Threat Intelligence Blog

Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.

Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 21 June 2024

Black Arrow Cyber Threat Intelligence Briefing 21 June 2024:

-Hackers Switch Focus to Cloud Apps for Data Theft, as Cloud Services Increasingly Seen as Huge Soft Target by Attackers

-The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe, 1 in 10 Email-Based Attacks are Now Business Email Compromise

-Regulatory Changes Are on the Horizon. Are Companies Ready?

-How Hackers Can Crack Your Password in an Hour

-US Bans Kaspersky Software, Citing National Security Risks

-Quarter of Firms Suffer an API-Related Breach

-More than 70% of Companies Increased Spending on Proactive Security

-The Resurgence of Major Data Breaches?

-Is Cyber Becoming a Primary Domain of Warfare?

-Cyber Threats Present Ever Greater Risks to International Peace and Security: UK Statement at UN Security Council

-Cyber Security and AI at Top of Risk List for UK Trustees

-Qilin: We Knew Our Synnovis Attack Would Cause a Healthcare Crisis at London Hospitals

-Ransomware Attacks Are Getting Worse

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Hackers Switch Focus to Cloud Apps for Data Theft, as Cloud Services Increasingly Seen as Huge Soft Target by Attackers

A recent report by Google’s Mandiant reveals that the Scattered Spider gang, also known as UNC3944, has escalated its tactics to target software-as-a-service (SaaS) applications and cloud infrastructure, focusing on data theft for extortion without using ransomware. They exploit genuine tools and permissions, then create new virtual machines and exfiltrate data to other cloud platforms they have under their control. Additionally, other reports this week highlight a rise in the exploitation of legitimate cloud services, with over half of all malware in March 2024 delivered via these services. Notably, 59% of cloud-based malware originated from 235 distinct apps. Sophisticated attacks, such as North Korea’s targeting of South Korean security professionals, underscore the urgent need for enhanced cloud security measures and a proactive defence strategy.

The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe, 1 in 10 Email-Based Attacks are Now Business Email Compromise

Recent reports highlight a significant shift in phishing tactics due to advancements in generative AI (GenAI). Historically, phishing relied on high-volume, low-effort strategies, but improved security measures have led to more sophisticated, targeted attacks such as Business Email Compromise (BEC). The advent of GenAI tools like ChatGPT has drastically reduced the time and effort required to craft convincing phishing emails, resulting in a 21% increase in BEC attempts from Q2 2022 to Q2 2023. BEC now accounts for 10.6% of social engineering attacks, up from 8% in 2022. Conversation hijacking has surged by 70% since 2022, despite its complexity.

Analysis of 69 million attacks on 4.5 million mailboxes highlights new tactics, such as using QR codes and URL shorteners, which evade traditional email filters. Gmail was the most exploited webmail service, used in 22% of social engineering attacks.

Furthermore, image-based phishing attacks, which evade natural language processing defences, have surged by 175% over the past year, illustrating the growing global threat posed by AI-enhanced phishing.

Regulatory Changes Are on the Horizon. Are Companies Ready?

A recent report highlights the increasing complexity of cyber security compliance across Europe, America, and Asia. European organisations face over 100 pieces of legislation, creating significant challenges in determining applicable laws, especially those with extraterritorial effects. This emphasises the importance of bespoke internal management and governance programmes tailored to specific business risks and data handling practices. The upcoming NIS 2 Directive in the EU is expected to further impact compliance requirements, as DORA will for financial services firms operating within the EU or those outside the EU providing critical services to EU organisations. Additionally, robust incident response plans and ensuring third-party compliance are crucial for effective cyber security management.

How Hackers Can Crack Your Password in an Hour

A recent analysis of 193 million leaked passwords by Kaspersky revealed alarming security weaknesses. 59% of these passwords could be cracked in under an hour using modern GPUs and advanced algorithms. The study found that 45% of passwords were vulnerable to cracking within a minute, highlighting the risks of predictable patterns and common phrases. Despite the increased threat, many users continue to use easily guessable passwords. To mitigate these risks, it is recommended to use strong, unique passwords, employ a password manager, and enable two-factor authentication (2FA) where possible.

US Bans Kaspersky Software, Citing National Security Risks

A recent announcement by the US Department of Commerce's Bureau of Industry and Security (BIS) has imposed a ban on Kaspersky Lab's US subsidiary from selling its security software due to national security risks. The ban, effective from July 20, stems from concerns over Kaspersky’s ties to the Russian government, which could potentially exploit the software for espionage and data theft. Existing customers have until September 29 to find alternatives. This decision follows previous restrictions, with Kaspersky added to the Federal Communications Commission's (FCC) "Covered List" and similar actions by Germany and Canada.

Quarter of Firms Suffer an API-Related Breach

A recent State of Application Programming Interfaces (API) Security Report by Salt Security reveals that nearly a quarter (23%) of organisations experienced breaches via production APIs last year. An API can be thought of as a set of rules and tools that allow different software applications to communicate with each other and exchange data.

The report, based on a survey of 250 respondents globally, found that 95% had encountered API security issues, including vulnerabilities (37%) and sensitive data exposure (38%). Despite a 167% increase in API counts, only 8% of companies consider their API security strategy to be advanced, and 37% lack a strategy entirely. Furthermore, just 58% have processes to discover all APIs, even though 46% discuss API security at the C-level. This highlights the urgent need for sophisticated API security measures.

More than 70% of Companies Increased Spending on Proactive Security

A recent study reveals that over 70% of organisations are boosting their spending on proactive security solutions, prioritising attack surface management and risk-based vulnerability management. Key investments focus on enhanced attack surface visibility (65%), security control optimisation (60%), and improved manpower productivity (54%). The research highlights that 47% of organisations aim to reduce threats using proactive security within the next 12 to 24 months, while 48% anticipate disruption from these new solutions. Confidence remains high in firewalls and routers, with only 6% of financial institutions proactively assessing firewalls and 4% assessing routers.

The Resurgence of Major Data Breaches?

A recent surge in data breaches has seen millions of records exposed and shared on dark web forums, predominantly driven by the hacker group ShinyHunters. This resurgence mirrors the "golden age" of data breaches from 2019 to 2021, where ShinyHunters notoriously targeted companies like Tokopedia and Microsoft’s GitHub. Recent breaches include a massive attack on Santander Bank, affecting 30 million customers, and Ticketmaster, compromising 560 million customer records. Organisations need to take appropriate steps to prevent breaches from happening in the first place, and ensure they have plans in place for what to do when something goes wrong.

Is Cyber Becoming a Primary Domain of Warfare?

A recent analysis by Cyberint reveals that cyber operations in conflicts such as the Ukraine-Russia and Israel-Hamas wars now focus on critical infrastructure and supply chains, with wiper malware frequently used to disrupt organisations. Hacktivists, equipped with new tools and greater capabilities, pose a significant threat, blurring lines between nation-state actors and cyber criminals. This overlap complicates attack attribution and motive understanding. Cyber operations, even when unsuccessful, can have profound psychological impacts on public safety. Enhanced targeting of essential services highlights the urgent need for robust defence strategies in modern cyber warfare.

Cyber Threats Present Ever Greater Risks to International Peace and Security: UK Statement at UN Security Council

A recent statement by the UK at the UN Security Council highlights three critical trends in cyber threats impacting international peace and security.

Firstly, ransomware attacks disrupt government functions and public services, necessitating an international response for resilience. The UK, co-chairing the Counter Ransomware Initiative with Singapore, urges global participation.

Secondly, the rise of AI systems poses new cyber security challenges, with the UK advocating secure AI design having published "Guidelines for Secure AI System Development" with international partners.

Thirdly, the market for advanced cyber intrusion capabilities is growing, increasing threat unpredictability. The UK and France invite collaboration through the Pall Mall Process to address this concern. The UK also calls for stricter enforcement of North Korea sanctions due to their use of cyber activities to fund illegal weapons programmes.

Cyber Security and AI at Top of Risk List for UK Trustees

A recent report by LCP reveals that cyber threats and artificial intelligence (AI) are the top concerns for UK pension trustees, with 23% identifying these as their primary worry. Over half of the respondents (61%) rated their concern about cyber risks as seven or higher on a scale of one to ten. Trustees from larger schemes felt marginally more prepared for cyber risks than those from smaller schemes.

Qilin: We Knew Our Synnovis Attack Would Cause a Healthcare Crisis at London Hospitals

A recent cyber attack by the ransomware gang Qilin has caused a healthcare crisis in London, targeting Synnovis, a partnership between Synlab and two NHS Trusts. The gang confirmed the attack was politically motivated, aiming to disrupt healthcare services. Qilin demanded a $50 million ransom, claiming to have stolen over one terabyte of data. The attack has led to the cancellation of more than 1,500 operations and appointments, significantly impacting patient care. Despite expressing token sympathy for the affected patients, Qilin remains unrepentant. The incident highlights the need for robust cyber security measures in critical infrastructure sectors.

Ransomware Attacks Are Getting Worse

A recent report highlights the escalating crisis of ransomware targeting schools, hospitals, and critical infrastructure, with over 1,200 data breaches reported by the UK Information Commissioner’s Office in 2023, a 25% increase from the previous year. The healthcare sector is notably affected, following a $44 million payout by Change Healthcare in March. 75% of organisations faced ransomware attacks, and 84% encountered phishing attempts, yet only 31% conducted a cyber security risk assessment. With the average cost of a breach at £3.4 million, the report underscores the urgent need for robust cyber security measures, including regular software updates, strong password policies, insider threat management, incident response plans, and multi-factor authentication. Increasing levels of regulation are coming in across Europe, US and Asia to try to enforce more resilience to these types of attacks.

Sources

https://www.bleepingcomputer.com/news/security/scattered-spider-hackers-switch-focus-to-cloud-apps-for-data-theft/

https://www.infosecurity-magazine.com/blogs/threat-targeting-cloud-services/

https://www.prnewswire.com/news-releases/conversation-hijacking-up-70-and-1-in-10-email-based-attacks-are-now-business-email-compromise-302174802.html

https://www.techradar.com/pro/security/email-threats-are-becoming-more-dangerous-than-ever-so-keep-an-eye-on-your-inbox

https://securityboulevard.com/2024/06/the-spammification-of-business-email-compromise-spells-trouble-for-businesses-around-the-globe/

https://www.govinfosecurity.com/regulatory-changes-are-on-horizon-are-companies-ready-a-25507

https://www.kaspersky.co.uk/blog/password-can-be-hacked-in-one-hour/27738/

https://thehackernews.com/2024/06/us-bans-kaspersky-software-citing.html

https://www.infosecurity-magazine.com/news/quarter-firms-suffer-api-related/

https://www.securitymagazine.com/articles/100796-more-than-70-of-companies-increased-spending-on-proactive-security

https://securityboulevard.com/2024/06/the-resurgence-of-major-data-breaches/

https://www.inforisktoday.com/cyber-becoming-primary-domain-warfare-a-25521

https://www.gov.uk/government/speeches/cyber-threats-will-present-an-ever-greater-number-of-risks-to-international-peace-and-security-uk-statement-at-the-un-security-council

https://www.europeanpensions.net/ep/Cyber-threats-take-top-spot-in-UK-trustee-risk-list.php

https://www.theregister.com/2024/06/20/qilin_our_plan_was_to/

https://www.wired.com/story/security-news-this-week-ransomware-attacks-are-getting-worse/

https://channeleye.co.uk/data-breaches-brought-on-by-ransomware-escalate/


Governance, Risk and Compliance

Cyber security and AI at top of risk list for trustees, LCP says (professionalpensions.com)

Regulatory Changes Are on the Horizon. Are Companies Ready? (govinfosecurity.com)

More than 70% of companies increased spending on proactive security | Security Magazine

Regulators urged to promote cyber security investment - Risk.net

The Perilous Role of the CISO: Navigating Modern Minefields - SecurityWeek

Cyber security Deserves the Proverbial Seat at the Table (govinfosecurity.com)

Pressure mounts on CISOs as SEC bares teeth with legal action - Help Net Security

Why Regulated Industries are Turning to Military-Grade Cyber Defenses (thehackernews.com)

Cyber Security Burnout Crisis: Burnout in Next 12 Months (thehrdirector.com)

9 ways CSOs lose their jobs | CSO Online

Why Resilience Is More Than Just Cyber Security (inforisktoday.com)

How will the Merck settlement affect the insurance industry? (securityintelligence.com)

How Cyber Security Can Steer Organisations Toward Sustainability (darkreading.com)

Your firm's reputation depends on strong data security. Don't undervalue it - spectator.sme.sk

Closing the Readiness Gap: How to Ensure a Fast Recovery From the Inevitable Cyber Attack - Security Boulevard

Why Your Business Needs To Level Up Its Defence Life Cycle Management (forbes.com)

The High Cost of Downtime and How to Reduce It | MSSP Alert

Is it time to split the CISO role? | CSO Online

Threats

Ransomware, Extortion and Destructive Attacks

Scattered Spider hackers switch focus to cloud apps for data theft (bleepingcomputer.com)

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica

Ransomware Attacks Are Getting Worse | WIRED

Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register

Why ransomware is still important to business resilience - IT Security Guru

UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week

What to do about the rise of unknown attack vectors in the ransomware playbook | SC Media (scmagazine.com)

Ransomware resurgence gives small businesses cause for concern | TechFinitive

The Financial Dynamics Behind Ransomware Attacks (securityaffairs.com)

Data breaches brought on by ransomware escalate. – Channel EYE

LockBit Ransomware Again Most Active - Real Attack Surge or Smokescreen? - Security Week

Ransomware attacks skyrocket, with LockBit 3.0 at the forefront - Exponential-e Blog

New ransomware over browser threat targets uploaded files (securityintelligence.com)

CISA warns of Windows bug exploited in ransomware attacks (bleepingcomputer.com)

Zero-Day Exploits and Ransomware Trends for 2024 (govinfosecurity.com)

How will the Merck settlement affect the insurance industry? (securityintelligence.com)

Qilin Ransomware: What You Need To Know | Tripwire

Linux version of RansomHub ransomware targets VMware ESXi VMs (bleepingcomputer.com)

Ransomware Victims

London hospitals postpone 1,600 operations and appointments after Russian cyber attack (newsbytesapp.com)

London Hospitals Knew of Cyber Vulnerabilities Years Before Hack (claimsjournal.com)

More than 100,000 patients ‘likely’ impacted by NHS cyber attack (holyrood.com)

London Ransomware Attack Led to 1500 Cancelled Ops and Appointments - Infosecurity Magazine (infosecurity-magazine.com)

Cyber criminals publish data from attack on NHS | UKAuthority

Change Healthcare to Start Notifying Customers Who Had Data Exposed in Cyber Attack - Security Week

512,000 radiology patient records accessed in cyber attack • The Register

Tally of victims reaches 100,000 in NHS cyber attack (thetimes.com)

Hackers demand $50M ransom payment from UK lab provider following hospital disruption - SiliconANGLE

Qilin has ‘no regrets’ over the healthcare crisis it caused • The Register

Don't blame us for people suffering - London hospital hackers - BBC News

Borders: NHS board warns patients over stolen personal details | The National

Cyber attack on a UK staffing company:  a 'war story' - Osborne Clarke | Osborne Clarke

Hospital cyber attack turns deadly as drugs given to wrong patients - Washington Times

British Library to renew entire IT system as it reveals £1.6m cyber attack loss (civilsociety.co.uk)

Panera Bread likely paid a ransom in March ransomware attack (bleepingcomputer.com)

NHS boss says Scottish trust didn't meet attackers' demands • The Register

Cyber attack shuts down Israeli pharma company's distribution | Ctech (calcalistech.com)

Phishing & Email Based Attacks

The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe - Security Boulevard

Nigerian national faces prison for $1.5M phishing scam • The Register

Conversation hijacking up 70%, and 1 in 10 email-based attacks are now business email compromise (prnewswire.com)

Email threats are becoming more dangerous than ever — so keep an eye on your inbox | TechRadar

Worldwide 2023 Email Phishing Statistics and Examples | Trend Micro (US)

Your company needs a BEC policy and five other email security trends (betanews.com)

Malicious emails trick consumers into false election contributions - Help Net Security

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Security bug allows anyone to spoof Microsoft employee emails | TechCrunch

Why You Shouldn't Unsubscribe From Spam Emails | HackerNoon

Cyber Criminals Target Trump Supporters with Donation Scams - Security Boulevard

Latest Cyber Insurance Policy Takes Aim at Phishing Attacks (inforisktoday.com)

BEC

The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe - Security Boulevard

Conversation hijacking up 70%, and 1 in 10 email-based attacks are now business email compromise (prnewswire.com)

Your company needs a BEC policy and five other email security trends (betanews.com)

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Other Social Engineering

Cyber Criminals Turn to Multichannel Attacks—Alongside 'Quishing and 'Smishing'—to Dupe Targets | Corporate Counsel (law.com)

Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register

Malware peddlers love this one social engineering trick! - Help Net Security

Fake Google Chrome errors trick you into running malicious PowerShell scripts (bleepingcomputer.com)

92% of Orgs Hit by Credential Compromise from Social Engineering - Infosecurity Magazine (infosecurity-magazine.com)

Explained: Android overlays and how they are used to trick people | Malwarebytes

Cyber Criminals Target Trump Supporters with Donation Scams - Security Boulevard

Artificial Intelligence

Cyber threats will present an ever greater number of risks to international peace and security: UK statement at the UN Security Council - GOV.UK (www.gov.uk)

'Sleepy Pickle' Exploit Subtly Poisons ML Models (darkreading.com)

Tech Policy Expert Calls for Law Overhaul to Combat Deepfakes - Infosecurity Magazine (infosecurity-magazine.com)

Majority of cyber security professionals unable to identify deepfake attacks - Singapore News (theindependent.sg)

Criminals, too, see productivity gains from AI | CSO Online

AI’s impact on data privacy remains unclear - Help Net Security

Can governments turn AI safety talk into action? | ZDNET

Chinese firm sought to use UK university links to access AI for possible military use | Imperial College London | The Guardian

How to bypass ChatGPT restrictions (androidpolice.com)

Cyber Threat Intelligence Pros Assess AI Threats Readiness - Infosecurity Magazine (infosecurity-magazine.com)

Apple Intelligence Could Introduce Device Security Risks (darkreading.com)

How big is the AI threat to the cyber security of tech companies? | TechRadar

NIS2 Directive: Stronger EU Cyber Security in the AI era | News | GRC World Forums

Hallucinated Packages, Malicious AI Models, and Insecure AI-Generated Code - Security Boulevard

Microsoft's Recall changes might be too little, too late | TechTarget

Meta Pauses AI Training on EU User Data Amid Privacy Concerns (thehackernews.com)

CISA leads first tabletop exercise for AI cyber security | CyberScoop

AI is not a magic wand – it has built-in problems that are difficult to fix and can be dangerous (theconversation.com)

How AI lies, cheats, and grovels to succeed - and what we need to do about it | ZDNET

2FA/MFA

The absence of multi factor authentication led to the Medibank hack, regulator alleges - ABC News

Medibank breach: Security failures revealed (lack of MFA among them) - Help Net Security

Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)

'ONNX' MFA Bypass Targets Microsoft 365 Accounts (darkreading.com)

Malware

Hackers have found a clever way to use emojis in their attacks — but it’s not what you think | Tom's Guide (tomsguide.com)

Hackers Exploit Legitimate Websites to Deliver BadSpace Windows Backdoor (thehackernews.com)

The art of concealment: how hackers hide malware | Cybernews

New Malware Targets Exposed Docker APIs for Cryptocurrency Mining (thehackernews.com)

New ransomware over browser threat targets uploaded files (securityintelligence.com)

Clever macOS malware delivery campaign targets cryptocurrency users - Help Net Security

New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration (thehackernews.com)

NiceRAT Malware Targets South Korean Users via Cracked Software (thehackernews.com)

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework | Trend Micro (US)

Mobile

Explained: Android overlays and how they are used to trick people | Malwarebytes

Internet of Things – IoT

IoT password ban a start, but admins can’t afford to wait for regulators | TechRadar

Data Breaches/Leaks

Blackbaud must pay $6.75 million, improve security after lying about scope of 2020 hack (therecord.media)

Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)

Cyber criminals publish data from attack on NHS | UKAuthority

Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)

The Resurgence of Major Data Breaches? - Security Boulevard

Insurance giant Globe Life investigating web portal breach (bleepingcomputer.com)

Truist Bank confirms breach after stolen data shows up on hacking forum (bleepingcomputer.com)

More than 100,000 patients ‘likely’ impacted by NHS cyber attack (holyrood.com)

Total Fitness database exposed 474k member and staff images • The Register

Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED

Dark-web kingpin puts 'stolen' internal AMD data up for sale • The Register

AMD Investigates Possible Breach Amid Hacker’s Sale of Company Data (pcmag.com)

Optus cyber attack could have been prevented four years prior, says telecoms watchdog - ABC News

T-Mobile denies it was hacked, links leaked data to vendor breach (bleepingcomputer.com)

Threat actor claims to have breached Apple, allegedly stealing source code of several internal tools - 9to5Mac

Threat Actor Claims AMD and Apple Breaches - Infosecurity Magazine (infosecurity-magazine.com)

Change Healthcare to Start Notifying Customers Who Had Data Exposed in Cyber Attack - Security Week

512,000 radiology patient records accessed in cyber attack • The Register

Coding error in forgotten API blamed for massive data breach • The Register

Panera Notifies Employees of Compromised Data (darkreading.com)

Los Angeles Public Health Department Discloses Large Data Breach - Infosecurity Magazine (infosecurity-magazine.com)

Cyber Attack Exposes Freelancer Personal Data - Freelance Informer

Hackers Derail Amtrak Guest Rewards Accounts in Breach (darkreading.com)

Organised Crime & Criminal Actors

UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week

Are We Turning the Corner in the Fight Against Cyber Crime? It’s Complicated. - Security Boulevard

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Microsoft hacker avoids jail over multiple cyber attacks - BBC News

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

New Malware Targets Exposed Docker APIs for Cryptocurrency Mining (thehackernews.com)

Clever macOS malware delivery campaign targets cryptocurrency users - Help Net Security

"Researchers" exploit Kraken exchange bug, steal $3 million in crypto (bleepingcomputer.com)

Insider Risk and Insider Threats

The Rise of the Outside Insider Threat | AFCEA International

Former IT employee gets 2.5 years for wiping 180 virtual servers (bleepingcomputer.com)

10 Ways Employees Are Sabotaging Your Cyber Security Stance (informationweek.com)

Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)

Insurance

Latest Cyber Insurance Policy Takes Aim at Phishing Attacks (inforisktoday.com)

