 4 Cyber Insurance Requirement Predictions for 2023 (trendmicro.com)

Dark Web

• Threat actors claim access to Telegram servers through insiders - Security Affairs

• $20K Buys Insider Access to Telegram Servers, Dark Web Ad Claims (darkreading.com)

• Pakistan tells government agencies to avoid the dark web • The Register

Software Supply Chain

• Software Supply Chain Security Needs a Bigger Picture (darkreading.com)

Cloud/SaaS

• Attackers abuse business-critical cloud apps to deliver malware - Help Net Security

• Top SaaS Cyber security Threats in 2023: Are You Ready? (thehackernews.com)

• Why Do User Permissions Matter for SaaS Security? (thehackernews.com)

Attack Surface Management

• Why the atomized network is growing, and how to protect it - Help Net Security

• Web 3.0 Shifts Attack Surface and Highlights Need for Continuous Security (darkreading.com)

Identity and Access Management

• 4 identity security trends to watch in 2023 - Help Net Security

Encryption

• RSA crypto cracked? Or perhaps not! – Naked Security (sophos.com)

• What is Triple DES and why is it being disallowed? | TechTarget

Passwords, Credential Stuffing & Brute Force Attacks

• A fifth of passwords used by federal agency cracked in security audit | Ars Technica

• Why FIDO and passwordless authentication is the future - Help Net Security

• 'Copyright Infringement' Lure Used for Facebook Credential Harvesting (darkreading.com)

• Why it might be time to consider using FIDO-based authentication devices | CSO Online

Social Media

• Twitter Data Leak: What the Exposure of 200 Million User Emails Means for You | WIRED

• Twitter's mushrooming data breach crisis could prove costly | CSO Online

• New Spyware Variant with RAT Capabilities Targeting Financial Institutions, Social Media - MSSP Alert

• Twitter Denies Hacking Claims, Assures Leaked User Data Not from its System (thehackernews.com)

• If governments are banning TikTok, why is it still on your corporate devices? | CSO Online

• 'Copyright Infringement' Lure Used for Facebook Credential Harvesting (darkreading.com)

Training, Education and Awareness

• 1 in 3 Organisations Do Not Provide Any Cyber Security Training to Remote Workers Despite a Majority of Employees Having Access to Critical Data (darkreading.com)

Regulations, Fines and Legislation

• Technical And Legal Risks Of ChatGPT: How Prepared Are We With Laws On AI? (informationsecuritybuzz.com)

Governance, Risk and Compliance

• US cyber security director: The tech ecosystem has ‘become really unsafe’ (yahoo.com)

• Global Cyber-Attack Volume Surges 38% in 2022 - Infosecurity Magazine (infosecurity-magazine.com)

• Customer and Employee Data the Top Prize for Hackers – Imperva - Infosecurity Magazine (infosecurity-magazine.com)

• 1 in 3 Organisations Do Not Provide Any Cyber Security Training to Remote Workers Despite a Majority of Employees Having Access to Critical Data (darkreading.com)

• Global Risks Report: Understand the risk landscape in 2023 and beyond - Help Net Security

• 6 oversights that enable data breaches - Help Net Security

• Why Analysing Past Incidents Helps Teams More Than Usual Security Metrics (darkreading.com)

• Cyber security spending and economic headwinds in 2023 | CSO Online

• How to Ensure Cyber Security Investments Remain a Priority Across Your Organisation (darkreading.com)

• Practical Risk Management - Beyond Certification (informationsecuritybuzz.com)

• Vulnerable software, low incident reporting raises risks | TechTarget

• How Will a Recession Will Affect CISOs? | SecurityWeek.Com

Careers, Working in Cyber and Information Security

• Cyber security staff are struggling. Here's how to support them better | ZDNET

Law Enforcement Action and Take Downs

• European cops shut down fake crypto call centres • The Register

• European police takes down call centres behind cryptocurrency scams (bleepingcomputer.com)

Privacy, Surveillance and Mass Monitoring

• Hidden Chinese tracking device 'found in UK Government car' sparks national security fears (inews.co.uk)

Artificial Intelligence

• AI-generated phishing emails just got much more convincing • The Register

• ChatGPT: The infosec assistant that is jack of all trades, master of none - Help Net Security

• How hackers might be exploiting ChatGPT | Cybernews

• Better Phishing, Easy Malicious Implants: How AI Could Change Cyber attacks (darkreading.com)

• VALL-E AI can mimic a person’s voice from a 3-second snippet • The Register

• ChatGPT Artificial Intelligence: An Upcoming Cyber security Threat? (darkreading.com)

• Hackers Exploiting OpenAI’s ChatGPT to Deploy Malware (hackread.com)

• Cyber criminals are already using ChatGPT to own you | SC Media (scmagazine.com)

• Trojan Puzzle attack trains AI assistants into suggesting malicious code (bleepingcomputer.com)

• The ChatGPT bot is causing panic now – but it’ll soon be as mundane a tool as Excel | John Naughton | The Guardian

• How hackers might be exploiting ChatGPT | Cybernews

• ChatGPT Used to Develop New Malicious Tools - Infosecurity Magazine (infosecurity-magazine.com)

• Technical And Legal Risks Of ChatGPT: How Prepared Are We With Laws On AI? (informationsecuritybuzz.com)

• DHS, CISA plan AI-based cyber security analytics sandbox • The Register

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• Turla, a Russian Espionage Group, Piggybacked on Other Hackers' USB Infections | WIRED

• Russia’s Turla falls back on old malware C2 domains to avoid detection | Computer Weekly

• Hidden Chinese tracking device 'found in UK Government car' sparks national security fears (inews.co.uk)

• Ukraine: Russian Cyber-Attacks Should Be Considered War Crimes - Infosecurity Magazine (infosecurity-magazine.com)

• New APT Dark Pink Hits Asia-Pacific, Europe With Spear Phishing Tactics - Infosecurity Magazine (infosecurity-magazine.com)

• Exclusive: Russian hackers targeted U.S. nuclear scientists | Reuters

• Russian cyber attacks on Ukraine halved with help from Amazon and Microsoft (telegraph.co.uk)

• Dark Pink, a newly discovered hacking campaign, threatens Southeast Asian military, government organisations (cyberscoop.com)

• New Dark Pink APT group targets govt and military with custom malware (bleepingcomputer.com)

• Big Prizes, Cash on Offer for Joining 'DDosia' Anti-Ukraine Cyber attack Project (darkreading.com)

• Phishing campaign targets government institution in Moldova - Security Affairs

• Serbia Slammed With DDoS Attacks (darkreading.com)

• Russian and Belarusian men charged with spying for Russian GRU - Security Affairs

---

Nation State Actors

Nation State Actors – Russia

• Turla, a Russian Espionage Group, Piggybacked on Other Hackers' USB Infections | WIRED

• Russia’s Turla falls back on old malware C2 domains to avoid detection | Computer Weekly

• Ukraine: Russian Cyber-Attacks Should Be Considered War Crimes - Infosecurity Magazine (infosecurity-magazine.com)

• Exclusive: Russian hackers targeted U.S. nuclear scientists | Reuters

• Russian cyber attacks on Ukraine halved with help from Amazon and Microsoft (telegraph.co.uk)

• How Elon Musk’s Starlink has changed warfare | The Economist

• Big Prizes, Cash on Offer for Joining 'DDosia' Anti-Ukraine Cyber attack Project (darkreading.com)

• Phishing campaign targets government institution in Moldova - Security Affairs

• Serbia Slammed With DDoS Attacks (darkreading.com)

• Russian and Belarusian men charged with spying for Russian GRU - Security Affairs

• Musk's Starlink Satellite's Role In Ukraine War Inspires Taiwan To Thwart Potential China Attack

Nation State Actors – China

• Hidden Chinese tracking device 'found in UK Government car' sparks national security fears (inews.co.uk)

• Many of 13 New Mac Malware Families Discovered in 2022 Linked to China | SecurityWeek.Com

• If governments are banning TikTok, why is it still on your corporate devices? | CSO Online

• Musk's Starlink Satellite's Role In Ukraine War Inspires Taiwan To Thwart Potential China Attack

Nation State Actors – Iran

• Iran says it foiled cyber attack on central bank | Reuters

Nation State Actors – Misc

• New APT Dark Pink Hits Asia-Pacific, Europe With Spear Phishing Tactics - Infosecurity Magazine (infosecurity-magazine.com)

• Dark Pink, a newly discovered hacking campaign, threatens Southeast Asian military, government organisations (cyberscoop.com)

• New Dark Pink APT group targets govt and military with custom malware (bleepingcomputer.com)

---

Vulnerability Management

Applications Five Years or Older Likely to have Security Flaws - Infosecurity Magazine (infosecurity-magazine.com)

Patch Where it Hurts: Effective Vulnerability Management in 2023 (thehackernews.com)

70% of apps contain at least one security flaw after 5 years in production - Help Net Security

Rackspace Ransomware Incident Highlights Risks of Relying on Mitigation Alone (darkreading.com)

Does a hybrid model for vulnerability management make sense? • Graham Cluley

Vulnerabilities

• Microsoft Patch Tuesday: 97 Windows Vulns, 1 Exploited Zero-Day | SecurityWeek.Com

• Microsoft plugs actively exploited zero-day hole (CVE-2023-21674) - Help Net Security

• The Roadmap to Secure Access Service Edge (SASE) - MSSP Alert

• Hundreds of SugarCRM servers infected with critical in-the-wild exploit | Ars Technica

• Chrome 109 Patches 17 Vulnerabilities | SecurityWeek.Com

• Cyber criminals bypass Windows security with driver-vulnerability exploit | CSO Online

• Google Chrome 'SymStealer' Vulnerability Could Affect 2.5 Billion Users - Infosecurity Magazine (infosecurity-magazine.com)

• Attackers target govt networks exploiting Fortinet SSL-VPN CVE-2022-42475 - Security Affairs

• Adobe Plugs Security Holes in Acrobat, Reader Software | SecurityWeek.Com

• Zoom Patches High Risk Flaws on Windows, MacOS Platforms | SecurityWeek.Com

• Cisco warns of auth bypass bug with public exploit in EoL routers (bleepingcomputer.com)

• Swiss Threema messaging app found to have vulnerabilities • The Register

• Alert: Hackers Actively Exploiting Critical "Control Web Panel" RCE Vulnerability (thehackernews.com)

• Fortinet says hackers exploited critical vulnerability to infect VPN customers | Ars Technica

• Critical bug in Cisco Small Business Routers will receive no patch - Security Affairs

• Severe Vulnerabilities Allow Hacking of Asus Gaming Router | SecurityWeek.Com

• JsonWebToken Security Bug Opens Servers to RCE (darkreading.com)

• Latest Firmware Flaws in Qualcomm Snapdragon Need Attention (darkreading.com)

---

Tools and Controls

• How to prevent and detect lateral movement attacks | TechTarget

• 65% of Organisations Plan to Adopt a Security Service Edge Platform in Next 2 Years: Axis Security (darkreading.com)

• How Will a Recession Will Affect CISOs? | SecurityWeek.Com

• What is Red Teaming & How it Benefits Orgs (trendmicro.com)

• Data Loss Prevention Capability Guide (informationsecuritybuzz.com)

• 4 key shifts in the breach and attack simulation (BAS) market - Help Net Security

• How to prioritize effectively with threat modeling • The Register

• XDR and the Age-old Problem of Alert Fatigue | SecurityWeek.Com

• 11 top XDR tools and how to evaluate them | CSO Online

• Why FIDO and passwordless authentication is the future - Help Net Security

• Why it might be time to consider using FIDO-based authentication devices | CSO Online

• How to Defend Against any Type of DNS Attack | A10 Networks

• DHS, CISA plan AI-based cyber security analytics sandbox • The Register

• ChatGPT: The infosec assistant that is jack of all trades, master of none - Help Net Security

---

Other News

• Better Include Physical Security With Cyber security | T&D World

• 6 oversights that enable data breaches - Help Net Security

• It’s official: Digital trust really matters to everyone online - Help Net Security

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 30 December 2022

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• Cyber Attacks Set to Become ‘Uninsurable’, Says Zurich Chief

The chief executive of one of Europe’s biggest insurance companies has warned that cyber attacks, rather than natural catastrophes, will become “uninsurable” as the disruption from hacks continues to grow.

Insurance executives have been increasingly vocal in recent years about systemic risks, such as pandemics and climate change, that test the sector’s ability to provide coverage. For the second year in a row, natural catastrophe-related claims are expected to top $100bn. 

But Mario Greco, chief executive at insurer Zurich, told the Financial Times that cyber was the risk to watch. “What will become uninsurable is going to be cyber,” he said. “What if someone takes control of vital parts of our infrastructure, the consequences of that?” Recent attacks that have disrupted hospitals, shut down pipelines and targeted government departments have all fed concern about this expanding risk among industry executives. Focusing on the privacy risk to individuals was missing the bigger picture, Greco added: “First off, there must be a perception that this is not just data . . . this is about civilisation. These people can severely disrupt our lives.” 

Spiralling cyber losses in recent years have prompted emergency measures by the sector’s underwriters to limit their exposure. As well as pushing up prices, some insurers have responded by tweaking policies so clients retain more losses. There are exemptions written into policies for certain types of attacks. In 2019, Zurich initially denied a $100mn claim from food company Mondelez, arising from the NotPetya attack, on the basis that the policy excluded a “warlike action”. The two sides later settled. In September, Lloyd’s of London defended a move to limit systemic risk from cyber attacks by requesting that insurance policies written in the market have an exemption for state-backed attacks.

https://www.ft.com/content/63ea94fa-c6fc-449f-b2b8-ea29cc83637d

Your Business Should Compensate for Modern Ransomware Capabilities Right Now

The “if, not when” mentality surrounding ransomware may be the biggest modern threat to business longevity. Companies of all sizes and across all industries are increasingly common targets for ransomware attacks, and we know that 94% of organisations experienced a cyber security incident last year alone. Yet, many enterprises continue to operate with decades-old security protocols that are unequipped to combat modern ransomware. Leaders have prioritised improving physical security measures in light of the pandemic — so why haven’t ransomware protections improved?

Maybe it’s the mistaken notion that ransomware attacks are declining. In reality, Q1 of 2022 saw a 200% YoY increase in ransomware incidents. Meanwhile, the rise in Ransomware as a Service (RaaS) offerings suggests that cyber threats have become a commodity for bad actors.

The RaaS market presents a new and troubling trend for business leaders and IT professionals. With RaaS — a subscription ransomware model that allows affiliates to deploy malware for a fee — the barrier to entry for hackers is lower than ever. The relatively unskilled nature of RaaS hackers may explain why the average ransomware downtime has plummeted to just 3.85 days (compared to an average attack duration of over two months in 2019).

While the decrease in attack duration is promising, the rise of RaaS still suggests an inconvenient truth for business leaders: All organisations are at risk. And in time, all organisations will become a target, which is why it’s time for IT and business leaders to implement tough cyber security protocols.

https://venturebeat.com/security/your-business-should-compensate-for-modern-ransomware-capabilities-right-now/

• Reported Phishing Attacks Have Quintupled

In the third quarter of 2022, the international Anti-Phishing Working Group (APWG) consortium observed 1,270,883 total phishing attacks; the worst quarter for phishing that APWG has ever observed. The total for August 2022 was 430,141 phishing sites, the highest monthly total ever reported to APWG.

Over recent years, reported phishing attacks submitted to APWG have more than quintupled since the first quarter of 2020, when APWG observed 230,554 attacks. The rise in Q3 2022 was attributable, in part, to increasing numbers of attacks reported against several specific targeted brands. These target companies and their customers suffered from large numbers of attacks from persistent phishers.

Threat researchers at the cyber security solution provider Fortra noted a 488 percent increase in response-based email attacks in Q3 2022 compared to the prior quarter. While every subtype of these attacks increased compared to Q2, the largest increase was in Advance Fee Fraud schemes, which rose by a staggering 1,074 percent.

In the third quarter of 2022, APWG founding member OpSec Security found that phishing attacks against the financial sector, which includes banks, remained the largest set of attacks, accounting for 23.2 percent of all phishing. Attacks against webmail and software-as-a-service (SaaS) providers remained prevalent as well. Phishing against social media services fell to 11 percent of the total, down from 15.3 percent.

Phishing against cryptocurrency targets — such as cryptocurrency exchanges and wallet providers — fell from 4.5 percent of all phishing attacks in Q2 2022 to 2 percent in Q3. This mirrored the fall in value of many cryptocurrencies since mid-year.

https://www.helpnetsecurity.com/2022/12/28/reported-phishing-attacks-quintupled/

• Ransomware, DDoS See Major Upsurge Led by Upstart Hacker Group

Cyber threat actors Cuba and Royal are driving a 41% boom in ransomware and other attacks hitting industry and consumer goods and services.

According to the Global Threat Intelligence team of information assurance firm NCC Group, November saw a 41% increase in ransomware attacks from 188 incidents to 265. In its most recent Monthly Threat Pulse, the group reported that the month was the most active for ransomware attacks since April this year.

Key takeaways from the study:

• Ransomware attacks rose by 41% in November.

• Threat group Royal (16%) was the most active, replacing LockBit as the worst offender for the first time since September 2021.

• Industrials (32%) and consumer cyclicals (44%) remain the top two most targeted sectors, but technology experienced a large 75% increase over the last month.

• Regional data remains consistent with last month — North America (45%), Europe (25%) and Asia (14%)

• DDoS attacks continue to increase.

Recent examples in the services sector include the Play ransomware group’s claimed attack of the German H-Hotels chain, resulting in communications outages. This attack reportedly uses a vulnerability in Microsoft Exchange called ProxyNotShell, which as the name implies, has similarities to the ProxyShell zero-day vulnerability revealed in 2021.

