Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Threat Briefing 21 June 2024
Black Arrow Cyber Threat Intelligence Briefing 21 June 2024:
-Hackers Switch Focus to Cloud Apps for Data Theft, as Cloud Services Increasingly Seen as Huge Soft Target by Attackers
-The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe, 1 in 10 Email-Based Attacks are Now Business Email Compromise
-Regulatory Changes Are on the Horizon. Are Companies Ready?
-How Hackers Can Crack Your Password in an Hour
-US Bans Kaspersky Software, Citing National Security Risks
-Quarter of Firms Suffer an API-Related Breach
-More than 70% of Companies Increased Spending on Proactive Security
-The Resurgence of Major Data Breaches?
-Is Cyber Becoming a Primary Domain of Warfare?
-Cyber Threats Present Ever Greater Risks to International Peace and Security: UK Statement at UN Security Council
-Cyber Security and AI at Top of Risk List for UK Trustees
-Qilin: We Knew Our Synnovis Attack Would Cause a Healthcare Crisis at London Hospitals
-Ransomware Attacks Are Getting Worse
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Hackers Switch Focus to Cloud Apps for Data Theft, as Cloud Services Increasingly Seen as Huge Soft Target by Attackers
A recent report by Google’s Mandiant reveals that the Scattered Spider gang, also known as UNC3944, has escalated its tactics to target software-as-a-service (SaaS) applications and cloud infrastructure, focusing on data theft for extortion without using ransomware. They exploit genuine tools and permissions, then create new virtual machines and exfiltrate data to other cloud platforms they have under their control. Additionally, other reports this week highlight a rise in the exploitation of legitimate cloud services, with over half of all malware in March 2024 delivered via these services. Notably, 59% of cloud-based malware originated from 235 distinct apps. Sophisticated attacks, such as North Korea’s targeting of South Korean security professionals, underscore the urgent need for enhanced cloud security measures and a proactive defence strategy.
The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe, 1 in 10 Email-Based Attacks are Now Business Email Compromise
Recent reports highlight a significant shift in phishing tactics due to advancements in generative AI (GenAI). Historically, phishing relied on high-volume, low-effort strategies, but improved security measures have led to more sophisticated, targeted attacks such as Business Email Compromise (BEC). The advent of GenAI tools like ChatGPT has drastically reduced the time and effort required to craft convincing phishing emails, resulting in a 21% increase in BEC attempts from Q2 2022 to Q2 2023. BEC now accounts for 10.6% of social engineering attacks, up from 8% in 2022. Conversation hijacking has surged by 70% since 2022, despite its complexity.
Analysis of 69 million attacks on 4.5 million mailboxes highlights new tactics, such as using QR codes and URL shorteners, which evade traditional email filters. Gmail was the most exploited webmail service, used in 22% of social engineering attacks.
Furthermore, image-based phishing attacks, which evade natural language processing defences, have surged by 175% over the past year, illustrating the growing global threat posed by AI-enhanced phishing.
Regulatory Changes Are on the Horizon. Are Companies Ready?
A recent report highlights the increasing complexity of cyber security compliance across Europe, America, and Asia. European organisations face over 100 pieces of legislation, creating significant challenges in determining applicable laws, especially those with extraterritorial effects. This emphasises the importance of bespoke internal management and governance programmes tailored to specific business risks and data handling practices. The upcoming NIS 2 Directive in the EU is expected to further impact compliance requirements, as DORA will for financial services firms operating within the EU or those outside the EU providing critical services to EU organisations. Additionally, robust incident response plans and ensuring third-party compliance are crucial for effective cyber security management.
How Hackers Can Crack Your Password in an Hour
A recent analysis of 193 million leaked passwords by Kaspersky revealed alarming security weaknesses. 59% of these passwords could be cracked in under an hour using modern GPUs and advanced algorithms. The study found that 45% of passwords were vulnerable to cracking within a minute, highlighting the risks of predictable patterns and common phrases. Despite the increased threat, many users continue to use easily guessable passwords. To mitigate these risks, it is recommended to use strong, unique passwords, employ a password manager, and enable two-factor authentication (2FA) where possible.
