Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 09 July 2021
Black Arrow Cyber Threat Briefing 09 July 2021: Hackers Demand $70 Million To End Biggest Ransomware Attack On Record; Zero Day Malware Reached An All-Time High In Q1 2021; New Trojan Malware Steals Millions Of Login Credentials; MacOS Targeted In WildPressure APT Malware Campaign; The Cost Of Cyber Insurance Increased 32% Last Year And Shows No Signs Of Easing; Critical Flaws In Windows Print Spooler Service Could Allow For Remote Attacks; British Airways Settles Over Record Claim For Data Breach; Hackers On Loose As 9,000 Data Leaks A Year Recorded
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Hackers Demand $70 Million To End Biggest Ransomware Attack On Record
An affiliate of the notorious REvil gang, best known for extorting $11 million from the meat-processor JBS after a Memorial Day attack, infected thousands of victims in at least 17 countries on Friday, largely through firms that remotely manage IT infrastructure for multiple customers. REvil was demanding ransoms of up to $5 million, the researchers said. But late Sunday it offered in a posting on its dark web site a universal decryptor software key that would unscramble all affected machines in exchange for $70 million in crypto currency.
https://www.cbsnews.com/news/ransomware-attack-revil-hackers-demand-70-million/
Zero Day Malware Reached An All-Time High Of 74% In Q1 2021
74% of threats detected in Q1 2021 were zero day malware – or those for which a signature-based antivirus solution did not detect at the time of the malware release – capable of circumventing conventional antivirus solutions. The report also covers new threat intelligence on rising network attack rates, how attackers are trying to disguise and repurpose old exploits, the quarter’s top malware attacks, and more.
https://www.helpnetsecurity.com/2021/06/29/zero-day-malware-q1-2021/
New Trojan Malware Steals Millions Of Login Credentials
There is a new custom Trojan-type malware that managed to infiltrate over three million Windows computers and steal nearly 26 million login credentials for about a million websites. The findings suggest that the Trojan classifies the websites into a dozen categories, which include virtually all popular email services, social media platforms, file storage and sharing services, ecommerce platforms, financial platforms, and more. In all, the unnamed malware managed to siphon away 1.2 terabytes of personal data including over a million unique email addresses, over two billion cookies, and more than six million other files.
https://www.techradar.com/news/malware-steals-millions-of-login-credentials-for-popular-websites
Ransomware As A Service: Negotiators Are Now In High Demand
The Ransomware-as-a-Service (RaaS) ecosystem is evolving into something akin to a corporate structure, with new openings available for "negotiators" -- a role focused on extorting victims to pay a ransom. A study in RaaS trends has recently come out saying that one-man-band operations have almost "completely dissolved" due to the lucrative nature of the criminal ransomware business. Showing the potential financial gains squeezed from companies desperate to unlock their systems have given rise to specialists in cyber crime and extortion and have also led to a high demand for individuals to take over the negotiation part of an attack chain.
MacOS Targeted In WildPressure APT Malware Campaign
Recently, threat actors known as WildPressure have added a MacOS malware variant to their latest campaign targeting energy sector businesses, while enlisting compromised WordPress websites to carry out attacks. Furthermore, known novel malware, initially identified in March 2020 and dubbed Milum, has now been retooled with a PyInstaller bundle containing a trojan dropper compatible with Windows and MacOS systems, according to researchers. Compromised endpoints allow the advanced persistent threat (APT) group to download and upload files and executing commands.
The Cost Of Cyber Insurance Increased 32% Last Year And Shows No Signs Of Easing
The cost of insurance to protect businesses and organisations against the ever-increasing threat of cyber crimes has soared by a third in the last year. Also adding that global cyber insurance pricing has increased by an average of 32 percent in the year to June. Not only are premiums going through the roof, insurers are also attaching more strings to their policies, demanding ever more assurances that firms taking out cover have the necessary systems and processes in place to prevent a cyber mishap. Previous research also suggests that the upward squeeze on premiums shows no sign of easing, which, in turn, is putting more strain on the sector.
https://www.theregister.com/2021/07/05/cyber_insurance_report/
Critical Flaws In Windows Print Spooler Service Could Allow For Remote Attacks
Administrators are urged to apply the latest patches from Microsoft and disable the Windows Print spooler service in domain controllers and systems not used for printing. This is because Microsoft is currently grappling with a couple of security holes in its Windows Print spooler service that could allow attackers to remotely control an affected system. Anyone able to exploit the more recent vulnerability of the two would be able to run code on the compromised computer with full system privileges. That attacker could then install software, modify data and create new user accounts.