Also, back on the scene is the TrueBot malware downloader (a.k.a., the silence.downloader), which is showing up in an increasing number of devices. TrueBot Windows malware, designed by a Russian-speaking hacking group identified as Silence, has resurfaced bearing Ransom.Clop, which first appeared in 2019. Clop ransomware encrypts systems and exfiltrates data with the threat that if no ransom is forthcoming, the data will show up on a leak site.

https://www.techrepublic.com/article/ransomware-ddos-major-upsurge-led-upstart-hacker-group/

• Videoconferencing Worries Grow, With SMBs in Cyber Attack Crosshairs

Securing videoconferencing solutions is just one of many IT security challenges small businesses are facing, often with limited financial and human resources.

It's no secret that the acceleration of work-from-home and distributed workforce trends — infamously spurred on by the pandemic — has occurred in tandem with the rise of video communications and collaboration platforms, led by Zoom, Microsoft, and Cisco.

But given that videoconferencing now plays a critical role in how businesses interact with their employees, customers, clients, vendors, and others, these platforms carry significant potential security risks, researchers say.

Organisations use videoconferencing to discuss M&A, legal, military, healthcare, intellectual property and other topics, and even corporate strategies. A loss of that data could be catastrophic for a company, its employees, its clients, and its customers.

However, a recent report on videoconferencing security showed that 93% of IT professionals surveyed acknowledged security vulnerabilities and gaping risks in their videoconferencing solutions.

Among the most relevant risks is the lack of controlled access to conversations that could result in disruption, sabotage, compromise, or exposure of sensitive information, while use of nonsecure, outdated, or unpatched videoconferencing applications can expose security flaws.

The risks include the potential for interruptions, unauthorised access, and perhaps most concerning, the opportunity for a bad actor to acquire sensitive information.

https://www.darkreading.com/application-security/videoconferencing-worries-grow-with-smbs-in-cyberattack-crosshairs

• Will the Crypto Crash Impact Cyber Security in 2023? Maybe.

With the implosion of the FTX exchange putting a punctuation mark on the cryptocurrency crash of 2022, one of the natural questions for those in the cyber security world is, how will this rapid decline of cryptocurrency valuations change the cyber crime economy?

Throughout the most recent crypto boom, and even before then, cyber criminals have used and abused cryptocurrency to build up their empires. The cryptocurrency market provides the extortionary medium for ransomware; it's a hotbed of scams against consumers to steal their wallets and accounts. Traditionally, it's provided a ton of anonymous cover for money laundering on the back end of a range of cyber criminal enterprises.

Even so, according to cyber security experts and intelligence analysts, while there certainly have been some shifts in trends and tactics that they believe are loosely tied to the crypto crash, the jury's still out on long-term impacts.

Regardless of crypto values, cyber criminals this year have definitely become more sophisticated in how they use cryptocurrencies to monetise their attacks including the use by some ransomware groups taking advantage of yield farming within decentralised finance (DeFi), as an example.

The concept of yield farming is the same as lending money, with a contract in place that clearly shows how much interest will need to be paid. The advantage for ransomware groups is that the 'interest' will be legitimate proceeds, so there will be no need to launder or hide it.

Threat actors are increasingly turning toward 'stablecoins,' which are usually tied to fiat currencies or gold to stem their volatility. In many ways, the downturn in crypto values has increased the risk appetite of cyber criminals and is spurring them into more investment fraud and cryptocurrency scams.

https://www.darkreading.com/threat-intelligence/crypto-crash-impact-cybersecurity-2023-maybe

• The Worst Hacks of 2022

The year was marked by sinister new twists on cyber security classics, including phishing, breaches, and ransomware attacks.

With the pandemic evolving into an amorphous new phase and political polarisation on the rise around the world, 2022 was an uneasy and often perplexing year in digital security. And while hackers frequently leaned on old chestnuts like phishing and ransomware attacks, they still found vicious new variations to subvert defences.

Technology magazine Wired looked back on the year's worst breaches, leaks, ransomware attacks, state-sponsored hacking campaigns, and digital takeovers. If the first years of the 2020s are any indication, the digital security field in 2023 will be more bizarre and unpredictable than ever. Stay alert, and stay safe out there.

Russia Hacking Ukraine

For years, Russia has pummelled Ukraine with brutal digital attacks causing blackouts, stealing and destroying data, meddling in elections, and releasing destructive malware to ravage the country's networks. Since invading Ukraine in February, though, times have changed for some of Russia's most prominent and most dangerous military hackers. Shrewd long-term campaigns and grimly ingenious hacks have largely given way to a stricter and more regimented clip of quick intrusions into Ukrainian institutions, reconnaissance, and widespread destruction on the network—and then repeated access over and over again, whether through a new breach or by maintaining the old access.

Twilio and the 0ktapus Phishing Spree

Over the summer, a group of researchers dubbed 0ktapus went on a massive phishing bender, compromising nearly 10,000 accounts within more than 130 organisations. The majority of the victim institutions were US-based, but there were dozens in other countries as well.

Ransomware Still Hitting the Most Vulnerable Targets

In recent years, countries around the world and the cyber security industry have increasingly focused on countering ransomware attacks. While there has been some progress on deterrence, ransomware gangs were still on a rampage in 2022 and continued to target vulnerable and vital social institutions, including health care providers and schools. The Russian-speaking group Vice Society, for example, has long specialised in targeting both categories, and it focused its attacks on the education sector this year.

The Lapsus$ Rampage Continues

The digital extortion gang Lapsus$ was on an intense hacking spree at the beginning of 2022, stealing source code and other sensitive information from companies like Nvidia, Samsung, Ubisoft, and Microsoft and then leaking samples as part of apparent extortion attempts. Lapsus$ has a sinister talent for phishing, and in March, it compromised a contractor with access to the ubiquitous authentication service Okta.

LastPass

The beleaguered password manager giant LastPass, which has repeatedly dealt with data breaches and security incidents over the years, said at the end of December that a breach of its cloud storage in August led to a further incident in which hackers targeted a LastPass employee to compromise credentials and cloud storage keys.

Vanuatu

At the beginning of November, Vanuatu, an island nation in the Pacific, was hit by a cyber attack that took down virtually all of the government's digital networks. Agencies had to move to conducting their work on paper because emergency systems, medical records, vehicle registrations, driver's license databases, and tax systems were all down.

Honourable Mention: Twitter-Related Bedlam

Twitter has been in chaos mode for months following Elon Musk's acquisition of the company earlier this year. Amidst the tumult, reports surfaced in July and then again in November of a trove of 5.4 million Twitter users' data that has been circulating on criminal forums since at least July, if not earlier. The data was stolen by exploiting a vulnerability in a Twitter application programming interface, or API.

https://www.wired.com/story/worst-hacks-2022/

• Geopolitical Tensions Expected to Further Impact Cyber Security in 2023

Geopolitics will continue to have an impact on cyber security and the security posture of organisations long into 2023.

The impact of global conflicts on cyber security was thrust into the spotlight when Russia made moves to invade Ukraine in February 2022. Ukraine’s Western allies were quick to recognise that with this came the threat of Russian-backed cyber-attacks against critical national infrastructure (CNI), especially in retaliation to hefty sanctions. While this may not have materialised in the way many expected, geopolitics is still front of mind for many cyber security experts looking to 2023.

Russia has always been among a handful of states recognised for their cyber prowess and being the source of many cyber criminal gangs. As previously mentioned, we have failed to see a significant cyber-attack, at least one comparable to the Colonial Pipeline incident, in 2022. However the cyber security services provider, e2e-assure, warned: “We have underestimated Russia’s cyber capability. There is a wide view that Russian cyber activity leading up to and during their invasion of Ukraine indicated that they aren’t the cyber power we once thought. Patterns and evidence will emerge in 2023 that shows this wasn’t the case, instead Russia was directing its cyber efforts elsewhere, with non-military goals (financial and political).”

NordVPN, the virtual private network (VPN) provider, warns that the cyber-war is only just starting: “With China’s leader securing his third term and Russia’s war in Ukraine, many experts predict an increase in state-sponsored cyber-attacks. China may increase cyber-attacks on Taiwan, Hong Kong, and other countries opposing the regime. Meanwhile, Russia is predicted to sponsor attacks on countries supporting Ukraine.”

We are used to seeing cyber-attacks that encrypt data and ask for ransom, but it is likely in this era of nation-state sponsored attacks we could experience attacks for the sake of disruption.

https://www.infosecurity-magazine.com/news/geopolitical-tensions-impact/

• Fraudsters’ Working Patterns Have Changed in Recent Years

Less sophisticated fraud — in which doctored identity documents are readily spotted — has jumped 37% in 2022, according to the identify verfication provider Onfido. Fraudsters can scale these attacks on an organisation’s systems around the clock.

It is estimated that the current global financial cost of fraud is $5.38 trillion (£4.37 trillion), which is 6.4% of the world’s GDP. With most fraud now happening online (80% of reported fraud is cyber-enabled), Onfido’s Identity Fraud Report uncovers patterns of fraudster behaviour, attack techniques, and emerging tactics.

Over the last four years, fraudsters’ working patterns have dramatically changed. In 2019, attacks mirrored a typical working week, peaking Monday to Friday and dropping off during the weekends. Yet over the last three years, fraudulent activity started to shift so that levels of fraud span every day of the week.

In 2022, fraud levels were consistent across 24 hours, seven days a week. With technology, fraudsters are more connected across the globe and are able to traverse regions and time zones, and can easily take advantage of businesses’ closed hours when staff are likely offline. This hyperconnectivity means there are no more ‘business hours’ for fraudsters and sophisticated fraud rings — they will scam and defraud 24/7.

“As criminals look to take advantage of digitisation processes, they’re able to commit financial crimes with increasing efficiency and sophistication, to the extent that financial crime and cyber crime are now invariably linked,” said Interpol. “A significant amount of financial fraud takes place through digital technologies, and the pandemic has only hastened the emergence of digital money laundering tools and other cyber-enabled financial crimes.”

https://www.helpnetsecurity.com/2022/12/29/less-sophisticated-fraud/

• Hacktivism is Back and Messier Than Ever

Throughout 2022, geopolitics has given rise to a new wave of politically motivated attacks with an undercurrent of state-sponsored meddling.

During its brutal war in Ukraine, Russian troops have burnt cities to the ground, raped and tortured civilians, and committed scores of potential war crimes. On November 23, lawmakers across Europe overwhelmingly labelled Russia a “state sponsor” of terrorism and called for ties with the country to be reduced further. The response to the declaration was instant. The European Parliament’s website was knocked offline by a DDoS attack.

The unsophisticated attack—which involves flooding a website with traffic to make it inaccessible—disrupted the Parliament’s website offline for several hours. Pro-Russian hacktivist group Killnet claimed responsibility for the attack. The hacktivist group has targeted hundreds of organisations around the world this year, having some limited small-scale successes knocking websites offline for short periods of time. It’s been one player in a bigger hacktivism surge.

Following years of sporadic hacktivist activity, 2022 has seen the re-emergence of hacktivism on a large scale. Russia’s full-scale invasion of Ukraine spawned scores of hacktivist groups on both sides of the conflict, while in Iran and Israel, so-called hacktivist groups are launching increasingly destructive attacks. This new wave of hacktivism, which varies between groups and countries, comes with new tactics and approaches and, increasingly, is blurring lines between hacktivism and government-sponsored attacks.

https://www.wired.com/story/hacktivism-russia-ukraine-ddos/

---

Threats

Ransomware, Extortion and Destructive Attacks

• Custom-Branded Ransomware: The Vice Society Group and the Threat of Outsourced Development - SentinelOne

• Jersey school locked out of systems as hackers demand "ransom" | Bailiwick Express Jersey

• Vice Society Ransomware Attackers Adopt Robust Encryption Methods (thehackernews.com)

• Global counter-ransomware task force to become active in January - CyberScoop

• Fool Me Thrice? How to Avoid Double and Triple Ransomware Extortion (darkreading.com)

• Rackspace criticized for PR response to ransomware attack (expressnews.com)

• After ransomware hits Colombian energy firm, Moody’s says low patch rate suggests inadequacies in cyber practices | SC Media (scmagazine.com)

• Ransomware, DDoS see major upsurge led by upstart hacker group (techrepublic.com)

• 6 Ways to Protect Your Organisation Against LAPSUS$ (darkreading.com)

• Your business should compensate for modern ransomware capabilities right now | VentureBeat

• Vice Society Adds Custom-branded Payload PolyVice to its Arsenal | Cyware Alerts - Hacker News

• Hackers stole data from multiple electric utilities in recent ransomware attack | CNN Politics

• Ransomware attack at Louisiana hospital impacts 270,000 patients (bleepingcomputer.com)

• The mounting death toll of hospital cyber attacks - POLITICO

• Royal ransomware claims attack on Intrado telecom provider (bleepingcomputer.com)

• Healthcare Providers and Hospitals Under Ransomware's Siege (darkreading.com)

• 2023 Predictions: Expect More Supply Chain Attacks, Ransomware-as-a-Service Kits in 2023 - MSSP Alert

• Guardian Australia staff sent home after cyber attack takes out systems (theage.com.au)

• Queensland University hit by cyber attack | PerthNow

• Dumfries Arnold Clark garages hit by company-wide cyber attack - Daily Record

• Ransom Deadline Given By LockBit In Port Of Lisbon Attack (informationsecuritybuzz.com)

Phishing & Email Based Attacks

• Reported phishing attacks have quintupled - Help Net Security

• 6 Ways to Protect Your Organisation Against LAPSUS$ (darkreading.com)

Other Social Engineering; Smishing, Vishing, etc

• Linkedin Is Full Of Job Scams – Be Careful Out There (informationsecuritybuzz.com)

Malware

• GuLoader implements new evasion techniques - Security Affairs

• PrivateLoader PPI Service Found Distributing Info-Stealing RisePro Malware (thehackernews.com)

• 2022 sees over 5000 times new Windows malware vs macOS, over 60 times vs Linux - Neowin

• APT Hackers Turn to Malicious Excel Add-ins as Initial Intrusion Vector (thehackernews.com)

• New information-stealing malware is being spread by fake pirate sites | TechSpot

Mobile

• Hackers steal $8 million from users running trojanized BitKeep apps (bleepingcomputer.com)

• EarSpy: Spying on Phone Calls via Ear Speaker Vibrations Captured by Accelerometer | SecurityWeek.Com

Denial of Service/DoS/DDOS

• Cyber criminals create new methods to evade legacy DDoS defences - Help Net Security

Internet of Things – IoT

• Anker admits Eufy camera security issues | TechRadar

• Smart Home Cyber security Hubs: Protecting Endpoints in Your Smarthome (compuquip.com)

• Google Home speakers allowed hackers to snoop on conversations (bleepingcomputer.com)

Data Breaches/Leaks

• BetMGM discloses security breach impacting 1.5 Million customers - Security Affairs

• Massive Twitter data leak investigated by EU privacy watchdog (bleepingcomputer.com)

• LastPass finally admits: Those crooks who got in? They did steal your password vaults, after all… – Naked Security (sophos.com)

• Massive EDiscovery Provider Shut Down Over 'Unauthorized Access' - Above the LawAbove the Law

• Data of 400 Million Twitter users up for sale - Security Affairs

• Ten significant data breaches from 2022 (smartermsp.com)

• It’s all in the (lack of) details: 2022’s badly handled data breaches | TechCrunch

• Military device with biometric database of 2K people sold on eBay for $68 | Ars Technica

Organised Crime & Criminal Actors

• 'Cyber crime has surpassed drug trafficking' - Rediff.com India News

• Labour attacks delays to online safety bill as it highlights Christmas scams | Cyber crime | The Guardian

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• FTX collapse shows crypto is 'too dangerous' not to regulate, Bank of England deputy governor says | Business News | Sky News

• How ‘brazen’ multibillion-dollar crypto fraud fell to pieces | Business | The Times

• BTC.com lost $3 million worth of cryptocurrency in cyber attack (bleepingcomputer.com)

• Hackers steal $8 million from users running trojanized BitKeep apps (bleepingcomputer.com)

• Bitcoin Mining Pool Btc.com Suffers $3 Million Cyber attack – Mining Bitcoin News

• Crypto wallet BitKeep lost over $9M over a cyber attack - Security Affairs

• Case for blockchain in financial services dented by failures | Financial Times (ft.com)

• Digital Assets Of $9.9 Million Stolen In BitKeep Cyber Attack (informationsecuritybuzz.com)

• Crypto platform 3Commas admits hackers stole API keys (bleepingcomputer.com)

Fraud, Scams & Financial Crime

• Linkedin Is Full Of Job Scams – Be Careful Out There (informationsecuritybuzz.com)

• Scam complaints from Revolut users more than double since 2020 (telegraph.co.uk)

• Labour attacks delays to online safety bill as it highlights Christmas scams | Cyber crime | The Guardian

• Fraudsters’ working patterns have changed in recent years - Help Net Security

• Experts warn of attacks exploiting WordPress gift card plugin - Security Affairs

• North Korean Hackers Created 70 Fake Bank, Venture Capital Firm Domains | SecurityWeek.Com

• Ukraine shuts down fraudulent call center claiming 18,000 victims (bleepingcomputer.com)

Insurance

• Zurich chief warned that cyber attacks will become uninsurable - Security Affairs

Supply Chain and Third Parties

• 2023 Predictions: Expect More Supply Chain Attacks, Ransomware-as-a-Service Kits in 2023 - MSSP Alert

Software Supply Chain

• Why Attackers Target GitHub, and How You Can Secure It (darkreading.com)

• Improving Software Supply Chain Cyber security (trendmicro.com)

Cloud/SaaS

• Google: With Cloud Comes APIs & Security Headaches (darkreading.com)

Identity and Access Management

• Enterprises waste money on identity tools they don't use - Help Net Security

• Steps To Planning And Implementation Of PAM Solutions (informationsecuritybuzz.com)

Encryption

• US passes the Quantum Computing Cybersecurity Preparedness Act – and why not? – Naked Security (sophos.com)

API

• Crypto platform 3Commas admits hackers stole API keys (bleepingcomputer.com)