US Bans Kaspersky Software, Citing National Security Risks
A recent announcement by the US Department of Commerce's Bureau of Industry and Security (BIS) has imposed a ban on Kaspersky Lab's US subsidiary from selling its security software due to national security risks. The ban, effective from July 20, stems from concerns over Kaspersky’s ties to the Russian government, which could potentially exploit the software for espionage and data theft. Existing customers have until September 29 to find alternatives. This decision follows previous restrictions, with Kaspersky added to the Federal Communications Commission's (FCC) "Covered List" and similar actions by Germany and Canada.
Quarter of Firms Suffer an API-Related Breach
A recent State of Application Programming Interfaces (API) Security Report by Salt Security reveals that nearly a quarter (23%) of organisations experienced breaches via production APIs last year. An API can be thought of as a set of rules and tools that allow different software applications to communicate with each other and exchange data.
The report, based on a survey of 250 respondents globally, found that 95% had encountered API security issues, including vulnerabilities (37%) and sensitive data exposure (38%). Despite a 167% increase in API counts, only 8% of companies consider their API security strategy to be advanced, and 37% lack a strategy entirely. Furthermore, just 58% have processes to discover all APIs, even though 46% discuss API security at the C-level. This highlights the urgent need for sophisticated API security measures.
More than 70% of Companies Increased Spending on Proactive Security
A recent study reveals that over 70% of organisations are boosting their spending on proactive security solutions, prioritising attack surface management and risk-based vulnerability management. Key investments focus on enhanced attack surface visibility (65%), security control optimisation (60%), and improved manpower productivity (54%). The research highlights that 47% of organisations aim to reduce threats using proactive security within the next 12 to 24 months, while 48% anticipate disruption from these new solutions. Confidence remains high in firewalls and routers, with only 6% of financial institutions proactively assessing firewalls and 4% assessing routers.
The Resurgence of Major Data Breaches?
A recent surge in data breaches has seen millions of records exposed and shared on dark web forums, predominantly driven by the hacker group ShinyHunters. This resurgence mirrors the "golden age" of data breaches from 2019 to 2021, where ShinyHunters notoriously targeted companies like Tokopedia and Microsoft’s GitHub. Recent breaches include a massive attack on Santander Bank, affecting 30 million customers, and Ticketmaster, compromising 560 million customer records. Organisations need to take appropriate steps to prevent breaches from happening in the first place, and ensure they have plans in place for what to do when something goes wrong.
Is Cyber Becoming a Primary Domain of Warfare?
A recent analysis by Cyberint reveals that cyber operations in conflicts such as the Ukraine-Russia and Israel-Hamas wars now focus on critical infrastructure and supply chains, with wiper malware frequently used to disrupt organisations. Hacktivists, equipped with new tools and greater capabilities, pose a significant threat, blurring lines between nation-state actors and cyber criminals. This overlap complicates attack attribution and motive understanding. Cyber operations, even when unsuccessful, can have profound psychological impacts on public safety. Enhanced targeting of essential services highlights the urgent need for robust defence strategies in modern cyber warfare.
Cyber Threats Present Ever Greater Risks to International Peace and Security: UK Statement at UN Security Council
A recent statement by the UK at the UN Security Council highlights three critical trends in cyber threats impacting international peace and security.
Firstly, ransomware attacks disrupt government functions and public services, necessitating an international response for resilience. The UK, co-chairing the Counter Ransomware Initiative with Singapore, urges global participation.
Secondly, the rise of AI systems poses new cyber security challenges, with the UK advocating secure AI design having published "Guidelines for Secure AI System Development" with international partners.
Thirdly, the market for advanced cyber intrusion capabilities is growing, increasing threat unpredictability. The UK and France invite collaboration through the Pall Mall Process to address this concern. The UK also calls for stricter enforcement of North Korea sanctions due to their use of cyber activities to fund illegal weapons programmes.