How will the Merck settlement affect the insurance industry? (securityintelligence.com)

Supply Chain and Third Parties

Blackbaud must pay $6.75 million, improve security after lying about scope of 2020 hack (therecord.media)

Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)

Hackers demand $50M ransom payment from UK lab provider following hospital disruption - SiliconANGLE

London Hospitals Knew of Cyber Vulnerabilities Years Before Hack (claimsjournal.com)

Cyber attacks on London's hospitals affect 800 planned operations - BBC News

Tally of victims reaches 100,000 in NHS cyber attack (thetimes.com)

Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED

T-Mobile denies it was hacked, links leaked data to vendor breach (bleepingcomputer.com)

Cloud/SaaS

Cyber Criminals Turn to Multichannel Attacks—Alongside 'Quishing and 'Smishing'—to Dupe Targets | Corporate Counsel (law.com)

The Huge Threat Posed by Increased Targeting of Cloud Services - Infosecurity Magazine (infosecurity-magazine.com)

Scattered Spider hackers switch focus to cloud apps for data theft (bleepingcomputer.com)

Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)

Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register

Microsoft admits no guarantee of sovereignty for UK policing data | Computer Weekly

The rise of SaaS security teams - Help Net Security

The Annual SaaS Security Report: 2025 CISO Plans and Priorities (thehackernews.com)

Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED

'ONNX' MFA Bypass Targets Microsoft 365 Accounts (darkreading.com)

The NCSC’s Take on SaaS - Adaptive Shield (adaptive-shield.com)

Encryption

Stop playing games with online security, Signal president warns EU lawmakers | TechCrunch

Signal, MEPs urge EU Council to drop encryption-eroding law • The Register

Linux and Open Source

New Linux malware is controlled through emojis sent from Discord (bleepingcomputer.com)

New ARM 'TIKTAG' attack impacts Google Chrome, Linux systems (bleepingcomputer.com)

Linux version of RansomHub ransomware targets VMware ESXi VMs (bleepingcomputer.com)

Passwords, Credential Stuffing & Brute Force Attacks

What is a password spraying attack? | Proton

Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)

Hackers can crack 59% of passwords in an hour | Kaspersky official blog

92% of Orgs Hit by Credential Compromise from Social Engineering - Infosecurity Magazine (infosecurity-magazine.com)

Criminals are Easily Bypassing Passkeys – How Organisations Can Stay Safe - Security Boulevard

Social Media

Why Trading Privacy for 'Free' Web Services Must End (darkreading.com)

4 ways oversharing on social media puts your privacy at risk | TechRadar

New Linux malware is controlled through emojis sent from Discord (bleepingcomputer.com)

Hackers have found a clever way to use emojis in their attacks — but it’s not what you think | Tom's Guide (tomsguide.com)

US surgeon general wants social media warning labels - BBC News

Meta Pauses AI Training on EU User Data Amid Privacy Concerns (thehackernews.com)

Malvertising

Google Chrome Will Track You For The Next 200 Days—Then It May Get Worse (forbes.com)

Training, Education and Awareness

Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)

Regulations, Fines and Legislation

Blackbaud must pay $6.75 million, improve security after lying about scope of 2020 hack (therecord.media)

Regulatory Changes Are on the Horizon. Are Companies Ready? (govinfosecurity.com)

Regulators urged to promote cyber security investment - Risk.net

UK organisations are confident they will meet the NIS 2 compliance timeline | The Independent

Pressure mounts on CISOs as SEC bares teeth with legal action - Help Net Security

Why Regulated Industries are Turning to Military-Grade Cyber Defences (thehackernews.com)

Can governments turn AI safety talk into action? | ZDNET

NIS2 Directive: Stronger EU Cyber Security in the AI era | News | GRC World Forums

The absence of multi factor authentication led to the Medibank hack, regulator alleges - ABC News

Signal, MEPs urge EU Council to drop encryption-eroding law • The Register

SEC cyber security filings on the rise as new reporting rules bite | ITPro

Models, Frameworks and Standards

Why NIS2 is set to become a ‘cornerstone’ of cyber security (siliconrepublic.com)

Careers, Working in Cyber and Information Security

Most cyber security pros took time off due to mental health issues - Help Net Security

The Perilous Role of the CISO: Navigating Modern Minefields - Security Week

Navigating the Cyber Security Hiring Trenches: Challenges, Realities, and Paths Forward | HackerNoon

To Address Burnout, Cyber Security Must Learn to Tolerate Failure (informationweek.com)

Cyber security burnout is costing US enterprises over $620 million a year (techinformed.com)

Effectively upskilling cyber security professionals to help close the skills gap | CSO Online

Cyber Security Burnout Crisis: Burnout in Next 12 Months (thehrdirector.com)

Cyber Security workers are increasingly working over the weekends — and many are ready to quit | TechRadar

9 ways CSOs lose their jobs | CSO Online

Making the Move From Tech Expert to Cyber Security Leader (inforisktoday.com)

Survey Finds Growing Number of Tech Tools Makes Cyber Security Professionals Feel “Out of Control” - IT Security Guru

Is it time to split the CISO role? | CSO Online

ISC2/CIISec Tips on Recruitment, Retention in Cyber Security (govinfosecurity.com)

Law Enforcement Action and Take Downs

Nigerian national faces prison for $1.5M phishing scam • The Register

Former IT employee gets 2.5 years for wiping 180 virtual servers (bleepingcomputer.com)

UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week

Suspected dark-web Empire Market admins charged in the US • The Register

Two Men Plead Guilty to Hacking Law Enforcement Database for Doxing - Security Week

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Rogue IT director pleads guilty to $2.1M scam charges • The Register

Sellafield pleads guilty to criminal charges over cyber security failings (yahoo.com)

Microsoft hacker avoids jail over multiple cyber attacks - BBC News

Misinformation, Disinformation and Propaganda

Addressing Misinformation in Critical Infrastructure Security (darkreading.com)

ISIS Created Fake CNN and Al Jazeera Broadcasts | WIRED

US election official: ‘Whack-a-mole’ strategies less effective to combat disinfo | CyberScoop


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Is Cyber Becoming a Primary Domain of Warfare? (inforisktoday.com)

Nation State Actors

China

Chinese Threats Aim for Government Sector  - Security Boulevard

British army delays King Charles cap badges over China spying fears (ft.com)

Bug Bounty Programs, Hacking Contests Power China's Cyber Offense (darkreading.com)

Chinese firm sought to use UK university links to access AI for possible military use | Imperial College London | The Guardian

China's 'Velvet Ant' APT Nests Inside Multiyear Espionage Effort (darkreading.com)

China-Linked Hackers Infiltrate East Asian Firm for 3 Years Using F5 Devices (thehackernews.com)

Chinese Cyber Espionage Targets Telecom Operators in Asia Since 2021 (thehackernews.com)

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework | Trend Micro (US)

Russia

ICC probes cyber attacks in Ukraine as possible war crimes, sources say | Reuters

Russia May Have Committed War Crimes by Hacking Ukraine's Critical Infrastructure, ICC Starts Probe | Tech Times

US Bans Kaspersky Software, Citing National Security Risks (thehackernews.com)

The Rise of the Outside Insider Threat | AFCEA International

Espionage and cyber attack threat reaches new dimension in Germany, interior minister warns – POLITICO

France wants to remind you of Russia’s threat to democracy • The Register

Poland points to Russian hackers in disruption of Euro 2024 broadcast (therecord.media)

Sweden says Russia is interfering with Nordic satellites • The Register

USA and G7 to increase cyber security of their energy sector / The New Voice of Ukraine (nv.ua)

Russians report some outages on bank apps after cyber attack, says Kommersant daily (yahoo.com)

Iran

Germany Warns of Growing Espionage, Cyber Threats from Iran | Iran International (iranintl.com)

North Korea

NiceRAT Malware Targets South Korean Users via Cracked Software (thehackernews.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

ISIS Created Fake CNN and Al Jazeera Broadcasts | WIRED

Hamas Hackers Sling Stealthy Spyware Across Egypt, Palestine (darkreading.com)


Tools and Controls

More than 70% of companies increased spending on proactive security | Security Magazine

Get your legal ducks in a row to contain a crisis - Katy MacAskill (scotsman.com)

The importance of collaborating AI with human expertise (securitybrief.co.nz)

Edge Devices: The New Frontier for Mass Exploitation Attacks - Security Week

Report Reveals Record Exploitation Rate For Load Balancers - Infosecurity Magazine (infosecurity-magazine.com)

Your company needs a BEC policy and five other email security trends (betanews.com)

The rise of SaaS security teams - Help Net Security

The Software Licensing Disease Infecting Our Nation's Cyber Security (darkreading.com)

Massachusetts 911 Outage Caused by Errant Firewall - Security Week

How Cyber Security Can Steer Organisations Toward Sustainability (darkreading.com)

How A Cyber Security Audit Can Identify Risk of Compromise | HealthLeaders Media

Defending your ever-changing attack surface - IT Security Guru

US, Allies Publish Guidance on Securing Network Access - Security Week

Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)

Closing the Readiness Gap: How to Ensure a Fast Recovery From the Inevitable Cyber Attack - Security Boulevard

Microsoft 365's Security Gaps: Logging and Beyond (govinfosecurity.com)

How to create your cyber security "Google Maps": A step-by-step guide for security teams - Help Net Security

A young cyber market has matured, but enhancing preparedness and resilience is key: Kreuzer, Munich Re - Reinsurance News

From Reactive to Proactive Threat Hunting - GovInfoSecurity

Cyber Security Practices For Remote Working - TechRound

Survey Finds Growing Number of Tech Tools Makes Cyber Security Professionals Feel “Out of Control” - IT Security Guru

Tabletop exercises are headed to the next frontier: Space (talosintelligence.com)

What Will the Next-Gen of Security Tools Look Like? | HackerNoon

The NCSC’s Take on SaaS - Adaptive Shield (adaptive-shield.com)

Tool Overload: Why MSPs Are Still Drowning with Countless Cyber Security Tools in 2024 (thehackernews.com)



Other News

Cyber threats will present an ever greater number of risks to international peace and security: UK statement at the UN Security Council - GOV.UK (www.gov.uk)

The importance of collaborating AI with human expertise (securitybrief.co.nz)

Report urges extending scope of cyber security measures | UKAuthority

What is the current state of Security Culture in Europe? | TechRadar

Cyber attack shuts down Israeli pharma company's distribution | Ctech (calcalistech.com)

Sellafield pleads guilty to criminal charges over cyber security failings (yahoo.com)

How resilient is UK Critical National Infrastructure to cyber attack? - Committees - UK Parliament

Microsoft 365's Security Gaps: Logging and Beyond (govinfosecurity.com)

Massachusetts 911 Outage Caused by Errant Firewall - Security Week

Cyber security - what GP practices need to know to protect themselves - Management In PracticeManagement In Practice

Microsoft 'accepts responsibility' for cyber security failures, top exec says (qz.com)

Microsoft was slammed for its lax cyber security practices after a series of breaches — now it plans to cut executive bonuses if they don't improve standards | ITPro

What Does the Future of Cyber Security in Space Look Like? (govtech.com)

Space: The Final Frontier for Cyber Attacks (darkreading.com)

A new fear for CSOs: The sky is falling | CSO Online

The Software Licensing Disease Infecting Our Nation's Cyber Security (darkreading.com)

Cyber Security Challenges For UK Private Bankers - TechRound

New maritime cyber security body launches - Port Technology International

Process and Control Today | New Study Finds Cyber Security as Top Concern Among Automotive Manufacturers (pandct.com)

Vietnam's internet again in trouble as 3/5 sub cables cut • The Register

Cyber Attack Hits Software Provider for Car Dealers Across the US (claimsjournal.com)

Improving OT cyber security remains a work in progress - Help Net Security

Microsoft is in trouble | Digital Trends


Vulnerability Management

The Ultimate Guide to Troubleshooting Vulnerability Scan Failures - Security Boulevard

Zero-Day Exploits and Ransomware Trends for 2024 (govinfosecurity.com)

Vulnerabilities

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica

New Wi-Fi Takeover Attack—All Windows Users Warned To Update Now (forbes.com)

Arm Memory Tag Extensions broken by speculative execution • The Register

VMware by Broadcom warns of critical vCenter flaws • The Register

Critical VMware Bugs Open Swaths of VMs to RCE, Data Theft (darkreading.com)

Hundreds of PC, Server Models Possibly Affected by Serious Phoenix UEFI Vulnerability - Security Week

CISA warns of Windows bug exploited in ransomware attacks (bleepingcomputer.com)

Security Researchers Expose Critical Flaw in Ivanti Software (databreachtoday.co.uk)

New ARM 'TIKTAG' attack impacts Google Chrome, Linux systems (bleepingcomputer.com)

Dark-web kingpin puts 'stolen' internal AMD data up for sale • The Register

AMD Investigates Possible Breach Amid Hacker’s Sale of Company Data (pcmag.com)

Chrome 126 Update Patches Vulnerability Exploited at Hacking Competition - Security Week

Fortinet, Ivanti zero-day victims face evolved persistence by the espionage actor | CSO Online

SolarWinds Serv-U path traversal flaw actively exploited in attacks (bleepingcomputer.com)

Atlassian fixed six high-severity bugs in Confluence (securityaffairs.com)

ASUS fixed critical remote authentication bypass bug in several routers (securityaffairs.com)


Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Advisory 19 June 2024 – Critical VMware vCenter Remote Code Execution and Privilege Escalation Vulnerability

Black Arrow Cyber Advisory 19 June 2024 – Critical VMware vCenter Remote Code Execution and Privilege Escalation Vulnerability

Executive summary

Broadcom have released patches addressing three vulnerabilities affecting VMware vCenter. Two of the vulnerabilities are critical severity, allowing remote code execution (CVE-2024-37079 and CVE-2024-37080) the other which allows an attacker to gain admin privileges (CVE-2024-37081).

What’s the risk to me or my business?

If the vulnerabilities are successfully exploited this will allow an attacker to perform arbitrary remote code execution, and the other will allow a local authenticated user to gain admin privileges. All of the vulnerabilities if exploited could have a high impact on the confidentiality, integrity and availability of the organisations data on affected systems.

What can I do?

There is no evidence that the vulnerabilities are being exploited in the wild, however Black Arrow recommends applying the available patches for the vulnerability as soon as possible, further information can be found in the Broadcast advisory below.

Technical Summary

CVE-2024-37039 and CVE-2024-37080 – vCenter Server contains a heap-overflow vulnerability in the Distributed Computing Environment/Remote Procedure Call (DCERPC) protocol. These vulnerabilities allow an attacker to potentially perform arbitrary remote code execution by sending specially crafted network packets.

CVE-2024-37081 – vCenter contains multi local privilege escalation vulnerabilities due to misconfigurations of sudo. This allows an authenticated local user with non-administrative privileges to elevate to root (admin) privileges on vCenter Server Appliance.

Further information on the VMware advisory can be found here:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453

https://core.vmware.com/resource/vmsa-2024-0012-questions-answers#introduction

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 14 June 2024

Black Arrow Cyber Threat Intelligence Briefing 14 June 2024:

-Phishing Attacks Targeting US and European Organisations Double

-78% of People Use the Same Password Across Multiple Accounts

-IT Downtime Cuts Enterprise Profit by 9%

-Financial Services, The Golden Target for Cyber Criminals

-Forced-Labour Camps Fuel Billions of Dollars in Cyber Scams

-Why You Must Consider the Security Risks of BYOD

-Cyber Criminals Work Faster Than Ever

-IoT Vulnerabilities Skyrocket, Becoming Key Entry Point for Attackers

-Cyber Security Is a Boardroom Issue

-An Evolving Threat Landscape: A Battle Between Good and Evil, with Small Business Cyber Security Threats on the Rise

-Ransomware Gangs are Adopting “More Brutal” Tactics Amid Crackdowns

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Phishing Attacks Targeting US and European Organisations Double

A recent report by Abnormal Security reveals a significant rise in phishing attacks targeting organisations, with Europe experiencing a 112.4% increase between April 2023 and April 2024, and the US seeing a 91.5% rise. The report, "Email Security Threats in Europe: Insights into Attack Trends," highlights that phishing, although not the most costly attack type, often serves as a gateway for further crimes. Additionally, business email compromise (BEC) attacks surged by 123.8% in Europe and 72.2% in the US, including vendor email compromise (VEC) schemes involving fraudulent payments and wire transfers.

78% of People Use the Same Password Across Multiple Accounts

A recent report from Forbes reveals troubling trends in password security. Based on a survey of 2,000 individuals, the survey found that 78% of individuals reuse passwords across multiple accounts, with 52% using the same password for at least three accounts. Notably, 22% of users do not use any safety measures to secure their passwords. Social media accounts are the most likely targets for password hacking at 29%, followed by email accounts at 15%. According to the survey respondents, the most common reason their passwords were hacked was due to weak passwords (35%) and repeated use of the same password (30%).

IT Downtime Cuts Enterprise Profit by 9%

A recent study by Splunk, titled “The Hidden Costs of Downtime,” reveals that eliminating downtime could save large enterprises $200 million annually, equivalent to a 9% increase in yearly profits. The study, conducted by Oxford Economics, found that nearly $49 million of downtime costs stem from lost revenue, with additional expenses from regulatory fines ($22 million), SLA penalties ($16 million), and legal costs ($15 million). While enterprises spend an average of $19 million on ransomware and data extortion payouts, they typically budget only $13.4 million for these incidents. Human error was identified as the leading cause of downtime, followed by malware and phishing attacks. Visibility is crucial in this context, as are risk-mitigation strategies that align with business risk objectives. Visibility serves as the basis for swift detection and response efforts, involving IT, security, and line-of-business leaders.

Financial Services, The Golden Target for Cyber Criminals

A recent IMF report highlights that the financial sector has faced over 20,000 cyber attacks, resulting in $12 billion in losses over the past 20 years. Despite being heavily regulated, the sector remains a prime target, with ransomware attacks increasing by 64% in 2023 compared to 2021. Digitalisation has introduced new vulnerabilities, particularly with unstructured data, which constitutes 80% of banks' data. Nearly 72% of businesses have over-provisioned access, leading to 78% experiencing security issues. With the average data breach costing $4.45 million and taking 204 days to detect, and only 54% of banking CEOs feeling well-prepared for cyber attacks, financial institutions must adopt stringent proven controls, foster a holistic security culture, and thoroughly test their systems, mitigate risks and protect critical data. It is essential too that financial services firms have rehearsed plans in place for what to do when incidents happen, as the even best technical controls in the world cannot stop every attack.

Forced-Labour Camps Fuel Billions of Dollars in Cyber Scams

A recent investigation revealed that Chinese crime syndicates, having shifted from illicit gambling to cyber fraud during the COVID-19 pandemic, have stolen over $64 billion through sophisticated scams, including a type of social engineering known as "pig butchering." Operating from cyber scam centres in Cambodia, Laos, and Myanmar, these syndicates exploit job seekers with the promise of well-paying jobs at reputable firms, but instead, force them into scamming roles. Despite regional government efforts, including China's law enforcement rescue of 45,000 workers, the scale of the operations remains vast. Financial institutions are urged to collaborate with law enforcement to combat these threats, as highlighted by Singapore's success in preventing $74 million in fraud through bank cooperation.

Why You Must Consider the Security Risks of BYOD

Research by the British Chambers of Commerce indicates that fewer than 30% of firms expect their workforce to be fully in-person over the next five years, prompting a shift towards hybrid and remote work models. This shift has led businesses to reduce in-office PCs, with employees often using their own laptops or devices, necessitating lightweight, powerful, and secure devices. The evolving security landscape is seeing increased phishing, quishing (tricking users with QR codes), and vishing (voice phishing) attacks targeting enterprise users, highlighting the critical need for robust security measures. While Bring Your Own Device (BYOD) policies may seem cost-effective, they pose significant security risks, including inadequate protection and potential data breaches, thus requiring careful consideration of long-term security and compliance costs. Employers are advised to invest in high-quality, secure devices to enhance employee satisfaction and maintain a secure work environment.

Cyber Criminals Work Faster Than Ever

Given the fast pace at which the threat landscape changes, it’s important to constantly monitor these changes if businesses are to have any chance of staying ahead of innovative cyber criminals. A recent report by Fortinet's FortiGuard Labs highlights the rapid evolution of the threat landscape, with cyber attacks commencing on average 4.76 days after new exploits are disclosed, a 43% increase in speed from early 2023. Notably, 98% of organisations detected vulnerabilities over five years old, emphasising the need for robust patching protocols. Additionally, 38 out of 143 Advanced Persistent Threat (APT) groups, including Lazarus and APT28, were noted as highly active. The report underscores the importance of collaboration and vigilance in cyber security efforts.

IoT Vulnerabilities Skyrocket, Becoming Key Entry Point for Attackers

A recent report by Forescout reveals a 136% surge in vulnerabilities within Internet of Things (IoT) devices, such as smart TVs, networking devices and printers, with 33% of nearly 19 million analysed devices found to be at risk, up from 14% in 2023. The riskiest devices include wireless access points, routers, printers, and IP cameras, which are frequently targeted by cyber criminals. The most vulnerable industries are technology, education, manufacturing, finance and healthcare.

Cyber Security Is a Boardroom Issue

A recent report highlights the increasing global momentum of cyber security regulations, driven by technologies such as cloud, containerisation, and artificial intelligence. These evolving regulatory initiatives in the US and EU are capturing the attention of boards of directors prompting them to prioritise cyber security, making it a central issue rather than just a CISO concern. Organisations must maintain a state of cyber readiness to prevent breaches, develop strategies to adapt to AI advancements, and balance compliance with security. This proactive approach is essential for mitigating threats and ensuring an integrated cyber security strategy. Being able to evidence that robust and appropriate controls are in place also puts Boards in a much more defensible position in the event of an incident when explaining actions to a regulator, customers or other stakeholders.

An Evolving Threat Landscape: A Battle Between Good and Evil, with Small Business Cyber Security Threats on the Rise

The recent Hiscox Cyber Readiness Report 2023 highlights that 41% of US small businesses experienced a cyber attack in the past year, often due to sophisticated digital tools like AI. Common threats include ransomware, phishing (53% of attacks), credential theft, and unpatched vulnerabilities. 43% of small businesses lack a network-based firewall, and 41% do not have data backup systems, indicating significant gaps in basic cyber security measures.

Further analysis by Sophos reveals that 75% of their 2023 cyber incident response cases involved small businesses, underscoring the urgent need for prudent cyber security investments. The commoditisation of advanced tools and the rise of 'cybercrime-as-a-service' have increased threats, with over 50% of organisations feeling outpaced by these dangers. Dark web marketplaces offer extensive tools, from ransomware to phishing kits, making cyber attacks accessible to low-skilled individuals. Organisations are urged to adopt actionable threat intelligence and robust solutions, including Managed Detection and Response (MDR), to stay ahead in the evolving cyber landscape.