End Users In The Dark About Latest Cyber Threats, Attacks
According to a recent survey, which polled consumers and end users, high-profile incidents such as the ransomware attack on Colonial Pipeline Co. and the breach of a Florida city's water utilities were either overlooked or ignored by many outside the IT and information security fields. As a result, the responsibility for keeping users informed and aware of the need for heightened security appears to fall on administrators and IT staff.
British Airways Settles Over Record Claim For Data Breach
British Airways has settled what is thought to be the biggest claim for a data breach in British legal history, involving 16,000 victims. However, the amount was not disclosed. When The breach took place three years ago, multiple data sources and customer data was leaked, including the leakage of names, addresses and card payment details which affected 420,000 customers and staff. As a result, in 2019 the Information Commissioner’s Office hit BA with its largest ever fine at £20 million.
Hackers On Loose As 9,000 Data Leaks A Year Recorded
Public bodies and the private sector suffered nearly 9,000 data security incidents in 12 months with sensitive and private information hacked, lost or accidentally given to the wrong people. This Data was seen to lists more than 500 organisations hit by ransomware attacks and a further 562 incidents of hacking. There was also a total of 8,815 data security incidents in 2020/21 with the most breaches in the health and education sectors. Furthermore, over the past three years, police forces across England and Wales suffered an average eight breaches a week. Even security experts announced that these figures were “alarming” and that the public would be “disturbed” to learn how often important information/data was being lost.
https://www.thetimes.co.uk/article/hackers-9000-data-leaks-recorded-cyber-crime-56nvs7t6w
Threats
Ransomware
Swedish Coop Supermarkets Shut Due To US Ransomware Cyber Attack
Ransomware-Hit Law Firm Gets Court Order Asking Crooks Not To Publish The Data They Stole
This Crowd Sourced Ransomware Payment Tracker Shows How Much Cyber Criminals Have Heisted
Ransomware: US Warns Russia To Take Action After Latest Attacks
Kaseya Says Up To 1,500 Businesses Compromised In Massive Ransomware Attack
Phishing
Malware
Vulnerabilities
Microsoft Issues Emergency Patch for Critical Windows PrintNightmare Vulnerability
Microsoft Warns Of Critical PowerShell 7 Code Execution Vulnerability
Researchers Briefly Posted PoC For Windows Print Spooler RCE Flaw
Kaseya Patches Imminent After Zero-Day Exploits, 1,500 Impacted
SonicWall Addresses Critical CVE-2021-20026 Flaw In NSM Devices
Kaseya Left Customer Portal Vulnerable To 2015 Flaw In Its Own Software
Morgan Stanley Announces Breach Of Customer SSNs Through Accellion FTA Vulnerability
Data Breaches
Organised Crime & Criminal Actors
UK, US Agencies Warn Of Large-Scale Brute-Force Attacks Carried Out By Russian APT
Moroccan Hacker Dr Hex Arrested For Phishing Attacks, Malware Distribution
Supply Chain
OT, ICS, IIoT and SCADA
Nation State Actors
SolarWinds Hackers Breached RNC Via Synnex In New Attack: Report
Lazarus gang targets engineers with job offers using poisoned emails (tripwire.com)
Cloud
Privacy
Other News
IT Manager Who Swindled Essex Hospital Trust Out Of £800k Gets 5 Years In Prison
Website Of Mongolian Certificate Authority Served Backdoored Client Installer
Security Problems Worsen As Enterprises Build Hybrid And Multiloud Systems
Leaked infrastructure code, credentials and keys costing orgs an average of $1.2 million per year
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our weekly ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.