Black Arrow Cyber Threat Briefing 12 July 2024
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
New Study Reveals UK Businesses at Risk from Imminent Cyber Attacks
A recent report by Cloudflare reveals that 70% of UK business leaders anticipate a cyber security incident within the next year, yet only 35% feel adequately prepared. The survey, involving over 4,000 business and technology leaders across Europe, highlights that 48% of UK organisations have faced a cyber security incident in the past 12 months, the highest in Europe. 80% of UK leaders report an increase in cyber incidents, with 60% expecting this trend to continue.
The Escalating War Against Email-Based Espionage and Fraud
A recent report highlights the rapid rise in email-based cyber crime, with cyber criminals sending an estimated 3.4 billion malicious emails daily, contributing to over $43 billion in business email compromise losses since 2016. Traditional email security measures are proving inadequate, prompting the need for proactive solutions like DMARC (Domain-based Message Authentication, Reporting & Conformance). Acting as an identity check for emails, DMARC can reduce email impersonation threats by over 90% when enforced correctly. However, global adoption remains slow at 30%, hindered by perceived complexity. New zero-trust email authentication tools are simplifying deployment, promising faster and more effective domain protection.
Trade the Comfort of Security Theatre for True Security
A recent article highlights the prevalence of "security theatre," where companies focus on creating an illusion of robust cyber security rather than implementing substantial defensive measures. Despite these superficial efforts, organisations continue to face lawsuits, fines, and regulatory scrutiny over their inadequate data protection practices. The article underscores the need for genuine cyber security programmes, driven by actual risk mitigation to protect against the rising tide of cyber threats rather than marketing tactics and checklist compliance. Regulatory bodies in the EU and the US are intensifying their focus, with fines reaching up to 7% of global revenue for breaches.
Traditional Cyber Security Measures are No Longer Enough
A recent report by LogRhythm highlights that traditional cyber security measures are insufficient against sophisticated AI-powered attacks, necessitating agile and adaptive strategies. According to the 'State of the Security Team’ report, 95% of companies adjusted their security strategies in the past year due to evolving threats, regulatory changes, and AI adoption. Additionally, 78% of professionals now hold cyber security leaders and CEOs accountable for breaches. The widespread adoption of cloud computing and remote work has expanded the attack surface, underscoring the need for robust cloud security practices, comprehensive security training, and advanced threat detection technologies.
Threats to NATO Countries Escalate, as NATO Outlines Internet Doomsday Plan
A Mandiant report reveals increasing cyber attack risks for NATO countries from state-sponsored actors, hacktivists, and criminals. Russia’s invasion of Ukraine drives many attacks, while China's espionage targets NATO intel and trade secrets. Cyber threats extend beyond military targets, impacting hospitals and civil infrastructure, with ransomware attacks on healthcare and government services escalating due to lax cyber crime enforcement.
NATO has recently outlined plans to safeguard subsea internet cables, a favoured target of nation state actors, and the data carried by these cables by rerouting to satellites in case of disruptions. This system, part of the HEIST project, involves researchers from the US, Iceland, Sweden, and Switzerland, supported by NATO's Science for Peace and Security Programme. By detecting disturbances in undersea cables and ensuring uninterrupted communication, the project addresses heightened concerns over global instability and threats to critical infrastructure.
In Ransomware Attacks, Expect to Lose 43 Percent of Affected Data Even if You Pay
A recent report by Veeam highlights the pervasive threat of ransomware, with the endemic impacting 3 out of 4 organisations in 2023. In many cases only 57% of compromised data was recoverable, leaving 43% lost. The report indicates that 81% of affected organisations paid ransoms, yet one-third failed to recover their data even after paying. Additionally, 63% of organisations risk reintroducing infections during recovery due to pressure to restore quickly. Despite increased focus on cyber preparedness, 63% of organisations find their backup and cyber teams misaligned.