Ransomware Gangs are Adopting “More Brutal” Tactics Amid Crackdowns

A recent report highlights the relentless rise of ransomware attacks, with 2023 witnessing record-breaking payments exceeding $1 billion globally. Healthcare and education sectors are frequently targeted, with 53% of ransomware attacks on small businesses originating from phishing. Despite increased police crackdowns, ransomware gangs are escalating their intimidation tactics, including direct threats and public data leaks. Notably, a 75% rise in data leak site posts was observed in 2023. Law enforcement operations like Operation Cronos and Operation Endgame are making strides in disrupting these operations, but any wins are unfortunately often short-lived. A large obstacle to reining in ransomware is the Hydra-esque nature of affiliates. After the LockBit disruption, analysts saw 10 new ransomware sites pop up almost immediately. The adaptable and proliferating nature of these gangs continues to challenge global cyber security efforts.

Sources

https://www.infosecurity-magazine.com/news/phishing-attacks-us-europe-double/

https://www.securitymagazine.com/articles/100765-78-of-people-use-the-same-password-across-multiple-accounts

https://www.cio.com/article/2142338/it-downtime-cuts-enterprise-profit-by-9-says-study-3.html

https://www.finextra.com/blogposting/26295/the-need-for-enhancing-cyber-preparedness-in-financial-institutions

https://www.finextra.com/blogposting/26288/financial-services-the-golden-target-for-cybercriminals

https://www.darkreading.com/cyber-risk/forced-labor-camps-fuel-billions-of-dollars-in-cyber-scams

https://www.infosecurity-magazine.com/opinions/security-risks-byod/

https://professionalsecurity.co.uk/products/cyber/cybercriminals-work-faster-than-ever/

https://www.infosecurity-magazine.com/news/iot-vulnerabilities-entry-point/

https://www.govinfosecurity.com/cybersecurity-now-boardroom-issue-a-25453

https://www.techradar.com/pro/an-evolving-threat-landscape-a-battle-between-good-and-evil

https://www.inc.com/hiscox/small-business-cybersecuritythreats-on-the-rise.html

https://www.wired.com/story/state-of-ransomware-2024/



Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Is ‘More Brutal’ Than Ever in 2024 | WIRED

Ransomware tracker: The latest figures [June 2024] (therecord.media)

Unpacking The Ten Most Dangerous Ransomware Gangs (informationsecuritybuzz.com)

Ransomware Group Exploits PHP Vulnerability Days After Disclosure - Security Week

Police arrest Conti and LockBit ransomware crypter specialist (bleepingcomputer.com)

Black Basta Actors Exploited Windows 0day Privilege Vulnerability (cybersecuritynews.com)

Scattered Spider Now Affiliated with RansomHub Following BlackCat Exit - Infosecurity Magazine (infosecurity-magazine.com)

7K LockBit decryptors offered as FBI seeks trust, cooperation from victims | SC Media (scmagazine.com)

Why Akira could be the next big thing in ransomware • The Register

Should there be a total ban on ransom payments? (securityintelligence.com)

What to Do When Your Business Associate Suffers a Ransomware Attack | Dentons - JDSupra

Medical-Targeted Ransomware Is Breaking Records After Change Healthcare’s $22M Payout | WIRED

NHS issues urgent blood donation appeal after IT cyber attack leaves hospitals struggling to match patients (yahoo.com)

What Makes Healthcare a Prime Target for Ransomware? (govinfosecurity.com)

New Fog ransomware targets schools via hacked VPNs | TechRadar

Ransomware Victims

Hundreds of cancer patients hit by NHS cyber attack as thousands of appointments cancelled | The Independent

Christie's Says Ransomware Attack Impacts 45,000 People - Security Week

Ransomware Attack Targets Canada’s Largest School Board (bloomberglaw.com)

Cyber attack means Japanese site Niconico needs total rebuild • The Register

Phishing & Email Based Attacks

Phishing Attacks Targeting US and European Organisations Double - Infosecurity Magazine (infosecurity-magazine.com)

Look before you scan – the QR code scammers are phishing for business | John Naughton | The Guardian

More eggs Malware Disguised as Resumes Targets Recruiters in Phishing Attack (thehackernews.com)

New phishing toolkit uses PWAs to steal login credentials (bleepingcomputer.com)

Phishing emails abuse Windows search protocol to push malicious scripts (bleepingcomputer.com)

Ascension Attack Caused by Employee Downloading Malicious File - Infosecurity Magazine (infosecurity-magazine.com)

Most impersonated sectors, brands in phishing examined | SC Media (scmagazine.com)

BEC

Massachusetts town loses $445,000 in email scam | StateScoop

BEC attack comment | Professional Security

Other Social Engineering

How to Spot a SIM-Swap Attack (and What to Do Next) | Lifehacker

Protecting identity in a world of deepfakes and social engineering - Help Net Security

Cyber security pros change strategies to combat AI-powered threats - Help Net Security

Are older adults more vulnerable to scams? What psychologists have learned about who’s most susceptible, and when (theconversation.com)

As 'swatting' attacks rise, feds win rare prison sentence for Ashton Connor Garcia - Washington Times

CISA Warns Phone Scammers Are Impersonating its Staff - Infosecurity Magazine (infosecurity-magazine.com)

Artificial Intelligence

Cyber security pros change strategies to combat AI-powered threats - Help Net Security

Multiple ChatGPT instances work together to find and exploit security flaws — teams of LLMs tested by UIUC beat single bots and dedicated software | Tom's Hardware (tomshardware.com)

EmailGPT Exposed to Prompt Injection Attacks - Infosecurity Magazine (infosecurity-magazine.com)

The Double-Edged Sword of Generative AI - Infosecurity Magazine (infosecurity-magazine.com)

Chatham House Cyber 2024 - how AI creates new cyber security dimensions (diginomica.com)

How to spot a deepfake - Raconteur

New Attack Technique 'Sleepy Pickle' Targets Machine Learning Models (thehackernews.com)

Easily Exploitable Critical Vulnerabilities Found in Open Source AI/ML Tools - Security Week

Urgently needed: AI governance in cyber warfare - Help Net Security

Protecting identity in a world of deepfakes and social engineering - Help Net Security

GDPR turns six: Expert discusses AI impact - Help Net Security

The Emerging Ecosystem Dedicated to AI Accountability | Decipher (duo.com)

Elon Musk threatens to ban iPhones over OpenAI integration | Digital Trends

Microsoft’s Recall puts the Biden administration’s cyber credibility on the line | CyberScoop

2FA/MFA

Snowflake Breach Exposes 165 Customers' Data in Ongoing Extortion Campaign (thehackernews.com)

How scammers bypass 2FA | Securelist

Hackers Using OTP bots To Bypass Two-Factor Authentication (cybersecuritynews.com)

How to meet evolving MFA demands in the current threat landscape (bleepingcomputer.com)

Malware

China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics (thehackernews.com)

One of Microsoft’s main markets is full of malware - Softonic

WarmCookie Gives Cyber Attackers New Backdoor for Initial Access (darkreading.com)

Why malware matters most: 6 ways to foil software threats faster - Security Boulevard

Cyber Criminals Employ PhantomLoader to Distribute SSLoad Malware (thehackernews.com)

Ascension Attack Caused by Employee Downloading Malicious File - Infosecurity Magazine (infosecurity-magazine.com)

Malicious VSCode extensions with millions of installs discovered (bleepingcomputer.com)

Hundreds of Russian organisations hit with infostealer campaign | SC Media (scmagazine.com)

Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (thehackernews.com)

Mobile

How to Spot a SIM-Swap Attack (and What to Do Next) | Lifehacker

Two arrested in UK over fake cell tower smishing campaign • The Register

Why You Should Delete These 100 Dangerous Google Play Store Apps (forbes.com)

Apple Says iPhones Will Get Security Updates for at Least 5 Years - Security Week

Google Will Track Your Location For The Next 180 Days—Then It Stops

Security and privacy strategies for CISOs in a mobile-first world - Help Net Security

Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (thehackernews.com)

Security and privacy settings in WhatsApp | Kaspersky official blog

Denial of Service/DoS/DDOS

Hacktivists target Irish websites in EU-wide cyber attacks (rte.ie)

DDoS attacks target EU political parties as elections begin (bleepingcomputer.com)

Pro-Russian hacker group claims responsibility for attempted cyber attacks on Irish websites (irishexaminer.com)

Ireland Hit by Coordinated Cyber Attacks: NCSC Mobilises Response | Cork Safety Alerts

Second Australian Rare Earths Producer Suffers Cyber Attack (bloomberglaw.com)

Internet of Things – IoT

Report: Network equipment most at risk of cyber attacks | SC Media (scmagazine.com)

Dangerous Liaisons: The Interaction Between Threat Actors and High-Risk Devices - Security Week

What Devices Pose the Highest Security Risk? Forescout Answers in New Research: The Riskiest Connected Devices in 2024 | Business Wire

IoT Vulnerabilities Skyrocket, Becoming Key Entry Point for Attackers - Infosecurity Magazine (infosecurity-magazine.com)

Data Breaches/Leaks

Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica

Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)

Hotel Check-in Kiosks Expose Guest Data, Room Keys (darkreading.com)

Snowflake Is Working to Beef Up Security Controls as Firms Probe Breaches (yahoo.com)

23andMe data breach under investigation in UK and Canada (bleepingcomputer.com)

Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)

Cylance confirms the legitimacy of data offered for sale in the dark web (securityaffairs.com)

NYSE Parent Hit with $10M Fine for Failure to Report Cyber Breach | MSSP Alert

The mystery of an alleged data broker’s data breach | TechCrunch

Tile hacked: Customer data and internal tools accessed by hacker (bgr.com)

Student's flimsy bin bags blamed for latest NHS data breach • The Register

Frontier says 750,000 Social Security numbers accessed during April cyber attack (therecord.media)

'New York Times source code' leaks online via 4chan • The Register

Threat Actor Claims to Leak 270GB of New York Times Data - Infosecurity Magazine (infosecurity-magazine.com)

Christie's Says Ransomware Attack Impacts 45,000 People - Security Week

White House report details all of 2023’s major gov breaches • The Register

Organised Crime & Criminal Actors

How Cyber Crime Empires Are Built (darkreading.com)

Scattered Spider Now Affiliated with RansomHub Following BlackCat Exit - Infosecurity Magazine (infosecurity-magazine.com)

Cyber crime suspects often young, increasingly armed: Dutch police | NL Times

Forced-Labor Camps Fuel Billions of Dollars in Cyber Scams (darkreading.com)

Cyber criminals work faster than ever | Professional Security

16-year-old arrested in France in connection with high-profile Epsilon hacking group attacks (bitdefender.com)

22 Chinese nationals sentenced to long prison terms in Zambia for multinational cyber crimes | AP News

As 'swatting' attacks rise, feds win rare prison sentence for Ashton Connor Garcia - Washington Times

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Cryptojacking Campaign Targets Misconfigured Kubernetes Clusters (thehackernews.com)

Insurance

Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)

The Big Question: Is the cyber market becoming too soft for the risks it writes? - Emerging Risks Media Ltd

Supply Chain and Third Parties

Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica

Hundreds of cancer patients hit by NHS cyber attack as thousands of appointments cancelled | The Independent

5 cyber security risks and challenges in supply chain | TechTarget

A Third-Party Risk Management Lifecycle for Cyber Security | UpGuard

Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)

Ransomware attack on England's health system highlights life-threatening impact of cyber crime | CBC News

Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)

What to Do When Your Business Associate Suffers a Ransomware Attack | Dentons - JDSupra

Cloud/SaaS

Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica

Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)

Snowflake Is Working to Beef Up Security Controls as Firms Probe Breaches (yahoo.com)

Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)

A CISO game plan for cloud security | InfoWorld

Why SaaS Security is Suddenly Hot: Racing to Defend and Comply (thehackernews.com)

Cloud migration expands the CISO role yet again - Help Net Security

Compatibility with UK laws and shared responsibility: MoD sets cloud security controls for suppliers – PublicTechnology

Identity and Access Management

Protecting identity in a world of deepfakes and social engineering - Help Net Security

Passwords, Credential Stuffing & Brute Force Attacks

78% of people use the same password across multiple accounts | Security Magazine

America’s Password Habits: 46% Report Having their Password Stolen Over the Last Year – Forbes Advisor

New phishing toolkit uses PWAs to steal login credentials (bleepingcomputer.com)

Regulations, Fines and Legislation

Is a US Nationwide Privacy Law Really Coming? (darkreading.com)

NYSE Parent Hit with $10M Fine for Failure to Report Cyber Breach | MSSP Alert

CISO Strategies For Navigating Expanding Cyber Security Regulations (forbes.com)

Google faces GDPR complaint over Privacy Sandbox • The Register

GDPR turns six: Expert discusses AI impact - Help Net Security

Here’s how to create a security culture that adheres to the new SEC regs | SC Media (scmagazine.com)

Data Protection

Is a US Nationwide Privacy Law Really Coming? (darkreading.com)

Careers, Working in Cyber and Information Security

Cyber Security Job Hunting May Come Down to Certifications (darkreading.com)

Cyber Security CPEs: Unraveling the What, Why & How (thehackernews.com)

The US cyber security industry needs an estimated 225,200 workers | Security Magazine

Preparing for a career in cyber security? Check out these statistics - Help Net Security

Strategies to Manage and Reduce Alert Fatigue in SOCs - IT Security Guru

70% of Cyber Security Pros Often Work Weekends - Infosecurity Magazine (infosecurity-magazine.com)

The risk of a thousand paper cuts – the human-centred problem seen with stress and burnout in cyber security (techuk.org)

Men’s Mental Health Week: Resource Guide - IT Security Guru

Law Enforcement Action and Take Downs

Police arrest Conti and LockBit ransomware crypter specialist (bleepingcomputer.com)

16-year-old arrested in France in connection with high-profile Epsilon hacking group attacks (bitdefender.com)

Misinformation, Disinformation and Propaganda

Russia Is Targeting Germany With Fake Information as Europe Votes | WIRED

Switzerland encounters rise in cyber attacks and disinformation prior to upcoming Ukraine summit (kyivindependent.com)


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Nation State Actors

China

Increasing Cyber Threats from China: What Business Leaders Need to Know | American Enterprise Institute - AEI

"Epoch-Defining" Challenge! China Weaponizing Civilian Hackers Via MCF Program Creates 'Typhoon' In The West (eurasiantimes.com)

Chinese hackers breached 20,000 FortiGate systems worldwide (bleepingcomputer.com)

Chinese cyber espionage campaign targets ‘dozens’ of Western governments, Dutch officials say | CyberScoop

Noodle RAT Reviewing the New Backdoor Used by Chinese-Speaking Groups | Trend Micro (US)

China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics (thehackernews.com)

Chinese Actor SecShow Conducts Massive DNS Probing on Global Scale (thehackernews.com)

The new front in China’s cyber campaign against America (economist.com)

Kaspersky Finds 24 Flaws in Chinese Biometric Hardware Provider - Infosecurity Magazine (infosecurity-magazine.com)

22 Chinese nationals sentenced to long prison terms in Zambia for multinational cyber crimes | AP News

Russia

Microsoft Says Russia 'More Aggressive' In Cyber Space (rferl.org)

bne IntelliNews - Russian cyberwar against Ukraine and the West

Switzerland encounters rise in cyber attacks and disinformation prior to upcoming Ukraine summit (kyivindependent.com)

NATO to take tougher action on Russian spies, says Stoltenberg – POLITICO

'Sticky Werewolf' APT Stalks Aviation Sector (darkreading.com)

Pro-Russia cyber attack targets Netherlands parties on first day of European elections - JURIST - News

Pro-Russian hacker group claims responsibility for attempted cyber attacks on Irish websites (irishexaminer.com)

Russia Is Targeting Germany With Fake Information as Europe Votes | WIRED

The Paris Olympic games will likely present a high cyber risk | Security Magazine

Hundreds of Russian organisations hit with infostealer campaign | SC Media (scmagazine.com)

Putin's subs have exposed Ireland's shameless hypocrisy (telegraph.co.uk)


Tools and Controls

CISOs may be too reliant on EDR/XDR defenses | CSO Online

How to conduct an API risk assessment and improve security | TechTarget

A Third-Party Risk Management Lifecycle for Cyber Security | UpGuard

What is ELINT (electronic intelligence)? | Definition from TechTarget

9 out of 10 businesses seek AI-led threat detection and vulnerability management - IT Security Guru

What is IT incident management? | Definition from TechTarget

Strategies to Manage and Reduce Alert Fatigue in SOCs - IT Security Guru

A CISO game plan for cloud security | InfoWorld

Chinese Actor SecShow Conducts Massive DNS Probing on Global Scale (thehackernews.com)

Why SaaS Security is Suddenly Hot: Racing to Defend and Comply (thehackernews.com)

Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)

Windows Security vs. Microsoft Defender: Important differences you should know | PCWorld

Assigning a Monetary Value to Cyber Risk | MSSP Alert

20 Questions To Assess Cyber Security Risks Within An Organisation (forbes.com)

Top 10 Critical Pentest Findings 2024: What You Need to Know (thehackernews.com)

Modern fraud detection need not rely on PII - Help Net Security

How to meet evolving MFA demands in the current threat landscape (bleepingcomputer.com)

The Big Question: Is the cyber market becoming too soft for the risks it writes? - Emerging Risks Media Ltd

How Enterprise Browsers Enhance Security and Efficiency (inforisktoday.com)

What is communications intelligence (COMINT)? | Definition from TechTarget

Cyber Security Consolidation Ahead: Tool Sprawl Rolls Up to Platforms | MSSP Alert

AI cyber security solutions detect ransomware in under 60 seconds (securityintelligence.com)

Why CISOs need to build cyber fault tolerance into their business - Help Net Security

What Is Attack Path Mapping? - TechRound

How PE Firm CFOs Cost-Effectively Manage Cyber Risk | Kovrr - Security Boulevard

How to Create a Cyber Risk Assessment Report (cybersaint.io)



Vulnerability Management

9 out of 10 businesses seek AI-led threat detection and vulnerability management - IT Security Guru

Easily Exploitable Critical Vulnerabilities Found in Open Source AI/ML Tools - Security Week

Solving the systemic problem of recurring vulnerabilities - Help Net Security

AI’s role in accelerating vulnerability management - Help Net Security

Vulnerabilities

Exploit for critical Veeam auth bypass available, patch now (bleepingcomputer.com)

Exploit for Veeam Recovery Orchestrator auth bypass available, patch now (bleepingcomputer.com)

Chinese hackers breached 20,000 FortiGate systems worldwide (bleepingcomputer.com)

Microsoft June 2024 Patch Tuesday fixes 51 flaws, 18 RCEs (bleepingcomputer.com)

Chrome 126, Firefox 127 Patch High-Severity Vulnerabilities - Security Week

PoC Exploit Emerges for Critical RCE Bug in Ivanti Endpoint Manager (darkreading.com)

SolarWinds fixes severe Serv-U vulnerability (CVE-2024-28995) - Help Net Security

Cisco fixes WebEx flaw after government comms exposed • The Register

New PHP Vulnerability Exposes Windows Servers to Remote Code Execution (thehackernews.com)

Nvidia Patches High-Severity GPU Driver Vulnerabilities - Security Week

JetBrains warns of IntelliJ IDE bug exposing GitHub access tokens (bleepingcomputer.com)

Ransomware Group Exploits PHP Vulnerability Days After Disclosure - Security Week

Black Basta Actors Exploited Windows 0day Privilege Vulnerability (cybersecuritynews.com)

Google patches 50 Pixel security flaws, including one hackers are using in their attacks — update your phone now | Tom's Guide (tomsguide.com)

Multiple flaws in Fortinet FortiOS fixed (securityaffairs.com)

Netgear WNR614 flaws allow device takeover, no fix available (bleepingcomputer.com)

Adobe Plugs Code Execution Holes in After Effects, Illustrator - Security Week


Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3


As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Advisory 13 June 2024 – Microsoft Patches Critical RCE Flaw and Zero-Click Vulnerability

Black Arrow Cyber Advisory 13 June 2024 – Microsoft Patches Critical RCE Flaw and Zero-Click Vulnerability

Executive summary

Microsoft have released patches for a ‘critical’ remote code execution vulnerability (CVE-2024-30080) and a ‘high’ zero-click vulnerability (CVE-2024-30103) this week. The critical vulnerability allows an attacker to perform remote code execution by sending a specially crafted malicious Microsoft Message Queuing (MSMQ) technology packet to an MSMQ server. The zero-click vulnerability allows an attacker to bypass Outlook registry block lists and enable the creation of malicious files, which is initiated when an affected email is previewed in Outlook or opened.

What’s the risk to me or my business?

If the vulnerabilities are successfully exploited this will allow an attacker to perform arbitrary remote code execution, and the other will allow for malicious DLL files to be created. Both vulnerabilities if exploited could have a high impact on the confidentiality, integrity and availability of the organisations data on affected systems.

What can I do?

Black Arrow recommends applying the available patches for the vulnerability as soon as possible following their organisations update policies due to the severity.

Technical Summary

CVE-2024-30080 – This vulnerability allows an attacker to completely take over an affected server by sending a specially crafted malicious MSMQ packet to a MSMQ server, performing arbitrary remote code execution on the server side.

CVE-2024-30103 – This vulnerability allows an authenticated malicious actor using valid Exchange user credentials to bypass the Outlook registry block lists and enable the creation of malicious DLL files, allowing them to perform other malicious activities.

Further information on Microsoft Patches released this week can be found here:

https://msrc.microsoft.com/update-guide/releaseNote/2024-Jun

Further information on the RCE vulnerability can be found here:

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30080

Further information on the Zero-Click vulnerability can be found here:

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30103

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Advisory 12 June 2024 – Fortinet FortiGate SSL VPN Vulnerability Leads to 20,000 Systems Being Breached by China Globally

Black Arrow Cyber Advisory 12 June 2024 – Fortinet FortiGate SSL VPN Vulnerability Leads to 20,000 Systems Being Breached by China Globally

Executive summary

The Dutch cyber security agency has recently State-sponsored threat actors backed by China have gained access to 20,000 Fortinet Fortigate systems globally between 2022 and 2023 through the Coathanger malware campaign.  The vulnerability (CVE-2022-42475) allows a malicious actor to remotely execute malicious code. The Coathanger malware is persistent and remains on the devices even after reboots and firmware and software updates. While Fortinet silently released an update to fix this vulnerability in November 2022, they did not announce this until December 2022 in which during this time 14,000 devices were backdoored.