• Google: With Cloud Comes APIs & Security Headaches (darkreading.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Extracting Encrypted Credentials From Common Tools (darkreading.com)

Biometrics

• Military device with biometric database of 2K people sold on eBay for $68 | Ars Technica

Social Media

• TikTok User Data Has Been Compromised (giantfreakinrobot.com)

• Elon Musk ‘orders Twitter to remove suicide prevention feature’ | Twitter | The Guardian

• Massive Twitter data leak investigated by EU privacy watchdog (bleepingcomputer.com)

• TikTok parent company ByteDance revealed the use of TikTok data to track journalists - Security Affairs

• Meta settles Cambridge Analytica scandal case for $725m - BBC News

• TikTok bans haven't really banned much of anything - The Washington Post

• Twitter restores suicide prevention feature | Twitter | The Guardian

• Data of 400 Million Twitter users up for sale - Security Affairs

• Hacker claims to be selling Twitter data of 400 million users (bleepingcomputer.com)

• Piers Morgan’s Twitter account abuses queen and Ed Sheeran in apparent hack | Piers Morgan | The Guardian

• US House boots TikTok from government phones • The Register

Malvertising

• Hackers abuse Google Ads to spread malware in legit software (bleepingcomputer.com)

• Cyber criminals using search engine ads to direct users to sites with malware, FBI warns | SC Media (scmagazine.com)

Privacy

• The Threat of Predictive Policing to Data Privacy and Personal Liberty (darkreading.com)

Regulations, Fines and Legislation

• FTX collapse shows crypto is 'too dangerous' not to regulate, Bank of England deputy governor says | Business News | Sky News

• US passes the Quantum Computing Cybersecurity Preparedness Act – and why not? – Naked Security (sophos.com)

Governance, Risk and Compliance

• IBM and 70 Global Banks Co-Create New Cyber security, Risk Framework (accelerationeconomy.com)

• Economic uncertainty compels IT leaders to rethink their strategy - Help Net Security

• 3 important changes in how data will be used and treated - Help Net Security

• 2022 Top Five Immediate Threats in Geopolitical Context (thehackernews.com)

Secure Disposal

• For Sale on eBay: A Military Database of Fingerprints and Iris Scans - The New York Times (nytimes.com)

Careers, Working in Cyber and Information Security

• How to Get Your First Job in InfoSec (freecodecamp.org)

• IT Jobs: How To Become An Information Security Analyst (informationsecuritybuzz.com)

• ‘There's a career in cyber security for everyone,’ Microsoft Security CVP says | Fortune

Law Enforcement Action and Take Downs

• Ukraine shuts down fraudulent call centre claiming 18,000 victims (bleepingcomputer.com)

Privacy, Surveillance and Mass Monitoring

• Google Home speakers allowed hackers to snoop on conversations (bleepingcomputer.com)

• Police in China can track protests by enabling ‘alarms’ on Hikvision software | China | The Guardian

• The Threat of Predictive Policing to Data Privacy and Personal Liberty (darkreading.com)

• Meta settles Cambridge Analytica scandal case for $725m - BBC News

• 78% of Employers Are Using Remote Work Tools to Spy on You (entrepreneur.com)

• Germany: Police surveillance software a legal headache – DW – 12/22/2022

Artificial Intelligence

• Code-generating AI can introduce security vulnerabilities, study finds | TechCrunch

• AI cyber attacks are a ‘critical threat’. This is how NATO is countering them | Euronews

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• 2022 Top Five Immediate Threats in Geopolitical Context (thehackernews.com)

• Ukraine marks a turning point for cyberwarfare – POLITICO

• Russia’s Cyberwar Foreshadowed Deadly Attacks on Civilians | WIRED

• Hacktivism Is Back and Messier Than Ever | WIRED

• Hundreds of Russian cyber attacks on CHPPs, regional power plants prevented - SBU

• Ukrainian Hackers Gather Data on Russian Soldiers, Minister Says - Bloomberg

• North Korean hackers targeted nearly 1,000 South Korean foreign policy experts

• German double agent ‘passed Ukraine intelligence to Russia’ (telegraph.co.uk)

---

Nation State Actors

Nation State Actors – Russia

• Hundreds of Russian cyber attacks on CHPPs, regional power plants prevented - SBU

• Russian mobile calls, internet seen deteriorating after Nokia, Ericsson leave – EURACTIV.com

Nation State Actors – China

• US House boots TikTok from government phones • The Register

• Police in China can track protests by enabling ‘alarms’ on Hikvision software | China | The Guardian

• Chinese-backed company instructs US law firm after UK blocked microchip factory takeover (telegraph.co.uk)

Nation State Actors – North Korea

• BlueNoroff APT Hackers Using New Ways to Bypass Windows MotW Protection (thehackernews.com)

• North Korean Hackers Created 70 Fake Bank, Venture Capital Firm Domains | SecurityWeek.Com

• North Korean hacking outfit impersonating venture capital firms | SC Media (scmagazine.com)

• North Korean hackers targeted nearly 1,000 South Korean foreign policy experts

Nation State Actors – Iran

• An Iranian group hacked Israeli CCTV cameras, defence was aware but didn’t block it - Security Affairs

Nation State Actors – Misc

• APT Hackers Turn to Malicious Excel Add-ins as Initial Intrusion Vector (thehackernews.com)

---

Vulnerability Management

• Log4Shell remains a big threat and a common cause for security breaches | CSO Online

• After ransomware hits Colombian energy firm, Moody’s says low patch rate suggests inadequacies in cyber practices | SC Media (scmagazine.com)

Vulnerabilities

• Patch now: Serious Linux kernel security hole uncovered | ZDNET

• Microsoft Patches Azure Cross-Tenant Data Access Flaw | SecurityWeek.Com

• Critical Linux Kernel flaw affects SMB servers with ksmbd enabled - Security Affairs

• Critical “10-out-of-10” Linux kernel SMB hole – should you worry? – Naked Security (sophos.com)

• Log4Shell remains a big threat and a common cause for security breaches | CSO Online

• Thousands of Citrix servers vulnerable to patched critical flaws (bleepingcomputer.com)

• Netgear warns users to patch recently fixed WiFi router bug (bleepingcomputer.com)

• CISA Warns of Active exploitation of JasperReports Vulnerabilities (thehackernews.com)

• Several DoS, Code Execution Vulnerabilities Found in Rockwell Automation Controllers | SecurityWeek.Com

---

Tools and Controls

• Understanding current XDR elements and options | TechTarget

---

Other News

• Cyber crime Top 10 Rankings: China is No. 1 While US Records Highest Rate of Security Breaches - MSSP Alert

• AI cyber attacks are a ‘critical threat’. This is how NATO is countering them | Euronews

• Review: 10 Biggest Hacks And Cyber Security Threats Of 2022 (informationsecuritybuzz.com)

• Modern technology and cyber recovery will intersect in the next generation of attacks - Help Net Security

• New information-stealing malware is being spread by fake pirate sites | TechSpot

•  Ten significant data breaches from 2022 (smartermsp.com)

• Trend Micro: Expect 2023 to Bring Uncertainty to Cyber Attackers and Defenders - MSSP Alert

• After the Uber Breach: 3 Questions All CISOs Should Ask Themselves (darkreading.com)

• Top 10 Cyber Security Predictions For 2023 Based On Expert Responses (informationsecuritybuzz.com)

• The Five Stories That Shaped Cyber security in 2022 | SecurityWeek.Com

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 23 December 2022

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• LastPass Admits Attackers have an Encrypted Copy of Customers’ Password Vaults 

Password locker LastPass has warned customers that the August 2022 attack on its systems saw unknown parties copy encrypted files that contain the passwords to their accounts.

In a December 22nd update to its advice about the incident, LastPass brings customers up to date by explaining that in the August 2022 attack “some source code and technical information were stolen from our development environment and used to target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service.” Those creds allowed the attacker to copy information “that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.”

The update reveals that the attacker also copied “customer vault” data, the file LastPass uses to let customers record their passwords. That file “is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.” The passwords are encrypted with “256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password”.

LastPass’ advice is that even though attackers have that file, customers who use its default settings have nothing to do as a result of this update as “it would take millions of years to guess your master password using generally-available password-cracking technology.” One of those default settings is not to re-use the master password that is required to log into LastPass. The outfit suggests you make it a complex credential and use that password for just one thing: accessing LastPass.

LastPass therefore offered the following advice to individual and business users: If your master password does not make use of the defaults above, then it would significantly reduce the number of attempts needed to guess it correctly. In this case, as an extra security measure, you should consider minimising risk by changing passwords of websites you have stored.

LastPass’s update concludes with news it decommissioned the systems breached in August 2022 and has built new infrastructure that adds extra protections.

https://www.theregister.com/2022/12/23/lastpass_attack_update/

• Ransomware Attacks Increased 41% In November

Ransomware attacks rose 41% last month as groups shifted among the top spots and increasingly leveraged DDoS attacks, according to new research from NCC Group.

A common thread of NCC Group's November Threat Pulse was a "month full of surprises," particularly related to unexpected shifts in threat actor behaviour. The Cuba ransomware gang resurged with its highest number of attacks recorded by NCC Group. Royal replaced LockBit 3.0 as the most active strain, a first since September of last year.

These factors and more contributed to the significant jump in November attacks, which rose from 188 in October to 265.

"For 2022, this increase represents the most reported incidents in one month since that of April, when there were 289 incidents, and is also the largest month-on-month increase since June-July's marginally larger increase of 47%," NCC Group wrote in the report.

Operators behind Royal ransomware, a strain that emerged earlier this year that operates without affiliates and utilises intermittent encryption to evade detection, surpassed LockBit 3.0 for the number one spot, accounting for 16% of hack and leak incidents last month.

https://www.techtarget.com/searchsecurity/news/252528505/NCC-Group-Ransomware-attacks-increased-41-in-November

• The Risk of Escalation from Cyber Attacks Has Never Been Greater

In 2022, an American dressed in his pyjamas took down North Korea’s Internet from his living room. Fortunately, there was no reprisal against the United States. But Kim Jong Un and his generals must have weighed retaliation and asked themselves whether the so-called independent hacker was a front for a planned and official American attack.

In 2023, the world might not get so lucky. There will almost certainly be a major cyber attack. It could shut down Taiwan’s airports and trains, paralyse British military computers, or swing a US election. This is terrifying, because each time this happens, there is a small risk that the aggrieved side will respond aggressively, maybe at the wrong party, and (worst of all) even if it carries the risk of nuclear escalation.

This is because cyber weapons are different from conventional ones. They are cheaper to design and wield. That means great powers, middle powers, and pariah states can all develop and use them.

More important, missiles come with a return address, but virtual attacks do not. Suppose in 2023, in the coldest weeks of winter, a virus shuts down American or European oil pipelines. It has all the markings of a Russian attack, but intelligence experts warn it could be a Chinese assault in disguise. Others see hints of the Iranian Revolutionary Guard. No one knows for sure. Presidents Biden and Macron have to decide whether to retaliate at all, and if so, against whom … Russia? China? Iran? It's a gamble, and they could get unlucky.

Neither country wants to start a conventional war with one another, let alone a nuclear one. Conflict is so ruinous that most enemies prefer to loathe one another in peace. During the Cold War, the prospect of mutual destruction was a huge deterrent to any great power war. There were almost no circumstances in which it made sense to initiate an attack. But cyber warfare changes that conventional strategic calculus. The attribution problem introduces an immense amount of uncertainty, complicating the decision our leaders have to make.

https://arstechnica.com/information-technology/2022/12/the-risk-of-escalation-from-cyberattacks-has-never-been-greater/

• FBI Recommends Ad Blockers as Cyber Criminals Impersonate Brands in Search Engine Ads

The Federal Bureau of Investigation (FBI) this week raised the alarm on cyber criminals impersonating brands in advertisements that appear in search engine results. The agency has advised consumers to use ad blockers to protect themselves from such threats.

The attackers register domains similar to those of legitimate businesses or services, and use those domains to purchase ads from search engine advertisement services, the FBI says in an alert. These nefarious ads are displayed at the top of the web page when the user searches for that business or service, and the user might mistake them for an actual search result.

Links included in these ads take users to pages that are identical to the official web pages of the impersonated businesses, the FBI explains. If the user searches for an application, they are taken to a fake web page that uses the real name of the program the user searches for, and which contains a link to download software that is, in fact, malware.

“These advertisements have also been used to impersonate websites involved in finances, particularly cryptocurrency exchange platforms,” the FBI notes. Seemingly legitimate exchange platforms, the malicious sites prompt users to provide their login and financial information, which the cyber criminals then use to steal the victim’s funds.

“While search engine advertisements are not malicious in nature, it is important to practice caution when accessing a web page through an advertised link,” the FBI says.

Businesses are advised to use domain protection services to be notified of domain spoofing, and to educate users about spoofed websites and on how to find legitimate downloads for the company’s software.

Users are advised to check URLs to make sure they access authentic websites, to type a business’ URL into the browser instead of searching for that business, and to use ad blockers when performing internet searches. Ad blockers can have a negative impact on the revenues of online businesses and advertisers, but they can be good for online security, and even the NSA and CIA are reportedly using them.

https://www.securityweek.com/fbi-recommends-ad-blockers-cybercriminals-impersonate-brands-search-engine-ads

• North Korea-Linked Hackers Stole $626 Million in Virtual Assets in 2022

South Korea’s spy agency, the National Intelligence Service, estimated that North Korea-linked threat actors have stolen an estimated 1.5 trillion won ($1.2 billion) in cryptocurrency and other virtual assets in the past five years.

According to the spy agency, more than half the crypto assets (about 800 billion won ($626 million)) have been stolen this year alone, reported the Associated Press. The Government of Pyongyang focuses on crypto hacking to fund its military program following harsh UN sanctions.

“South Korea’s main spy agency, the National Intelligence Service, said North Korea’s capacity to steal digital assets is considered among the best in the world because of the country’s focus on cyber crimes since UN economic sanctions were toughened in 2017 in response to its nuclear and missile tests.” reported the AP agency. North Korea cannot export its products due to the UN sanctions imposed in 2016 and 1017, and the impact on its economy is dramatic.

The NIS added that more than 100 billion won ($78 million) of the total stolen funds came from South Korea. Cyber security and intelligence experts believe that attacks aimed at the cryptocurrency industry will continue to increase next year. National Intelligence Service experts believe that North Korea-linked APT groups will focus on the theft of South Korean technologies and confidential information on South Korean foreign policy and national security.

Data published by the National Intelligence Service agency confirms a report published by South Korean media outlet Chosun early this year that revealed North Korean threat actors have stolen around $1.7 billion (2 trillion won) worth of cryptocurrency from multiple exchanges during the past five years.

https://securityaffairs.co/wordpress/139909/intelligence/north-korea-cryptocurrency-theft.html

• UK Security Agency Wants Fresh Approach to Combat Phishing

The UK National Cyber Security Centre (NCSC) has called for a defence-in-depth approach to help mitigate the impact of phishing, combining technical controls with a strong reporting culture.

Writing in the agency’s blog, technical director and principal architect, “Dave C,” argued that many of the well-established tenets of anti-phishing advice simply don’t work. For example, advising users not to click on links in unsolicited emails is not helpful when many need to do exactly that as part of their job.

This is often combined with a culture where users are afraid to report that they’ve accidentally clicked, which can delay incident response, he said. It’s not the user’s responsibility to spot a phish – rather, it’s their organisation’s responsibility to protect them from such threats, Dave C argued.

As such, they should build layered technical defences, consisting of email scanning and DMARC/SPF policies to prevent phishing emails from arriving into inboxes. Then, organisations should consider the following to prevent code from executing:

• Allow-listing for executables

• Registry settings changes to ensure dangerous scripting or file types are opened in Notepad and not executed

• Disabling the mounting of .iso files on user endpoints

• Making sure macro settings are locked down

• Enabling attack surface reduction rules

• Ensuring third-party software is up to date

• Keeping up to date about current threats

Additionally, organisations should take steps such as DNS filtering to block suspicious connections and endpoint detection and response (EDR) to monitor for suspicious behaviour, the NCSC advised.

https://www.infosecurity-magazine.com/news/uk-security-agency-combat-phishing/

• GodFather Android malware targets 400 banks, crypto exchanges

An Android banking malware named 'Godfather' has been targeting users in 16 countries, attempting to steal account credentials for over 400 online banking sites and cryptocurrency exchanges.

The malware generates login screens overlaid on top of the banking and crypto exchange apps' login forms when victims attempt to log into the site, tricking the user into entering their credentials on well-crafted HTML phishing pages.

The Godfather trojan was discovered by Group-IB analysts, who believe it is the successor of Anubis, a once widely-used banking trojan that gradually fell out of use due to its inability to bypass newer Android defences. ThreatFabric first discovered Godfather in March 2021, but it has undergone massive code upgrades and improvements since then.

Also, Cyble published a report yesterday highlighting a rise in the activity of Godfather, pushing an app that mimics a popular music tool in Turkey, downloaded 10 million times via Google Play. Group-IB has found a limited distribution of the malware in apps on the Google Play Store; however, the main distribution channels haven't been discovered, so the initial infection method is largely unknown.

Almost half of all apps targeted by Godfather, 215, are banking apps, and most of them are in the United States (49), Turkey (31), Spain (30), Canada (22), France (20), Germany (19), and the UK (17).

Apart from banking apps, Godfather targets 110 cryptocurrency exchange platforms and 94 cryptocurrency wallet apps.

https://www.bleepingcomputer.com/news/security/godfather-android-malware-targets-400-banks-crypto-exchanges/

• Companies Overwhelmed by Available Tech Solutions

92% of executives reported challenges in acquiring new tech solutions, highlighting the complexities that go into the decision-making process, according to GlobalDots.

Moreover, some 34% of respondents said the overwhelming amount of options was a challenge when deciding on the right solutions, and 33% admitted the time needed to conduct research was another challenge in deciding.