New Ransomware Scam Will Hassle You with Phone Calls Until You Pay Up
A recent report reveals that a new ransomware group, Volcano Demon, has emerged, harassing its victims via phone until payment is made. The group has targeted several organisations in the past weeks, deploying an encryptor named LukaLocker. This ransomware maps and exfiltrates sensitive files before encrypting them, adding a .nba extension, which works on both Windows and Linux systems. Notably, Volcano Demon does not operate a data leak site but instead directly contacts company leadership to negotiate payments, often using threatening tones. Additionally, LukaLocker can disable most antivirus processes and clear logs, complicating forensic investigations. Limited logging and monitoring solutions among victims exacerbate the issue.
China's APT40 Gang is Attacking Vulnerabilities Within Hours of Public Release
A recent advisory led by Australia, with contributions from seven other nations, details the sophisticated methods of the China-aligned threat actor APT40, also known as Kryptonite Panda and Gingham Typhoon. This state-sponsored group is adept at exploiting new vulnerabilities within hours, as well as targeting unpatched systems dating back to 2017 such as Log4J and Microsoft Exchange. APT40 employs compromised devices, including small-office/home-office equipment, to launch attacks, masking their activities as legitimate traffic. The advisory recommends basic cyber security practices like logging, patch management, and network segmentation to defend against APT40's persistent threats.
New Survey: Generative AI and Phishing Concerns, Employees Put Corporate Data at Risk
A study by Censuswide reveals that 74% of security professionals express confidence in their IT departments, yet over half have experienced a data breach recently. The misuse of generative AI, particularly deepfake phishing attacks, is cited as a significant threat. All types of phishing, along with poor software design, ransomware, and zero-day threats are top concerns, with 55% of experts admitting to not conducting regular security audits. Cloud security issues, especially incorrectly set identity and access management policies, are also highlighted. Additionally, trust in employees is dwindling, with 63% of IT security decision-makers in the UK and US expecting remote workers to put corporate data at risk. Notably, 55% reported these workers have knowingly jeopardised data security, and 73% lack the necessary skills and technology to keep data safe. This underscores the urgent need for improved training and robust security measures.
The Urgent Need for Digital Executive Protection: A CEO’s Perspective
A recent article highlights the urgent need for Digital Executive Protection amidst increasing cyber threats. Cyber criminals are now targeting executives personally, endangering both their personal integrity and their companies' credibility and market perception. A cyber attack on a CEO can lead to severe consequences, including data breaches and financial losses. The sophistication of phishing attempts, ransomware, and social engineering tactics demands advanced security measures tailored for high-value targets. By prioritising their own digital security, executives can ensure business continuity, safeguard confidential information, and set a precedent for a robust corporate security posture, thereby protecting both their personal and professional integrity.
Businesses Must do Better to Understand Complexity of Business Email Compromise
A recent report highlights Business Email Compromise (BEC) as one of the most financially damaging cyber threats. BEC attacks, involving impersonation schemes where cyber criminals masquerade as trusted entities, are increasing in frequency and sophistication. The FBI’s Internet Crime Complaint Center reports annual economic losses from BEC attacks in the billions of dollars. Organisations must enhance their understanding and defences against BEC to protect their assets, reputation, and operations from severe financial losses and regulatory penalties.
Ransomware Surges Annually Despite Law Enforcement Takedowns
A recent report by Symantec reveals a 9% year-on-year increase in ransomware attacks advertised on leak sites in Q1 2024, with 962 claimed attacks. Despite law enforcement actions against major groups like ALPHV/BlackCat and LockBit, the latter remains the top threat, responsible for over 20% of all claimed attacks. Known vulnerabilities continue to be the primary vector for these attacks.