Cyber Security and AI at Top of Risk List for UK Trustees
A recent report by LCP reveals that cyber threats and artificial intelligence (AI) are the top concerns for UK pension trustees, with 23% identifying these as their primary worry. Over half of the respondents (61%) rated their concern about cyber risks as seven or higher on a scale of one to ten. Trustees from larger schemes felt marginally more prepared for cyber risks than those from smaller schemes.
Qilin: We Knew Our Synnovis Attack Would Cause a Healthcare Crisis at London Hospitals
A recent cyber attack by the ransomware gang Qilin has caused a healthcare crisis in London, targeting Synnovis, a partnership between Synlab and two NHS Trusts. The gang confirmed the attack was politically motivated, aiming to disrupt healthcare services. Qilin demanded a $50 million ransom, claiming to have stolen over one terabyte of data. The attack has led to the cancellation of more than 1,500 operations and appointments, significantly impacting patient care. Despite expressing token sympathy for the affected patients, Qilin remains unrepentant. The incident highlights the need for robust cyber security measures in critical infrastructure sectors.
Ransomware Attacks Are Getting Worse
A recent report highlights the escalating crisis of ransomware targeting schools, hospitals, and critical infrastructure, with over 1,200 data breaches reported by the UK Information Commissioner’s Office in 2023, a 25% increase from the previous year. The healthcare sector is notably affected, following a $44 million payout by Change Healthcare in March. 75% of organisations faced ransomware attacks, and 84% encountered phishing attempts, yet only 31% conducted a cyber security risk assessment. With the average cost of a breach at £3.4 million, the report underscores the urgent need for robust cyber security measures, including regular software updates, strong password policies, insider threat management, incident response plans, and multi-factor authentication. Increasing levels of regulation are coming in across Europe, US and Asia to try to enforce more resilience to these types of attacks.
Sources
https://www.infosecurity-magazine.com/blogs/threat-targeting-cloud-services/
https://www.govinfosecurity.com/regulatory-changes-are-on-horizon-are-companies-ready-a-25507
https://www.kaspersky.co.uk/blog/password-can-be-hacked-in-one-hour/27738/
https://thehackernews.com/2024/06/us-bans-kaspersky-software-citing.html
https://www.infosecurity-magazine.com/news/quarter-firms-suffer-api-related/
https://securityboulevard.com/2024/06/the-resurgence-of-major-data-breaches/
https://www.inforisktoday.com/cyber-becoming-primary-domain-warfare-a-25521
https://www.europeanpensions.net/ep/Cyber-threats-take-top-spot-in-UK-trustee-risk-list.php
https://www.theregister.com/2024/06/20/qilin_our_plan_was_to/
https://www.wired.com/story/security-news-this-week-ransomware-attacks-are-getting-worse/
https://channeleye.co.uk/data-breaches-brought-on-by-ransomware-escalate/
Governance, Risk and Compliance
Cyber security and AI at top of risk list for trustees, LCP says (professionalpensions.com)
Regulatory Changes Are on the Horizon. Are Companies Ready? (govinfosecurity.com)
More than 70% of companies increased spending on proactive security | Security Magazine
Regulators urged to promote cyber security investment - Risk.net
The Perilous Role of the CISO: Navigating Modern Minefields - SecurityWeek
Cyber security Deserves the Proverbial Seat at the Table (govinfosecurity.com)
Pressure mounts on CISOs as SEC bares teeth with legal action - Help Net Security
Why Regulated Industries are Turning to Military-Grade Cyber Defenses (thehackernews.com)
Cyber Security Burnout Crisis: Burnout in Next 12 Months (thehrdirector.com)
9 ways CSOs lose their jobs | CSO Online
Why Resilience Is More Than Just Cyber Security (inforisktoday.com)
How will the Merck settlement affect the insurance industry? (securityintelligence.com)
How Cyber Security Can Steer Organisations Toward Sustainability (darkreading.com)
Your firm's reputation depends on strong data security. Don't undervalue it - spectator.sme.sk
Why Your Business Needs To Level Up Its Defence Life Cycle Management (forbes.com)
The High Cost of Downtime and How to Reduce It | MSSP Alert