Organisations of all varieties rely on technology more than ever before. The constant adoption of innovation is no longer a luxury but rather a necessity to stay on par in today’s fast-paced and competitive digital landscape. In this environment, IT and security leaders are coming under increased pressure to show ROIs from their investment in technology while balancing operational excellence with business innovation. Due to current market realities, IT teams are short-staffed and suffering from a lack of time and expertise, making navigating these challenges even more difficult.

The report investigated how organisations went about finding support for their purchasing decisions. Conferences, exhibitions, and online events served as companies’ top source of information for making purchasing decisions, at 52%. Third-party solutions, such as value-added resellers and consultancies, came in second place at 48%.

54% are already using third parties to purchase, implement, or support their solutions, highlighting the value that dedicated experts with in-depth knowledge of every solution across a wide range of IT fields provide.

We are living in an age of abundance when it comes to tech solutions for organisations, and this makes researching and purchasing the right solutions for your organisation extremely challenging.

https://www.helpnetsecurity.com/2022/12/20/tech-purchasing-decisions/

• Nine in 10 Third-party Contractors, Freelancers Use Personal, Unmanaged Devices Likely to be Infected

Talon Cyber Security surveyed 258 third-party providers to better understand the state of third-party working conditions, including work models, types of devices and security technologies used, potentially risky actions taken, and how security and IT tools impact productivity.

Looking at recent high-profile breaches, third parties have consistently been at the epicenter, so they took a step back with their research to better understand the potential root causes. The findings paint a picture of a third-party work landscape where individuals are consistently working from personal, unmanaged devices, conducting risky activities, and having their productivity impacted by legacy security and IT solutions.

Here’s what Talon discovered:

• Most third parties (89%) work from personal, unmanaged devices, where organisations lack visibility and cannot enforce the enterprise’s security posture on. Talon pointed to a Microsoft data point that estimated users are 71% more likely to be infected on an unmanaged device.

• With third parties working from personal devices, they tend to carry out personal, potentially risky tasks. Respondents note that at least on occasion, they have used their devices to:

  • Browse the internet for personal needs (76%)

  • Indulge in online shopping (71%)

  • Check personal email (75%)

  • Save weak passwords in the web browser (61%)

  • Play games (53%)

  • Allow family members to browse (36%)

  • Share passwords with co-workers (24%)

• Legacy apps such as Virtual Desktop Infrastructure (VDI) and Desktop-as-a-Service (DaaS) solutions are prominent, with 45% of respondents using such technologies while working for organisations.

https://www.msspalert.com/cybersecurity-research/nine-in-10-third-party-contractors-freelancers-use-personal-unmanaged-devices-likely-to-be-infected/

• UK Privacy Regulator Names and Shames Breached Firms

The UK Information Commissioner’s Office (ICO) has taken the unusual step of publishing details of personal data breaches, complaints and civil investigations on its website, according to legal experts.

The data, available from Q4 2021 onwards, includes the organisation’s name and sector, the relevant legislation and the type of issues involved, the date of completion and the outcome.

Given the significance of this development, it’s surprising that the ICO has (1) chosen to release it with limited fanfare, and (2) buried the data sets on its website. Indeed, it seems to have flown almost entirely under the radar.

Understanding whether their breach or complaint will be publicised by European regulators is one of – if not the – main concern that organisations have when working through an incident, and the answer has usually been no. That is particularly the understanding or assumption where the breach or complaint is closed without regulatory enforcement. Now, at least in the UK, the era of relative anonymity looks to be over.

Despite the lack of fanfare around the announcement, this naming and shaming approach could make the ICO one of the more aggressive privacy regulators in Europe. In the future, claimant firms in class action lawsuits may adopt “US-style practices” of scanning the ICO database to find evidence of repeat offending or possible new cases.

The news comes even as data reveals the value of ICO fines issued in the past year tripled from the previous 12 months. In the year ending October 31 2022, the regulator issued fines worth £15.2m, up from £4.8m the previous year. The sharp increase in the value of fines shows the ICO’s increasing willingness selectively to crack down on businesses – particularly those that the ICO perceives has not taken adequate measures to protect customer and employee data.

https://www.infosecurity-magazine.com/news/uk-privacy-regulator-names-and/

---

Threats

Ransomware, Extortion and Destructive Attacks

• 20 companies affected by major ransomware attacks in 2021 | TechTarget

• NCC Group: Ransomware attacks increased 41% in November | TechTarget

• Conti Team One Splinter Group Resurfaces as Royal Ransomware with Callback Phishing Attacks (trendmicro.com)

• Adversarial risk in the age of ransomware - Help Net Security

• Guardian newspaper hit by suspected ransomware attack, staff told not to come to office - The Record by Recorded Future

• FIN7 hackers create auto-attack platform to breach Exchange servers (bleepingcomputer.com)

• New Agenda Ransomware Variant, Written in Rust, Aiming at Critical Infrastructure (thehackernews.com)

• Ransomware Groups to Increase Zero-Day Exploit-Based Access Methods in the Future - Infosecurity Magazine (infosecurity-magazine.com)

• Ransomware Uses New Exploit to Bypass ProxyNotShell Mitigations | SecurityWeek.Com

• New Microsoft Exchange exploit chain lets ransomware attackers in (CVE-2022-41080) - Help Net Security

• British newspaper The Guardian says it’s been hit by ransomware | TechCrunch

• Play ransomware actors bypass ProxyNotShell mitigations | TechTarget

• Preventing Cryptocurrency Cyber Extortion (trendmicro.com)

• FIN7 Cyber crime Syndicate Emerges as Major Player in Ransomware Landscape (thehackernews.com)

• Vice Society ransomware gang is using a custom locker - Security Affairs

• NIO suffers user data breach, hacker demands $2.25 million worth of bitcoin - CnEVPost

• German industrial giant ThyssenKrupp targeted in a cyber attack - Security Affairs

• Paying Ransom: Why Manufacturers Shell Out to Cyber criminals (darkreading.com)

• France Seeks to Protect Hospitals After Series of Cyber attacks | SecurityWeek.Com

• Fire and rescue service in Victoria, Australia, confirms cyber attack - Security Affairs

• Ransomware hits Leiden University - Techzine Europe

• Play Ransomware Gang Lay Claims For Cyber Attack On H-Hotels (informationsecuritybuzz.com)

• Evolving threats and broadening responses to Ransomware in the UAE - Security Boulevard

• Cyber Incident Causes System Failures at Canadian Children’s Hospital - Infosecurity Magazine (infosecurity-magazine.com)

Phishing & Email Based Attacks

• Five Best Practices for Consumers to Beat Phishing Campaigns This Holiday Season - CPO Magazine

• Hackers continue to exploit hijacked MailChimp accounts in cyber crime campaigns (bitdefender.com)

• Holiday Spam, Phishing Campaigns Challenge Retailers (darkreading.com)

• Email hijackers scam food out of businesses, not just money • The Register

• Telling users to ‘avoid clicking bad links’ still isn’t working - NCSC.GOV.UK

• UK Security Agency Calls for Fresh Approach to Combat Phishing - Infosecurity Magazine (infosecurity-magazine.com)

• “Suspicious login” scammers up their game – take care at Christmas – Naked Security (sophos.com)

• Simple Steps to Avoid Phishing Attacks During This Festive season | Tripwire

• Web3 IPFS Currently Used For Phishing (trendmicro.com)

BEC – Business Email Compromise

• Telling users to ‘avoid clicking bad links’ still isn’t working - NCSC.GOV.UK

• What happens once scammers receive funds from their victims - Help Net Security

Other Social Engineering; Smishing, Vishing, etc

• Amplified security trends to watch out for in 2023 - Help Net Security

2FA/MFA

• Why Security Teams Shouldn't Snooze on MFA Fatigue (darkreading.com)

• Comcast Xfinity accounts hacked in widespread 2FA bypass attacks (bleepingcomputer.com)

Malware

• DarkTortilla malware spreads on phishing sites masquerading as legitimate domains | SC Media (scmagazine.com)

• Malicious ‘SentinelOne’ PyPI package steals data from developers (bleepingcomputer.com)

• Glupteba Botnet Continues to Thrive Despite Google's Attempts to Disrupt It (thehackernews.com)

• Ukraine's DELTA military system users targeted by info-stealing malware (bleepingcomputer.com)

• Sophisticated DarkTortilla Malware Serves Imposter Cisco, Grammarly Pages (darkreading.com)

• Trojanized Windows 10 installers compromised the Ukrainian government | SC Media (scmagazine.com)

• Raspberry Robin Worm Targets Telcos & Governments (darkreading.com)

• Detecting Windows AMSI Bypass Techniques (trendmicro.com)

• Raspberry Robin worm drops fake malware to confuse researchers (bleepingcomputer.com)

• Number of command-and-control servers spiked in 2022: report - The Record by Recorded Future

Mobile

• GodFather Android malware targets 400 banks, crypto exchanges (bleepingcomputer.com)

• Godfather makes banking apps an offer they can’t refuse • The Register

• Beware: Cyber criminals Launch New BrasDex Android Trojan Targeting Brazilian Banking Users (thehackernews.com)

• T-Mobile hacker gets 10 years for $25 million phone unlock scheme (bleepingcomputer.com)

Botnets

• Glupteba Botnet Continues to Thrive Despite Google's Attempts to Disrupt It (thehackernews.com)

• Zerobot malware now spreads by exploiting Apache vulnerabilities (bleepingcomputer.com)

• Flaws within IoT devices exploited by the Zerobot botnet (izoologic.com)

• Zerobot Adds Brute Force, DDoS to Its IoT Attack Arsenal (darkreading.com)

Denial of Service/DoS/DDOS

• How AI/ML Can Thwart DDoS Attacks (darkreading.com)

• DDoS Attacks are Slowly Growing in the Technology Era (analyticsinsight.net)

• Zerobot Adds Brute Force, DDoS to Its IoT Attack Arsenal (darkreading.com)

BYOD

• Nine in 10 Third-party Contractors, Freelancers Use Personal, Unmanaged Devices Likely to be Infected - MSSP Alert

Internet of Things – IoT

• Millions of IP cameras around the world are unprotected | TechRadar

• Zerobot Adds Brute Force, DDoS to Its IoT Attack Arsenal (darkreading.com)

• Eufy has removed privacy-focused language from its website amid ongoing security camera fiasco (androidpolice.com)

• Throw away all your Eufy cameras right now | Android Central

• Read what Anker’s customer support is telling worried Eufy camera owners - The Verge

• Amazon Ring Cameras Used in Nationwide ‘Swatting’ Spree, US Says - Bloomberg

• Connected homes are expanding, so is attack volume - Help Net Security

• Security Risks, Serious Vulnerabilities Rampant Among XIoT Devices in the Workplace - CPO Magazine

• Researchers Develop AI-powered Malware Classification for 5G-enabled IIoT - Infosecurity Magazine (infosecurity-magazine.com)

Data Breaches/Leaks

• LastPass users: Your info and password vault data are now in hackers’ hands | Ars Technica

• Okta's source code stolen after GitHub repositories hacked (bleepingcomputer.com)

• McGraw Hill's S3 buckets exposed 100,000 students' grades • The Register

• NIO suffers user data breach, hacker demands $2.25 million worth of bitcoin - CnEVPost

• Notice of Recent Security Incident - The LastPass Blog

• Shoemaker Ecco leaks over 60GB of sensitive data for 500+ days - Security Affairs

• Restaurant CRM platform ‘SevenRooms’ confirms breach after data for sale (bleepingcomputer.com)

• Leading sports betting firm BetMGM discloses data breach (bleepingcomputer.com)

• MP blasts water firm over cyber attack that saw customers' details leaked to dark web - Staffordshire Live (staffordshire-live.co.uk)

Organised Crime & Criminal Actors

• 'Russian hackers' help two New York men game JFK taxi system - CyberScoop

• Hackers Mined a Single Software Flaw for a Year in NY Cyber attack - The New York Times (nytimes.com)

• What happens once scammers receive funds from their victims - Help Net Security

• [FIN7] Fin7 Unveiled: A deep dive into notorious cyber crime gang - PRODAFT

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Microsoft bans cryptomining in Azure | TechRadar

• FTX's alleged run-of-the-mill frauds depended entirely on crypto (yahoo.com)

• GodFather Android malware targets 400 banks, crypto exchanges (bleepingcomputer.com)

• Preventing Cryptocurrency Cyber Extortion (trendmicro.com)

• Two associates of Sam Bankman-Fried plead guilty to fraud charges in FTX fall | FTX | The Guardian

• North Korea-linked hackers stole $626M in virtual assets in 2022 - Security Affairs

Insider Risk and Insider Threats

• Amplified security trends to watch out for in 2023 - Help Net Security

Fraud, Scams & Financial Crime

• FTX's alleged run-of-the-mill frauds depended entirely on crypto (yahoo.com)

• “Suspicious login” scammers up their game – take care at Christmas – Naked Security (sophos.com)

• Fraudulent ‘popunder’ Google Ad campaign generated millions of dollars • The Register

• Over 67,000 DraftKings Betting Accounts Hit by Hackers (gizmodo.com)

• What happens once scammers receive funds from their victims - Help Net Security

• T-Mobile hacker gets 10 years for $25 million phone unlock scheme (bleepingcomputer.com)

• Google Ad fraud campaign used adult content to make millions (bleepingcomputer.com)

• Two associates of Sam Bankman-Fried plead guilty to fraud charges in FTX fall | FTX | The Guardian

• Inside The Next-Level Fraud Ring Scamming Billions Off Holiday Retailers (darkreading.com)

Supply Chain and Third Parties

• teiss - Supply Chain Security - Hacking the supply chain

• Supply Chain Risks Got You Down? Keep Calm and Get Strategic! (darkreading.com)

Cloud/SaaS

• Microsoft bans cryptomining in Azure | TechRadar

• McGraw Hill's S3 buckets exposed 100,000 students' grades • The Register

• AWS simplifies Simple Storage Service to prevent data leaks • The Register

• Organisations Warned of New Attack Vector in Amazon Web Services - Infosecurity Magazine (infosecurity-magazine.com)

• New Brand of Security Threats Surface in the Cloud (darkreading.com)

• Google WordPress Plug-in Bug Allows AWS Metadata Theft (darkreading.com)

• Dealing with cloud security shortfalls - Help Net Security

• It’s time to fill those cloud security gaps • The Register

• Security on a Shoestring? Cloud, Consolidation Best Bets for Businesses (darkreading.com)

Hybrid/Remote Working

• Remote Workers Are Blowing the Whistle, Employees Exposing Companies

Attack Surface Management

• Nine in 10 Third-party Contractors, Freelancers Use Personal, Unmanaged Devices Likely to be Infected - MSSP Alert

Encryption

• Biden Signs Post-Quantum Cyber security Guidelines Into Law (darkreading.com)

API

• APIs are placing your enterprise at risk - Help Net Security

Open Source

• Open source vulnerabilities add to security debt - Help Net Security

Passwords, Credential Stuffing & Brute Force Attacks

• LastPass admits attackers copied password vaults • The Register

• LastPass users: Your info and password vault data are now in hackers’ hands | Ars Technica

• Notice of Recent Security Incident - The LastPass Blog

Social Media

• Meta Takes Down Over 200 Covert Influence Operations Since 2017 - Infosecurity Magazine (infosecurity-magazine.com)

• Social media use can put companies at risk: Here are some ways to mitigate the danger | CSO Online

• Colleges Move To Ban TikTok on Campus (gizmodo.com)

Malvertising

• Fraudulent ‘popunder’ Google Ad campaign generated millions of dollars • The Register

• Don't click too quick! FBI warns of malicious search engine ads | Tripwire

• FBI Recommends Ad Blockers as Cyber criminals Impersonate Brands in Search Engine Ads | SecurityWeek.Com

• Google Ad fraud campaign used adult content to make millions (bleepingcomputer.com)

Parental Controls and Child Safety

• Buggy parental-control apps could allow device takeover • The Register

• Bfore.Ai Releases 'The King, The Knight & The Snowball' - Cyber security Book for Children (darkreading.com)

• Children And The Dangers Of The Virtual World (informationsecuritybuzz.com)

Regulations, Fines and Legislation

• TSB fined nearly $60m for platform migration disaster • The Register

• FTC Fines Fortnite Maker Epic Games $275 Million for Violating Children's Privacy Law (thehackernews.com)

• UK Privacy Regulator Names and Shames Breached Firms - Infosecurity Magazine (infosecurity-magazine.com)

• FCC proposes record-breaking $300 million fine against robocaller (bleepingcomputer.com)

• France Fines Microsoft 60 Million Euros Over Advertising Cookies | SecurityWeek.Com

• The long, long reach of the UK’s national security laws | Financial Times

Governance, Risk and Compliance

• Make sure your company is prepared for the holiday hacking season - Help Net Security

• Rethinking Risk After the FTX Debacle (darkreading.com)

• The benefit of adopting a hacker mindset for building security strategies - Help Net Security

Careers, Working in Cyber and Information Security

• CISO roles continue to expand beyond technical expertise - Help Net Security

• UK secret services wants ‘corkscrew thinkers’ for new cyber force | News | The Times

Law Enforcement Action and Take Downs

• Swatting spree suspects charged after compromising Ring cams • The Register

Privacy, Surveillance and Mass Monitoring

• Not Big Brother, but close: a surveillance expert explains some of the ways we’re all being watched, all the time (theconversation.com)

• France Fines Microsoft 60 Million Euros Over Advertising Cookies | SecurityWeek.Com

• What is surveillance capitalism? - Definition from WhatIs.com (techtarget.com)

• Google Maps: Important reason you should blur your house on Street View (ladbible.com)

• Blur Your House ASAP if It's on Google Maps. Here's Why - CNET

Artificial Intelligence

• Threat Modeling in the Age of OpenAI's Chatbot (darkreading.com)

• This is how OpenAI's ChatGPT can be used to launch cyber attacks (techmonitor.ai)

• How AI/ML Can Thwart DDoS Attacks (darkreading.com)

• Bfore.Ai Releases 'The King, The Knight & The Snowball' - Cyber security Book for Children (darkreading.com)