Sources:
https://www.afcea.org/signal-media/cyber-edge/escalating-war-against-email-based-espionage-and-fraud
https://www.darkreading.com/cyber-risk/trade-the-comfort-of-security-theater-for-true-security
https://www.techradar.com/pro/traditional-cybersecurity-measures-are-no-longer-enough
https://www.msspalert.com/brief/escalating-cyber-threats-faced-by-nato-countries
https://www.tomshardware.com/tech-industry/nato-outlines-internet-doomsday-plan
https://www.theregister.com/2024/07/09/apt_40_tradecraft_advisory/
https://www.infosecurity-magazine.com/news/ransomware-surges-2024-law/
Governance, Risk and Compliance
Traditional cyber security measures are no longer enough | TechRadar
Cloudflare Study: UK Businesses are at Risk of Cyber Attacks (itsecuritywire.com)
The Escalating War Against Email-Based Espionage and Fraud | AFCEA International
5 Key Questions CISOs Must Ask Themselves About Their Cyber Security Strategy (thehackernews.com)
Cyber security pros don't like being ignored (betanews.com)
Trade the Comfort of Security Theater for True Security (darkreading.com)
The Urgent Need for Digital Executive Protection: A CEO's Perspective - Security Boulevard
More than a CISO: the rise of the dual-titled IT leader | CSO Online
Survey Sees Modern CISOs Becoming More Comfortable With Risk - Security Boulevard
A CISO's Guide to Avoiding Jail After a Breach (darkreading.com)
5 Steps CISOs Can Take to Ensure Resilience (informationweek.com)
It’s Time to Reassess Your Cyber Security Priorities - Security Week
Three pillars of cyber | Professional Security
The Future Of Cyber Security: Emerging Threats And How To Combat Them (forbes.com)
Top priorities for compliance leaders this year - Help Net Security
Deconstructing Security Assumptions to Ensure Future Resilience (darkreading.com)
Managing cyber attack fallout: Financial and operational damage - Help Net Security
Applying Bloch’s Philosophy to Cyber Security - Security Boulevard
Cyber Security Success Hinges on Leadership, Not Just Tech (inforisktoday.com)
Threats
Ransomware, Extortion and Destructive Attacks
This new ransomware scam will hassle you with phone calls until you pay up | TechRadar
Victims of cyber extortion and ransomware increase in 2024 | SC Media (scmagazine.com)
LockBit 3.0: The Rising Costs of Ransomware Attacks - Security Boulevard
Ransomware gangs invest in custom data stealing malware • The Register
New Ransomware Group Exploiting Veeam Backup Software Vulnerability (thehackernews.com)
Ransomware gangs increasingly exploiting vulnerabilities | TechTarget
Akira Ransomware: Lightning-Fast Data Exfiltration in 2-Ish Hours (darkreading.com)
In ransomware attacks, expect to lose 43 percent of affected data - eCampus News
NHS cyber security: Ex security chief warns of future attacks - BBC News
New Ransomware-as-a-Service 'Eldorado' Targets Windows and Linux Systems (thehackernews.com)
Eldorado Ransomware Cruises Onto the Scene to Target VMware ESXi (darkreading.com)
CISA Advises Against Paying Ransom, But Rules Out a Ban | MSSP Alert
Risk & Repeat: Hacks, lies and LockBit | TechTarget
An In-Depth Look at Crypto-Crime in 2023 Part 1 | Trend Micro (US)
Evolving ransomware attack techniques examined | SC Media (scmagazine.com)
Fujitsu Suffers Worm-Like Attack From Something That Wasn't Ransomware (darkreading.com)
Envisioning cyber resilience beyond ransom payments - SiliconANGLE
Avast releases DoNex ransomware decryptor • The Register
CISA director says banning ransomware payments is off the table (securityintelligence.com)
Cisco Talos: Top Ransomware TTPs Exposed (techrepublic.com)
Emulating the Long-Term Extortionist Nefilim Ransomware - Security Boulevard
Ransomware Victims
Evolve Bank says ransomware gang stole personal data on millions of customers | TechCrunch
The untold impact of Qilin's attack on London hospitals • The Register
Nearly 800,000 affected by children’s hospital ransomware attack | Security Magazine
Patelco faces multiple lawsuits over ransomware attack | American Banker