Is it time to split the CISO role? | CSO Online
Threats
Ransomware, Extortion and Destructive Attacks
Scattered Spider hackers switch focus to cloud apps for data theft (bleepingcomputer.com)
Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica
Ransomware Attacks Are Getting Worse | WIRED
Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register
Why ransomware is still important to business resilience - IT Security Guru
UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week
Ransomware resurgence gives small businesses cause for concern | TechFinitive
The Financial Dynamics Behind Ransomware Attacks (securityaffairs.com)
Data breaches brought on by ransomware escalate. – Channel EYE
LockBit Ransomware Again Most Active - Real Attack Surge or Smokescreen? - Security Week
Ransomware attacks skyrocket, with LockBit 3.0 at the forefront - Exponential-e Blog
New ransomware over browser threat targets uploaded files (securityintelligence.com)
CISA warns of Windows bug exploited in ransomware attacks (bleepingcomputer.com)
Zero-Day Exploits and Ransomware Trends for 2024 (govinfosecurity.com)
How will the Merck settlement affect the insurance industry? (securityintelligence.com)
Qilin Ransomware: What You Need To Know | Tripwire
Linux version of RansomHub ransomware targets VMware ESXi VMs (bleepingcomputer.com)
Ransomware Victims
London Hospitals Knew of Cyber Vulnerabilities Years Before Hack (claimsjournal.com)
More than 100,000 patients ‘likely’ impacted by NHS cyber attack (holyrood.com)
Cyber criminals publish data from attack on NHS | UKAuthority
Change Healthcare to Start Notifying Customers Who Had Data Exposed in Cyber Attack - Security Week
512,000 radiology patient records accessed in cyber attack • The Register
Tally of victims reaches 100,000 in NHS cyber attack (thetimes.com)
Hackers demand $50M ransom payment from UK lab provider following hospital disruption - SiliconANGLE
Qilin has ‘no regrets’ over the healthcare crisis it caused • The Register
Don't blame us for people suffering - London hospital hackers - BBC News
Borders: NHS board warns patients over stolen personal details | The National
Cyber attack on a UK staffing company: a 'war story' - Osborne Clarke | Osborne Clarke
Hospital cyber attack turns deadly as drugs given to wrong patients - Washington Times
British Library to renew entire IT system as it reveals £1.6m cyber attack loss (civilsociety.co.uk)
Panera Bread likely paid a ransom in March ransomware attack (bleepingcomputer.com)
NHS boss says Scottish trust didn't meet attackers' demands • The Register
Cyber attack shuts down Israeli pharma company's distribution | Ctech (calcalistech.com)
Phishing & Email Based Attacks
Nigerian national faces prison for $1.5M phishing scam • The Register
Email threats are becoming more dangerous than ever — so keep an eye on your inbox | TechRadar
Worldwide 2023 Email Phishing Statistics and Examples | Trend Micro (US)
Your company needs a BEC policy and five other email security trends (betanews.com)
Malicious emails trick consumers into false election contributions - Help Net Security
Convicted BEC scammer could face over 100 years in prison (bitdefender.com)
Security bug allows anyone to spoof Microsoft employee emails | TechCrunch
Why You Shouldn't Unsubscribe From Spam Emails | HackerNoon
Cyber Criminals Target Trump Supporters with Donation Scams - Security Boulevard
Latest Cyber Insurance Policy Takes Aim at Phishing Attacks (inforisktoday.com)
BEC
Your company needs a BEC policy and five other email security trends (betanews.com)
Convicted BEC scammer could face over 100 years in prison (bitdefender.com)
Other Social Engineering
Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register
Malware peddlers love this one social engineering trick! - Help Net Security
Fake Google Chrome errors trick you into running malicious PowerShell scripts (bleepingcomputer.com)
Explained: Android overlays and how they are used to trick people | Malwarebytes
Cyber Criminals Target Trump Supporters with Donation Scams - Security Boulevard
Artificial Intelligence
'Sleepy Pickle' Exploit Subtly Poisons ML Models (darkreading.com)
Criminals, too, see productivity gains from AI | CSO Online
AI’s impact on data privacy remains unclear - Help Net Security
Can governments turn AI safety talk into action? | ZDNET