Misinformation, Disinformation and Propaganda

• Sophisticated DarkTortilla Malware Serves Imposter Cisco, Grammarly Pages (darkreading.com)

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• Cyber Warfare Is Getting Real | WIRED

• State level cyber attacks – Why and how (ukdefencejournal.org.uk)

• The risk of escalation from cyber attacks has never been greater | Ars Technica

• Ukraine's DELTA military system users targeted by info-stealing malware (bleepingcomputer.com)

• Trojanized Windows 10 installers compromised the Ukrainian government | SC Media (scmagazine.com)

• NATO-Member Oil Refinery Targeted in Russian APT Blitz Against Ukraine (darkreading.com)

• Russian APT Gamaredon Changes Tactics in Attacks Targeting Ukraine | SecurityWeek.Com

• Kremlin-linked hackers tried to spy on oil firm in NATO country, researchers say | CNN Politics

• ‘Our weapons are computers’: Ukrainian coders aim to gain battlefield edge | Ukraine | The Guardian

• The long, long reach of the UK’s national security laws | Financial Times

• UK secret services wants ‘corkscrew thinkers’ for new cyber force | News | The Times

---

Nation State Actors

Nation State Actors – Russia

• UK orders sale of Russian-backed broadband firm Upp over ‘security risk’ | Telecommunications industry | The Guardian

• Dark Web Profile: Killnet - Russian Hacktivist Group - SOCRadar

Nation State Actors – China

• Apple accused of censoring apps in Hong Kong and Russia • The Register

• The long, long reach of the UK’s national security laws | Financial Times

Nation State Actors – North Korea

• North Korea-linked hackers stole $626M in virtual assets in 2022 - Security Affairs

---

Vulnerability Management

• Open source vulnerabilities add to security debt - Help Net Security

• Ransomware Groups to Increase Zero-Day Exploit-Based Access Methods in the Future - Infosecurity Magazine (infosecurity-magazine.com)

• Top 5 Vulnerabilities Routinely Exploited by Threat Actors in 2022 (socradar.io)

• Over 50 New CVE Numbering Authorities Announced in 2022 | SecurityWeek.Com

• A Guide to Efficient Patch Management with Action1 (thehackernews.com)

• Digging into the numbers one year after Log4Shell | SC Media (scmagazine.com)

Vulnerabilities

• Critical Windows code-execution vulnerability went undetected until now | Ars Technica

• FoxIt Patches Code Execution Flaws in PDF Tools | SecurityWeek.Com

• Old vulnerabilities in Cisco products actively exploited in the wild - Security Affairs

• OWASSRF: CrowdStrike Identifies New Method for Bypassing ProxyNotShell Mitigations

• Microsoft reports macOS Gatekeeper has an 'Achilles' heel • The Register

• Microsoft will turn off Exchange Online basic auth in January (bleepingcomputer.com)

• Cisco’s Talos security bods predict new wave of Excel Hell • The Register

• Microsoft pushes emergency fix for Windows Server Hyper-V VM issues (bleepingcomputer.com)

• Ransomware Groups to Increase Zero-Day Exploit-Based Access Methods in the Future - Infosecurity Magazine (infosecurity-magazine.com)

• Ransomware Uses New Exploit to Bypass ProxyNotShell Mitigations | SecurityWeek.Com

• New Microsoft Exchange exploit chain lets ransomware attackers in (CVE-2022-41080) - Help Net Security

• Zerobot malware now spreads by exploiting Apache vulnerabilities (bleepingcomputer.com)

• Two New Security Flaws Reported in Ghost CMS Blogging Software (thehackernews.com)

• Critical Security Flaw Reported in Passwordstate Enterprise Password Manager (thehackernews.com)

• This critical Windows security flaw could be as serious as WannaCry, experts claim | TechRadar

• Google WordPress Plug-in Bug Allows AWS Metadata Theft (darkreading.com)

• Microsoft Details Gatekeeper Bypass Vulnerability in Apple macOS Systems (thehackernews.com)

Tools and Controls

• Companies overwhelmed by available tech solutions - Help Net Security

• Is Enterprise VPN on Life Support or Ripe for Reinvention? | SecurityWeek.Com

Reports Published in the Last Week

• National Cyber Security Centre (NCSC) Annual Review 2022: Highlights and Thoughts | Tripwire

Other News

• 'Sextortion,' Business Disruption, and a Massive Attack: What Could Be in Store for 2023 (darkreading.com)

• The Growing Risk Of Malicious QR Codes (informationsecuritybuzz.com)

• NASA infosec again falls short of required standard • The Register

• US Joint Cyber Force Elevated to Newest Subordinate Unified Command - MSSP Alert

• The Rise of the Rookie Hacker - A New Trend to Reckon With (thehackernews.com)

• What enumeration attacks are and how to prevent them | TechTarget

• US consumers seriously concerned over their personal data | CSO Online

• The FBI is worried about wave of crime against small businesses (cnbc.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 09 December 2022

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• Economic Uncertainty Will Greatly Impact the Spread of Cyber Crime

Norton released its top cyber trends to watch in 2023, emphasising that the economy will have the greatest impact on the spread of cyber crime next year. Experts predict the pressures associated with economic uncertainty and rising costs will create the perfect environment for scammers to take advantage of people when they are more vulnerable.

It’s expected that cyber criminals will trick victims into surrendering personal information, emptying their bank accounts, or spending money for products, services or “lottery winnings” that never arrive. “We anticipate scammers will continue to prey on the vulnerability of people as economic pressures rise in 2023,” said Norton.

“Cyber criminals love to exploit seasonal opportunities, and consumers are facing a perfect storm of rising prices in the middle of the busiest shopping season of the year when scammers are particularly active. Scams are always harder to detect during the holiday season because consumers expect deep discounts and may believe prices that would normally seem too good to be true. This year, inflation and other unfavourable macroeconomic factors are likely to make people particularly eager to find good deals and they may therefore be at greater risk than in previous years. Taking a few proactive steps today could help you to be safer all year long.”

https://www.helpnetsecurity.com/2022/12/06/economic-uncertainty-cybercrime/

• Cyber Security Resilience Emerges as Top Priority, as 62% of Companies Say Security Incidents Impacted Business Operations

Cyber security resilience is a top priority for companies as they look to defend against a rapidly evolving threat landscape, according to the latest edition of Cisco's annual Security Outcomes Report.

Resilience has emerged as a top priority as a staggering 62 percent of organisations surveyed said they had experienced a security event that impacted business in the past two years. The leading types of incidents were network or data breaches (51.5 percent), network or system outages (51.1 percent), ransomware events (46.7 percent) and distributed denial of service attacks (46.4 percent).

These incidents resulted in severe repercussions for the companies that experienced them, along with the ecosystem of organisations they do business with. The leading impacts cited include IT and communications interruption (62.6 percent), supply chain disruption (43 percent), impaired internal operations (41.4 percent) and lasting brand damage (39.7 percent).

With stakes this high, it is no surprise that 96 percent of executives surveyed for the report said that security resilience is high priority for them. The findings further highlight that the main objectives of security resilience for security leaders and their teams are to prevent incidents, and mitigate losses when they occur.

Technology is transforming businesses at a scale and speed never seen before. While this is creating new opportunities, it also brings with it challenges, especially on the security front. To be able to tackle these effectively, companies need the ability to anticipate, identify, and withstand cyber threats, and if breached be able to rapidly recover from one. That is what building resilience is all about.

Security, after all, is a risk business. As companies don't secure everything, everywhere, security resilience allows them to focus their security resources on the pieces of the business that add the most value to an organisation, and ensure that value is protected.

https://www.darkreading.com/vulnerabilities-threats/cybersecurity-resilience-emerges-as-top-priority-as-62-of-companies-say-security-incidents-impacted-business-operations

• Cyber Security Should Focus on Managing Risk

Preventing all data breaches is an unrealistic goal. Instead, focus on finding and minimising the greatest risks.

There is a common misconception that all problems have clear, straightforward solutions — as long as you look hard enough. While this is a bold and ambitious goal, it's misguided when applied to cyber security. Organisations cannot prevent data breaches or cyberattacks altogether, and avoiding a breach or cyber incident is nearly impossible in the modern era. Organisations can, however, take steps to reduce an attack's negative impacts.

Eradicating risk is an impractical goal because you cannot "solve" something that constantly changes. To understand the risks you need to think like an attacker.

Threat actors are, first and foremost, opportunistic. They will always look for the easiest targets to maximise their financial gain. So intimately understanding an organisation's level of risk is the first step to managing and reducing it — and making yourself less of a target.

In line with Verizon’s "Data Breach Investigations Report" (DBIR) the four critical ways that threat actors most frequently use to compromise organisations large and small are credential compromise, phishing, vulnerability exploitation, and botnets, and these are the areas organisations should look reduce risks.

https://www.darkreading.com/edge-articles/cybersecurity-should-focus-on-managing-risk

• Fear of Cyber Attacks Drives SMBs to Spend More on Software

Despite fears of a looming recession, small and medium sized businesses (SMBs) are spending more on software in 2023, according to Capterra’s 2023 SMB Software Buying Trends Survey. 75% of US SMBs estimate they’ll spend more on software in 2023 compared to 2022.

Alongside increased software budgets, Capterra’s survey of over 500 SMBs reveals four other major trends in software buying behaviours and challenges that will impact businesses in 2023:

• Fearful of cyber attacks, US businesses rate security as a top motivator for software purchases

• Implementation concerns are SMBs’ biggest purchase barrier

• Most SMB software purchases are solely handled by IT, disregarding other important stakeholders

• Customer reviews sway purchase decisions, and verified reviews are critical

Despite the expected increase in software investments, many US SMBs regret their technology purchases. 61% of US SMBs say they have buyer’s remorse over a technology purchase in the past 12-18 months. Inadequate support services (39%) and higher-than-anticipated costs (34%) are the top reasons behind such regrets.

https://www.helpnetsecurity.com/2022/12/07/smbs-software-spending-2023/

• Business Email Compromise (BEC) Fraud Attacks Expand Beyond Email and Toward Mobile Devices

Business email compromise (BEC) scams have been increasingly targeting mobile devices, particularly with SMS-focused attacks. According to a new advisory by cyber security specialists at Trustwave, the trend indicates a broader shift towards phishing scams via text messages.

“Phishing scams are prevalent in the SMS threat landscape, and now, BEC attacks are also going mobile,” reads the report. Trustwave further added that scammers typically obtain mobile numbers from data breaches, social media and data brokers, among other methods. After that, attackers ask victims for a wire transfer, send a copy of an aging report or change a payroll account, luring them into paying for something that should be reimbursed later (but never will).

BEC attacks will always be here so long as they remain profitable. Their continued profitability proves that employee cyber security behaviour is neglected and mismanaged by the compliance-based approach to security awareness.

Security culture needs a reformation that begins with transforming the human layer into an asset which, when empowered by the right training and platform, augments the protect-detect-respond pillars of the [National Institute of Standards and Technology] NIST framework.

Trustwave’s findings were also confirmed in SlashNext’s State of Phishing 2022 report, which recently highlighted a 50% increase in attacks on mobile devices, with scams and credential theft at the top of the list of payloads. The document also suggested 83% of organisations reported that mobile device threats had been growing more quickly than other device threats.

https://www.infosecurity-magazine.com/news/bec-attacks-expand-toward-mobile/

• Ransomware Professionalisation Grows as Ransomware-as-a-Service (RaaS) Takes Hold

Ransomware groups are getting their acts together, growing in sophistication and business acumen while monetising ransomware beyond encryption, including double and triple extortion, as the market for ransomware-as-a-service (RaaS) matures.

In first half of 2022, LockBit, Conti, Alphv, Black Basta, and Vice Society were among the most prolific ransomware gangs, focusing their attack on US-based organisations, according to a LookingGlass report on the topic.

The report confirmed and attributed 1,133 ransomware attacks in the first six months of the year and attributed 207 data leaks across all active threat actor groups throughout the same period. Of the more than 1,300 incidents, the bulk came from the top 15 most active ransomware groups, led by LockBit, Conti, and Alphv.

Ransomware gangs have primarily targeted two sectors during the analysis period: manufacturing and industrial products, followed by engineering and construction and healthcare and life sciences, with the consumer and retail industry rounding out the top five.

The report highlighted the rise of sophisticated software and networks as a principal contributor to the professionalisation of ransomware, with malicious actors now offering RaaS, bug bounties, sales teams, and even customer support.

“This new, more professional ransomware structure can only mean that the problem will continue to grow in the months ahead," the report noted. "We anticipate the adoption of more traditional business practices as the underground economy continues to remain robust”.

https://www.darkreading.com/threat-intelligence/ransomware-professionalization-grows-as-raas-takes-hold

• Automated Dark Web Markets Sell Corporate Email Accounts For $2

Cyber crime marketplaces are increasingly selling stolen corporate email addresses for as low as $2 to fill a growing demand by hackers who use them for business email compromise and phishing attacks or initial access to networks.

Analysts at Israeli cyber-intelligence firm KELA have closely followed this trend, reporting at least 225,000 email accounts for sale on underground markets.

The largest webmail shops are Xleet and Lufix, claiming to offer access to over 100k breached corporate email accounts, with prices ranging between $2 and $30, if not more, for highly-desirable organisations.

Typically, these accounts were stolen via password cracking (brute-forcing) or credential stuffing, had their credentials stolen through phishing, or were bought from other cyber criminals.

Hackers use their access to corporate email accounts in targeted attacks like business email compromise (BEC), social engineering, spear-phishing, and deeper network infiltration.

https://www.bleepingcomputer.com/news/security/automated-dark-web-markets-sell-corporate-email-accounts-for-2/

• Cloud Hosting Provider Rackspace Warns of Phishing Risks Following Ransomware Attack

Cloud computing provider Rackspace warned customers on Thursday of increased risks of phishing attacks following a ransomware attack affecting its hosted Microsoft Exchange environment.

While the company is still investigating the incident and is working on bringing affected systems back online, it says that cyber criminals might also take advantage and exploit this incident for their own purposes.

"If you do receive a message from an individual you do not recognise, do not reply. Please login to your control panel and create a ticket, including details about the message you received," Rackspace said. "We understand that contact such as this may be alarming, but we currently have no evidence to suggest that you are at increased risk as a result of this direct contact."

Rackspace added that customers could easily spot scammers attempting to steal their sensitive information since:

• Emails from Rackspace will be sent from @rackspace.com emails (although attackers might still use a spoofed email address and redirect their targets to a landing phishing page)

• Rackspace support will not ask for login credentials or personal information (e.g., social security number, driver's license) during phone calls

Even though the company is yet to reveal if it has any evidence that the attackers have stolen data from its systems during the breach, customers were advised to remain vigilant and monitor their credit reports and banking account statements for suspicious activity.

Some customers are also reporting an increase in phishing emails impersonating Rackspace since the ransomware attack. Those affected by the Rackspace ransomware attack and outage should not open any suspicious email attachments or click any suspicious links.

https://www.bleepingcomputer.com/news/security/rackspace-warns-of-phishing-risks-following-ransomware-attack/

• Security Concerns Scupper Deals for Two-Thirds of Firms

Two-thirds (67%) of global organisations have admitted to losing out on acquiring potential customers due to concerns about their security posture, according to LogRhythm.

The security vendor polled 1175 security professionals and executives across five continents to compile its latest report, The State of the Security Team 2022. It found that security due diligence among customers and partners is increasingly rigorous.

Some 91% of respondents said that their security strategy must now align with customers’ security policies and standards, while 85% claimed their company must provide proof that they meet partners’ security requirements.

There was more worrying news from the report: 70% of respondents reported an increase in workplace stress for security teams, with nearly a third (30%) citing a “significant” increase. Among the key stress factors highlighted in the study were growing attack sophistication, greater responsibilities and increasing attack frequency.

Two-fifths (41%) claimed that better integrated solutions would help to relieve these pressures, while a similar number (42%) pointed to the need for more experienced security professionals. The latter would seem unlikely, given the coming recession’s likely impact on budgets, and persistent industry skills shortages. The gap is now 3.4 million globally, including 56,800 in the UK, a massive 73% year-on-year increase, according to ISC2.

https://www.infosecurity-magazine.com/news/security-concerns-scupper-deals/

• Microsoft Encourages 'Strong Cyber Hygiene' in Light of Increasing Russian Cyber Attacks

Microsoft is gearing up for a slew of Russian cyber attacks this winter, and warns others to stay vigilant. Between missiles, drones, and cyber attacks the onslaught against Ukraine has been a brutal one, and reportedly only set to get worse in the coming months.

"Moscow has intensified its multi-pronged hybrid technology approach to pressure the sources of Kyiv’s military and political support," says Microsoft in a recent blog post. "Recent attacks in Poland suggest that Russian state-sponsored cyber attacks may increasingly be used outside Ukraine in an effort to undermine foreign-based supply chains."

In late October, Russian forces were pushed from formerly occupied territory, retaliating with missile, drone, and cyber strikes that left much of Kyiv in need of simple running water.