Hackers leak 170k Taylor Swift ’s ERAS Tour Barcodes (securityaffairs.com)
Indonesian National Data Center Breach Traced to Weak Password: 'Admin#1234' (jakartaglobe.id)
STORMOUS Ransomware Group Claiming Breach of HITC Telecom (cybersecuritynews.com)
‘Serious hacker attack’ forces Frankfurt university to shut down IT systems (therecord.media)
Hackers leak 39,000 print-at-home Ticketmaster tickets for 154 events (bleepingcomputer.com)
Ransomware attack on blood-testing service puts lives in danger in South Africa (bitdefender.com)
NTT Data Romania, hacked (romaniajournal.ro)
Phishing & Email Based Attacks
The Escalating War Against Email-Based Espionage and Fraud | AFCEA International
New 'FishXProxy' phishing kit lowers entry bar for cyber attacks - SiliconANGLE
Spear phishing techniques in mass phishing: a new trend | Securelist
Why You Might Be Getting Spam Emails From Yourself (slashgear.com)
How do cryptocurrency drainer phishing scams work? (talosintelligence.com)
The New Battlefield in Banking: Defending Against Phishing Scams (financemagnates.com)
The 9 most common phishing scam types, explained | PCWorld
State, local governments facing deluge of phishing attacks | SC Media (scmagazine.com)
The FIA has been hacked after workers fell for a phishing attack | TechRadar
BEC
The 9 most common phishing scam types, explained | PCWorld
Other Social Engineering
This new ransomware scam will hassle you with phone calls until you pay up | TechRadar
Euro Vishing Fraudsters Add Physical Intimidation to Arsenal (darkreading.com)
Google Fi's 'Number Lock' adds protection against SIM swaps - here's how to enable it | ZDNET
Revealed the cyber security risks of working in public places | theHRD (thehrdirector.com)
The 9 most common phishing scam types, explained | PCWorld
Artificial Intelligence
OpenAI breach is a reminder that AI companies are treasure troves for hackers | TechCrunch
Bring Your Own AI to Work Creates a Haven for Cyber Attackers (technewsworld.com)
Human Vigilance is Required Amid AI-Generated Cyber Security Threats - Security Boulevard
Top 10 AI Security Risks for 2024 | Trend Micro (US)
Security, privacy, and generative AI | InfoWorld
Winner takes Al | Professional Security
ChatGPT for Mac app flaw left users' chat history exposed (bitdefender.com)
Can AI be Meaningfully Regulated, or is Regulation a Deceitful Fudge? - Security Week
ChatGPT 4 exploits 87% of vulnerabilities (devx.com)
When implementing AI, first train your managers | ZDNET
Privacy & Security Concerns With AI Meeting Tools (darkreading.com)
Cyber Security Success Hinges on Leadership, Not Just Tech (inforisktoday.com)
Most Security Pros Admit Shadow SaaS and AI Use - Infosecurity Magazine (infosecurity-magazine.com)
2FA/MFA
Authy Users Urged to Stay Alert After Hack Exposes 33 Million Phone Numbers - MacRumors
Hackers abused API to verify millions of Authy MFA phone numbers (bleepingcomputer.com)
Multifactor Authentication Shouldn't Be Optional (govinfosecurity.com)
Gmail Users Offered Free Top Tier Security Upgrade—Say Goodbye To 2FA (forbes.com)
Malware
Botnets are being sold on the dark web for as little as $99 | ITPro
GootLoader is still active and efficient (securityaffairs.com)
Security Bite: Mac Malware wreaking the most havoc in 2024 - 9to5Mac
Ransomware gangs invest in custom data stealing malware • The Register
GuardZoo Malware Targets Over 450 Middle Eastern Military Personnel (thehackernews.com)
ViperSoftX Malware Disguises as eBooks on Torrents to Spread Stealthy Attacks (thehackernews.com)
Fujitsu Suffers Worm-Like Attack From Something That Wasn't Ransomware (darkreading.com)
Hackers Resurrect Internet Explorer to Attack Windows PCs (pcmag.com)
Chinese APT41 Upgrades Malware Arsenal with DodgeBox and MoonWalk (thehackernews.com)
350 million people downloaded insecure browser extensions over two years | Cybernews
Hackers Weaponizing Shortcut Files With Zero-day Tricks (cybersecuritynews.com)
Notorious Hacker Kingpin ‘Tank’ Is Finally Going to Prison | WIRED