How to bypass ChatGPT restrictions (androidpolice.com)
Apple Intelligence Could Introduce Device Security Risks (darkreading.com)
How big is the AI threat to the cyber security of tech companies? | TechRadar
NIS2 Directive: Stronger EU Cyber Security in the AI era | News | GRC World Forums
Hallucinated Packages, Malicious AI Models, and Insecure AI-Generated Code - Security Boulevard
Microsoft's Recall changes might be too little, too late | TechTarget
Meta Pauses AI Training on EU User Data Amid Privacy Concerns (thehackernews.com)
CISA leads first tabletop exercise for AI cyber security | CyberScoop
How AI lies, cheats, and grovels to succeed - and what we need to do about it | ZDNET
2FA/MFA
The absence of multi factor authentication led to the Medibank hack, regulator alleges - ABC News
Medibank breach: Security failures revealed (lack of MFA among them) - Help Net Security
Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)
'ONNX' MFA Bypass Targets Microsoft 365 Accounts (darkreading.com)
Malware
Hackers Exploit Legitimate Websites to Deliver BadSpace Windows Backdoor (thehackernews.com)
The art of concealment: how hackers hide malware | Cybernews
New Malware Targets Exposed Docker APIs for Cryptocurrency Mining (thehackernews.com)
New ransomware over browser threat targets uploaded files (securityintelligence.com)
Clever macOS malware delivery campaign targets cryptocurrency users - Help Net Security
NiceRAT Malware Targets South Korean Users via Cracked Software (thehackernews.com)
Mobile
Explained: Android overlays and how they are used to trick people | Malwarebytes
Internet of Things – IoT
IoT password ban a start, but admins can’t afford to wait for regulators | TechRadar
Data Breaches/Leaks
Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)
Cyber criminals publish data from attack on NHS | UKAuthority
Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)
The Resurgence of Major Data Breaches? - Security Boulevard
Insurance giant Globe Life investigating web portal breach (bleepingcomputer.com)
Truist Bank confirms breach after stolen data shows up on hacking forum (bleepingcomputer.com)
More than 100,000 patients ‘likely’ impacted by NHS cyber attack (holyrood.com)
Total Fitness database exposed 474k member and staff images • The Register
Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED
Dark-web kingpin puts 'stolen' internal AMD data up for sale • The Register
AMD Investigates Possible Breach Amid Hacker’s Sale of Company Data (pcmag.com)
Optus cyber attack could have been prevented four years prior, says telecoms watchdog - ABC News
T-Mobile denies it was hacked, links leaked data to vendor breach (bleepingcomputer.com)
Threat Actor Claims AMD and Apple Breaches - Infosecurity Magazine (infosecurity-magazine.com)
Change Healthcare to Start Notifying Customers Who Had Data Exposed in Cyber Attack - Security Week
512,000 radiology patient records accessed in cyber attack • The Register
Coding error in forgotten API blamed for massive data breach • The Register
Panera Notifies Employees of Compromised Data (darkreading.com)
Cyber Attack Exposes Freelancer Personal Data - Freelance Informer
Hackers Derail Amtrak Guest Rewards Accounts in Breach (darkreading.com)
Organised Crime & Criminal Actors
UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week
Are We Turning the Corner in the Fight Against Cyber Crime? It’s Complicated. - Security Boulevard
Convicted BEC scammer could face over 100 years in prison (bitdefender.com)
Microsoft hacker avoids jail over multiple cyber attacks - BBC News
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
New Malware Targets Exposed Docker APIs for Cryptocurrency Mining (thehackernews.com)
Clever macOS malware delivery campaign targets cryptocurrency users - Help Net Security
"Researchers" exploit Kraken exchange bug, steal $3 million in crypto (bleepingcomputer.com)
Insider Risk and Insider Threats
The Rise of the Outside Insider Threat | AFCEA International
Former IT employee gets 2.5 years for wiping 180 virtual servers (bleepingcomputer.com)
10 Ways Employees Are Sabotaging Your Cyber Security Stance (informationweek.com)
Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)
Insurance
Latest Cyber Insurance Policy Takes Aim at Phishing Attacks (inforisktoday.com)