The Russian group known to Microsoft as IRIDIUM (aka Sandworm) is thought to be working with the Russian intelligence service, the GRU, in coordinated efforts to inflict suffering on the people of Ukraine. The group has been at large for almost a decade, as Microsoft notes, "Following Russia’s annexation of Crimea in 2014, IRIDIUM launched a series of wintertime operations against Ukrainian electricity providers, cutting power to hundreds of thousands of citizens in 2015 and 2016."

https://www.pcgamer.com/microsoft-encourages-strong-cyber-hygiene-in-light-of-increasing-russian-cyberattacks/

---

Threats

Ransomware, Extortion and Destructive Attacks

• Rackspace customers rage following ransomware attack, as class-action lawsuits filed (bitdefender.com)

• Ransomware Professionalization Grows as RaaS Takes Hold (darkreading.com)

• Rackspace Admits Security Incident, Helps Customers Migrate to Microsoft 365 Accounts - Infosecurity Magazine (infosecurity-magazine.com)

• Medibank share price slumps ahead of major shutdown and cyber security overhaul (fool.com.au)

• Rackspace confirms ransomware behind days-long email outage • The Register

• Vice Society: Profiling a Persistent Threat to the Education Sector (paloaltonetworks.com)

• Wiper, Disguised as Fake Ransomware, Targets Russian Orgs (darkreading.com)

• Never-before-seen malware is nuking data in Russia’s courts and mayors’ offices | Ars Technica

• Rackspace rocked by ‘security incident’ in hosted Exchange • The Register

• Open Source Ransomware Toolkit Cryptonite Turns Into Accidental Wiper Malware (thehackernews.com)

• Understanding NIST CSF to assess your organisation's Ransomware readiness (thehackernews.com)

• New Ransom Payment Schemes Target Executives, Telemedicine – Krebs on Security

• South Pacific vacations may be wrecked by ransomware • The Register

• Gartner: 5 Considerations for I&O Leaders Planning Against Ransomware Attacks - IT Security Guru

• Intersport Data Posted On Hive Dark Web Blog - Information Security Buzz

• NZ Privacy Commissioner Investigates Mercury IT Ransomware Attack - Infosecurity Magazine (infosecurity-magazine.com)

• Vice Society Ransomware Attackers Targeted Dozens of Schools in 2022 (thehackernews.com)

• Education sector hit by Hive ransomware in November | TechTarget

• Ransomware attack forces French hospital to transfer patients (bleepingcomputer.com)

• CommonSpirit Health ransomware attack exposed data of 623,000 patients (bleepingcomputer.com)

• Ransomware Gang Steals Employee and Customer Data From LJ Hooker (vice.com)

Phishing & Email Based Attacks

• Rackspace warns of phishing risks following ransomware attack (bleepingcomputer.com)

• Phishing in the Cloud: We're Gonna Need a Bigger Boat (darkreading.com)

• Phishing scammers impersonate WhatsApp by buying a top ad spot on Google | PC Gamer

• Man who lost $149k after clicking on phishing e-mail among at least 10 victims in Case cyber attack | The Straits Times

• How to Recognize Phishing Emails: Cyber security Experts Give Advice - WSJ

• Investment Fraud Gang May Have Made $500m - Infosecurity Magazine (infosecurity-magazine.com)

BEC – Business Email Compromise

• BEC Attacks Expand Beyond Email and Toward Mobile Devices - Infosecurity Magazine (infosecurity-magazine.com)

Other Social Engineering; Smishing, Vishing, etc

• Christmas Warning: Threat Actors Impersonate your Favourite Brands to Attack, Finds CSC - Infosecurity Magazine (infosecurity-magazine.com)

• Infostealer Malware Market Booms, as MFA Fatigue Sets In (darkreading.com)

• Hardening Identities With Phish-Resistant MFA (darkreading.com)

• 'I had £8,000 stolen but Revolut won't refund it' - BBC News

Malware

• Hack-for-Hire Group Targets Travel and Financial Entities with New Janicab Malware Variant (thehackernews.com)

• Infostealer Malware Market Booms, as MFA Fatigue Sets In (darkreading.com)

• Malware Authors Inadvertently Take Down Own Botnet (darkreading.com)

• New TrueBot Malware Variant Leveraging Netwrix Auditor Bug and Raspberry Robin Worm (thehackernews.com)

• Truebot Malware Activity Increases With Possible Evil Corp Connections - Infosecurity Magazine (infosecurity-magazine.com)

• Newly Discovered Trojan Steals 300,000 Facebook Users Details In 4 Year-Long Campaign - Information Security Buzz

• Artifact Poisoning in GitHub Actions Imports Malware via Software Pipelines (darkreading.com)

Mobile

• BEC Attacks Expand Beyond Email and Toward Mobile Devices - Infosecurity Magazine (infosecurity-magazine.com)

• 'Scattered Spider' Cyber crime Group Targets Mobile Carriers via Telecom, BPO Firms | SecurityWeek.Com

• Code of practice for app store operators and app developers - GOV.UK (www.gov.uk)

• Android malware apps with 2 million installs spotted on Google Play (bleepingcomputer.com)

• Privacy changes set Apple at odds with UK government over online safety bill | Apple | The Guardian

• Android malware infected 300,000 devices to steal Facebook accounts (bleepingcomputer.com)

• Researchers Uncover Darknet Service Allowing Hackers to Trojanize Legit Android Apps (thehackernews.com)

• Android December 2022 security updates fix 81 vulnerabilities (bleepingcomputer.com)

• Telcom and BPO Companies Under Attack by SIM Swapping Hackers (thehackernews.com)

• Darknet's Largest Mobile Malware Marketplace Threatens Users Worldwide (thehackernews.com)

• Eight Questions to Ask Your Aging Parents (and Yourself) to Keep Their Phones Safe From Hackers - WSJ

• SIM swapper gets 18-months for involvement in $22 million crypto heist (bleepingcomputer.com)

• Compromised Android keys used to sign info-stealing malware • The Register

• Largest mobile malware marketplace identified by Resecurity in the Dark Web - Security Affairs

Internet of Things – IoT

• How IoT is changing the threat landscape for businesses - Help Net Security

• What's the Matter with digital trust in smart home devices? - Help Net Security

• Security Risks Found in Millions of XIoT Devices - Infosecurity Magazine (infosecurity-magazine.com)

• Self-Propagating 'Zerobot' Botnet Targeting Spring4Shell, IoT Vulnerabilities | SecurityWeek.Com

• Eufy responds to camera security concerns | ZDNET

Data Breaches/Leaks

• Popular HR and Payroll Company Sequoia Discloses a Data Breach | WIRED

• Personal data of 10,000 Australians found for sale online | 7NEWS

• Stolen data of 600,000 Indians sold on bot markets so far - study | Reuters

Organised Crime & Criminal Actors

• Of Exploits and Experts: The Professionalization of Cyber Crime (darkreading.com)

• Economic uncertainty will greatly impact the spread of cyber crime - Help Net Security

• Automated dark web markets sell corporate email accounts for $2 (bleepingcomputer.com)

• DHS Cyber Safety Board to review Lapsus$ gang’s hacking tactics (bleepingcomputer.com)

• BlackProxies proxy service increasingly popular among hackers (bleepingcomputer.com)

• Gen Z Internet Users "Normalize" Cyber crime - Report - Infosecurity Magazine (infosecurity-magazine.com)

• Chart: Cyber crime Expected To Skyrocket in Coming Years | Statista

• Metaparasites: The cyber criminals who rip each other off • Graham Cluley

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Bitcoin ‘rarely’ used for legal transactions, on ‘road to irrelevance’, say European Central Bank officials | TechCrunch

• North Korean Hackers Spread AppleJeus Malware Disguised as Cryptocurrency Apps (thehackernews.com)

• Microsoft Warns Cryptocurrency Firms Against Complex Cyber-Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Threat Actors Use Malicious File Systems to Scale Crypto-Mining Operations - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft: Hackers target cryptocurrency firms over Telegram (bleepingcomputer.com)

• UK finalises plans for regulation of ‘wild west’ crypto sector | Financial Times (ft.com)

• North Korean Lazarus Group Linked to New Cryptocurrency Hacking Scheme – Security Bitcoin News

Insider Risk and Insider Threats

• Insights into insider threats: Detecting and monitoring abnormal user activity - Help Net Security

Fraud, Scams & Financial Crime

• Even cyber criminals fall for online scams: $2.5m last year • The Register

• Why are Monzo, Revolut and Starling becoming scam targets? — Startup Europe, The Sifted Podcast | Sifted

• 'I had £8,000 stolen but Revolut won't refund it' - BBC News

• Suspects arrested for hacking US networks to steal employee data (bleepingcomputer.com)

• Credit card skimming – the long and winding road of supply chain failure – Naked Security (sophos.com)

• Australia arrests 'Pig Butchering' suspects for stealing $100 million (bleepingcomputer.com)

• Cyber criminals are scamming each other, tipping off law enforcement - Help Net Security

• Elon Musk "Freedom Giveaway" crypto scam promoted via Twitter lists (bleepingcomputer.com)

• SIM swapper gets 18-months for involvement in $22 million crypto heist (bleepingcomputer.com)

• Metaparasites: The cyber criminals who rip each other off • Graham Cluley

• Investment Fraud Gang May Have Made $500m - Infosecurity Magazine (infosecurity-magazine.com)

Deepfakes

• Thanks to AI, it’s probably time to take your photos off the Internet | Ars Technica

AML/CFT/Sanctions

• Santander UK fined £108m over anti-money laundering failings | Banco Santander | The Guardian

Insurance

• What you should know when considering cyber insurance in 2023 | CSO Online

• Cyber Insurance Policy Underwriting Explained (trendmicro.com)

Dark Web

• Dark web recruiting techniques: Malware, phishing, and carding - Help Net Security

Supply Chain and Third Parties

• Iranian Hackers Strike Diamond Industry with Data-Wiping Malware in Supply-Chain Attack (thehackernews.com)

• Antwerp's city services down after hackers attack digital partner (bleepingcomputer.com)

• Credit card skimming – the long and winding road of supply chain failure – Naked Security (sophos.com)

• Transport And Shipping Beware – Supply Chains Under Attack - Information Security Buzz

• Popular HR and Payroll Company Sequoia Discloses a Data Breach | WIRED

Software Supply Chain

• How Naming Can Change the Game in Software Supply Chain Security (darkreading.com)

Denial of Service DoS/DDoS

• 3 Types Of DDoS Attack Types You Should Care About - Information Security Buzz

• Microsoft warning after DDoS attack disrupts Russian bank • The Register

Cloud/SaaS

• Phishing in the Cloud: We're Gonna Need a Bigger Boat (darkreading.com)

• How to get cloud migration right - Help Net Security

• 3 Ways Attackers Bypass Cloud Security (darkreading.com)

• How to implement least privilege access in the cloud | TechTarget

Hybrid/Remote Working

• Remote workers losing laptops are bigger threat to companies than hackers (telegraph.co.uk)

Encryption

• WhatsApp raises threat of UK shutdown in encryption row (telegraph.co.uk)

• Governments want to avert quantum's encryption apocalypse (axios.com)

API

• 68% of IT leaders are worried about API sprawl - Help Net Security

Open Source

• Ping of death! FreeBSD fixes crashtastic bug in network tool – Naked Security (sophos.com)

• Research reveals where 95% of open source vulnerabilities lie - Help Net Security

• Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems (thehackernews.com)

• Threat Actors Use Malicious File Systems to Scale Crypto-Mining Operations - Infosecurity Magazine (infosecurity-magazine.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Password Reset Calls Are Costing Your Org Big Money (bleepingcomputer.com)

Social Media

• Taiwan bans state-owned devices from running TikTok • The Register

• Critical Vulnerabilities Force Twitter Alternative Hive Social Offline | SecurityWeek.Com

• Does Hive's Security Problem Make It Unsafe to Use? (lifehacker.com)

• Elon Musk "Freedom Giveaway" crypto scam promoted via Twitter lists (bleepingcomputer.com)

• US States label TikTok a malicious and menacing threat • The Register

Training, Education and Awareness

• Making Cyber-awareness Training And Spoofing Protection Mandatory In The Digital Workplace - Information Security Buzz

• Engage your employees with better cyber security training - Help Net Security

• Lack of Cyber security Expertise Poses Threat for Public-Safety Orgs (darkreading.com)

• 4 cyber security predictions for 2023 --- SANS analysts look ahead | VentureBeat

Parental Controls and Child Safety

• US Sues TikTok Over Child Safety and Data Security Claims - Infosecurity Magazine (infosecurity-magazine.com)

• Are Parents Feeding Kids’ Data To Threat Actors? Expert Comments - Information Security Buzz

Regulations, Fines and Legislation

• Five companies fined over £400,000 for targeting over-60s with illegal marketing calls | UK News | Sky News

• UK finalises plans for regulation of ‘wild west’ crypto sector | Financial Times (ft.com)

• What Stricter Data Privacy Laws Mean for Your Cyber security Policies (thehackernews.com)

Governance, Risk and Compliance

• Cyber security Risk Management In The Real World - Information Security Buzz

• Economic uncertainty will greatly impact the spread of cyber crime - Help Net Security

• Cyber security Plan: 3 Keys for CISOs (trendmicro.com)

Models, Frameworks and Standards

• Understanding NIST CSF to assess your organisation's Ransomware readiness (thehackernews.com)

• PCI Secure Software Standard 1.2 released - Help Net Security

• How compliance leaders can encourage employees to report misconduct - Help Net Security

• The changing role of the MITRE ATT@CK framework | CSO Online

• Don't Wait to Become CMMC Compliant - Information Security Buzz

• Three Ways to Improve Defence Readiness Using MITRE D3FEND | SecurityWeek.Com

Data Protection

• Remote workers losing laptops are bigger threat to companies than hackers (telegraph.co.uk)

• How companies time data leak disclosures - Help Net Security

• What Stricter Data Privacy Laws Mean for Your Cyber security Policies (thehackernews.com)

Careers, Working in Cyber and Information Security

• 5 top qualities you need to become a next-gen CISO | CSO Online

Law Enforcement Action and Take Downs

• Suspects arrested for hacking US networks to steal employee data (bleepingcomputer.com)

• Australia arrests 'Pig Butchering' suspects for stealing $100 million (bleepingcomputer.com)

Privacy, Surveillance and Mass Monitoring

• The Privacy War Is Coming (darkreading.com)

• Apple Faces Critics Over Its Privacy Policies | SecurityWeek.Com

• Privacy changes set Apple at odds with UK government over online safety bill | Apple | The Guardian

• Apple announces new security and privacy measures amid surge in cyber-attacks | Apple | The Guardian

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• NATO Readies for Cyber War: Simulation Shows Unified Front Against Attack - MSSP Alert

• Microsoft warns of Russian cyber attacks throughout the winter (bleepingcomputer.com)

• Microsoft warning after DDoS attack disrupts Russian bank • The Register

• Lessons from Russia’s cyber-war in Ukraine | The Economist

• Russian Espionage APT Callisto Focuses on Ukraine War Support Organisations | SecurityWeek.Com

• Russian Actors Use Compromised Healthcare Networks Against Ukrainian Orgs (darkreading.com)

• Security Firms Aiding Ukraine During War Could Be Considered Participants in Conflict (substack.com)

• Russian Hackers Use Western Networks to Attack Ukraine - Infosecurity Magazine (infosecurity-magazine.com)

• Pegasus spyware was used to hack reporters’ phones. I’m suing its creators | Nelson Rauda Zablah | The Guardian

---

Nation State Actors

Nation State Actors – Russia

• Microsoft encourages 'strong cyber hygiene' in light of increasing Russian cyber attacks | PC Gamer

• Russian Hackers Spotted Targeting US Military Weapons and Hardware Supplier (thehackernews.com)

• The surprising ineffectiveness of Russia’s cyber-war | The Economist

Nation State Actors – China

• Chinese Government Linked Hackers Swiped $20M in Targeted Pandemic Funds, Secret Service Says - MSSP Alert

• Chinese Hackers Using Russo-Ukrainian War Decoys to Target APAC and European Entities (thehackernews.com)

• Chinese Hackers Target Middle East Telecoms in Latest Cyber Attacks (thehackernews.com)

• Chinese hackers stole millions worth of US COVID relief money, Secret Service says | Reuters

• Amnesty International Canada breached by suspected Chinese hackers (bleepingcomputer.com)

• China Operates More Than 100 Secret 'Police Stations' Globally: Report (businessinsider.com)

• US Congress rolls back proposal to restrict use of Chinese chips | Computerworld

Nation State Actors – North Korea

• North Korean tech freelancers' earnings fund nukes, missiles • The Register

• North Korean Hackers Spread AppleJesus Malware Disguised as Cryptocurrency Apps (thehackernews.com)

• Google Documents IE Browser Zero-Day Exploited by North Korean Hackers | SecurityWeek.Com

• APT37 Uses Internet Explorer Zero-Day to Spread Malware (darkreading.com)

• Google: State hackers still exploiting Internet Explorer zero-days (bleepingcomputer.com)

• North Korean Lazarus Group Linked to New Cryptocurrency Hacking Scheme – Security Bitcoin News

Nation State Actors – Iran

• Iranian APT Targets US With Drokbk Spyware via GitHub (darkreading.com)

• Iranian Hackers Strike Diamond Industry with Data-Wiping Malware in Supply-Chain Attack (thehackernews.com)

• Iranian State Hackers Targeting Key Figures in Activism, Journalism, and Politics (thehackernews.com)

• UK lawmakers warned of cyber-attacks and possible harassment from Iranian operatives | CNN

• Iran Arrests News Agency Deputy After Reported Cyber attack | SecurityWeek.Com

---

Vulnerabilities

• Attackers take over expired domain to deliver web skimming scripts - Help Net Security

• Google discovers Windows exploit framework used to deploy spyware (bleepingcomputer.com)

• Cisco discloses high-severity IP phone bug with exploit code (bleepingcomputer.com)

• Google Chrome emergency update fixes 9th zero-day of the year (bleepingcomputer.com)

• Google Documents IE Browser Zero-Day Exploited by North Korean Hackers | SecurityWeek.Com

• For Cyber attackers, Popular EDR Tools Can Turn into Destructive Data Wipers (darkreading.com)

• A new Linux flaw can be chained with other two bugs to gain full root privileges - Security Affairs

• Self-Propagating 'Zerobot' Botnet Targeting Spring4Shell, IoT Vulnerabilities | SecurityWeek.Com

• Google Chrome Flaw Added to CISA Patch List (darkreading.com)

• Fortinet Patches High-Severity Authentication Bypass Vulnerability in FortiOS | SecurityWeek.Com

• Research reveals where 95% of open source vulnerabilities lie - Help Net Security

• Critical Ping Vulnerability Allows Remote Attackers to Take Over FreeBSD Systems (thehackernews.com)

• Google: State hackers still exploiting Internet Explorer zero-days (bleepingcomputer.com)