60 New Malicious Packages Uncovered in NuGet Supply Chain Attack (thehackernews.com)
Multiple threat actors exploit PHP flaw CVE-2024-4577 to deliver malware (securityaffairs.com)
GuardZoo spyware used by Houthis to target military personnel - Help Net Security
Mac Security: How secure is a Mac, is macOS more secure than Windows? | Macworld
Mobile
New Google Play Store Warning As Dangerous Threat Returns (forbes.com)
Europol says mobile roaming tech is hampering crimefighters • The Register
Hackers abused API to verify millions of Authy MFA phone numbers (bleepingcomputer.com)
Examining the impact of cyber crime and online fraud | TechRadar
A simple firmware update completely hides a device's Bluetooth fingerprint (techxplore.com)
Apple warns iPhone users in 98 countries of spyware attacks | TechCrunch
Every Phone Can ID Your Router—Here's How to Stop It | PCMag
Google is opening its dark web reports to all users free of charge | TechSpot
How to protect Apple ID and avoid scams - 9to5Mac
How to clear your Google search cache on Android (and why you should) | ZDNET
Denial of Service/DoS/DDOS
OVHcloud Hit with Record 840 Million PPS DDoS Attack Using MikroTik Routers (thehackernews.com)
Internet of Things – IoT
How to clear the cache on your TV (and why you should do it) | ZDNET
Data Breaches/Leaks
OpenAI breach is a reminder that AI companies are treasure troves for hackers | TechCrunch
Hacker Stole Secrets From OpenAI - Security Week
Hackers stole OpenAI secrets in a 2023 security breach (securityaffairs.com)
Authy Users Urged to Stay Alert After Hack Exposes 33 Million Phone Numbers - MacRumors
OpenAI hit by two big security issues this week (engadget.com)
Shopify denies it was hacked, links stolen data to third-party app (bleepingcomputer.com)
Fujitsu Suffers Worm-Like Attack From Something That Wasn't Ransomware (darkreading.com)
The FIA has been hacked after workers fell for a phishing attack | TechRadar
Cyber Confidence at MSPs high, despite falling victim to data breaches - IT Security Guru
General Motors reports “suspicious activity” within certain GM accounts | Cybernews
Ticketmaster hack: Customers told to sign up to security service - BBC News
Hackers leak 170k Taylor Swift ’s ERAS Tour Barcodes (securityaffairs.com)
NTT Data Romania, hacked (romaniajournal.ro)
Top cyber agency still unsure of fallout months after hack - Washington Times
Computer maker Zotac exposed customers' RMA info on Google Search (bleepingcomputer.com)
Fujitsu confirms customer data exposed in March cyber attack (bleepingcomputer.com)
Neiman Marcus data breach: 31 million email addresses found exposed (bleepingcomputer.com)
Philhealth: Victims of data leak not yet notified of hacking’s extent (inquirer.net)
ChatGPT for Mac app flaw left users' chat history exposed (bitdefender.com)
Heritage Foundation Exec Threatens 'Gay Furry Hackers' in Unhinged Texts (rollingstone.com)
Mastodon: Security flaw allows unauthorized access to posts (stackdiary.com)
Advance Auto Parts data breach impacts 2.3 million people (bleepingcomputer.com)
Organised Crime & Criminal Actors
New 'FishXProxy' phishing kit lowers entry bar for cyber attacks - SiliconANGLE
An In-Depth Look at Crypto-Crime in 2023 Part 1 | Trend Micro (US)
Notorious Hacker Kingpin ‘Tank’ Is Finally Going to Prison | WIRED
How AI helps decode cyber criminal strategies - Help Net Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Hackers Have Stolen $1.38 Billion in Crypto So Far This Year (pcmag.com)
How do cryptocurrency drainer phishing scams work? (talosintelligence.com)
An In-Depth Look at Crypto-Crime in 2023 Part 1 | Trend Micro (US)
Insider Risk and Insider Threats
Fears escalate that employees will put corporate data at risk | theHRD (thehrdirector.com)
Insurance
Cyber Insurance Prices Plummet as Market Competition Grows (darkreading.com)
Supply Chain and Third Parties
Shopify denies it was hacked, links stolen data to third-party app (bleepingcomputer.com)
60 New Malicious Packages Uncovered in NuGet Supply Chain Attack (thehackernews.com)