What’s the risk to me or my business?

The vulnerability in Fortinet’s products affected by this could pose a significant risk to your organisation. If exploited it could allow an attacker to remain in the product even after reboots and firmware updates. It also could allow an attacker to remotely execute malicious code. This could compromise the confidentiality, integrity, and availability of your organisation’s data

What can I do?

The vulnerability is difficult to identify and remove even if the patch has been installed to fix this vulnerability, indicators of compromise can be found in the link below. If you are unsure of what to do, please contact Black Arrow for further help and guidance.

Technical Summary

CVE-2022-42475: This is a heap-based buffer overflow vulnerability which may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

The affected products are:

·         FortiOS version 7.2.0 through 7.2.2

·         FortiOS version 7.0.0 through 7.0.8

·         FortiOS version 6.4.0 through 6.4.10

·         FortiOS version 6.2.0 through 6.2.11

·         FortiOS version 6.0.0 through 6.0.15

·         FortiOS version 5.6.0 through 5.6.14

·         FortiOS version 5.4.0 through 5.4.13

·         FortiOS version 5.2.0 through 5.2.15

·         FortiOS version 5.0.0 through 5.0.14

·         FortiOS-6K7K version 7.0.0 through 7.0.7

·         FortiOS-6K7K version 6.4.0 through 6.4.9

·         FortiOS-6K7K version 6.2.0 through 6.2.11

·         FortiOS-6K7K version 6.0.0 through 6.0.14

·         FortiProxy version 7.2.0 through 7.2.1

·         FortiProxy version 7.0.0 through 7.0.7

·         FortiProxy version 2.0.0 through 2.0.11

·         FortiProxy version 1.2.0 through 1.2.13

·         FortiProxy version 1.1.0 through 1.1.6

·         FortiProxy version 1.0.0 through 1.0.7

Further information from the National Cyber Security Centre can be found here:

https://www.ncsc.nl/actueel/nieuws/2024/juni/10/aanhoudende-statelijke-cyberspionagecampagne-via-kwetsbare-edge-devices

Further information on the FortiGuard Advisory can be found here:

https://www.fortiguard.com/psirt/FG-IR-22-398

Further information on the Indicators of compromise can be found here:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Critical-vulnerability-Protect-against-heap-based/ta-p/239420


Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Advisory 11 June 2024 – Active exploitation of Check Point Zero-Day Vulnerability

Black Arrow Cyber Advisory 11 June 2024 – Active exploitation of Check Point Zero-Day Vulnerability

Executive summary

Recent exploitation of Check Point VPN zero-days have been ramping up since the proof of concept was released to the public. The actively exploited zero-day (CVE2024-24919) has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog and could allow an attacker to access sensitive information on Check Point Security gateways and allow them to obtain admin privileges. Check Point have recently stated that it is thought exploitation to have begun in early April, however Checkpoint is not due to release any patches until 20 June.

What’s the risk to me or my business?

The vulnerability in Check Point’s products could pose a significant risk to your organisation. If exploited, it could potentially allow an attacker to access sensitive information from your Check Point Security Gateways. In some instances, the attacker might even gain domain admin privileges. This could compromise the confidentiality, integrity, and availability of your organisation’s data

What can I do?

Check Point have not released any patches for this vulnerability however they have released automatic interim preventative measures deployed through AutoUpdater utility. Black arrow recommends following Check Points advice, which can be found in their advisory linked below.

Technical Summary

CVE-2024-24919 - A path traversal vulnerability, which could allow an attacker to read any file on the system. No specific privilege level is required to exploit this vulnerability.

The affected products are:

·         CloudGuard Network

·         Quantum Maestro

·         Quantum Scalable Chassis

·         Quantum Security Gateways

·         Quantum Spark Appliances

A security gateway is vulnerable if one of the configurations is applied:

·         If the “IPSec VPN” blade has been enabled and the Security Gateway device is part of the “Remote Access” VPN community.

·         If the “Mobile Access” blade has been enabled.

The advisory provided by Check Point can be found here:

https://support.checkpoint.com/results/sk/sk182336

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 07 June 2024

Black Arrow Cyber Threat Intelligence Briefing 07 June 2024:

-Urgent Training Gap Exposed as a Quarter of Organisations Provide No Cyber Training to End-Users

-UK SMEs Unaware of the True Cost of Cyber Attacks, Whilst 78% of SMBs Fear Cyber Attacks Could Shut Down Their Business

-Major Cyber Crime Networks Dismantled in US and Europe Deemed a Wake-Up Call for Businesses, Ransomware Rises Despite Law Enforcement Takedowns

-Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT, or How the Smart TV in your Office Could Infect Your Whole Business with Malware

-CISOs Are Facing a ‘Tsunami of Regulations’; Here’s Why It’s Crucial They Focus on Quantifying Cyber Risk

-90% of Threats are Social Engineering

-UK Businesses Faced with Month-Long Recoveries from Supply Chain Attacks

-Account Takeovers Outpace Ransomware as Top Security Concern

-The Impact of Legacy Vulnerabilities in Today's Cyber Security Landscape

-Nearly All FTSE 100 Companies Exposed to Third and Fourth-Party Breaches

-Snowflake Denies Breach, Blames Data Theft on Poorly Secured Customer Accounts

-97 percent of Security Experts Worry about AI Security Related Threats and Incidents

-85% of Managed Service and Security Providers Face “Significant” Challenges Maintaining Security Compliance for Clients

-Cyber Attack Causes Critical Incident in London Hospitals with Operations Cancelled and Emergency Patients Diverted

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Urgent Training Gap Exposed as a Quarter of Organisations Provide No Cyber Training to End-Users

A recent survey by Hornetsecurity highlights a concerning gap in IT security training among organisations, with 26% not providing any training to end-users. While 79% of organisations believe their training is moderately effective, 39% admit it fails to address recent AI-powered threats adequately. Notably, 31% of respondents found the training unengaging. The survey also revealed that 23% of organisations experienced a cyber security breach in the past year, leading 94% to implement additional controls. However, 52% of end-users often ignore identified threats, emphasising the need for ongoing, engaging, and adaptive training programmes.

Black Arrow supports organisations of all sizes in designing and delivering proportionate user education and awareness programmes, including in-person and online training as well as simulated phishing campaigns. Our programmes help secure employee engagement and build a cyber security culture to protect the organisation.  

UK SMBs Unaware of True Cost of Cyber Attacks, 78% of SMBs Fear Cyber Attacks Could Shut Down Their Business

New research reveals that UK SMBs underestimate the financial impact of cyber attacks by nearly £85,000. SMBs that have not experienced an attack estimate losses at £39,633, while those that have suffered breaches report actual losses at £123,984.

A separate report by ConnectWise reveals that 94% of SMBs have experienced at least one cyber attack in the last year, up from 64% in 2019, highlighting a significant rise in cyber threats. The report shows that 76% of SMBs lack in-house cyber security skills, driving demand for externally sourced third party security experts. Additionally, 78% of SMBs fear a severe cyber attack could jeopardise their operations. The study found that 56% have faced a cyber attack so far this year, with 89% anticipating another within six months. 83% of SMBs plan to increase their cyber security budgets by an average of 19% over the next year to bolster defences.

Major Cyber Crime Networks Dismantled in US and Europe Deemed a Wake-Up Call for Businesses, Although Ransomware Rises Despite Law Enforcement Takedowns

The recent crackdown on cyber crime by the US and Europe underscores the critical need for robust cyber security measures for businesses. The US Department of Justice arrested Chinese national YunHe Wang, who allegedly compromised over 19 million devices, resulting in $5.9 billion in fraudulent claims. Europol simultaneously apprehended key figures in Armenia and Ukraine, dismantling ransomware networks extorting millions in cryptocurrency. Despite these efforts, a recent report from Mandiant reveals a 75% increase in ransomware activity in 2023, with nearly 1,400 victims across 110 countries.

Factors driving this resurgence include new ransomware entrants, partnerships between groups, and the use of remote management tools, which featured in 41% of intrusions. Established groups like ALPHV/BlackCat and LockBit were prominent, but the landscape also saw 50 new ransomware variants, with a trend towards updating existing families rather than creating new ones.

Businesses must adopt comprehensive security training, regular system updates, advanced threat detection, and incident response planning to mitigate these substantial threats.

Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT, or How the Smart TV in your Office Could Infect Your Whole Business with Malware

A recent report underscores the escalating cyber risks linked to the Internet of Things (IoT), especially for critical infrastructure. Vulnerable legacy IoT devices, often manually updated, pose significant security risks.

Additionally, there is now more malware specifically targeting IoT devices, such as the Pandoraspear malware, which targets smart TVs via free streaming sites accessed on smartphones. This malware turns TVs into part of a botnet for Distributed Denial of Service (DDoS) attacks. The botnet has compromised over 170,000 endpoints, with estimates suggesting it involves 1.3 million unique IP addresses.

These findings highlight the critical need for enhanced cyber security measures to safeguard against IoT threats, including changing default passwords, network isolation, encrypting data, and conducting regular software updates.

CISOs Are Facing a ‘Tsunami of Regulations’; Here’s Why It’s Crucial They Focus on Quantifying Cyber Risk

Recent discussions emphasise the challenges CISOs encounter when trying to quantify cyber risk in the face of an influx of new regulations such as NIS2 in Europe and SEC requirements in the US that are transforming the way security leaders handle risks. CISOs must translate diverse threats into simplified metrics to communicate effectively with boards. The importance of continuous assessment over annual checks to keep up with evolving vulnerabilities cannot be stressed enough. A mature approach involves visibility, prioritisation, communication, and quantification of risks. The focus should be on defending yourself against the attacker by maintaining credible controls, not on defending yourself against the regulator through a weak tick box exercise.

90% of Threats are Social Engineering

The Avast Q1 2024 Threat Report reveals that nearly 90% of threats were social engineering-based, with scams and phishing utilising deepfake technology and hijacked YouTube channels. Over 90% of mobile threats were scams, including adware and banker malware. YouTube was heavily exploited for phishing and crypto scams.

UK Businesses Faced with Month-Long Recoveries from Supply Chain Attacks

New research by BlackBerry shows that 38% of British organisations face month-long recovery times following software supply chain attacks. The survey, involving 200 IT decision-makers, found that 74% of UK IT leaders were notified of supply chain attacks or vulnerabilities in the past year. While regulatory requirements are encouraging proactive monitoring, a lack of technical knowledge and confidence to act on threats persists. Notably, only 22% of organisations perform real-time inventories of their software environment. The impacts of these attacks include financial loss (62%), data loss (59%), and reputational damage (57%).

Account Takeovers Outpace Ransomware as Top Security Concern

A recent survey by Abnormal Security highlights account takeover attacks as the primary threat to organisations. According to the 2024 State of Cloud Account Takeover Attacks Report, 83% of organisations experienced at least one such attack in the past year, with 77% of security leaders ranking them among their top four threats. Nearly half faced these attacks over five times annually, and 20% encountered more than ten incidents. Despite common defences like multi-factor authentication and strong password policies, 63% of respondents doubted MFA’s effectiveness. The survey emphasises the need for solutions offering cross-platform visibility and automated remediation to combat these pervasive threats effectively.

The Impact of Legacy Vulnerabilities in Today's Cyber Security Landscape

Research shows that the vulnerabilities most affecting small to medium sized businesses (SMBs) are older, known vulnerabilities rather than newer highly publicised zero-days. According to SonicWall’s data from January 2022 to March 2024, the top five network attacks included Log4j (43%) and Heartbleed (35%), both of which target vulnerabilities up to a decade old. Despite advancements in AI and novel threats, these older vulnerabilities remain significant risks due to their ease of exploitation and how widespread they continue to be. SMBs, especially in critical industries, are advised to utilise industry-leading tools and automated patches, ensuring robust cyber security measures against both old and new threats.

Nearly All FTSE 100 Companies Exposed to Third and Fourth-Party Breaches

A recent report by SecurityScorecard reveals that virtually all FTSE 100 companies had suppliers experiencing breaches in the past year. The UK Top 100 Companies: Cybersecurity Threat Report graded firms A-F based on factors predicting a security breach. While UK firms generally scored higher than their continental counterparts, 97% had breaches in their third-party ecosystem. This shows the increasing threat of supply chain attacks, with 97% also experiencing fourth-party breaches. Notably, the energy and basic materials sectors were the most secure, with only 12% and 16% reporting third-party breaches, respectively, while the communications sector had the lowest security posture.

Snowflake Denies Breach, Blames Data Theft on Poorly Secured Customer Accounts

Recent incidents involving cloud storage provider Snowflake highlights the risks associated with compromised credentials. A threat actor claimed to have breached Snowflake’s infrastructure, accessing data from Santander, Ticketmaster and others. However, Snowflake maintains that the theft resulted from stolen customer login details, not a vulnerability or misconfiguration in their system. Snowflake’s CISO clarified that a former employee's demo account was accessed, which was not protected by two-factor authentication (2FA). Santander confirmed a third-party database breach, and Ticketmaster identified unauthorised activity in a Snowflake-hosted database. Snowflake, alongside Crowdstrike and Mandiant, found no evidence implicating Snowflake's platform itself.

97 percent of Security Experts Worry about AI Security Related Threats and Incidents

A new report from Deep Instinct reveals that 97% of security professionals fear AI-generated security incidents, prompting 75% to alter their cyber security strategies over the past year, with 73% focusing more on prevention. The survey of 500 senior experts from large enterprises also shows a 61% rise in deepfake incidents, primarily targeting CEOs and C-suite members. Stress levels have increased for 66% of cyber security professionals due to these threats. Despite 41% relying on endpoint detection and response (EDR) solutions, only 31% plan to boost EDR investments, while 53% feel board pressure to adopt preventative tools against AI threats. This report highlights the need for predictive prevention to enhance resilience.

85% of Managed Service and Security Providers Face “Significant” Challenges Maintaining Security Compliance for Clients

Recent reports by Apptega and Sophos reveals that 85% of managed service providers (MSPs) face significant challenges in maintaining compliance for customers due to resource, expertise, and technology gaps. The MSP Perspectives 2024 survey reveals that MSPs struggle to keep pace with evolving threats and industry trends, with 91% of ransomware attacks occurring outside business hours.

Cyber Attack Causes Critical Incident in London Hospitals with Operations Cancelled and Emergency Patients Diverted

Major hospitals in London declared a critical incident earlier in the week after a cyber attack led to operations being cancelled and emergency patients being diverted elsewhere.  It applies to hospitals partnered with Synnovis, a provider of pathology services which suffered a ransomware attack linked to Russian threat actors. King’s College Hospital, Guy’s and St Thomas’, the Royal Brompton and the Evelina London Children’s Hospital, as well as primary care services, were among those affected.

The incident has had a "major impact" on the delivery of services, especially blood transfusions and test results. Some procedures were cancelled or were redirected to other NHS providers as the hospitals tried to establish what work can be carried out safely.

Sources:

https://www.prnewswire.com/news-releases/urgent-training-gap-exposed-as-a-quarter-of-organisations-unprepared-for-cyber-attacks-hornetsecurity-survey-reveals-302160745.html

https://www.commsbusiness.co.uk/content/news/uk-smes-unaware-of-the-true-cost-of-cyberattacks

https://www.helpnetsecurity.com/2024/06/06/smbs-cyberattack-frequency/

https://www.grcworldforums.com/risk/major-cybercrime-networks-dismantled-in-us-and-europe-a-wake-up-call-for-businesses/9642.article

https://www.infosecurity-magazine.com/news/ransomware-rise-2023-mandiant/

https://www.insurancejournal.com/news/international/2024/06/06/778306.htm

https://www.techradar.com/pro/security/that-smart-tv-in-your-office-could-be-infecting-your-whole-business-with-malware

https://www.itpro.com/security/cisos-are-facing-a-tsunami-of-regulations-heres-why-its-crucial-they-focus-on-quantifying-cyber-risk

https://www.helpnetsecurity.com/2024/06/06/social-engineering-threats-video/

https://www.infosecurity-magazine.com/news/uk-businesses-recoveries-supply/

https://www.infosecurity-magazine.com/news/ato-outpace-ransomware-top/

https://www.techradar.com/pro/the-impact-of-legacy-vulnerabilities-in-todays-cybersecurity-landscape

https://www.infosecurity-magazine.com/news/ftse-100-exposed-third-fourth/

https://www.helpnetsecurity.com/2024/06/01/snowflake-breach-data-theft/

https://betanews.com/2024/06/03/97-percent-of-organizations-worried-about-ai-security-threats/

https://www.businesswire.com/news/home/20240605033270/en

https://www.computerweekly.com/microscope/news/366587132/Skills-shortages-exposing-MSPs-to-security-risks

https://www.bbc.co.uk/news/articles/c288n8rkpvno

https://securityaffairs.com/164142/cyber-crime/ransomware-attack-synnovis-london-hospitals.html


Governance, Risk and Compliance

78% of SMBs fear cyber attacks could shut down their business - Help Net Security

26% of organisations lack any form of IT security training - Help Net Security

Cyber attacks on financial services firms hit 20m people in 2023 - CIR Magazine

Small Firms Need to Stretch Security Budgets - Infosecurity Magazine (infosecurity-magazine.com)

CISOs are facing a ‘tsunami of regulations’ — here’s why it’s crucial they focus on quantifying cyber risk | ITPro

Microsoft: weak cyber defences set to hit economic growth (cityam.com)

How to Prove Security Effectiveness with a Cyber Security Board Report  - Security Boulevard

Skills shortages exposing MSPs to security risks | Microscope (computerweekly.com)

85% of Managed Service and Security Providers Face “Significant” Challenges Maintaining Security Compliance for Clients, Apptega Survey Finds | Business Wire

Urgent training gap exposed as a quarter of organisations unprepared for cyber attacks, Hornetsecurity survey reveals (prnewswire.com)

Is your workplace ‘cyber savvy’? (siliconrepublic.com)

Governance Essentials for Businesses in the AI Era | News | GRC World Forums

49% of organisations feel somewhat prepared to handle a breach | Security Magazine

UK Businesses Face Month-Long Recoveries from Supply Chain Attacks - Infosecurity Magazine (infosecurity-magazine.com)

Mastering Cyber Risk Quantification Methods: A Strategic Approach - Security Boulevard

Deciding cyber security spend: how much is enough? | Propertymark

Effective Incident Response: A Cyber Security Playbook for Executives - Security Boulevard

1/3 of CISOs in the UK ignore NCSC cyber security guidance (verdict.co.uk)

4 communication mistakes to avoid during a data breach - PR Daily

80 percent of organisations not ready for CISA rules on security practices (betanews.com)


Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Rises Despite Law Enforcement Takedowns - Infosecurity Magazine (infosecurity-magazine.com)

Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools | Google Cloud Blog

Darknet site for Qilin gang, suspected in London hospitals ransomware attack, goes down (therecord.media)

With over 1.7 million employees, the UK's NHS has become a 'rinse-and-repeat target' for cyber criminals—disrupting services and risking lives | Fortune Europe

Account Takeovers Outpace Ransomware as Top Security Concern - Infosecurity Magazine (infosecurity-magazine.com)

RansomHub extortion gang linked to now-defunct Knight ransomware (bleepingcomputer.com)

RansomHub Actors Exploit ZeroLogon Vuln in Recent Ransomware Attacks (darkreading.com)

FBI recovers 7,000 LockBit keys, urges ransomware victims to reach out (bleepingcomputer.com)

New ransomware attack based on an evolutional generative adversarial network can evade security measures (techxplore.com)

Security industry has ransomware-as-a-service model wrong, says expert | SC Media (scmagazine.com)

Ransomware Ecosystem Transformed, New Groups “Changing the Rules” - Infosecurity Magazine (infosecurity-magazine.com)

'Fog' Ransomware Rolls in to Target Education, Recreation Sectors (darkreading.com)

New Gitloker attacks wipe GitHub repos in extortion scheme (bleepingcomputer.com)

Cyber insurance isn't the answer for ransom payments - Help Net Security

Linux version of TargetCompany ransomware focuses on VMware ESXi (bleepingcomputer.com)

What is ransomware? 7 things you must know before it's too late | PCWorld

Ransomware Victims

MediSecure in administration just weeks after confirming large cyber attack - ABC News

Former cyber security boss 'believes a Russian group' is behind the NHS 'major IT incident' (cityam.com)

A ransomware attack on Synnovis impacted several London hospitals (securityaffairs.com)

Darknet site for Qilin gang, suspected in London hospitals ransomware attack, goes down (therecord.media)

Wrongful death lawsuit alleges baby dies as a result of Springhill Medical Center’s negligence during cyber attack (fox10tv.com)

Consulting Firm Greylock Hit With Ransomware Attack Class Action (bloomberglaw.com)

RansomHub gang claims the hack of Frontier Communications (securityaffairs.com)

Christie's avoids leak of stolen data, is sold instead • The Register

FBI recovers 7,000 LockBit keys, urges ransomware victims to reach out (bleepingcomputer.com)

Ransomware ravaged schools and cities in May | TechTarget

What If The Scathing UnitedHealth Cyber Rebuke Was Yours? (forbes.com)

Hack of UK Hospitals Highlights Growing Threat (itprotoday.com)

UK School Forced to Close Following Cyber Attack - Infosecurity Magazine (infosecurity-magazine.com)

Ransomware Gang Leaks Data From Australian Mining Company - Security Week

Phishing & Email Based Attacks

90% of threats are social engineering - Help Net Security

AI Will Increase the Quantity—and Quality—of Phishing Scams - Schneier on Security

New V3B phishing kit targets customers of 54 European banks (bleepingcomputer.com)

AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)

Microsoft: The brand attackers love to imitate | CSO Online

AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say | FedScoop

Why your inbox is still so bad at blocking malware and spam - 9to5Mac

Phishing scams using QR codes are surging, here's what you should know | Tech News - Business Standard (business-standard.com)

The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)

BEC

90% of threats are social engineering - Help Net Security

US Authorities Attempting to Recover $5.3 Million Stolen in BEC Scam  - Security Week

Other Social Engineering

Have you answered a spam call by accident? Your next move is extremely important

Artificial Intelligence

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

OpenAI report reveals threat actors using ChatGPT in influence operations | SC Media (scmagazine.com)

AI Will Increase the Quantity—and Quality—of Phishing Scams - Schneier on Security

AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)

97% of security experts worry about AI-related security incidents | Security Magazine

Coinbase's top cyber exec warns deepfake threat is growing | Fortune Crypto

Five AI-based threats security pros need to understand | SC Media (scmagazine.com)

AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say | FedScoop

Forrester report highlights 2024 IAM trends & AI impact (securitybrief.co.nz)

ChatGPT privacy tips: Two important ways to limit the data you share with OpenAI | ZDNET

AI Company Hugging Face Detects Unauthorized Access to Its Spaces Platform (thehackernews.com)

2FA/MFA

Snowflake’s Lack of MFA Control Leaves Companies Vulnerable, Experts Say (informationweek.com)

What is MFA bombing? Apple users were targeted using this phishing technique (securitybrief.co.nz)

Security keys unlock nothing but inconvenience (techmonitor.ai)

Malware

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)

Europol identifies 8 cyber criminals tied to malware loader botnets (bleepingcomputer.com)

Europol's Hunt Begins for Emotet Malware Mastermind (darkreading.com)

Beware: Fake Browser Updates Deliver BitRAT and Lumma Stealer Malware (thehackernews.com)

DarkGate Malware Replaces AutoIt with AutoHotkey in Latest Cyber Attacks (thehackernews.com)

Ukrainian Systems Hit by Cobalt Strike Via a Malicious Excel File (darkreading.com)

Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan (thehackernews.com)

Comms Business - Malware targeting endpoints on the rise, finds report

Non-mobile malware statistics, Q1 2024 | Securelist

Stealthier DarkGate malware campaign emerges | SC Media (scmagazine.com)

Hackers Exploit Legitimate Packer Software to Spread Malware Undetected (thehackernews.com)

Mobile

The NSA advises you to turn your phone off and back on once a week - here's why | ZDNET

In case you missed it: Bank info-stealing malware found in 90+ Android apps with 5.5M installs | Mashable

Hackers Targeting 1,500 Banks and Their Customers in Push To Drain Accounts Across 60 Countries: Report - The Daily Hodl

37 Vulnerabilities Patched in Android - Security Week

361 million account credentials leaked on Telegram: Are yours among them? - Help Net Security

Android malware and unwanted software statistics for Q1 2024 | Securelist

Denial of Service/DoS/DDOS

Conflicts Drive DDoS Attacks Surge in EMEA - Infosecurity Magazine (infosecurity-magazine.com)

Internet of Things – IoT

Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT (insurancejournal.com)

That smart TV in your office could be infecting your whole business with malware | TechRadar

Over 600,000 SOHO routers were destroyed by Chalubo malware in 72 hours  (securityaffairs.com)

Data Breaches/Leaks

The Ticketmaster Data Breach May Be Just the Beginning | WIRED

Ticketmaster confirms massive breach after stolen data for sale online (bleepingcomputer.com)

Snowflake denies breach, blames data theft on poorly secured customer accounts - Help Net Security

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

Snowflake account hacks linked to Santander, Ticketmaster breaches (bleepingcomputer.com)

Snowflake’s Lack of MFA Control Leaves Companies Vulnerable, Experts Say (informationweek.com)

The Snowflake Attack May Be Turning Into One of the Largest Data Breaches Ever | WIRED

Santander hit by massive cyber attack: All staff and '30million' customers have personal data stolen by gang 'behind Ticketmaster hack' | Daily Mail Online

The Billericay School pupils have details exposed in cyber attack - BBC News

Crooks threaten to leak 2.9B records of personal info • The Register

Threat actor considers leaking 3B records from background check firm | SC Media (scmagazine.com)

Secrets Exposed in Hugging Face Hack - Security Week

Google's hidden logs detail thousands of privacy breaches - CyberGuy

Spanish police investigate whether hackers stole millions of drivers' data - CNA (channelnewsasia.com)

Blackbaud Class Action Lawsuit Denied by Federal Court | MSSP Alert

Ticketek customer details exposed in cyber security breach | Data and computer security | The Guardian

Club Penguin fans breached Disney Confluence server, stole 2.5GB of data (bleepingcomputer.com)

Check-in terminals used by thousands of hotels leak guest info (bleepingcomputer.com)

Debt Collector Data Breach Exposes Data on 3 Million+ Americans | PCMag

Nearly 400,000 affected by data breach at eye care management services company (therecord.media)

Over 2.5 billion free Android VPN users at risk of data leaks | TechRadar

Advance Auto Parts stolen data for sale after Snowflake attack (bleepingcomputer.com)

Organised Crime & Criminal Actors

Major Cyber Crime Networks Dismantled in US and Europe: A Wake-Up Call for Businesses | News | GRC World Forums

International Cyber Crime Ringleaders Arrested In Armenia, Ukraine – Eurasia Review

Authorities Ramp Up Efforts to Capture the Mastermind Behind Emotet (thehackernews.com)

4 cuffed following probe into holiday scheme for cyber crooks • The Register

Security industry has ransomware-as-a-service model wrong, says expert | SC Media (scmagazine.com)

Ransomware Ecosystem Transformed, New Groups “Changing the Rules” - Infosecurity Magazine (infosecurity-magazine.com)

Why Hackers Love Logs - Security Week

Police dismantle pirated TV streaming network that made $5.7 million (bleepingcomputer.com)

Hacker ordered to pay Nintendo 25-30% of his salary for the rest of his life still hasn't got a full-time job

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Two 39-year-old Estonian men are the alleged kingpins behind a massive half billion fraud targeting thousands of US investors | Fortune

Hackers exploit Chrome plugin to steal millions from Binance accounts (cointelegraph.com)

Microsoft India’s X account hijacked in Roaring Kitty crypto scam (bleepingcomputer.com)

Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers | Trend Micro (US)

Insider Risk and Insider Threats

4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)

Insurance

30% of Organisations with Cyber Insurance Implemented Additional Security Measures to Be Eligible for the Policy, up from 22% in 2023 (prnewswire.com)

Cyber insurance isn't the answer for ransom payments - Help Net Security

The top three cyber policy gaps - Insurance News | InsuranceNewsNet

Supply Chain and Third Parties

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

Third-party vendors pose serious cyber security threat to national security - Help Net Security

London NHS hospitals revert to paper records after cyber attack | NHS | The Guardian

Software Supply Chain Attacks Have Increased Financial and Reputational Impacts on Companies Globally, New BlackBerry Research Reveals (prnewswire.com)

UK Businesses Face Month-Long Recoveries from Supply Chain Attacks - Infosecurity Magazine (infosecurity-magazine.com)

Third-party software supply chain threats continue to plague CISOs | CSO Online

Nearly All of FTSE 100 Exposed to Third and Fourth-Party - Infosecurity Magazine (infosecurity-magazine.com)

Snowflake data breach claims spark war of words over culpability; researchers may have been trolled - DataBreaches.net

Ticketmaster Breach Showcases SaaS Data Security Risks (darkreading.com)

Ticketek customer details exposed in cyber security breach | Data and computer security | The Guardian

Basic cyber security can protect from rising supply chain attacks | TechRadar

Advance Auto Parts stolen data for sale after Snowflake attack (bleepingcomputer.com)

Cloud/SaaS

Snowflake denies breach, blames data theft on poorly secured customer accounts - Help Net Security

Snowflake account hacks linked to Santander, Ticketmaster breaches (bleepingcomputer.com)

Snowflake Recommends Customers Take Steps to Prevent Unauthorized Access | CISA

2024-State-of-Multicloud-Security-Risk-Report.pdf (microsoft.com)

Shadow IT and Zombie Accounts: Sabotaging Your SaaS Security - Security Boulevard

Azure Service Tags tagged as security risk, Microsoft disagrees (bleepingcomputer.com)

Identity and Access Management

The Top Trends Shaping Identity And Access Management I... | Forrester

Why (and how) threat actors target your Active Directory (bleepingcomputer.com)

Encryption

WhatsApp encryption isn't the problem, metadata is | TechRadar

Using entangled particles to create unbreakable encryption (phys.org)

Linux and Open Source

CISA warns of actively exploited Linux privilege elevation flaw (bleepingcomputer.com)

Passwords, Credential Stuffing & Brute Force Attacks

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)

Understanding Credential Phishing - Security Boulevard

Should Employee Password Management Be Mandatory? (forbes.com)

361 million account credentials leaked on Telegram: Are yours among them? - Help Net Security

Account Takeovers Outpace Ransomware as Top Security Concern - Infosecurity Magazine (infosecurity-magazine.com)

Prevent Account Takeover with Better Password Security (thehackernews.com)

Security keys unlock nothing but inconvenience (techmonitor.ai)

Social Media

Microsoft India’s X account hijacked in Roaring Kitty crypto scam (bleepingcomputer.com)

TikTok fixes zero-day bug used to hijack high-profile accounts (bleepingcomputer.com)

Donald Trump Joins TikTok, App He Tried to Ban as President (variety.com)

Malvertising

Google Chrome’s plan to limit ad blocking extensions kicks off next week | Ars Technica

Training, Education and Awareness

26% of organisations lack any form of IT security training - Help Net Security

Urgent training gap exposed as a quarter of organisations unprepared for cyber attacks, Hornetsecurity survey reveals (prnewswire.com)

Is your workplace ‘cyber savvy’? (siliconrepublic.com)

How to Change Security Behaviours Beyond Awareness Training - Infosecurity Magazine (infosecurity-magazine.com)

4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)

The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)

Regulations, Fines and Legislation

CISOs are facing a ‘tsunami of regulations’ — here’s why it’s crucial they focus on quantifying cyber risk | ITPro

104 EU Laws Have Different Definitions of Cyber Security - Infosecurity Magazine (infosecurity-magazine.com)

Here’s what a US surveillance law means for European data privacy | Euronews

80 percent of organisations not ready for CISA rules on security practices (betanews.com)

Data Protection

Here’s what a US surveillance law means for European data privacy | Euronews

Careers, Working in Cyber and Information Security

Narrowing the Stubborn Cyber Security Worker Gap - Security Boulevard

What is a typical day like as an SOC analyst? (siliconrepublic.com)

Law Enforcement Action and Take Downs

Major Cyber Crime Networks Dismantled in US and Europe: A Wake-Up Call for Businesses | News | GRC World Forums

Europol identifies 8 cyber criminals tied to malware loader botnets (bleepingcomputer.com)

Two 39-year-old Estonian men are the alleged kingpins behind a massive half billion fraud targeting thousands of US investors | Fortune

Authorities Ramp Up Efforts to Capture the Mastermind Behind Emotet (thehackernews.com)

4 cuffed following probe into holiday scheme for cyber crooks • The Register

Police dismantle pirated TV streaming network that made $5.7 million (bleepingcomputer.com)

Misinformation, Disinformation and Propaganda

Poland Suspects Russia Behind False PAP Story on Mobilization (bloomberglaw.com)

Information Warfare: The Future Is Here | Proceedings - June 2024 Vol. 150/6/1,456 (usni.org)

Microsoft Security is warning of Russian misinformation campaigns during the 2024 Olympics - Neowin

Fake Tom Cruise warns of violence at Paris Olympics in pro-Russian info op | CyberScoop


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Resilience isn't enough, NATO must be 'proactive' for cyber defence, warns official (therecord.media)

Information Warfare: The Future Is Here | Proceedings - June 2024 Vol. 150/6/1,456 (usni.org)

Conflicts Drive DDoS Attacks Surge in EMEA - Infosecurity Magazine (infosecurity-magazine.com)

Cyber Attacks and the Risk of Real War: A NATO Perspective - Defence News | The Financial Express

Nation State Actors

China

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

China outsourcing its cyber attacks to hackers-for-hire - Asia Times

Donald Trump Joins TikTok, App He Tried to Ban as President (variety.com)

Russia

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)

Europe subjected to multi-phase APT28 cyberespionage attacks | SC Media (scmagazine.com)

Poland Suspects Russia Behind False PAP Story on Mobilization (bloomberglaw.com)

FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)

European IT Coalition raises 58 million euros for Ukraine's IT, cyber security defence capabilities (kyivindependent.com)

Poland to spend almost $760 million to improve digital security following suspected Russian cyber attack (kyivindependent.com)

Ukrainian Systems Hit by Cobalt Strike Via a Malicious Excel File (darkreading.com)

Pro-Russia group claims responsibility for cyber attacks on first day of EU elections | Euronews

Poland sees ‘Russian cyber attack’ behind fake military draft report – Euractiv

Russia jams Elon Musk’s Starlink sats in Ukraine for the first time (interestingengineering.com)

Microsoft Security is warning of Russian misinformation campaigns during the 2024 Olympics - Neowin

Fake Tom Cruise warns of violence at Paris Olympics in pro-Russian info op | CyberScoop

Olympics 2024: Cyber Attackers are Targeting Companies Associated With Paris Games (techrepublic.com)

Poland launches investigation into Russian, Belarusian political influence (voanews.com)

Polish government will spend more than $ 3 billion on cyber security - BiznesAlert EN

Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan (thehackernews.com)

Russian hackers claim cyber attack on Spanish defence company | Reuters

Iran

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

North Korea

A US Company Enabled a North Korean Scam That Raised Money for WMDs | WIRED

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)


Tools and Controls

26% of organisations lack any form of IT security training - Help Net Security

CISOs are facing a ‘tsunami of regulations’ — here’s why it’s crucial they focus on quantifying cyber risk | ITPro

How to Prove Security Effectiveness with a Cyber Security Board Report  - Security Boulevard

Mastering Cyber Risk Quantification Methods: A Strategic Approach - Security Boulevard

Should Employee Password Management Be Mandatory? (forbes.com)

Security challenges mount as companies handle thousands of APIs - Help Net Security

Comms Business - Malware targeting endpoints on the rise, finds report

Why Hackers Love Logs - Security Week

Security experts call for unity again... - Mobile World Live

The Top Trends Shaping Identity And Access Management I... | Forrester

Lawyers Ask Forensics Investigators for Help Outside Cyber Security (darkreading.com)

Why (and how) threat actors target your Active Directory (bleepingcomputer.com)

30% of Organisations with Cyber Insurance Implemented Additional Security Measures to Be Eligible for the Policy, up from 22% in 2023 (prnewswire.com)

How to Change Security Behaviours Beyond Awareness Training - Infosecurity Magazine (infosecurity-magazine.com)

4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)

The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)

Deciding cyber security spend: how much is enough? | Propertymark

Effective Incident Response: A Cyber Security Playbook for Executives - Security Boulevard

4 communication mistakes to avoid during a data breach - PR Daily

More Than One-Third of Healthcare Organisations Lack Cyber Security Response Plan | HealthLeaders Media





Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 31 May 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Santander Staff and '30 million' Customers Hacked via Cloud Provider Breach

Hackers known as ShinyHunters claim to have stolen confidential data from Santander, affecting all staff globally and millions of customers in Chile, Spain, and Uruguay. The breach includes 30 million bank account details, 6 million account numbers and balances, and 28 million credit card numbers. Santander confirmed the theft but assured no transactional data or online banking credentials were compromised. The attack is linked to an ongoing hack of cloud storage company Snowflake, accessed through a former employee's demo account. Santander is proactively contacting affected individuals and continues to ensure secure transactions. ShinyHunters have this week also claimed responsibility for the massive Ticketmaster breach below.

Source: [BBC]

ABN Amro Disclose Data Breach Following an Attack on a Third-Party Provider

A recent disclosure by Dutch bank ABN Amro revealed a data breach due to a ransomware attack on their third-party service provider, AddComm. This attack potentially exposed data of some ABN Amro clients, prompting the bank to notify affected clients and the Dutch Data Protection Authority. AddComm has since contained the incident, restored affected systems, and is investigating the breach with external security experts. While there are no signs of misuse of client data, ABN Amro has ceased using AddComm's services and warned clients to remain vigilant against phishing attempts.

Source: [SecurityAffairs]

Ticketmaster Confirms Massive Breach of 560m Users After Stolen Data Offered for Sale Online

Live Nation has confirmed a data breach at Ticketmaster, attributed to unauthorised activity within a third-party cloud database, believed to be Snowflake. The breach, identified on May 20, 2024, exposed data of over 560 million users, including personal details and ticket information. A threat actor known as ShinyHunters, the same threat actor claiming responsibility for the Santander attack above, has been attempting to sell this data on the dark web for $500,000. Despite the severity, Live Nation stated the breach is not expected to materially impact business operations or financial condition. The company is working with law enforcement and notifying affected users and regulatory authorities

Source: [BleepingComputer]

Material Cyber Attacks a Concern Among Many CISOs, with Human Error Still Perceived as the Achilles’ Heel of Cyber Security

A recent survey from Proofpoint reveals that 70% of CISOs feel at risk of a significant cyber attack within the next 12 months, up from 68% last year and 48% in 2022. Despite this, only around half feel prepared for such an attack. Human error remains a key vulnerability, with 74% identifying it as the most significant risk. Notably, 87% of CISOs are deploying AI-powered solutions to mitigate these risks. The top concerns include ransomware (41%), malware (38%), and email fraud (36%), with a notable increase in ransomware threats.

Sources: [HelpNetSecurity] [SCMagazine]

Old But Gold: Why Shoulder Surfing is an Underacknowledged Cyber Threat

A recent incident in the UK has highlighted the persistent threat of shoulder surfing, a social engineering tactic where sensitive information is obtained by observing someone's device screen. On 22 May 2024, The Times reported that information from a private memo by British Cabinet Minister Johnny Mercer was leaked after a fellow train passenger photographed Mercer's laptop screen. The memo contained accusations against Downing Street officials and advisors, illustrating the ease with which malicious actors can access confidential information through simple observation. This event underscores the need for heightened awareness and protective measures to combat shoulder surfing, including being mindful of your surroundings and using privacy screen filters.

Source: [ITPro]

Hackers Phish Finance Orgs Using Trojanised Minesweeper Clone

A recent cyber security alert highlights that hackers are leveraging code from a clone of Microsoft's Minesweeper game to conceal malicious scripts in attacks targeting financial institutions in Europe and the US. The threat actor, identified as 'UAC-0188,' uses this legitimate code to hide Python scripts that install remote management software on compromised systems. At least five breaches have been identified across financial and insurance sectors. The attack initiates with an email from "support@patient-docs-mail.com," prompting recipients to download a malicious file from Dropbox, which includes both innocuous and malicious code to evade security detection.

Source: [BleepingComputer]

Deepfake Scams Have Robbed Companies of Millions. Experts Warn It Could Get Worse

A recent surge in deepfake scams has resulted in millions of dollars in losses for companies globally, with experts predicting an increase in such frauds as criminals leverage generative AI. In one major incident, a Hong Kong finance worker was deceived into transferring over $25 million to fraudsters using deepfake technology to impersonate senior executives on a video call. UK engineering firm Arup confirmed involvement in this case, though details remain under investigation. The accessibility of AI tools like OpenAI’s Chat GPT has lowered the entry barrier for cyber criminals, enhancing both the volume and sophistication of these types of scams.

Source: [CNBC]

Ransomware in the Finance Sector: Emerging threats

A recent analysis highlights ransomware as a critical threat, particularly to the financial services sector due to its integral role in the global economy and sensitive data handling. Cyber criminals have enhanced their tactics, including pre-emptive data exfiltration, to coerce victims into paying ransoms. Phishing emails remain the primary delivery method, exploiting user unawareness to execute these attacks. These emails allow attackers to reach numerous targets cost-effectively, increasing the likelihood of successful breaches. This evolution in ransomware strategies underscores the need for heightened cyber security measures across all sectors.

Source: [Verdict]

Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware

A coordinated law enforcement effort codenamed Operation Endgame led by Europol has dismantled the infrastructure of several malware loader operations, including IcedID, SystemBC, PikaBot, SmokeLoader, Bumblebee, and TrickBot. The operation, conducted between May 27 and May 29, resulted in the takedown of over 100 servers worldwide and the arrest of four individuals in Armenia and Ukraine. Europol's actions targeted high-value criminal infrastructure, resulting in the seizure of more than 2,000 domains and the disruption of services used to facilitate ransomware and other malicious attacks. One suspect allegedly profited €69 million ($74.6 million) from renting out these criminal services.

Source: [TheHackerNews]

Hacktivist Attacks on Europe Have Doubled Since 2023, Top EU Cyber Security Official says: ‘This is Part of the Russian War of Aggression’

A recent surge in disruptive digital attacks, largely attributed to Russia-backed groups, has doubled within the European Union, targeting critical infrastructure and election-related services. Juhan Lepassaar, head of the European Union Agency for Cybersecurity (ENISA), reported a significant increase in hacktivist attacks since Russia's invasion of Ukraine, with methods often tested in Ukraine before extending to the EU. Upcoming elections in the EU and other countries have heightened security concerns. ENISA has been working to bolster the resilience of election agencies and noted a rise in ransomware targeting public institutions. The agency also warned of the growing threat of AI-enabled disinformation campaigns.

Source: [Fortune]

North Korean 'Moonstone Sleet' Threat Group Melds Espionage, Financial Goals - Microsoft

A recent report by Microsoft has uncovered the North Korean threat group "Moonstone Sleet," which engages in both espionage and financial cyber attacks. Initially overlapping with the DPRK's Diamond Sleet, Moonstone Sleet has since developed its own unique tactics, using techniques like fake job offers, custom ransomware, and trojanised software delivered via social media. The group has targeted aerospace, education, and software organisations by masquerading as legitimate companies such as "StarGlow Ventures" and "C.C. Waterfall." Their methods, including using trusted platforms like LinkedIn and Telegram, complicate defensive measures and exploit the inherent trust in these platforms.

Source: [DarkReading]

Europe on High Alert after Suspected Moscow-linked Arson and Sabotage

A recent spate of arson and sabotage attacks across Europe, potentially linked to Russian operatives, has heightened security concerns. Incidents include a fire at an Ikea in Lithuania, an arson attack in east London, antisemitic graffiti in Paris, and in Germany suspicions of foreign intelligence-driven attacks in addition to a wave of cyber-attacks in 2023 by a hacker group linked to Russian intelligence. Security services suspect these acts aim to destabilise the West amidst its support for Ukraine. Polish authorities have arrested nine individuals for alleged sabotage under Russian orders, while Estonia and Germany report similar threats. This issue, discussed at a Brussels summit, highlights the need for increased vigilance against hybrid attacks orchestrated by foreign entities.