• Multiple Zero Days Discovered In Leading Antivirus And Endpoint Solutions (informationsecuritybuzz.com)

• APT37 Uses Internet Explorer Zero-Day to Spread Malware (darkreading.com)

• WAFs of Several Major Vendors Bypassed With Generic Attack Method | SecurityWeek.Com

• Google Chrome zero-day exploited in the wild (CVE-2022-4262) - Help Net Security

• Sophos fixed a critical flaw in its Sophos Firewall version 19.5 - Security Affairs

---

Tools and Controls

• Security pros feel threat detection and response workloads have increased - Help Net Security

• Single Sign-on: It's Only as Good as Your Ability to Use It (darkreading.com)

• Leveraging the full potential of zero trust - Help Net Security

• Understanding malware analysis and its challenges | TechTarget

• Using XDR to Consolidate and Optimize Cyber security Technology (thehackernews.com)

---

Reports Published in the Last Week

• The promise of Open Everything (axway.com)

• Security Outcomes Report, Volume 3 - Cisco

• ENISA Threat Landscape 2022 — ENISA (europa.eu)

---

Other News

• Over 4,000 Vulnerable Pulse Connect Secure Hosts Exposed to Internet | SecurityWeek.Com

• Where Advanced Cyber attackers Are Heading Next: Disruptive Hits, New Tech (darkreading.com)

• 43 Trillion Security Data Points Illuminate Our Most Pressing Threats (darkreading.com)

• 7 reasons why you must embed trust into the core of your business - Help Net Security

• Most convicted terrorists radicalised online, finds MoJ-backed study | UK security and counter-terrorism | The Guardian

• Risky online behaviour ‘almost normalised’ among young people, says study | Internet | The Guardian

• Top 7 factors boosting enterprise cyber security resilience - Help Net Security

• Machine Learning Models: A Dangerous New Attack Vector (darkreading.com)

• Microsoft's rough 2022 security year in review | CSO Online

• Consumers want convenience without sacrificing security - Help Net Security

• 4 cyber security predictions for 2023 --- SANS analysts look ahead | VentureBeat

• 3 of the Worst Data Breaches in the World That Could Have Been Prevented  - Security Affairs

• Removing the Barriers to Security Automation Implementation | SecurityWeek.Com

• Cyber security Should Focus on Managing Risk (darkreading.com)

• Deal with sophisticated bot attacks: Learn, adapt, improve - Help Net Security

• Want to detect Cobalt Strike? Look to process memory • The Register

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 28 October 2022

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

• ‘Biggest Cyber Risk Is Complacency, Not Hackers’ - UK Information Commissioner Issues Warning as Construction Company Fined £4.4 Million

The UK Information Commissioner has warned that companies are leaving themselves open to cyber attack by ignoring crucial measures like updating software and training staff.

The warning comes as the Information Commissioner’s Office (ICO) issued a fine of £4,400,000 to Interserve Group Ltd, a Berkshire based construction company, for failing to keep personal information of its staff secure. This is a breach of data protection law.

The ICO found that the company failed to put appropriate security measures in place to prevent a cyber attack, which enabled hackers to access the personal data of up to 113,000 employees through a phishing email.

The compromised data included personal information such as contact details, national insurance numbers, and bank account details, as well as special category data including ethnic origin, religion, details of any disabilities, sexual orientation, and health information.

John Edwards, UK Information Commissioner, said:

 “The biggest cyber risk businesses face is not from hackers outside of their company, but from complacency within their company. If your business doesn't regularly monitor for suspicious activity in its systems and fails to act on warnings, or doesn't update software and fails to provide training to staff, you can expect a similar fine from my office.

 “Leaving the door open to cyber attackers is never acceptable, especially when dealing with people’s most sensitive information. This data breach had the potential to cause real harm to Interserve’s staff, as it left them vulnerable to the possibility of identity theft and financial fraud.

 “Cyber attacks are a global concern, and businesses around the world need to take steps to guard against complacency. The ICO and NCSC already work together to offer advice and support to businesses, and this week I will be meeting with regulators from around the world, to work towards consistent international cyber guidance so that people’s data is protected wherever a company is based.”

https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2022/10/biggest-cyber-risk-is-complacency-not-hackers/

• Ransomware Threat Shifts from US to EMEA and APAC

The volume of ransomware detections in Q3 2022 was the lowest in two years, but certain geographical regions have become bigger targets as attacks on US organisations wane, according to SonicWall. The security vendor used its own threat detection network, including over one million security sensors in more than 200 countries, to reveal the current landscape.

The good news is that global malware volumes have remained flat for the past three quarters, amounting to a total of over four billion detections in the year to date. Of these, ransomware is also trending down after a record-breaking 2021. Even so, SonicWall detected 338 million compromise attempts in the first three quarters of the year.

Year-to-date ransomware attempts in 2022 have already exceeded the full-year totals from four of the past five years, the vendor claimed. While attacks on US organisations dipped by 51% year-on-year during the period, they increased significantly in the UK (20%), EMEA (38%) and APAC (56%).

The cyber-warfare battlefront continues to shift, posing dangerous threats to organisations of all sizes. With expanding attack surfaces, growing numbers of threats and the current geopolitical landscape, it should be no surprise that even the most seasoned IT professional can feel overwhelmed.

https://www.infosecurity-magazine.com/news/ransomware-threat-shifts-from-us/

• Phishing Attacks Increase by Over 31% In Third Quarter

Email security and threat detection company Vade has found that phishing emails in the third quarter this year increased by more than 31% quarter on quarter, with the number of emails containing malware in the first three quarters surpassing the 2021 level by 55.8 million.

Malware emails in the third quarter of 2022 alone increased by 217% compared to same period in 2021. Malware email volume peaked in July, reaching 19.2 million, before month-over-month declines in August and September, with numbers dropping to 16.8 million and 16.5 million respectively.

According to the report, email is the preferred attack vector for phishing and malware, as it gives hackers a direct channel to users, the weakest link in an organisation’s attack surface. The report analyses phishing and malware data captured by Vade, which does business internationally.

As attacks become more sophisticated, Vade said, they also become increasingly capable of evading the basic security offered by email providers, which almost eight in 10 businesses still rely on, according to Vade’s research.

While the activity of threat actors fluctuates, Vade’s research found that impersonating trusted and established brands remains the most popular strategy for hackers. In the third quarter of 2022, Facebook was the most impersonated brand for the second consecutive quarter, followed by Google, MTB, PayPal, and Microsoft.

The financial services sector remains the most impersonated industry, representing 32% of phishing emails detected by Vade, followed by cloud at 25%, social media at 22%, and internet/telco at 13%.

As phishing attacks increase, the techniques used by threat actors continue to evolve. While phishing campaigns were traditionally large scale and random, more recent campaigns seen by Vade suggest that hackers have pivoted to using more targeted campaigns.

https://www.csoonline.com/article/3678311/phishing-attacks-increase-by-over-31-in-third-quarter-report.html#tk.rss_news

• UK Urged to Watch for Fraud as People Aim to Make Extra Cash in Cost of Living Crisis

Brits have been warned to “stay alert for fraud” as more people are out to make extra cash as the cost of living rises across the country.

UK Finance said that more than half (56%) of people admitted that they are likely to look for opportunities to make extra money in the coming months, which could leave some people more susceptible to fraud.

According to the trade association’s Take Five To Stop Fraud campaign, one in six, or 16%, of people said the rising cost of living means they are more likely to respond to an unprompted approach from someone offering an investment opportunity or a loan.

Young people were more likely to be at risk, the data suggested, which surveyed 2,000 people across the UK. More than a third (34%) of 18 to 34-year-olds said they are more likely to respond to an unprompted approach from someone, with three in 10 (30%) also more likely to provide their personal or financial details to secure the arrangement.

Overall, three in five people (60%) said they are concerned about falling victim to financial fraud or a scam. It comes as recent figures from UK Finance showed that £609.8m was lost due to fraud and scams in the first half of this year.

https://uk.news.yahoo.com/uk-watch-for-fraud-extra-cash-cost-of-living-crisis-230154352.html

• HR Departments Play a Key Role in Cyber Security

A common shortcoming of human resources (HR) departments is that — despite being an operation designed to put humans at the centre of how an organisation is run — they often fail to adequately align with their IT counterparts and the core technology systems that define how a business is run and protected from cyber-risk.

Insufficient coordination between HR and IT processes and procedures remains common and gives rise to security gaps that can represent some of the most dangerous vulnerabilities on a company's attack surface. Let's examine the scope of the challenge and some key cyber-asset management priorities that can close the schism for a more robust cyber security posture.

Gone are the days when HR's role in securing the enterprise relied on basic tutorials for employees about protecting passwords on company equipment. Today's threat environment intersects with the workforce in more ways than ever — from bring-your-own-device (BYOD) and authentication gaps to user vulnerabilities that make spear-phishing seem quaint. Traditional social engineering attacks are now being augmented by zero-click exploits that compromise employee devices without the user ever having to click a link or take any action at all.

Beyond malicious threats, even routine HR processes can introduce risk to the organisation when they're not adequately aligned with the IT processes in an organisation. As just one example, when an employee leaves a company, the offboarding goes far beyond just the exit interview to also include removing access to multiple enterprise systems, accounts, and devices — all of which require close coordination between HR and IT personnel and systems.

To better secure the enterprise, it's mission-critical to get HR and IT more united in a common and advanced understanding of cyber hygiene and risk mitigation. This relies on enhanced awareness of the impact that HR processes have on cyber assets in other parts of the organisation, as well as the HR role in access management for employees and contractors. This requires asset visibility that must be ongoing and in real time, since our roles, devices, and access to data and systems may change multiple times over the course of our employment.

https://www.darkreading.com/vulnerabilities-threats/hr-departments-play-a-key-role-in-cybersecurity

• The Long-Term Psychological Effects of Ransomware Attacks

Northwave has conducted scientific research into the psychological effects of a ransomware crisis on both organisations and individuals. The findings reveal the deep marks that a ransomware crisis leaves on all those affected. It also shows how their IT and security teams can turn in disarray long after the crisis itself has passed.

The research reveals how the psychological impact of ransomware attacks can persist on people in affected organisations for a very long time. It shows that crisis team members may develop serious symptoms far later. Top management and HR need to take measures against this, in fact right from the very beginning of the crisis. They are the ones bearing responsibility for the well-being of their staff.

They also discovered how teams have fallen apart some time after the crisis, with members leaving or staying home on sick-leave. The study reveals that effects can linger throughout the organisation. All in all the investigation shows that this invisible impact of a cyber crisis is an issue for the general business management, and certainly also for HR.

Northwave regards the response to a cyber attack as occurring in three phases. First comes the actual crisis situation, which evolves into an incident phase after about a week. A plan of action is then in place, and recovery measures are launched. The fire has been largely extinguished after a month or so, with the first (basic) functionalities available again.

Full recovery can take one to two years. Each phase has its specific effects on the minds and bodies of those involved, and by extension, on the organisation or parts of it. “On average a company is down for three weeks following a malware attack,” notes Van der Beijl. “But it surprised us that the impact persists for so long afterwards. Psychological issues are still surfacing a year after the actual crisis.”

One of every seven employees involved in the attack, either directly or indirectly, exhibits severe enough symptoms several months later, at a level considered to be above the clinical threshold at which professional trauma treatment help is needed. One in five employees say they would actually have needed more professional help subsequently in coming to terms with the attack. One in three liked to have more knowledge and concrete tools to deal with the psychological effects of the attack.

A ransomware attack has enduring psychological effects on the way employees view the world. Two-thirds of employees, including those not actually involved in the attack, now believe the world is less safe. As one IT manager pointed out, “I’ve become far more suspicious. The outside world is a dangerous place.”

https://www.helpnetsecurity.com/2022/10/25/psychological-effects-ransomware/

• 7 Hidden Social Media Cyber Risks for Enterprises

Whether they use it to amplify the brand, recruit new employees, advertise new products, or even sell directly to consumers, corporate brands love social media.

According to recent figures, brand advertising on social media is up by 53% in the last year, and that's not accounting for further investments that brands are making in developing and distributing content. They're pushing viral videos, funny memes, podcasts, written material, and more to increase engagement with their customers.

And brands are doing it across not only the old reliable social networks like Facebook and Twitter, but also emerging platforms like TikTok. In fact, according to another recent study, in 2022 marketers are expanding their horizons, with their increased content investments focused on areas like live streaming, long-form and short-form video content, virtual reality and augmented reality content, experimental content, and live audio chat rooms. The top platforms they're focused on most for increasing spending are now TikTok, Instagram, YouTube, and LinkedIn.

With the broadening of these social-media marketing strategies comes more risk. Whether an organisation uses social media to amplify its brand, or its executives and employees leverage social channels to bolster their professional and personal brands, these marketing platforms are a breeding ground for a wide range of cyber attacks and scams, including in the areas of artificial intelligence, deepfakes, and biometrics.

Cyber criminals, fraudsters, spies, and activists work around the clock to take advantage of emerging attack surfaces that arise from enterprise use of social media. The article below presents just a few avenues that organisations may overlook when they double-down on their social media investments.

https://www.darkreading.com/application-security/7-hidden-social-media-cyber-risks-enterprises

• 54% of Staff Would Reconsider Working for a Firm That Had Experienced a Cyber Breach, Research Finds

Over half (54%) of office workers would reconsider working for a company that had recently experienced a cyber breach. That's according to a new study by cyber security technology provider, Encore.

An independent study of 100 C-level executives, 100 Chief Information Security Officers (CISOs) and 500 office workers in the US and the UK, conducted by Censuswide, sought to uncover the gap that remains between boards and security teams when it comes to addressing cyber demands.

Only a third (33%) of staff said they would be "completely unphased" if their employer suffered a cyber break-in. The majority (57%) of C-level executives polled said they have been breached in the last 12 months alone. Most office workers, however, were unaware, with only 39% believing their organisation had been the victim of a successful attack.

The immediate financial cost of a cyber-attack remains the number one concern for businesses, but security teams are learning that there is a long tail to these breaches, with employees at risk of losing faith in their company, its ethics and values and its overarching responsibilities to the general public. In a competitive market, this is a stark warning to businesses across the world. Keeping your staff in the dark about cyber risk is a fundamental error, not to mention the additional impact of delayed disclosure to customers.

41% of C-level executives polled named reputational damage as one of the biggest costs to their business following a cyber-attack, with 34% agreeing that loss of clientele or their trust was a significant cost.

Despite many admitting to suffering a cyber breach in the last year, the overwhelming majority (92%) of CISOs and C-level executives polled believe their business is secure at any given moment. Encore believes that a mindset shift is needed at an organisational level, treating cyber incidents and the security of employee and customer data as a fundamental part of normal business operations, not a function that sits on the outside, looking in.

https://www.darkreading.com/careers-and-people/54-of-staff-would-reconsider-working-for-a-firm-that-had-experienced-a-cyber-breach-research-finds

• Evolve as Fast as the Cyber Criminals: Protect Your Business Now, Before It’s Too Late

According to the 2022 Cyber Threat Report, 2021 saw a global average increase of 105% in the number of ransomware attacks. Proofpoint's 2022 State of the Phish report said that a staggering 82% of UK businesses that experienced a ransomware attack sent payment to the cyber criminals – believing this was the cheapest and easiest way to regain access to their data. However, in many cases criminals simply took the payment without restoring access and the organisation finds itself on criminal target lists as it has demonstrated that attacks pay off. Even when decryption keys are handed over it can take an extended period of time to restore data.

One attack, on a hospital in Dusseldorf, Germany, was implicated in the death of a patient who had to be diverted to an alternative site as the A&E department had been forced to close due to the loss of core computer systems. It appears that the attack had been misdirected, and the hackers – who were quickly apprehended by the police – handed over the encryption keys immediately when they realised what had happened. Nevertheless, the decryption process was slow. It began in the early hours of September 11 and by September 20 the hospital was still unable to add or retrieve information, or even send emails. 30 servers had been corrupted.

The methods and techniques required to conduct a cyber-attack have never been more accessible. Whether it is on the darknet or through open-source content, the ability to purchase material that allows a malicious user to conduct a cyber-attack is readily available. Conducting a ransomware attack and using it to extort money from companies and government services alike, is now viewed as a viable business model by organised criminals.

https://www.itsecurityguru.org/2022/10/28/evolve-as-fast-as-the-cybercriminals-protect-your-business-now-before-its-too-late/

• Enterprise Ransomware Preparedness Improving but Still Lacking

The majority of organisations have made ransomware preparedness a top-five business priority, yet only half believe their preparedness is stronger than it was two years ago. That is according to a recent survey, "The Long Road Ahead to Ransomware Preparedness" by Enterprise Strategy Group, a division of TechTarget.

Despite warnings and available preparedness resources, ransomware continues to distress companies. Seventy-nine percent of survey respondents said they suffered a successful attack within the last year, and 73% reported they had one or more attacks that caused negative financial impact or disrupted business operations in the same time period.

The good news is the board and the C-suite are finally getting the message that more needs to be done to address impending ransomware attempts. In fact, 79% of respondents said business leaders made ransomware preparedness a top business priority, and 82% of organisations plan to invest more in ransomware preparedness over the next 12 to 18 months.

With preparedness investments expected to grow, the survey asked how organisations currently tackle ransomware. Respondents said the most important prevention tactics involve efforts in the following:

• network security (43%)

• backup infrastructure security (40%)

• endpoint security (39%)

• email security (36%)

• data encryption (36%)

Ongoing activities cited included data recovery testing, employee security awareness training, response readiness assessments, incident response functional exercises, penetration testing, incident planning and playbook development, phishing simulation programs, tabletop exercises, and blue/red/purple team engagements.

https://www.techtarget.com/searchsecurity/feature/Enterprise-ransomware-preparedness-improving-but-still-lacking

• Why Are There So Many Data Breaches? A Growing Industry of Criminals is Brokering in Stolen Data

New details have emerged on the severity of the Australian Medibank hack, which has now affected all users. Optus, Medibank, Woolworths, and, last Friday, electricity provider Energy Australia are all now among the Australian household names that have fallen victim to a data breach.