Are SOC 2 Reports Sufficient for Vendor Risk Management? (darkreading.com)
Addressing third-party security risks - FreightWaves
Cloud/SaaS
OVHcloud Hit with Record 840 Million PPS DDoS Attack Using MikroTik Routers (thehackernews.com)
SaaS Security in Europe: A Report Card - Infosecurity Magazine (infosecurity-magazine.com)
Multifactor Authentication Shouldn't Be Optional (govinfosecurity.com)
The Crucial Role Of Browser Context In Modern Cyber Security (forbes.com)
Most Security Pros Admit Shadow SaaS and AI Use - Infosecurity Magazine (infosecurity-magazine.com)
Security pros use unauthorized SaaS apps despite the risk (betanews.com)
73% of security pros use unauthorized SaaS applications - Help Net Security
Encryption
Linux and Open Source
New Ransomware-as-a-Service 'Eldorado' Targets Windows and Linux Systems (thehackernews.com)
OpenSSH bug leaves RHEL 9 and the RHELatives vulnerable • The Register
Do you need antivirus on Linux? | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
Indonesian National Data Center Breach Traced to Weak Password: 'Admin#1234' (jakartaglobe.id)
General Motors reports “suspicious activity” within certain GM accounts | Cybernews
Back to Basics of Automated Attacks: Account Takeover | Fastly
Time to see past the blind spots of account takeover | SC Media (scmagazine.com)
Self-service password reset: How the cure could introduce more security ills (betanews.com)
Training, Education and Awareness
Human Vigilance is Required Amid AI-Generated Cyber Security Threats - Security Boulevard
When implementing AI, first train your managers | ZDNET
Training, awareness key to preventing cyber attacks | Country 94
Regulations, Fines and Legislation
Vinted Fined €2.3m Over Data Protection Failure - Infosecurity Magazine (infosecurity-magazine.com)
What You Need to Know About the EU Cyber Resilience Act - Security Boulevard
How to Prepare for the EU’s NIS2 Directive - Security Boulevard
CISA Advises Against Paying Ransom, But Rules Out a Ban | MSSP Alert
The New Battlefield in Banking: Defending Against Phishing Scams (financemagnates.com)
A CISO's Guide to Avoiding Jail After a Breach (darkreading.com)
A Comprehensive Guide to the Digital Operational Resilience Act (DORA) - Security Boulevard
CISA director says banning ransomware payments is off the table (securityintelligence.com)
Supreme Court Ruling Threatens the Framework of Cyber Security Regulation - Security Week
Can AI be Meaningfully Regulated, or is Regulation a Deceitful Fudge? - Security Week
A CISO's Summary Of The Cyber Resilience Act (forbes.com)
Models, Frameworks and Standards
OWASP Penetration Testing: Methodology, Kit, Checklist (Downloadable) - Security Boulevard
A Comprehensive Guide to the Digital Operational Resilience Act (DORA) - Security Boulevard
Are SOC 2 Reports Sufficient for Vendor Risk Management? (darkreading.com)
Data Protection
Vinted Fined €2.3m Over Data Protection Failure - Infosecurity Magazine (infosecurity-magazine.com)
Careers, Working in Cyber and Information Security
What Kind of People Do Cyber Security for a Living? (databreachtoday.co.uk)
5 Ways to Run Security as a Meritocracy (darkreading.com)
Diversifying cyber teams to tackle complex threats - Help Net Security
Three critical steps to close the cyber security talent gap, once and for all | VentureBeat
Organisations change recruitment strategies to find cyber talent - Help Net Security
Exploring the root causes of the cyber security skills gap - Help Net Security
Most Security Pros Admit Shadow SaaS and AI Use - Infosecurity Magazine (infosecurity-magazine.com)
Security pros use unauthorized SaaS apps despite the risk (betanews.com)
73% of security pros use unauthorized SaaS applications - Help Net Security
Law Enforcement Action and Take Downs
Europol says mobile roaming tech is hampering crimefighters • The Register
Risk & Repeat: Hacks, lies and LockBit | TechTarget
Notorious Hacker Kingpin ‘Tank’ Is Finally Going to Prison | WIRED