Source: [TheGuardian]

Making the Case for 'Reasonable' Cyber Security

A recent white paper from the Center for Internet Security (CIS) discusses the concept of "reasonable cyber security" and its alignment with privacy laws. This standard, highlighted at the RSA Conference, is context-dependent and varies by industry. For instance, while the Payment Card Industry Data Security Standard (PCI DSS) prescribes specific controls, the GDPR emphasises transparency and good faith efforts. The importance of quantifying cyber risk was underscored by the US Federal Reserve emphasising improved data on cyber threats for better risk assessment. Implementing security frameworks like the NIST Cybersecurity Framework can help meet these evolving regulatory and insurance requirements

Source: [DarkReading]

Hundreds of Thousands of Internet Routers Destroyed in Attack on Telco

A significant cyber attack last October targeted a US telecoms company, disabling over 600,000 internet routers across multiple states, according to Lumen Technologies' Black Lotus Labs. The attack, undisclosed until recently, involved malicious firmware updates that rendered the routers inoperable. Researchers did not identify the hackers or the affected company. The malware, still circulating online, disrupted internet access from October 25 to 27. This attack is considered one of the most severe against the US telecommunications sector and illustrates the vulnerability of telecoms provided routers to these types of attacks.

Source: [YahooFinance]


Governance, Risk and Compliance


Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

BEC

Other Social Engineering

Artificial Intelligence

Malware

Mobile

Denial of Service/DoS/DDOS

Internet of Things – IoT

Data Breaches/Leaks

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

Insurance

Supply Chain and Third Parties

Cloud/SaaS

Identity and Access Management

Encryption

Passwords, Credential Stuffing & Brute Force Attacks

Malvertising

Training, Education and Awareness

Regulations, Fines and Legislation

Models, Frameworks and Standards

Data Protection

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Nation State Actors

China

Russia

North Korea

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence


Vulnerability Management

Vulnerabilities


Tools and Controls




Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3


As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 24 May 2024

Black Arrow Cyber Threat Intelligence Briefing 24 May 2024:

-Human Error and AI Tops Cyber Threats as 70% of CISOs Worry About Risk

-Threat Research Highlights Growing Mobile Security Risks

-The State of Cyber Security: AI and Geopolitics Mean a Bigger Threat Than Ever

-Family Offices Become Prime Targets for Cyber Hacks and Ransomware

-Ransomware Fallout - 94% Experience Downtime, 40% Face Work Stoppage

-Employee Discontent - Insider Threat No. 1

-Report Reveals 341% Rise in Advanced Phishing Attacks

-Ransomware and GenAI Raise Security Challenges, Driving Cyber Investment

-New Rules Prompt 93% of Organisations to Rethink Cyber Security Plans

-HR and IT Related Phishing Scams Still Most Popular According to KnowBe4’s Latest Phishing Report

-80% of Exposures from Misconfigurations, as 15 Vendors Account for 62% of Global Attack Surface

-UK to Propose Mandatory Reporting for Ransomware Attacks and Licensing Regime for all Payments

-UK’s Legal Sector Needs to Improve its Cyber Security, Says Experts

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Human Error and AI Tops Cyber Threats as 70% of CISOs Worry About Risk

According to a survey of 1,600 CISOs, 70% worry about the risk of a material cyber attack over the next 12 months. Additionally, nearly 31% believe an attack is very likely, compared to 25% in 2023.  Amongst the largest concerns were human error, with 75% of CISOs identifying it as their most significant cyber vulnerability, up from 60% in 2023. Furthermore, 80% anticipate that human risk and employee negligence in particular will be major cyber security issues in the next two years.  Additionally, artificial intelligence was identified as an emerging concern for 54% of CISOs.

Sources: [The Register] [Infosecurity Magazine] [Cryptopolitan]

The State of Cyber Security: AI and Geopolitics Mean a Bigger Threat Than Ever

A recent report by Check Point reveals that global organisations faced an average of 1,158 weekly cyber attacks in 2023, an increase from 2022. In the UK, 50% of businesses experienced cyber attacks in the past year, with medium and large-sized businesses more affected at 70% and 74%, respectively. A ClubCISO survey found 62% of CISOs believe organisations are ill-equipped for AI-driven attacks, yet 77% haven't increased cyber security spending.

Additionally, a British Foreign Policy Group (BFPG) article highlights cyber threats from geopolitical tensions, with a recent attack on the Ministry of Defence exposing HR and payroll data. The National Cyber Security Centre attributes such attacks to state-affiliated actors like China and Russia. Despite efforts to establish international cyber norms, enforcement remains challenging. Businesses must recognise that cyber security is now deeply intertwined with geopolitics, affecting strategic partnerships and procurement.

Sources: [Verdict] [BFPG]

Threat Research Highlights Growing Mobile Security Risks

A recent report by a cloud security vendor focusing on the mobile threat landscape found that in the first quarter of 2024, the number of phishing, malicious, denylisted and offensive links delivered to their customers’ mobile devices tripled compared to Q1 2023. The report, which bases its data on 220 million devices, 325 million apps and billions of web items, found that the most common misconfiguration in mobiles was out of date operating systems (37%). When it came to the prevalence of attacks, 75% of organisations reported experiencing mobile phishing attempts targeting their employees.

This comes as a representative from the US Cybersecurity and Infrastructure Security Agency told the Federal Communications Commission earlier this year that there had been “numerous incidents of successful, unauthorised attempts” to steal location data, monitor voice and text messages, and deliver spyware.

Sources: [Economist] [Business Wire]

Family Offices Become Prime Targets for Cyber Hacks and Ransomware

A recent Dentons survey reveals that nearly 80% of family offices perceive a dramatic increase in cyber attack threats, with a quarter experiencing an attack in 2023, up from 17% in 2020. Despite their wealth, family offices often lack the staff and technology to manage these risks effectively. Less than a third report well-developed cyber risk management processes, and only 29% believe their cyber training programs are sufficient. This gap between awareness and action highlights the need for family offices to prioritise comprehensive cyber security measures, including better training, updated policies, and secure communication practices.

Source: [CNBC]

Ransomware Fallout: 94% Experience Downtime, 40% Face Work Stoppage

According to a report by cyber security provider Arctic Wolf, within the last 12 months 48% of organisations identified evidence of a successful breach within their environment and 70% of organisations were the targets of attempted Business Email Compromise (BEC) attacks, with 29% of these targets becoming victims of one or more successful BEC occurrences.

In its survey, the company says “45% of the organizations we spoke with admitted to being the victim of a ransomware attack within the last 12 months”,  an increase from the prior year. Of those impacted by ransomware, 86% of attacks including successful data exfiltration and 94% of those impacted by a ransom event experienced a significant downtime and delays. 40% of victims stated they experienced a period of total work stoppage due to ransomware.

Source: [Help Net Security]

Employee Discontent: Insider Threat No. 1

Chief Information Security Officers (CISOs) must integrate human factors into insider risk management (IRM), not just rely on detection technologies. IRM must consider factors such as those raised by recent research where only half of US workers are very satisfied with their jobs, and 28% feel their employers don't care about them. CISOs themselves are affected by job satisfaction; the 2024 IANS/Artico report shows three out of four CISOs are ready to leave their roles. DTEX Systems found 77% of malicious insiders concealed their activities, emphasising the importance of human engagement and feedback in mitigating risks.

Source: [CSO]

Report Reveals 341% Rise in Advanced Phishing Attacks

A recent report has revealed malicious emails increased by 341% over the past 6 months. This included a 217% increase in credential harvesting phishing attacks and a 29% increase in Business Email Compromise (BEC) attacks. The report highlighted the impact of artificial intelligence, noting that since the launch of ChatGPT in November 2022, there has been a 4,151% surge in malicious phishing messages.

Source: [Security Magazine] [ Infosecurity Magazine]

Ransomware and GenAI Raise Security Challenges, Driving Cyber Investment

A recent study by Infosecurity Europe reveals that nearly 40% of cyber security leaders are increasing investments to combat the growing threats of ransomware and AI-generated attacks. A separate survey found 94% of organisations have or plan to implement generative AI use policies, and a third strictly forbid AI tech in their environment. This data highlights the ongoing effort to balance AI benefits with security risks, indicating that there isn’t a one-size-fits-all strategy for formalising AI adoption and usage policies.

Source: [Security Boulevard] [Infosecurity Magazine]

New Rules Prompt 93% of Organisations to Rethink Cyber Security Plans

A recent report reveals that 93% of organisations have re-evaluated their cyber security strategies due to new regulations, with 58% reconsidering their entire approach. The survey, which included 500 cyber security decision-makers from the US and UK, found that 92% reported increased security budgets, with 36% seeing rises of 20-49% and 23% experiencing over 50% increases. Despite this, only 40% feel confident in their resources to comply with regulations, and just one-third believe they can meet all requirements, highlighting significant gaps in preparedness.

Source: [security magazine]

HR and IT Related Phishing Scams Still Most Popular According to KnowBe4’s Latest Phishing Report

A recent KnowBe4 report reveals that HR-related phishing emails account for 42% of top-clicked phishing attempts, followed by IT-related emails at 30%. These phishing tactics exploit employees' trust and evoke immediate responses by mimicking legitimate business communications about dress code changes, tax updates, and training notifications. The report also highlights that nearly a third of users are vulnerable to phishing, emphasising the need for robust security awareness training. A well-trained workforce is essential in defending against increasingly sophisticated phishing attacks that leverage AI and emotional manipulation.

Source: [IT Security Guru]

80% of Exposures from Misconfigurations, as 15 Vendors Account for 62% of Global Attack Surface

A recent XM Cyber report highlights a significant gap in cyber security focus with identity and credential misconfigurations accounting for 80% of security exposures. The study, based on hundreds of thousands of attack path assessments, found that 62% of the global attack surface is concentrated in just 15 vendors. Furthermore, 41% of organisations had at least one compromised device, and 11% experienced ransomware incidents. The report underscores the need for a shift from patching all vulnerabilities to addressing high-impact exposures, especially those around identity management and critical asset protection.

Sources: [Security Magazine] [The Hacker News]

UK to Propose Mandatory Reporting for Ransomware Attacks and Licensing Regime for all Payments

A forthcoming proposal in Britain aims to overhaul the response to ransomware by mandating victims to report incidents and obtain a license before making extortion payments. This initiative, part of a public consultation, includes a ban on ransom payments for critical national infrastructure to deter attacks. The National Cyber Security Centre has highlighted concerns over underreporting, with a 2023 increase in ransomware-related data breaches. The plan’s success hinges on replacing the delayed Action Fraud reporting platform. This proposal marks a significant step in global ransomware policy, with Britain leading international efforts against cyber criminals.

Source: [The Record Media]

UK’s Legal Sector Needs to Improve its Cyber Security, Says Experts

One in ten UK data breaches in 2023 occurred in the legal sector, highlighting that UK law firms are attractive targets for cyber criminals. A recent analysis of the UK’s Information Commissioner's Office (ICO) data found that the legal sector is one of the worst performing sectors for data breaches, with nearly 86 per cent of the incidents within the legal sector involving breaches of personal identifiable information, including instances also affecting sensitive economic and financial data.

Sources [CITY AM]


Governance, Risk and Compliance


Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

BEC

Other Social Engineering

Artificial Intelligence

2FA/MFA

Malware

Mobile

Internet of Things – IoT

Data Breaches/Leaks

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

Insurance

Supply Chain and Third Parties

Cloud/SaaS

Identity and Access Management

Encryption

Linux and Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Malvertising

Training, Education and Awareness

Regulations, Fines and Legislation

Backup and Recovery

Data Protection

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Nation State Actors

China

Russia

Iran

North Korea

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence


Vulnerability Management

Vulnerabilities

Tools and Controls




Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3


As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Alert 20 May 2024 – Flaw in Popular PDF Reader Foxit Exploited by Hackers to Deliver Variety of Malware

Black Arrow Cyber Alert 20 May 2024 – Flaw in Popular PDF Reader Foxit Exploited by Hackers to Deliver Variety of Malware

Executive summary

An active campaign has been identified in which a flaw in Foxit, a popular PDF reader, is being exploited by attackers to deploy a variety of malware. Check Point, who have identified the campaign have said that it has been used by multiple threat actors in campaigns ranging “from e-crime to espionage”. The campaign takes advantage of a flaw in which the PDF reader is set to accept a document as trusted by default.  Once a user clicks OK on this, a second display pops up which has the default option of allowing the PDF to open additional programs and execute commands.

What’s the risk to me or my business?

There is a risk that organisations using Foxit PDF reader are vulnerable to this exploitation, which has a low detection rate. Additionally, this risk extends to employees who have access to corporate data on their personal device and are using Foxit. In both cases, the confidentiality, integrity and availability of information is at risk.

Reports indicate that the malicious PDF’s are being distributed in traditional manners including email, as well as social media such as Facebook, capitalising on the low-level of detection of this exploit.

What can I do?

Black Arrow recommends organisations evaluate the most suitable risk treatment approach for their environment. This may involve exploring alternative software solutions or uninstalling the affected software altogether. Additionally, disabling non-essential features, such as command prompt and PowerShell execution, for standard users is recommended. Cyber awareness training should also emphasise the importance of not opening unexpected files or granting permissions via pop-up windows to mitigate risks.

#threatadvisory #threatintelligence #cybersecurity

Further information from Check Point can be found here:

https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 17 May 2024

Black Arrow Cyber Threat Intelligence Briefing 17 May 2024:

-Social Engineering is the Biggest Cyber Threat as Study Finds Most Workers Have Clicked on a Suspicious Email Link

-Business Leaders are Stressing Out Over Pace of Technological Change, as Cyber Security Incidents Seen as Main Business Disruptor

-ICO Warns That Many UK Businesses Neglect Basic Cyber Security: More Ransomware and Cyber Attacks Last Year Than Ever Before

-Data Breaches are Getting Worse, Many are Employee Errors or Social Engineering Attacks

-Why Cyber Insurance isn’t a Substitute for Cyber Risk Management

-China Presents Defining Challenge to Global Cyber Security, Says GCHQ

-Botnet Sent Millions of Emails in LockBit Black Ransomware Campaign

-Global Financial Stability at Risk Due to Cyber Threats, IMF warns

-Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls

-Santander Data Breach via Third-Party Provider Impacted Customers and Employees

-40% of Cyber Teams Have Held Back from Reporting Cyber Attacks Over Fear of Losing Jobs

-Digital Resilience – a Step Up from Cyber Security

-UK Lags Europe on Exploited Vulnerability Remediation

-Cyber Threats Demand More Focus Says Zurich, as UK Insurance And NCSC Join Forces to Fight Ransomware Payments

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Social Engineering is the Biggest Cyber Threat, as Study Finds Most Workers Have Clicked on a Suspicious Email Link

According to a recent report, half of office workers have clicked on a link or attachment within a suspicious email sent to their work address within the last 12 months, and of those that interacted with the email, half of them claimed to be confident in their ability to identify phishing emails.

With 68% of breaches involving the human element, your organisation must be cognisant of its employees. Hackers know that no matter what your tech stack is, you will always have employees and where there is an employee, there is a way into your organisation. It is far cheaper to exploit an employee who already has the access you require, than to develop a new exploit. It only takes one human to make a mistake by granting access to an attacker.  

When it came to training, only 41% of respondents said their employer had provided formal cyber security awareness training and 79% said their previous training is not sufficient to keep pace with modern cyber threats.

Source: [HackerNoon] [BusinessPlus]

Business Leaders are Stressing Out Over Pace of Technological Change, as Cyber Security Incidents Seen as Main Business Disruptor

A recent report commissioned by BT reveals that 86% of UK business leaders suffer from 'tech-related stress,' particularly concerning AI and cyber security, a phenomenon they have termed as 'Bytmares.' The report found that 59% of business leaders worry about the rapid and relentless pace of tech advancement, and whether appropriate controls are in place to protect it.

According to a different survey, 74% of business leaders view cyber security incidents as the main disruptive threat to their organisations either currently or over the next twelve months. This was followed by cloud computing, internet of things and artificial intelligence.

These findings highlight the critical importance of robust cyber security measures in today’s interconnected world. As organisations increasingly rely on digital infrastructure, safeguarding sensitive data and systems becomes paramount. Cyber threats can disrupt operations, compromise customer trust, and result in financial losses. Remember, cyber security is not just an IT concern; it is a strategic imperative for every organisation.

Sources: [Beta News] [Telecoms] [Verdict]

ICO Warns That Many UK Businesses Neglect Basic Cyber Security: More Ransomware and Cyber Attacks Last Year Than Ever Before

A recent update from the UK’s Information Commissioner’s Office (ICO) has revealed that ransomware attacks in the UK have surpassed all previous years, up 52% from the previous year. The report found that finance, retail and education sectors are suffering the most incidents.

The leading causes of breaches include phishing, brute force attacks, errors and supply chain attacks. The ICO noted that many organisations still neglect basic cyber security measures and has called for enhanced efforts to combat the escalating threat, emphasising the importance of foundational controls.

Sources: [Tech Monitor] [Government Business] [The Record Media] [Tech Monitor]

Data Breaches are Getting Worse, Many are Employee Errors or Social Engineering Attacks

The latest Verizon Business Data Breach Investigations Report (DBIR) highlights that employee error is the leading cause of cyber security incidents in the EMEA region, accounting for 49% of cases. The top reasons for these incidents are “miscellaneous errors, system intrusion, and social engineering,” making up 87% of all breaches. Hackers primarily target personal information (64%), internal data (33%), and login credentials (20%). Despite zero-day vulnerabilities being a significant threat, with exploitation rising to 14% of breaches, the report emphasises the critical need for ongoing employee training and awareness to mitigate these risks.

Source: [TechRadar]

Why Cyber Insurance isn’t a Substitute for Cyber Risk Management

While cyber insurance can be beneficial in mitigating financial loss from cyber attacks, it is not a substitute for comprehensive cyber risk management. Many firms with cyber insurance have still fallen victim to attacks, highlighting that cyber insurance primarily transfers residual risk. Effective cyber risk management includes conducting proper risk assessments and implementing robust cyber security controls. Cyber insurance cannot resolve issues like business disruption, breach of client confidentiality, and compliance with legal obligations; this stresses the need for proactive measures and independent assurance to protect against cyber threats.

Source: [ Law Society of Scotland]

China Presents Defining Challenge to Global Cyber Security, Says GCHQ

A recent speech by the new director of the UK’s GCHQ highlighted China's growing cyber threat, describing it as an "epoch-defining challenge." She warned that China's destabilising actions undermine global internet security. The current head of the UKs’ NCSC echoed these concerns, pointing to the Chinese state-sponsored hacking group Volt Typhoon which has infiltrated critical sectors like energy and transportation. The National Cyber Director at the White House added that China’s cyber capabilities pose a significant threat to global infrastructure, particularly in crisis scenarios, as Chinese hackers increasingly use sophisticated techniques to pre-position within networks.

Source: [Infosecurity Magazine]

Botnet Sent Millions of Emails in LockBit Black Ransomware Campaign

Since April, millions of phishing emails have been sent through a botnet known as “Phorpiex” to conduct a large-scale LockBit Black ransomware campaign. In a warning from New Jersey’s Cybersecurity and Communications Integration Cell, it was explained that the attackers use ZIP attachments containing an executable that deploys the LockBit Black payload, which encrypts the recipients' systems if launched. The emails are sent from 1,500 unique IP addresses worldwide.

Sources: [Bleeping Computer]

Global Financial Stability at Risk Due to Cyber Threats, IMF warns

A new International Monetary Fund (IMF) report highlights the severe threat cyber attacks pose to global financial stability, revealing that nearly 20% of reported cyber incidents in the past two decades targeted the financial sector, causing $12 billion in direct losses. Since 2020, these attacks have led to an estimated $2.5 billion in direct losses. The report underscores that cyber incidents threaten financial institutions' operational resilience, potentially leading to funding challenges and reputational damage. The IMF calls for bolstered cyber security measures, including stress testing, information-sharing arrangements, and enhanced national cyber security strategies to mitigate these growing risks.

Source: [World Economic Forum]

Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls

An ongoing social engineering campaign that is bombarding enterprises with spam calls and emails has been uncovered. The campaign involves a threat actor overwhelming a user’s email with junk, followed by a call offering to assist in removing the junk. From here, the threat actor aims to convince the victim to download remote monitoring and management software such as AnyDesk or Microsoft’s built in Quick Assist feature to allow the attacker remote access to the victim’s machine.

Source: [The Hacker News]

Santander Data Breach via Third-Party Provider Impacted Customers and Employees

A recent disclosure by the Spanish bank Santander revealed a data breach at a third-party provider affecting customers in Chile, Spain, and Uruguay. Unauthorised access to a database hosted by the provider compromised information on all current and some former employees, but did not include transactional data, online banking details, or passwords. Santander said they swiftly implemented measures to contain the incident, blocking access to the compromised database and enhancing fraud prevention controls. The bank assured that its operations and systems remain unaffected, allowing customers to continue transacting securely. The number of impacted individuals remains unspecified.

There is a continued trend in third party providers being used as the soft underbelly to attack larger and better defended organisations, requiring all organisations to consider the security controls of their third parties.

Source: [securityaffairs.com]

40% of Cyber Teams Have Held Back from Reporting Cyber Attacks Over Fear of Losing Jobs

Recent research has revealed that 40% of cyber teams have not reported a cyber attack due to the fear of losing their job. Unfortunately, this leaves businesses at risk of being non-compliant, without even knowing so. When it came to challenges faced by organisations, it was found that nearly 20% of companies say a lack of qualified talent is a key challenge to overcoming cyber attacks and 32% did not have the resources to hire new staff. This is not to say however, they are unable to outsource some of their cyber function to cyber specialists. This lack of allocated resources prevents the organisation from being confident that any incidents have been appropriately remediated.

Source: [Business Wire]

Digital Resilience – a Step Up from Cyber Security

In an increasingly digital world, many organisations are unaware of how truly reliant they are on digital technology, and the accompanying risks. As we move toward an even more digitally dependent future, the need for digital resilience is more critical than ever. Digital resilience refers to the ability to maintain, change, or recover technology-dependent operations. Organisations should begin with an internal audit to assess their digital resilience, involving all departments and ensuring senior management oversight, as board involvement is essential for effective cyber security programmes.

Digital resilience goes beyond cyber security to encompass change management, business resilience, and operational risk. Implementing digital resilience strategies requires continuous adaptation, cross-functional collaboration, and embedding resilience thinking throughout the organisation. Businesses must integrate digital resilience into their strategic planning to ensure ongoing competitiveness and adaptability in an ever-evolving digital landscape.

Sources: [CSO Online] [CSO Online]

UK Lags Europe on Exploited Vulnerability Remediation

A new report by Bitsight reveals that UK organisations lag behind their European counterparts in remediating software flaws listed in the US ‘Known Exploited Vulnerability’ (KEV) catalogue. UK organisations take an average of 225 days to address KEVs, compared to 220 days for European entities and just 21 days for German organisations. Non-KEV vulnerabilities are patched at an even slower rate, with UK entities taking over two years (736 days) to patch. Globally, the average time to resolve KEVs is around six months (180 days). Despite fewer KEVs detected in UK environments (30% versus 43% in Europe), the slow remediation poses significant risks, emphasising the need for faster and more proactive cyber security measures, specifically robust vulnerability scanning and patching.