If it seems like barely a week goes by without news of another incident like this, you would be right. Cyber crime is on the rise – seven major Australian businesses were affected by data breaches in the past month alone.

But why now? And who is responsible for this latest wave of cyber attacks?

In large part, the increasing number of data breaches is being driven by the growth of a global illicit industry that trades in your data. In particular, hackers known as “initial access brokers” specialise in illegally gaining access to victim networks and then selling this access to other cyber criminals.

Hackers and initial access brokers are just one part of a complex and diversifying cyber crime ecosystem. This ecosystem contains various cyber criminal groups who increasingly specialise in one particular aspect of online crime and then work together to carry out the attacks.

Ransomware attacks are complex, involving up to nine different stages. These include gaining access to a victim’s network, stealing data, encrypting a victim’s network, and issuing a ransom demand. Increasingly, these attacks are carried out not by lone cyber criminal groups, but rather by networks of different cyber crime groups, each of which specialises in a different stage of the attack.

Initial access brokers will often carry out the first stage of a ransomware attack. Described by Google’s Threat Analysis Group as “the opportunistic locksmiths of the security world”, it’s their job to gain access to a victim’s network.

https://theconversation.com/why-are-there-so-many-data-breaches-a-growing-industry-of-criminals-is-brokering-in-stolen-data-193015

• How The "pizza123" Password Could Take Down an Organisation

Criminal hackers took responsibility for a recent FastCompany breach, saying they exploited an easily guessed default password, "pizza123." The business magazine reused the weak password across a dozen WordPress accounts, according to the hackers, who described the attack in their own article on FastCompany.com before the publication took the site down.

The breach, the bitter taste of pizza123, and the plight of malicious push notifications, demand caution when selecting and managing passwords.

The hackers claimed to have used the vulnerable password pizza123 to access authentication tokens, Apple News API keys, and Amazon Simple Email Service (SES) tokens. Then they sent offensive push notifications to the home screens of subscribers of the FastCompany channel on the Apple News service.

After decades of investment in sculpting the organisation's brand image, a business can watch its reputation flounder in the face of an obscene push notification. The sentiment of millions of faithful customers can turn sour in an instant. By the time organisations block the messages and make public apologies, the harm is done.

Customers can swap to a competitor, or even sue for the offence when they have entrusted a publisher to provide safe content. Regulatory bodies can fine organisations. The company can spend time and money defending itself in court and restoring its image. But malicious push notifications can do a lot worse than offend customers—criminal hackers can load messages with malware and infect consumer devices, leading to privacy violations and consumer financial fraud.

People often build passwords using the first word that comes to mind and a brief series of numbers. Pizza123 is a perfect example of an easy-to-guess password. Employees will create passwords already appearing on breached password lists. Criminal hackers use brute force attacks to confirm working passwords from the same lists.

Nearly two-thirds of employees reuse their passwords. The more they reuse them across business and personal accounts, the more likely criminal hackers will breach them and test them on the organisation. Hackers know to try the same passwords on different companies they hack because of password reuse.

Robust password management enables fine-grained password policies and policy customisation. With a custom password policy, organisations can increase complexity requirements, like length and previous-password change minimums. A custom password policy with increased complexity requirements will block 95% of weak and breached passwords.

Password length is a particularly critical component of strong passwords. Ninety-three percent of the passwords used in brute force attacks include eight or more characters. A custom password policy can require a minimum password length, decreasing password entropy.

https://www.bleepingcomputer.com/news/security/how-the-pizza123-password-could-take-down-an-organization/

---

Threats

Ransomware and Extortion

• SonicWall: Ransomware down this year, but there’s a catch • The Register

• Medibank cyber-attack: should the health insurer pay a ransom for its customers’ data? | Health | The Guardian

• Health insurer Medibank's infosec diagnosis is getting worse • The Register

• Microsoft links Raspberry Robin worm to Clop ransomware attacks (bleepingcomputer.com)

• How to detect Windows worm that now distributes ransomware • The Register

• Ransomware Barrage Aimed at US Healthcare Sector, Feds Warn (darkreading.com)

• BlackByte ransomware affiliate also steals victims' data • The Register

• Cuba ransomware affiliate targets Ukraine, CERT-UA warns - Security Affairs

• OldGremlin Ransomware Fierce Comeback Against Russian Targets (informationsecuritybuzz.com)

• CISA warns of ransomware attacks on healthcare providers (techtarget.com)

• Industrial Ransomware Attacks: New Groups Emerge, Manufacturing Pays Highest Ransom | SecurityWeek.Com

• Ransom Cartel - REvil Rebrand? (informationsecuritybuzz.com)

• Addressing Ransomware in Hospitals & Medical Devices (trendmicro.com)

• Australian Clinical Labs says patient data stolen in ransomware attack (bleepingcomputer.com)

• Vice Society Hackers Confess To Education Sector Ransomware Attacks (informationsecuritybuzz.com)

• Why Ransomware in Education on the Rise and What That Means for 2023 (thehackernews.com)

• Largest EU copper producer Aurubis suffers cyber attack, IT outage (bleepingcomputer.com)

• Hive Ransomware Hackers Begin Leaking Data Stolen from Tata Power Energy Company (thehackernews.com)

• Ransomware Gangs Ramp Up Industrial Attacks in US (darkreading.com)

Phishing & Email Based Attacks

• DHL Replaces LinkedIn As Most Imitated Brand in Phishing Attempts - Infosecurity Magazine (infosecurity-magazine.com)

Other Social Engineering; Smishing, Vishing, etc

• Social engineering attacks anybody could fall victim to - Help Net Security

• Twilio Says Employees Targeted in Separate Smishing, Vishing Attacks | SecurityWeek.Com

Malware

• Threat Groups Repurpose Banking Trojans into Backdoors (darkreading.com)

• Types of cloud malware and how to defend against them (techtarget.com)

• Cranefly Hackers Use Stealthy Techniques to Deliver and Control Malware - Infosecurity Magazine (infosecurity-magazine.com)

• Thousands Of Fake PoC Exploits In GitHub Repositories Deliver Malware – (informationsecuritybuzz.com)

• Chrome extensions with 1 million installs hijack targets’ browsers (bleepingcomputer.com)

• Hackers use Microsoft IIS web server logs to control malware (bleepingcomputer.com)

Mobile

• Apple Releases Patch for New Actively Exploited iOS and iPadOS Zero-Day Vulnerability (thehackernews.com)

• These Dropper Apps On Play Store Targeting Over 200 Banking and Cryptocurrency Wallets (thehackernews.com)

• Android Hacking Warning As Criminals Target TikTok And PayPal For (informationsecuritybuzz.com)

Internet of Things – IoT

• IoT Fingerprinting Helps Authenticate and Secure All Those Devices (darkreading.com)

• IoT security strategy from enterprises using connected devices | Network World

• Security by design vital to protecting IoT, smart cities around the world, says CEO of UK NCSC | CSO Online

• Your CCTV devices can be hacked and weaponized - Help Net Security

• Critical Flaws in Abode Home Security Kit Allow Hackers to Hijack, Disable Cameras | SecurityWeek.Com

Data Breaches/Leaks

• Thomson Reuters leaked at least 3TB of sensitive data | Cybernews

• See Tickets discloses 2.5 years-long credit card theft breach (bleepingcomputer.com)

• Twilio discloses another hack from June, blames voice phishing (bleepingcomputer.com)

• Seven months after it found out, FamilySearch tells users their personal data has been breached • Graham Cluley

• Bed Bath & Beyond reviewing possible data breach | Reuters

Organised Crime & Criminal Actors

• Ukrainian charged for operating Raccoon Stealer malware service (bleepingcomputer.com)

• Interpol says metaverse opens up new world of cyber crime | Reuters

• From Bounty to Exploit Observations About Cyber criminal Contests (trendmicro.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Researchers uncover cryptojacking campaign targeting Docker, Kubernetes cloud servers | SC Media (scmagazine.com)

• Purpleurchin: Cryptocurrency miners scour GitHub, Heroku • The Register

• Cryptomining campaign abused free GitHub account trials (techtarget.com)

Insider Risk and Insider Threats

• New York Post hacked? No, the culprit is an employee - Security Affairs

Fraud, Scams & Financial Crime

• UK Anti-fraud Efforts Failing (informationsecuritybuzz.com)

• Dealers Report Dramatic Increase in Identity Fraud: Most Lack Effective Protection (darkreading.com)

• Economic strife fuels cyber anxiety - Help Net Security

• LinkedIn Releases New Security Features To Combat Fraud (informationsecuritybuzz.com)

• Beware Of SCAMS As Cost Of Living Bites Finances, Expert Comments (informationsecuritybuzz.com)

Insurance

• Health insurer Medibank's infosec diagnosis is getting worse • The Register

• Cyber Insurance Market 2022: FAQs & Updates with iBynd (trendmicro.com)

Dark Web

• Notorious ‘BestBuy’ hacker arraigned for running dark web market (bleepingcomputer.com)

• Student arrested for running one of Germany’s largest dark web markets (bleepingcomputer.com)

• Dark Web Forum Busts Come Days Apart (darkreading.com)

• British hacker arraigned for running The Real Deal dark web marketplace - Security Affairs

Software Supply Chain

• Supply Chain Attacks Or Vulnerabilities Experienced By 80% Of Organisations (informationsecuritybuzz.com)

• How the Software Supply Chain Security is Threatened by Hackers (thehackernews.com)

• Open Source Is Just the Tip of the Iceberg in Software Supply Chain Security (darkreading.com)

• Consumer behaviours are the root of open source risk - Help Net Security

Denial of Service DoS/DDoS

• Key observations on DDoS attacks in H1 2022 - Help Net Security

• Meet the Windows servers that have been fuelling massive DDoSes for months | Ars Technica

Cloud/SaaS

• Everything you Need to Know about Cloud Hacking and its Methodologies (analyticsinsight.net)

• It’s time to prioritize SaaS security | InfoWorld

• Top Cloud Security Challenges & How to Beat Them (trendmicro.com)

• Atlassian Vulnerabilities Highlight Criticality of Cloud Services (darkreading.com)

• Threat Actors Target AWS EC2 Workloads to Steal Credentials (trendmicro.com)

• Cloud and Hybrid Working Security Concerns Surge - Infosecurity Magazine (infosecurity-magazine.com)

• 4 Reasons Open Source Matters for Cloud Security (darkreading.com)

• Cloud Providers Throw Their Weight Behind Confidential Computing (darkreading.com)

Hybrid Working

• Balancing remote work privacy vs. productivity monitoring (techtarget.com)

• Cloud and Hybrid Working Security Concerns Surge - Infosecurity Magazine (infosecurity-magazine.com)

Attack Surface Management

• Attack Surface Management 2022 Midyear Review Part 2 (trendmicro.com)

• Asset risk management: Getting the basics right - Help Net Security

Encryption

• New Critical Vuln In Component That Allow Encryption Across Internet - (informationsecuritybuzz.com)

• Can a new form of cryptography solve the internet’s privacy problem? | Data protection | The Guardian

API

• Thousands Of Publicly Exposed API Tokens Could Threaten Software Integrity (informationsecuritybuzz.com)

• Key API Security Principles And How To Implement Them (informationsecuritybuzz.com)

Open Source

• Open Source Is Just the Tip of the Iceberg in Software Supply Chain Security (darkreading.com)

• 4 Reasons Open Source Matters for Cloud Security (darkreading.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Why it's time to expire mandatory password expiration policies (techtarget.com)

• Feds say Ukrainian man running malware service amassed 50M unique credentials | Ars Technica

Biometrics

• ICO Warns of "Immature" Biometric Tech - Infosecurity Magazine (infosecurity-magazine.com)

Social Media

• LinkedIn Phishing Spoof Bypasses Google Workspace Security (darkreading.com)

• LinkedIn's new security features combat fake profiles, threat actors (bleepingcomputer.com)

• Cyber security event cancelled after scammers disrupt LinkedIn live chat (bitdefender.com)

• Expert Opinion: What Does Musk's Takeover Mean For Cyber security? (informationsecuritybuzz.com)

• Cyber attackers Target Instagram Users With Threats of Copyright Infringement (darkreading.com)

Cyber Bullying, Cyber Stalking and Sextortion

• Ex-cop abused police tool in Snapshot sextortion plot that stole sexually explicit photos and videos (bitdefender.com)

Regulations, Fines and Legislation

• UK Construction Biz Fined £4.4m for Serious Security Failings - Infosecurity Magazine (infosecurity-magazine.com)

• Australia Flags New Corporate Penalties for Privacy Breaches | SecurityWeek.Com

Data Protection

• What consumers expect from organisations that handle their personal data - Help Net Security

Law Enforcement Action and Take Downs

• Criminals are starting to exploit the metaverse, says Interpol. So police are heading there too | ZDNET

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

• Ukraine: Russian cyber attacks aimless and opportunistic (techtarget.com)

• Unknown Actors are Deploying RomCom RAT to Target Ukrainian Military (thehackernews.com)

• Slovak, Polish Parliaments Hit by Cyber attacks | SecurityWeek.Com

• Norway arrests man accused of being Russian spy - BBC News

• Cuba ransomware affiliate targets Ukraine, CERT-UA warns - Security Affairs

• Ukraine Warns of Cuba Ransomware Attacks - Infosecurity Magazine (infosecurity-magazine.com)

---

Nation State Actors

Nation State Actors – Russia

• Russia says Starlink satellites could become military target • The Register

• Calls for inquiry mount after reports that Truss’s phone was hacked | Financial Times

• OldGremlin Ransomware Fierce Comeback Against Russian Targets (informationsecuritybuzz.com)

Nation State Actors – China

• Chinese spy duo charged in Huawei case as US condemns ‘egregious’ interference | China | The Guardian

• Chinese Connected Cyber Crew Unleashes Disinformation Campaign Ahead of US Elections - MSSP Alert

• Federal bans don't stop US states from buying Chinese kit • The Register

• Chinese Spies Indicted for Coercing Nationals Living in US to Return as Agents of the PRC - MSSP Alert

Nation State Actors – North Korea

• Kimsuky Hackers Spotted Using 3 New Android Malware to Target South Koreans (thehackernews.com)

Nation State Actors – Iran

• Iranian government blames 'foreign country' for hack-and-leak of nuclear information - CyberScoop

---

Vulnerability Management

• Outpost24: How Pentesting-as-a-Service finds vulnerabilities before they're exploited (bleepingcomputer.com)

• Protecting organisations by understanding end-of-life software risks - Help Net Security

---

Vulnerabilities

• OpenSSL to fix the second critical flaw ever - Security Affairs

• Urgent: Google Issues Emergency Patch for Chrome Zero-Day (darkreading.com)

• Multiple RCE Vulnerabilities Discovered in Veeam Backup & Replication App - Infosecurity Magazine (infosecurity-magazine.com)

• ConnectWise fixes RCE bug exposing thousands of servers to attacks (bleepingcomputer.com)

• Critical authentication bug in Fortinet products actively exploited in the wild | The Daily Swig (portswigger.net)

• Apple megaupdate: Ventura out, iOS and iPad kernel zero-day – act now! – Naked Security (sophos.com)

• Windows Mark of the Web Zero-Days Remain Patchless, Under Exploit (darkreading.com)

• 22-Year-Old Vulnerability Reported in Widely Used SQLite Database Library (thehackernews.com)

• Cisco warns admins to patch AnyConnect flaws exploited in attacks (bleepingcomputer.com)

• Exploit released for critical VMware RCE vulnerability, patch now (bleepingcomputer.com)

• Cisco Confirms In-the-Wild Exploitation of Two VPN Vulnerabilities | SecurityWeek.Com

• Incoming OpenSSL critical fix: Organisations, users, get ready! - Help Net Security

• Cisco Users Informed of Vulnerabilities in Identity Services Engine | SecurityWeek.Com

• VMware fixes critical RCE in VMware Cloud Foundation - Security Affairs

• VMware Patches Critical Vulnerability in End-of-Life Product | SecurityWeek.Com

• Multiple vulnerabilities affect the Juniper Junos OS - Security Affairs

---

Reports Published in the Last Week

• Q3 2022 Phishing and Malware Report: Phishing Volumes Increase 31% (vadesecure.com)

• Attack Surface Management 2022 Midyear Review Part 2 (trendmicro.com)

• Justice response inadequate to meet scale of fraud epidemic - Committees - UK Parliament

---

Other News

• Cyber Security Risks & Stats This Spooky Season (darkreading.com)

• Cyber Certification Skills Are For Life, Not Just For Linkedin (informationsecuritybuzz.com)

• 8 hallmarks of a proactive security strategy | CSO Online

• Implementing Defence in Depth to Prevent and Mitigate Cyber Attacks (thehackernews.com)

• Cyber security’s importance and impact reaches all levels of the tech workforce - Help Net Security

• Stress Is Driving Cyber Security Professionals to Rethink Roles (darkreading.com)

• Equifax's Lessons Are Still Relevant, 5 Years Later (darkreading.com)

• Why dark data is a growing danger for corporations - Help Net Security

• Know the dangers you're facing: 4 notable TTPs used by cyber criminals worldwide - Help Net Security

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·       Automotive

·       Construction

·       Critical National Infrastructure (CNI)

·       Defence & Space

·       Education & Academia

·       Energy & Utilities

·       Estate Agencies

·       Financial Services

·       FinTech

·       Food & Agriculture

·       Gaming & Gambling

·       Government & Public Sector (including Law Enforcement)

·       Health/Medical/Pharma

·       Hotels & Hospitality

·       Insurance

·       Legal

·       Manufacturing

·       Maritime

·       Oil, Gas & Mining

·       OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·       Retail & eCommerce

·       Small and Medium Sized Businesses (SMBs)

·       Startups

·       Telecoms

·       Third Sector & Charities

·       Transport & Aviation

·       Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.