Cyber stalking expert jailed after 'grotesque' online threats • The Register
FBI, cyber cops zap 968 'Russian AI disinfo' Twitter bots • The Register
Misinformation, Disinformation and Propaganda
How Disinformation From a Russian AI Spam Farm Ended up on Top of Google Search Results | WIRED
US intel officials: Kremlin once again prefers Trump | CyberScoop
Feds Uncover Sprawling, GenAI-Enabled Russian Troll Farm (darkreading.com)
FBI, cyber cops zap 968 'Russian AI disinfo' Twitter bots • The Register
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
The Escalating War Against Email-Based Espionage and Fraud | AFCEA International
Escalating Cyber Threats Faced by NATO Countries | MSSP Alert
NATO members increasingly targeted by state-sponsored cyber attacks | SC Media (scmagazine.com)
Allies Agree New NATO Integrated Cyber Defence Center – Eurasia Review
Allies Agree New NATO Integrated Cyber Defence Center – Eurasia Review
Nation State Actors
China
China’s APT40 gang can attack new vulns within hours • The Register
Eight Nations Issue Warning About Speed Of Chinese Hackers’ Operations (forbes.com)
Chinese APT41 Upgrades Malware Arsenal with DodgeBox and MoonWalk (thehackernews.com)
Australia accuses China-backed hackers of breaching government networks (ft.com)
Global Coalition Blames China’s APT40 for Hacking Government Networks - Security Week
China-Made Tech Discovered at Taiwanese Army Base (thedefensepost.com)
Germany finally gets round to banning Huawei, sort of (telecoms.com)
Russia
A recent Microsoft data breach also let Russian hackers compromise US federal agencies | TechRadar
Teamviewer Discloses Investigation Update Following Cyber Attack (cybersecuritynews.com)
How Disinformation From a Russian AI Spam Farm Ended up on Top of Google Search Results | WIRED
The Stark Truth Behind the Resurgence of Russia’s Fin7 – Krebs on Security
Feds Uncover Sprawling, GenAI-Enabled Russian Troll Farm (darkreading.com)
CloudSorcerer hackers abuse cloud services to steal Russian govt data (bleepingcomputer.com)
New APT Group "CloudSorcerer" Targets Russian Government Entities (thehackernews.com)
French political turmoil, cyber attacks and protests threaten to disrupt Olympics (inews.co.uk)
US intel officials: Kremlin once again prefers Trump | CyberScoop
Alert Level Raised at US Bases in Europe Over Russian Threats - The New York Times
North Korea
Japan warns of attacks linked to North Korean Kimsuky hackers (bleepingcomputer.com)
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Heritage Foundation Exec Threatens 'Gay Furry Hackers' in Unhinged Texts (rollingstone.com)
'Gay furry hackers' take credit for Project 2025 cyber attack (thepinknews.com)
Furry Hackers SiegedSec Suspended from X Amid Leak Spree (dailydot.com)
Tools and Controls
Why Firewalls Are Not Enough in Today’s Cyber Security Landscape | MSSP Alert
5 Key Questions CISOs Must Ask Themselves About Their Cyber Security Strategy (thehackernews.com)
Cloudflare blames recent outage on BGP hijacking incident (bleepingcomputer.com)
Cyber Security 101: MDR vs. XDR | MSSP Alert
Authy Users Urged to Stay Alert After Hack Exposes 33 Million Phone Numbers - MacRumors
Blueprint for Success: Implementing a CTEM Operation (thehackernews.com)
Human Vigilance is Required Amid AI-Generated Cyber Security Threats - Security Boulevard
How API attacks work, plus 5 common types | TechTarget
Selfie-based authentication is on the rise, alarming security experts | TechSpot
The Crucial Role Of Browser Context In Modern Cyber Security (forbes.com)
Training, awareness key to preventing cyber attacks | Country 94
Survey Sees Modern CISOs Becoming More Comfortable With Risk - Security Boulevard
5 Steps CISOs Can Take to Ensure Resilience (informationweek.com)
How Observability Leads to Better Cyber Security | eWEEK
Deconstructing Security Assumptions to Ensure Future Resilience (darkreading.com)
Cyber Insurance Prices Plummet as Market Competition Grows (darkreading.com)
2024 SANS SOC Survey Reveals Critical Trends and Technologies in Cyber Defence (darkreading.com)