Source: [Infosecurity Magazine]

Cyber Threats Demand More Focus Says Zurich, as UK Insurance And NCSC Join Forces to Fight Ransomware Payments

A recent discussion at the British Insurance Brokers' Association (BIBA) conference highlighted the increasing importance of cyber security for businesses, driven by the surge in cyber attacks and the use of AI by criminal gangs. Zurich Resilience Solutions UK noted that businesses face greater scrutiny from underwriters over their cyber exposures.

BIBA, together with the Association of British Insurers (ABI), and the International Underwriting Association (IUA), have united with the UK’s National Cyber Security Centre (NCSC) in a joint effort to tackle ransom payments. As a result of their collaboration, they have published new best practice guidance, which aims to reduce the number of payments being made by UK victims as well as the disruption businesses face.

Source: [Emerging Risks] [NCSC] [Infosecurity Magazine]


Governance, Risk and Compliance


Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

BEC

Other Social Engineering

Artificial Intelligence

2FA/MFA

Malware

Mobile

Internet of Things – IoT

Data Breaches/Leaks

Organised Crime & Criminal Actors

Insider Risk and Insider Threats

Insurance

Supply Chain and Third Parties

Cloud/SaaS

Encryption

Linux and Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Training, Education and Awareness

Regulations, Fines and Legislation

Models, Frameworks and Standards

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Nation State Actors

China

Russia

Iran

North Korea


Vulnerability Management

Vulnerabilities





Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3


As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Advisory 15 May 2024 – Microsoft, Adobe, Apple, Mozilla Firefox, Google Chrome, SAP and VMware Updates

Black Arrow Cyber Advisory 15 May 2024 – Microsoft, Adobe, Apple, Mozilla Firefox, Google Chrome, SAP and VMware Updates

Executive summary

Microsoft’s May Patch Tuesday provides updates to address 61 security issues across its product range. Notably, the update tackles two actively exploited zero-day vulnerabilities. The zero-days include a security feature bypass and an elevation of privilege vulnerability. Among the updates provided by Microsoft were 1 critical vulnerability, allowing an attacker remote code execution.

In addition to the Microsoft updates this week also saw Adobe, Apple, Firefox, Google Chrome, SAP and VMware all provide updates for vulnerabilities in a variety of their products, including multiple zero-days and critical vulnerabilities.

What’s the risk to me or my business?

The actively exploited vulnerabilities could allow an unauthenticated attacker to gain code execution as well as elevating to system privileges, the highest available. Both of which compromise the confidentiality, integrity and availability of data stored by an organisation.

What can I do?

Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have an available patch should be updated as soon as possible.


Technical Summary

Microsoft

CVE-2024-30040 – A security feature bypass, in which an unauthenticated attacker can gain code execution through convincing a user to open a malicious document. It is now known how this flaw was abused in attacks.

CVE-2024-30051- A flaw in Windows DWM Core Library which upon exploitation, allows an attacker to elevate to system privileges, the highest available.

Apple

Apple have addressed multiple vulnerabilities in its products, including 16 vulnerabilities on iPhone and iPads. This includes include one vulnerability which the company say “may have been exploited”.

Adobe

Adobe have addressed 37 vulnerabilities in its products, including 9 critical vulnerabilities in Adobe Acrobat and Reader, ,  2 critical vulnerabilities in Adobe Commerce, Adobe InDesign, Adobe Experience manager, 1 critical vulnerability in Adobe Media Encoder and Adobe Bridge, 3 critical vulnerabilities in Adobe Illustrator and 2 critical vulnerabilities in Adobe Animate. The company said it was not aware of any exploits in the wild for any of the documented issues.

Firefox

Firefox has upgraded to version 126. The new version addresses 16 unique security issues. None of the vulnerabilities are currently under active exploitation. The release also comes with some quality-of-life changes such as search telemetry changes and copy link without site tracking.

Google Chrome

Google Chrome released an emergency update to fix their 6th zero-day exploited this year, just one week after a previous one. Google are aware that an exploit for the vulnerability exists in the wild. Users are recommended to update as soon as possible.

SAP

This month, SAP has released 17 patches, which include 14 new fixes and 3 updates from previous releases. Two patches and one update have been given the “hot news” priority in SAP, the highest severity. The vulnerabilities encompass a range of issues, including CSS Injection, Remote Code Execution, File Upload flaws, and Cross-Site Scripting (XSS).

VMWare

Multiple security flaws, including one critical vulnerability, have been addressed by VMware after their exploitation was demonstrated at a security event. Some of the vulnerabilities do not have a fix yet and as such, users are advised to disable Bluetooth support and 3D acceleration as temporary workarounds until patches are applied.


More info:

Microsoft

Further details on other specific updates within Microsoft’s May patch Tuesday can be found here:

https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2024-patch-tuesday-fixes-3-zero-days-61-flaws/

https://www.ghacks.net/2024/05/14/microsoft-releases-the-may-2024-security-updates-for-windows/

Apple

Further details of the vulnerabilities in Apple can be found here:

https://support.apple.com/en-gb/HT201222

Adobe

Further details of the vulnerabilities in Adobe Acrobat and Reader can be found here:

https://helpx.adobe.com/security/products/acrobat/apsb24-29.html

Further details of the vulnerabilities in Adobe Photoshop can be found here:

https://helpx.adobe.com/security/products/photoshop/apsb24-16.html

Further details of the vulnerabilities in Adobe Commerce can be found here:

https://helpx.adobe.com/uk/security/products/magento/apsb24-18.html

Further details of the vulnerabilities in Adobe InDesign can be found here:

https://helpx.adobe.com/uk/security/products/indesign/apsb24-20.html

Further details of the vulnerabilities in Adobe Experience Manager can be found here:

https://helpx.adobe.com/uk/security/products/experience-manager/apsb24-21.html

Further details of the vulnerabilities in Adobe Media Encoder can be found here:

https://helpx.adobe.com/uk/security/products/media-encoder/apsb24-23.html

Further details of the vulnerabilities in Adobe Bridge can be found here:

https://helpx.adobe.com/uk/security/products/bridge/apsb24-24.html

Further details of the vulnerabilities in Adobe Illustrator can be found here:

https://helpx.adobe.com/uk/security/products/illustrator/apsb24-25.html

Further details of the vulnerabilities in Adobe Animate can be found here:

https://helpx.adobe.com/uk/security/products/animate/apsb24-26.html

Firefox

Further details on the vulnerabilities addressed in the Firefox release can be found here:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/

Google Chrome

Further details on the vulnerabilities addressed in the Google Chrome update can be found here:

https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html

SAP

Further details on the vulnerabilities addressed in SAP can be found here:

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html

VMware

Further details on the vulnerabilities addressed by VMware can be found here:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 10 May 2024

Black Arrow Cyber Threat Intelligence Briefing 10 May 2024:

-China Suspected of Hacking MoD, Through Its Payroll Provider

-Security Tools Fail to Translate Risks for Executives

-Gang Accused of MGM Hack Shifts Attacks to Finance Sector

-Are SMEs Paving the Way for Cyber Attacks on Larger Companies?

-Misconfigurations Drive 80% of Security Exposure, Report Finds

-Only 45% of Organisations Employ MFA Protections

-You Cannot Protect What You Do Not Know You Have, as Criminals are Exploiting Vulnerabilities Faster Than Ever

-The Rise and Stealth of The Socially Engineered Insider

-Over 70% of Staff Use AI At Work, But Only 30% of European Organisations Provide AI Training

-Don't Be the Weakest Link – You and Your Team's Crucial Role in Cyber Security

-Ransomware Activity Thrives, Despite Law enforcement Efforts

-NATO Warns of Russian Hybrid Warfare

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

China Suspected of Hacking UK Ministry of Defence, Through Its Payroll Provider

UK Defence Secretary Grant Shapps has confirmed that over 270,000 personal details have been leaked after the MoD was hacked through its third-party payroll provider, SSCL. The affected systems have been pulled offline since the attack. SSCL’s website describes that it manages HR for the armed forces, the Metropolitan Police and other areas of British government. The commercial supply chain, and in particular HR and payroll providers, is increasing being used as the soft underbelly to attack larger and better protected organisations.

Sources: [LBC] [The Register] [Sky News]

Security Tools Fail to Translate Risks for Executives

Organisations are struggling with internal communication barriers, hindering their ability to address and mitigate cyber security threats, according to a report which found that seven out of 10 C-suite executives said their security teams talk in technical terms without providing business context. However, in contrast, 75% of CISO’s highlight the issue is rooted in security tools that cannot generate the insights C-level executives and boards can use to understand business implications. The role of a good CISO should be to take the output of these tools and turn that data into metrics the Boards can understand.

The issues highlight the necessity for organisations to have someone in their organisation, whether an employee or a third-party, who is able to ingest technical results and translate them into a style that the C-suite can understand for business risk management.

Source: [Help Net Security]

Gang Accused of MGM Hack Shifts Attacks to Finance Sector

The hacking group responsible for the infamous hack on MGM and Caesar’s Palace resorts is engaged in a new campaign targeting the financial sector. The group known as Scattered Spider has targeted 29 companies since 20 April this year, compromising at least 2 insurance companies so far. The research has stated that the attackers are purchasing lookalike domains that match the name of target companies, hosting fake log-in pages. Links to these are sent to employees, in an attempt to direct them there. The most recent attack took place just days ago, with more expected.

Sources: [Bloomberg Law] [Claims Journal]

Are SMEs Paving the Way for Cyber Attacks on Larger Companies?

A recent study highlights the escalating cyber threats facing businesses, particularly SMEs and supply chains. The study found that 32% of UK businesses, including 69% of large and 59% of mid-sized organisations, suffered a cyber attack last year. The situation is worse for SMEs, with weaker security systems and 77% lacking in-house cyber security. SMEs can become entry points for hackers targeting larger partners through interconnected supply chains. Meanwhile, Verizon’s latest data breaches report revealed a 68% increase in supply chain breaches, accounting for 15% of all breaches in 2023, up from 9% in 2022. These breaches are primarily driven by third-party software vulnerabilities exploited in ransomware and extortion attacks. Experts emphasise proactive cyber policies, vulnerability scans, and employee education for SMEs to bolster defences. They also urge organisations to consider third-party bugs as both vulnerability and vendor management problems, make better vendor choices, and use external signals like SEC disclosures in the United States to guide decisions. These measures can help prevent SMEs from becoming gateways for larger attacks and manage the rising threat of supply chain breaches.

Sources: [Insurance Times] [Dark Reading]

Misconfigurations Drive 80% of Security Exposure, Report Finds

A recent report has found that 80% of security exposures are caused by identity and credential misconfigurations, with a third of these putting critical assets at risk of a breach. According to the report, the majority of this is within an organisation’s network user management (Active Directory) and 56% of breaches that impact critical assets are within cloud platforms. There is often the misconception that cloud-based environments are secure by default, but misconfigurations can undo any security benefits and still leave you exposed. Just because someone else built and maintains your house, it is still your responsibility to lock the doors and windows.

Sources: [Security Magazine]

Only 45% of Organisations Employ MFA Protections

A recent report of IT decision-makers has found that 97% are facing challenges with identity verification and 52% are very concerned about credential compromise, followed by account takeover (50%). When it comes to reinforcing identity verification, only 45% used multi-factor authentication (MFA). By using MFA, organisations are forcing two identification verifications: simply knowing a username and password is not enough, especially given the speeds with which attackers can crack passwords, with average 8 character passwords able to be cracked in less than a minute. Whilst no control is 100% impenetrable, enabling MFA will aid in increasing your organisation's cyber resilience.

Source: [Help Net Security]

You Cannot Protect What You Do Not Know You Have, as Criminals are Exploiting Vulnerabilities Faster Than Ever

For many organisations, visibility of their information assets can be incredibly hard to obtain and maintain, with different tools, under-reporting and shadow IT contributing to the problem. Unfortunately, cyber criminals are getting faster at exploiting vulnerabilities, and if you do not know you have the vulnerability in your estate then you cannot patch against it. In their recent report, Fortinet found that attacks started on average 4.76 days after new exploits were publicly disclosed.

Interestingly though, while zero-day threats garner much attention (these are ‘new’ vulnerabilities that are being exploited by attackers but for which there are no security patches yet available), one third of all exploits are for older vulnerabilities. This highlights the need for a comprehensive and robust approach to network security and vulnerability management, beyond simply patching what Microsoft puts out once a month. To have effective patch management, organisations must know what they need to patch and therefore must have visibility of the corporate environment. A good starting block is the creation of a robust information asset register.

Sources: [Security Brief] [Help Net Security] [IT Security Guru]

The Rise and Stealth of The Socially Engineered Insider

Social engineering has become increasingly prevalent as the preferred tactic for foreign adversaries. Insiders are prime targets due to their privileged access to sensitive data. This is particularly affecting the technology, pharma, and critical infrastructure sectors. Advances in AI and social platforms have made it easier to exploit these vulnerabilities. These advances allow threat actors to tailor attacks with unprecedented speed and realism. Using methods like coercion or deception, these actors exploit employees to gain high-value data that can be weaponised. As a result, the threat landscape has become more complex, blurring the lines between internal and external risks. To bolster their defences, organisations are now investing in insider risk management and AI. They are also emphasising employee education and cross-sector collaboration.

Source: [Forbes]

Over 70% of Staff Use AI At Work, But Only 30% of European Organisations Provide AI Training

An ISACA study and the AI Security & Governance Report reveal a complex landscape of AI adoption and security. 73% of European organisations and 54% of global organisations use AI, with 79% increasing their AI budgets, however training and policy development lag behind. Only 30% offer limited training, 40% provide none, and a mere 17% have a comprehensive AI policy. Despite AI’s potential, 80% of data experts find it complicates security, with concerns high around generative AI exploitation (61% of respondents) and AI-powered attacks (over 50% of business leaders). Data poisoning and privacy issues persist, yet 85% of leaders express confidence in their data security strategies, with 83% revising privacy and governance guidelines. With 86% recognising a need for AI training within two years, the call for dynamic governance strategies and formal education is clear to manage evolving threats.

Sources: [Help Net Security] [IT Security Guru]

Don't Be the Weakest Link – You and Your Team's Crucial Role in Cyber Security

Cyber security success depends on more than just technology. Bad actors are always looking for the easiest entry point, meaning that employees’ everyday actions are crucial, when even one careless click or a weak password can be an open door for hackers. However, empowered with the right knowledge and tools, staff can become a robust defence. Nearly 80% of organisations have reported an increase in phishing attacks, but training programs like role-playing exercises and phishing simulations significantly reduce these risks. Effective cyber security also hinges on C-suite leaders promoting a security-first culture, ensuring all employees understand the risks and follow strict protocols like MFA and strong password policies. Consistent training and open communication are vital in fostering a resilient, security-aware workforce.

Source: [JDSupra]

Ransomware Activity Thrives, Despite Law enforcement Efforts

Despite the recent law enforcement takedowns on ransomware groups, ransomware remains rife. Whilst the takedown of a group can come as an initial relief in that the group has gone, it simply forces ransomware affiliates to diversify. This is reflected in ransomware continuing its growth in the first quarter of 2024, with 18 new leak sites, the largest number in a single quarter, emerging over this period. When comes to those at risk, both financial services and healthcare remain a prominent target.

Sources: [Help Net Security ] [Infosecurity Magazine] [Help Net Security]

NATO Warns of Russian Hybrid Warfare

NATO has issued a statement in which it describes it is “deeply concerned about Russia's hybrid actions and the threat that they constitute to NATO security”.  The actions are described to include sabotage, acts of violence, cyber and electronic interference, and disinformation campaigns. This comes as many countries including the UK and US are due to have elections this year.

Sources: [EU Reporter] [Financial Times]



Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

Other Social Engineering

Artificial Intelligence

2FA/MFA

Malware

Mobile

Denial of Service/DoS/DDOS

Data Breaches/Leaks

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

Supply Chain and Third Parties

Cloud/SaaS

Encryption

Linux and Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Training, Education and Awareness

Regulations, Fines and Legislation

Models, Frameworks and Standards

Data Protection

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Nation State Actors

China

Russia

Iran

North Korea

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence




Tools and Controls


Reports Published in the Last Week



Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3


As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 03 May 2024

Black Arrow Cyber Threat Intelligence Briefing 03 May 2024:

-Most Attacks Impacting SMB’s Target Older, Unpatched Vulnerabilities

-91% of Ransomware Victims Paid At least One Ransom in the Past Year, as 1 in 5 Ransomware Attacks Triggers Lawsuit

-BEC and Fund Transfer Fraud Top Insurance Claims

-Correlating Cyber Investments with Business Outcomes

-Vulnerability Exploitation up 180%, 68% of Breaches involved Humans and Supply Chain Weak Link

-MOVEit & Change Healthcare Attacks Designated as Cyber Catastrophe Loss Events by Insurer

-Securing Your Organisation’s Supply Chain: Reducing the Risks of Third Parties

-Why Remote Desktop Tools are Facing an Onslaught of Cyber Threats

-95% of Organisations Revamped Cyber Security Strategies in the Last Year: Make Sure Yours is Right

-Human Factor a Significant Risk for Small and Medium-Sized Businesses.

-Microsoft CEO Says it is Putting Security Above All Else in Major Refocus

-Ending the Culture of Silence in Cyber Security; Three Ways to Empower Teams

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Most Attacks Impacting SMB’s Target Older, Unpatched Vulnerabilities

Attackers continue to aggressively target small and mid-size businesses using specific high-profile vulnerabilities dating back a decade or more, network telemetry shows. Findings have shown that this is due to these vulnerabilities featuring in a wide range of products. Due to their prevalence, they can often become missed by organisations conducting patch management and therefore leave the organisation open.

For this reason it is critical that all organisations, including smaller organisations, have internal as well as external vulnerability scanning. You might believe your systems are patched up to date but there is no way to confirm without scanning , or to know which patches might have been missed.

Sources: [Infosecurity Magazine]

91% of Ransomware Victims Paid At least One Ransom in the Past Year, as 1 in 5 Ransomware Attacks Triggers Lawsuit

Ransomware attacks saw a significant surge in 2023, following a dip in 2022. The number of victims increased by 66% from 2022 to 2023, with 91% of those affected paying at least one ransom. 58% of organisations have been targeted six times or more.

The Sophos State of Ransomware 2023 report highlighted ransom payments rose by 500%; nearly two-thirds exceeded $1m or more, with an average payment of $2m. Furthermore, 30% of the demands were for over $5m.

In the US, 18% of incidents led to litigation, with 123 lawsuits filed in 2023 and 355 over five years. Data breaches, affecting 283.3 million records, primarily triggered these lawsuits, especially in healthcare and finance sectors. The resolution rate is 59%, with the highest settlement at $8.7m. Regulatory fines added nearly $10m to the financial impact. These figures underscore the significant financial implications of ransomware attacks and the urgent need for robust cyber security measures.

Sources: [ZD Net] [Infosecurity Magazine] [Security Magazine] [PrNewsWire] [Infosecurity Magazine]

BEC and Fund Transfer Fraud Top Insurance Claims

Cyber Insurer Coalition's 2024 Cyber Claims Report highlights a significant trend in cyber security threats, identifying email-based fraud as the predominant cause of insurance claims in 2023, accounting for 53% of all claims. Business email compromise (BEC) and funds transfer fraud (FTF) topped the list, contributing to 28% of claims and increasing claim amounts by 24% to an average loss exceeding $278,000. In contrast, ransomware, while less frequent at 19% of claims, also saw a rise in both frequency and severity, with average losses climbing to over $263,000. The report also notes a 13% year-on-year surge in overall claims, with substantial losses tied to compromised network security devices and a notable vulnerability in organisations using exposed remote desktop protocols.

Source: [Infosecurity Magazine]

Correlating Cyber Investments with Business Outcomes

The US Securities and Exchange Commission (SEC) has implemented stringent new rules compelling organisations to report significant cyber incidents within four days and to annually disclose details concerning their cyber security risk management, strategy, and governance. These mandates are seen as giving “more teeth to the idea that cyber security is a business problem” and “bringing an element of cyber security to the boardroom” according to cyber security solutions provider SecurityGate. Highlighted in the "Cybersecurity Insights" podcast, experts argue for simplifying cyber security strategies, advocating sustained resource allocation over reactive measures, and emphasising the importance of training over expensive solutions. These steps are deemed crucial for enhancing organisational resilience and security in a landscape where cyber threats are increasingly sophisticated and pervasive.

Source: [InfoRisk Today

Verizon: Vulnerability Exploitation up 180%, 68% of Breaches involved Humans and Supply Chain Weak Link

Verizon has released the findings of its 17th Annual Data Breach Investigations Report, which showed security incidents doubled year over year in 2023 to a record high 30,458 security events and 10,626 confirmed breaches. Some of the key takeaways from the 100-page report include zero-day attacks on unpatched systems and devices rising 180% in 2023, most breaches (68%) involving a non-malicious human element and the median time for users to fall for phishing emails falling just south of 60 seconds. In its first inclusion as a separate metric, supply chain attacks were found to contribute to 15% of all attacks.

Sources: [MSSP Alert] [Verizon]

MOVEit & Change Healthcare Attacks Designated as Cyber Catastrophe Loss Events by Insurer

Verisk’s Property Claim Services (PCS) has recently identified the MOVEit and Change Healthcare cyber attacks as significant Cyber Catastrophe Loss Events. These designations are part of PCS’s Global Cyber solution, which tracks cyber incidents and their potential impact on the insurance market. The designation indicates that each attack is anticipated to result in insurance industry losses exceeding USD 250 million.

The MOVEit attack, linked to the Russian-affiliated group Cl0p, compromised over 2,700 organisations globally, affecting up to 90 million individuals. The Change Healthcare attack, attributed to the ALPHV/Blackcat gang, notably disrupted UnitedHealth Group’s operations, with projected costs and lost revenue totalling up to USD 1.6 billion. These designations highlight the escalating scale and financial impact of cyber incidents on global markets.

Source: [Reinsurance News]

Securing Your Organisation’s Supply Chain: Reducing the Risks of Third Parties

Nearly every organisation is part of a supply chain, where a significant amount of data is transferred. When data leaves your infrastructure, its security depends on the third party. The risks of a cyber incident increases as the supply chain increases.

Organisations need to mitigate the risks that their third party brings. This requires an understanding of the supply chain actors, and performing cyber security assessments of the most critical ones. The objective is to ensure that your organisation is satisfied with the third party’s security controls, or to work together to remediate any gaps.