ChatGPT 4 exploits 87% of vulnerabilities (devx.com)
When implementing AI, first train your managers | ZDNET
Fake network traffic is on the rise — here's how to counter it | CSO Online
Self-service password reset: How the cure could introduce more security ills (betanews.com)
Strengthening cyber security preparedness with defence in depth - Help Net Security
Navigating Europe’s digital identity crossroads • The Register
Other News
Euro 2024 Becomes Latest Sporting Event to Attract Cyber Attacks (darkreading.com)
Cyber Security Checklist: Preparing Your Devices for Summer Travel - Security Boulevard
Halton Council 'at mercy of criminal hacker gangs' - report - BBC News
The Future Of Cyber Security: Emerging Threats And How To Combat Them (forbes.com)
Labour’s next steps: Cyber security, AI, & Open-Source industry leaders weigh in (techinformed.com)
Microsoft’s cyber security dilemma: An open letter to Satya Nadella - Help Net Security
Checking in on the state of cyber security and the Olympics (talosintelligence.com)
MSPs confident they can fend off cyber threat | Microscope (computerweekly.com)
From Iron Dome To Cyber Dome: Defending Israel’s Cyber Space – Analysis – Eurasia Review
'Gay furry hackers' take credit for Project 2025 cyber attack (thepinknews.com)
Why 'change' for the UK must include cyber security (computing.co.uk)
Is Your Gaming Setup Safe? Gaming Security Musts (cgmagonline.com)
Protecting against cyber attacks in space (mybroadband.co.za)
Vulnerability Management
China’s APT40 gang can attack new vulns within hours • The Register
Ransomware gangs increasingly exploiting vulnerabilities | TechTarget
Blueprint for Success: Implementing a CTEM Operation (thehackernews.com)
ChatGPT 4 exploits 87% of vulnerabilities (devx.com)
Introducing a New Vulnerability Class: False File Immutability — Elastic Security Labs
What's Bugging the NSA? A Vuln in Its 'SkillTree' Training Platform (darkreading.com)
Vulnerabilities
Attackers Already Exploiting Flaws in Microsoft's July Security Update (darkreading.com)
‘Blast-RADIUS’ Critical Bug Blows Up IT Vacation Plans - Security Boulevard
The Windows Security Updates of July 2024 are now available - gHacks Tech News
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited (thehackernews.com)
Microsoft Warns of Windows Hyper-V Zero-Day Being Exploited - Security Week
Blast RADIUS attack can bypass authentication for clients • The Register
New OpenSSH Vulnerability Discovered: Potential Remote Code Execution Risk (thehackernews.com)
Citrix Patches Critical NetScaler Console Vulnerability - Security Week
Veeam flaw becomes malware target a year after patching • The Register
Threat actors exploited Windows 0-day for more than a year before Microsoft fixed it | Ars Technica
Bust this Ghostscript bug or risk a big breach, say experts • The Register
Apache fixed a source code disclosure flaw in Apache HTTP Server (securityaffairs.com)
MongoDB Compass Code Injection Flaw Exposes Systems to Hacking (cybersecuritynews.com)
New Ransomware Group Exploiting Veeam Backup Software Vulnerability (thehackernews.com)
Adobe Issues Critical Patches for Multiple Products, Warns of Code Execution Risks - Security Week
Cisco Warns of regreSSHion RCE Impacting Multiple Products (cybersecuritynews.com)
Hackers Resurrect Internet Explorer to Attack Windows PCs (pcmag.com)
SAP Patches High-Severity Vulnerabilities in PDCE, Commerce - Security Week
CISA Takedown of Ivanti Systems Is a Wake-up Call (darkreading.com)
Multiple threat actors exploit PHP flaw CVE-2024-4577 to deliver malware (securityaffairs.com)
Hackers target WordPress calendar plugin used by 150,000 sites (bleepingcomputer.com)
GitLab Patches Critical Flaw Allowing Unauthorized Pipeline Jobs (thehackernews.com)
VMware Patches Critical SQL-Injection Flaw in Aria Automation - Security Week
Introducing a New Vulnerability Class: False File Immutability — Elastic Security Labs
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.