Source: [Help Net Security]

Why Remote Desktop Tools are Facing an Onslaught of Cyber Threats

In the era of hybrid work, remote desktop tools have become crucial yet vulnerable points within corporate networks, attracting significant cyber criminal attention. A study by Barracuda Networks underscores the challenges of securing these tools. Virtual Network Computing (VNC) is particularly susceptible; it is targeted in 98% of these types of attacks due to its use of multiple, sometimes unsecured ports. VNC attacks predominantly exploit weak password practices, notably through brute force methods. Conversely, Remote Desktop Protocol (RDP) accounts for about 1.6% of these attacks but is favoured for more extensive network breaches, often involving ransomware or crypto mining. The study highlights a pressing need for robust endpoint management and heightened security measures to mitigate these threats.

Source: [ITPro]

95% of Organisations Revamped Cyber Security Strategies in the Last Year: Make Sure Yours is Right

A recent report found that 95% of companies have altered their cyber security strategies in the last twelve months. This was driven by keeping pace with the shifting regulatory landscape (98%), the need to meet customer expectations for data protection and privacy (89%), and the rise of AI-driven threats and solutions (65%). Almost half (44%) of non-security executives do not understand the regulatory requirements their organisation must adhere to.

When it came to reporting, the study found that security teams aren’t reporting on key operational metrics that define whether their security investments and strategy changes have a measurable impact. It is evident that there is a disconnect between security and non-security professionals when it comes to the business strategy.

Sources: [Business Wire] [Security Magazine]

Human Factor a Significant Risk for Small and Medium-Sized Businesses.

A survey of business and IT security in small and medium-sized businesses (SMBs) conducted by LastPass found that roughly one in five business leaders admits to circumventing security policies, as do one in 10 IT security leaders. The survey found that password management is critically important to cyber security, with nearly half (47%) reporting recent breaches due to compromised passwords.

Sources: [Beta News] [Business Wire]

Microsoft CEO Says it is Putting Security Above All Else in Major Refocus

Following a series of high-profile attacks in recent months and a report by the US Cyber Safety Review Board (CSRB), Microsoft’s CEO has revealed it will now focus its efforts on an increase in the commitment to security. Investigating a summer 2023 attack, Microsoft was deemed to have made a series of “avoidable errors”, including the failure to detect several compromises, the CSRB said.

Sources: [TechRadar]

Ending the Culture of Silence in Cyber Security; Three Ways to Empower Teams

A recent discussion on workplace errors highlights the significant repercussions of cyber breaches compared to typical office mistakes. In the UK, nearly a third of businesses face cyber attacks weekly, with each breach costing approximately £4,000. However, a concerning trend is that 41% of these breaches are not reported to internal leadership, often due to fears among staff about the consequences of admitting faults. A three-pronged approach has been suggested to foster a blame-free culture: providing tailored and evolving cyber training, establishing safe zones for admitting mistakes, and implementing robust recovery plans. This approach not only prepares employees to handle potential breaches more effectively but also encourages them to report incidents promptly, reducing the overall impact and aiding quicker recovery. Such strategies are essential for maintaining resilience against increasingly sophisticated cyber threats.

Source: [Minute Hack]

Governance, Risk and Compliance


Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

BEC

Other Social Engineering

Artificial Intelligence

2FA/MFA

Malware

Mobile

Denial of Service/DoS/DDOS

Internet of Things – IoT

Data Breaches/Leaks

Organised Crime & Criminal Actors

Insider Risk and Insider Threats

Insurance

Supply Chain and Third Parties

Cloud/SaaS

Encryption

Linux and Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Training, Education and Awareness

Regulations, Fines and Legislation

Data Protection

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs

Misinformation, Disinformation and Propaganda


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Nation State Actors

China

Russia

Iran

North Korea

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence


Vulnerability Management

Vulnerabilities


Tools and Controls



Other News


Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

It’s World Password Day today; if you are protecting your systems access using a password, then you need to know this

It’s World Password Day today; if you are protecting your systems access using a password, then you need to know this

Passwords are one of the basic ways that we confirm our identity when we access systems on our company network, or our own person email account for example. Although many organisations have a policy that requires users to create passwords of a certain length and complexity, the challenge is that the user can fulfil those criteria even if they create a weak password that can be easily guessed or cracked by an attacker. This is yet another intersection of technology and human behaviours that can make or break cyber security.

Did you know that attackers exchange lists of passwords from previous attacks, which they use at high speed in combination with a user’s email address for example, to try to break into a system?

If you are told that you need to create a password that uses upper and lower case letters, with numbers and special characters, the chances are you will use a word that starts with a capital letter, then add a number and use an exclamation point or similar at the end. The attackers know this, and they have millions of examples of them in their password listing. Equally, passwords like querty12345 are, sadly, still frequently used.

The trick is for us all to avoid using ‘weak’ passwords that are likely to feature on the password listing, which means we need to avoid falling into predictable human behaviour patterns. Equally, users need to avoid obvious passwords, like the name of their town or their pet dog, which can be guessed or cracked by a dedicated attacker.

As a solution consider using a passphrase such as “BananaHippoCyclist” and if you want it even more complex, trying adding a few numbers and special characters. And make sure every access you have uses a different password. We all live in the real world, and it can be hard to manage multiple passwords, so you could consider a password manager application to store your passwords, providing you use a very strong master password to access it.

Even strong passwords need extra security, which is why they should be used in conjunction with other multi-factor authentication methods such as facial recognition or biometrics (something you are) or verification codes received on your mobile phone (something you have). Utilising multiple methods of authentication makes it significantly harder for attackers to compromise your accounts.

If you are wondering how to implement this in your organisation, then reach out to us for a free 30-minute consultation to discuss your specific needs and proportionate options. We love discussing this and other aspects of cyber security, so contact us through our website page www.blackarrowcyber.com/contact, and we will get back to you shortly.

In the meantime, Happy World Password Day!

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Insight 30 April 2024 – UK’s New IoT Legislation Aiming to Protect Consumers From Cyber Attacks Comes in to Force

Black Arrow Cyber Insight 30 April 2024 – UK’s New IoT Legislation Aiming to Protect Consumers From Cyber Attacks Comes in to Force

Executive summary

The UK Government has released new legislation to protect consumers from cyber criminals. 

The regime comprises of two pieces of legislation: 

  • Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022; and 

  • The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.

Now that this new legislation is in force, the UK’s consumer connectable product security regime will be enforced, aiming to protect consumers against hacking and cyber attacks. This regulation sets out the minimum-security standards that all IoT (Internet of Things) devices are now legally obliged to meet.

What are the security requirements?

The regulations set out specific requirements that the relevant people, manufacturer, importer and distributor of the products have to follow:

1.      Passwords must be unique per the product. This includes banning common and easily guessable passwords for example admin or 12345 to prevent vulnerabilities and hacking.

2.      The manufacturer must provide clear and transparent information on how to report security issues about their product.  Manufacturers are also obligated to provide information on timescales of acknowledging, reporting and updating the status of security issues to the consumer until they have been resolved.

3.      The manufacturers and retailers must publish to consumers in a clear and accessible way, the minimum time they can expect to receive important security updates. This information should be available without prior request in English and free of charge.

While these security requirements demonstrate the seriousness in which the Government regards cyber security, they should not be relied upon alone and organisations ensure they are employing their own controls such as changing default passwords, performing vulnerability scanning and conducting timely patch management. Effective cyber security requires multiple layers of defence

The official UK Government legislation can be found below:

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Advisory 30 April 2024 – New Android Malware Disguised as Chrome Update can Steal Your Data and Access Your Banking Information

Black Arrow Cyber Advisory 30 April 2024 – New Android Malware Disguised as Chrome Update can Steal Your Data and Access Your Banking Information

Executive summary

A new strain of Android mobile malware dubbed “Brokewell” is being used to spread fake browser updates to steal user data. The malware has the ability to overlay banking application screens, capturing credentials without the users knowledge, as well as allowing remote access by an attacker. The malware has also been recorded as using popular ‘buy now, pay later’ service “Klarna” in addition to the fake Google Chrome update. Research indicates that the malware is in active development.

What’s the risk?

Due to the sensitive nature of the information sought by the malware, there is a genuine risk to the confidentiality and integrity of data. Features of the malware include the ability to overlay applications to steal user credentials and allow an attacker remote access, including the commands which record audio, take screenshots, access locations, and send communications from the victim phone.

The list of potential targets is extensive, especially so with many employees using personal devices for corporate purposes, including the storage of corporate credentials. A recent report from Google owned Mandiant found that 10% of intrusions began with evidence of stolen credentials.

What can I do?

It is recommended to employ a multi-layer defence to mitigate the risk of such malware succeeding. This should include only downloading updates from the official application in the Google Play store and enabling Google Play Protect will help to prevent malware. To further bolster defence, it is recommended that anti-virus applications are run in parallel.

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Further information can be found below:

https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Threat Briefing 26 April 2024

Black Arrow Cyber Threat Intelligence Briefing 26 April 2024:

-Coalition Finds More Than Half of Cyber Insurance Claims Originate in the Email Inbox

-Unmasking the True Cost of Cyber Attacks: Beyond Ransom and Recovery

-Why Cyber Security Should Be Driving Your Enterprise Risk Management Strategy

-Ransomware Double-Dip - Re-Victimisation in Cyber Extortion

-AI is a Major Threat and Many Financial Organisations Are Not Doing Enough to Fight the Threat

-6 out of 10 Businesses Struggle to Manage Cyber Risk

-'Junk Gun' Ransomware: New Low-Cost Cyber Threat Targets SMBs

-Penetration Testing Infrequency Leaves Security Gaps

-Bank Prohibited from Opening New Accounts After Regulators Lose Patience With Poor Cyber Security Governance

-The Psychological Impact of Phishing Attacks on Your Employees

-Where Hackers Find Your Weak Spots

-The Role of Threat Intelligence in Financial Data Protection

-Government Cannot Protect Business and Services from Cyber Attack, Decision Makers Say

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Coalition Finds More Than Half of Cyber Insurance Claims Originate in the Email Inbox

The 2024 Cyber Claims Report by insurer Coalition reveals critical vulnerabilities and trends affecting cyber insurance policyholders. Notably, over half of the claims in 2023 stemmed from funds transfer fraud (FTF) and business email compromise (BEC), underlining the critical role of email security in cyber risk management. The report also indicated heightened risks associated with boundary devices like firewalls and VPNs, particularly if they are exposed online and have known vulnerabilities. Additionally, the overall claims frequency and severity rose by 13% and 10% respectively, pushing the average loss to $100,000. These insights emphasise the necessity of proactive cyber security measures and the valuable role of cyber insurance in mitigating financial losses from cyber incidents.

Sources: [IT Security Guru] [Emerging Risks]

Unmasking the True Cost of Cyber Attacks: Beyond Ransom and Recovery

The global cost of cyber crime is expected to soar to $10.5 trillion annually by 2025, a steep rise from $3 trillion in 2015, underscoring a significant improvement in the methods of cyber criminals, according to Cybersecurity Ventures. Beyond direct financial losses like ransomware payments, the hidden costs of cyber attacks for businesses include severe operational disruptions, lost revenue, damaged reputations, strained customer relationships, and regulatory fines. These incidents, further exacerbated by increased insurance premiums, collectively contribute to substantial long-term financial burdens. The report indicates that 88% of data breaches are attributable to human error, underscoring the importance of comprehensive employee training alongside technological defences. To combat these evolving cyber threats effectively, organisations must adopt a multi-pronged strategy that includes advanced security technologies, regular system updates, employee education, and comprehensive security audits.

According to another report from SiliconAngle, cyber insurance claims increased 13% year-over-year in 2023, with the 10% rise in overall claims severity attributed to mounting ransomware attack claims.

Sources: [The Hacker News] [Huntress] [SC Media]

Why Cyber Security Should Be Driving Your Enterprise Risk Management Strategy

Cyber security has transformed from a secondary concern into the cornerstone of corporate risk management. The historical view of cyber security as merely a component of broader risk strategies is outdated; it now demands a central role in safeguarding against operational, financial, and reputational threats. Many businesses, recognising the vital role of technology in all operations, have begun elevating the position of Chief Information Security Officer (CISO) to integrate cyber security into their overall enterprise risk frameworks. This shift not only enhances visibility and strategic alignment at the highest organisational levels but also fosters more robust defences against cyber threats. As such, adopting a cyber security-centric approach is crucial for compliance and long-term resilience in the face of growing digital threats.

Source: [Forbes]

Ransomware Double-Dip: Re-Victimisation in Cyber Extortion

A recent cyber security study reveals a troubling trend of re-victimisation among organisations hit by cyber extortion or ransomware attacks. Analysis of over 11,000 affected organisations shows recurring victimisation due to repeated attacks, data reuse among criminal affiliates, or cross-affiliate data sharing. Notably, cyber extortion incidents have surged by 51% year-on-year. Additionally, a separate study reports payments exceeding $1 billion and a 20% increase in ransomware attack victims since early 2023. These findings underscore the increasing sophistication and persistence of cyber criminals. Despite law enforcement efforts, adaptable cyber crime groups swiftly resume operations, complicating effective threat mitigation. Organisations must enhance their cyber security measures to avoid becoming repeated targets.

Sources: [Security Magazine] [The Hacker News] [SC Media]

AI is a Major Threat and Many Financial Organisations Are Not Doing Enough

Artificial intelligence (AI) is a major concern for organisations, especially for the financial services sector due to the information they hold. Recent reports have found that AI has driven phishing up by 60% and AI tools have been linked to data exposure in 1 in 5 UK organisations. But it is not just attackers utilising AI: a separate report found that 20% of employees have exposed data via AI.

Currently, many financial organisations are not doing enough to secure themselves to fight AI. In a recent survey, 69% of fraud-management decision makers, AML professionals, and risk and compliance leaders reported that criminals are more advanced at using AI for financial crime than firms are in defending against it.

Sources: [Verdict] [Beta News] [Infosecurity Magazine] [TechRadar] [Security Brief]

[Biometric Update]

6 out of 10 Businesses Struggle to Manage Cyber Risk

A report has found that 6 in 10 businesses are struggling to manage their cyber risk and just 43% have confidence in their ability to address cyber risk. Further, 35% of total respondents worry that senior management does not see cyber attacks as a significant risk; the same percentage also reported a struggle in hiring skilled professionals. When it came to implementing their security policy, half of respondents found difficulty, and when it came to securing the supply chain, a third reported worries.

Given the inevitability of a cyber attack, organisations need to prepare themselves. Those that struggle to manage their cyber risk and/or hire skilled professions will benefit from outsourcing to skilled, reputable cyber security organisations who can guide them through the process.

Sources: [PR Newswire] [Beta News]

'Junk Gun' Ransomware: New Low-Cost Cyber Threat Targets SMBs

Sophos’ research reveals a concerning trend: ‘junk gun’ ransomware variants are now traded on the dark web. Rather than going the traditional route of selling or buying ransomware to or as an affiliate, attackers have now begun creating and selling unsophisticated ransomware variants for a one-time cost. Priced at a median of $375, they attract lower-skilled attackers, especially those targeting small and medium-sized businesses (SMBs). As major ransomware players fade, these variants pose significant threats, accounting for over 75% of cyber incidents affecting SMBs in 2023.

Source: [Security Brief] [Tripwire]

Penetration Testing Infrequency Leaves Security Gaps

Many organisations are struggling to maintain the balance between penetration testing and IT changes within the organisation, leaving security gaps according to a recent report. The report found that 73% of organisations reported changes to their IT environments at least quarterly, however only 40% performed penetration testing at the same frequency.

The issue arises where there is a significant duration during which changes have been implemented without undergoing assessment, leaving organisations open to risk for extended periods of time. Consider the situation in which an organisation moves their infrastructure from on-premise to the cloud: they now have a different IT environment, and with that, new risks.

Black Arrow always recommends that a robust penetration test should be conducted whenever changes to internet facing infrastructure have been made, and at least annually.

Source: [MSSP Alert]

Bank Prohibited from Opening New Accounts After Regulators Lose Patience with Poor Cyber Security Governance

A bank in India has been banned from signing up new customers, and instructed to focus on improving its cyber security after “serious deficiencies and non-compliances” were found within their IT environment. The compliances provided by the bank were described as “inadequate, incorrect or not sustained”. The bank is now subject to an external audit, which if passed, will consider the lifting of the restrictions placed upon them.

Source: [The Register]

The Psychological Impact of Phishing Attacks on Your Employees

Phishing remains one of the most prevalent attack vectors for bad actors, and its psychological impact on employees can be severe, with many employees facing a loss in confidence and job satisfaction as well as an increase in anxiety. In a study by Egress, it was found that 74% of employees were disciplined, dismissed or left voluntarily after suffering a phishing incident, which can cause hesitation when it comes to reporting phishing.

Phishing incidents and simulations where employees have clicked should be seen as an opportunity to learn, not to blame, and to understand why a phish was successful and what can be done in future to prevent it. Organisations should perform security education and awareness training to help employees lessen their chance of falling victim, as well as knowing the reporting procedures.

Source: [Beta News]

Where Hackers Find Your Weak Spots

A recent analysis highlights social engineering as a primary vector for cyber attacks, emphasising its reliance on meticulously gathered intelligence to exploit organisational vulnerabilities. Attackers leverage various intelligence sources; Open Source Intelligence (OSINT) for public data, Social Media Intelligence (SOCMINT) for social media insights, Advertising Intelligence (ADINT) from advertising data, Dark Web Intelligence (DARKINT) from the DarkWeb, and the emerging AI Intelligence (AI-INT) using artificial intelligence. These methods equip cyber criminals with detailed knowledge about potential victims, enabling targeted and effective attacks. The report underscores the critical importance of robust information management and employee training to mitigate such threats, specifically advocating for regular training, AI-use policies, and proactive intelligence gathering by organisations to protect against the substantial risks posed by social engineering.

Source: [Dark Reading]

The Role of Threat Intelligence in Financial Data Protection

The financial industry’s reliance on digital processes has made it vulnerable to cyber attacks. Criminals target sensitive customer data, leading to financial losses, regulatory fines, and reputational damage. To combat these threats such as phishing, malware, ransomware, and social engineering, financial institutions must prioritise robust cyber security measures. One effective approach is threat intelligence, which involves ingesting reliable threat data, customised to your sector and the technology you have in place, and dark web monitoring.

Source: [Security Boulevard]

Government Cannot Protect Business and Services from Cyber Attack, Decision Makers Say

According to a recent report, 66% of surveyed IT leaders expressed a lack of confidence in their government’s ability to defend people and enterprises from cyber attacks, especially those from nation state actors. This scepticism arises from the growing complexity of threats and the rapid evolution of cyber warfare. While governments play a critical role in national security, their agility in adapting to the ever-changing digital landscape leaves organisations finding themselves increasingly responsible for their own protection.

Source: [TechRadar] [Security Magazine]


Governance, Risk and Compliance


Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

BEC

Other Social Engineering

Artificial Intelligence

2FA/MFA

Malware

Mobile

Data Breaches/Leaks

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

Insurance

Supply Chain and Third Parties

Cloud/SaaS

Identity and Access Management

Encryption

Linux and Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Malvertising

Training, Education and Awareness

Regulations, Fines and Legislation

Models, Frameworks and Standards

Data Protection

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs

Misinformation, Disinformation and Propaganda


Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

China

Russia

Iran

North Korea

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence


Vulnerability Management

Vulnerabilities


Tools and Controls



Other News


Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Insight 25 April 2024 – Understanding Infostealers: The Malicious Software Targeting Your Information

Black Arrow Cyber Insight 25 April 2024 – Understanding Infostealers: The Malicious Software Targeting Your Information

Executive summary

A recent report conducted by Kaspersky found that nearly 10 million devices fell victim to data-stealing malware, also known as  “InfoStealers” in 2023. Put simply, an InfoStealer is malware that is built to collect and transmit sensitive information to unauthorised parties. Once stolen and transmitted, this information can be used or sold. Unlike ransomware, which often announces its presence with dramatic demands, infostealers operate in the shadows, harvesting your information.

What’s the risk?

Due to the sensitive nature of the information sought by InfoStealers, there is a genuine risk to the confidentiality of data. The data sought by an InfoStealer can include credentials, financial information, cookies, MFA tokens, text files, and machine information. The list of potential targets is extensive, especially so with many employees storing their credentials on personal devices. In a recent report, Mandiant, which is owned by Google, found that 10% of intrusions began with evidence of stolen credentials.

Infostealers can be delivered in a variety of ways, including through malicious attachments, unofficial software downloads and compromised websites. InfoStealers often try to disguise themselves as legitimate, in some cases tricking a victim in to running them and keeping them on their device. Anti-virus is not enough to stop them.

What can I do?

Mitigating the threat of InfoStealers requires practicing robust cyber hygiene. Organisations should adhere to leading practices, including downloading software exclusively from official sources, exercising caution with email links and attachments and maintaining visibility of the software ecosystem within their corporate environment.

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More
Black Arrow Admin Black Arrow Admin

Black Arrow Cyber Advisory 25 April 2024 – Cisco ASA and FTD Zero-days Exploited by Nation-state Hackers, Patch Now

Black Arrow Cyber Advisory 25 April 2024 – Cisco ASA and FTD Zero-days Exploited by Nation-state Hackers, Patch Now

Executive summary

Cisco has published a security advisory warning regarding an active attack campaign labelled as “ArcaneDoor”. The campaign involves threat actors exploiting vulnerabilities in Cisco Adaptive Security Appliance (ASA) or Cisco Firepower Threat Defense (FTD) to implant previously unknown malware, execute commands and exfiltrate data. Activity is thought to have begun in early January 2024.

What’s the risk to me or my business?

There is a risk that organisations running vulnerable software versions of Cisco ASA or FTD are leaving themselves at risk of allowing an attacker to implant malware, execute commands and exfiltrate data, impacting the confidentiality, integrity and availability of data. There is no current workaround, and Cisco advises to upgrade to a fixed software release immediately.

What can I do?

Black Arrow recommends following Cisco’s advice, and applying patches immediately. Additionally, organisations can also open a case with Cisco Technical Assistance Center, referencing the keyword “ArcaneDoor” to verify the integrity of their Cisco ASA or FTD devices. Further information on this can be found in the advisory provided by Cisco.

Technical Summary

CVE-2024-20353-  a denial of service vulnerability impacting Cisco ASA and FTD software.

CVE-2024-20359- A privilege escalation vulnerability, which could allow an authenticated local attacker to execute code with the highest level of privilege. Administrator level privileges are required to exploit this vulnerability.

Further information can be found below.

The advisories provided by Cisco can be found here:

https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response

https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-websrvs-dos-X8gNucD2

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-asaftd-persist-rce-FLsNXF4h

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Read More