How will the Merck settlement affect the insurance industry? (securityintelligence.com)
Supply Chain and Third Parties
Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)
Hackers demand $50M ransom payment from UK lab provider following hospital disruption - SiliconANGLE
London Hospitals Knew of Cyber Vulnerabilities Years Before Hack (claimsjournal.com)
Cyber attacks on London's hospitals affect 800 planned operations - BBC News
Tally of victims reaches 100,000 in NHS cyber attack (thetimes.com)
Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED
T-Mobile denies it was hacked, links leaked data to vendor breach (bleepingcomputer.com)
Cloud/SaaS
Scattered Spider hackers switch focus to cloud apps for data theft (bleepingcomputer.com)
Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)
Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register
Microsoft admits no guarantee of sovereignty for UK policing data | Computer Weekly
The rise of SaaS security teams - Help Net Security
The Annual SaaS Security Report: 2025 CISO Plans and Priorities (thehackernews.com)
Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED
'ONNX' MFA Bypass Targets Microsoft 365 Accounts (darkreading.com)
The NCSC’s Take on SaaS - Adaptive Shield (adaptive-shield.com)
Encryption
Stop playing games with online security, Signal president warns EU lawmakers | TechCrunch
Signal, MEPs urge EU Council to drop encryption-eroding law • The Register
Linux and Open Source
New Linux malware is controlled through emojis sent from Discord (bleepingcomputer.com)
New ARM 'TIKTAG' attack impacts Google Chrome, Linux systems (bleepingcomputer.com)
Linux version of RansomHub ransomware targets VMware ESXi VMs (bleepingcomputer.com)
Passwords, Credential Stuffing & Brute Force Attacks
What is a password spraying attack? | Proton
Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)
Hackers can crack 59% of passwords in an hour | Kaspersky official blog
Criminals are Easily Bypassing Passkeys – How Organisations Can Stay Safe - Security Boulevard
Social Media
Why Trading Privacy for 'Free' Web Services Must End (darkreading.com)
4 ways oversharing on social media puts your privacy at risk | TechRadar
New Linux malware is controlled through emojis sent from Discord (bleepingcomputer.com)
US surgeon general wants social media warning labels - BBC News
Meta Pauses AI Training on EU User Data Amid Privacy Concerns (thehackernews.com)
Malvertising
Google Chrome Will Track You For The Next 200 Days—Then It May Get Worse (forbes.com)
Training, Education and Awareness
Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)
Regulations, Fines and Legislation
Regulatory Changes Are on the Horizon. Are Companies Ready? (govinfosecurity.com)
Regulators urged to promote cyber security investment - Risk.net
UK organisations are confident they will meet the NIS 2 compliance timeline | The Independent
Pressure mounts on CISOs as SEC bares teeth with legal action - Help Net Security
Why Regulated Industries are Turning to Military-Grade Cyber Defences (thehackernews.com)
Can governments turn AI safety talk into action? | ZDNET
NIS2 Directive: Stronger EU Cyber Security in the AI era | News | GRC World Forums
The absence of multi factor authentication led to the Medibank hack, regulator alleges - ABC News
Signal, MEPs urge EU Council to drop encryption-eroding law • The Register
SEC cyber security filings on the rise as new reporting rules bite | ITPro
Models, Frameworks and Standards
Why NIS2 is set to become a ‘cornerstone’ of cyber security (siliconrepublic.com)
Careers, Working in Cyber and Information Security
Most cyber security pros took time off due to mental health issues - Help Net Security
The Perilous Role of the CISO: Navigating Modern Minefields - Security Week
Navigating the Cyber Security Hiring Trenches: Challenges, Realities, and Paths Forward | HackerNoon
To Address Burnout, Cyber Security Must Learn to Tolerate Failure (informationweek.com)
Cyber security burnout is costing US enterprises over $620 million a year (techinformed.com)
Effectively upskilling cyber security professionals to help close the skills gap | CSO Online
Cyber Security Burnout Crisis: Burnout in Next 12 Months (thehrdirector.com)
9 ways CSOs lose their jobs | CSO Online
Making the Move From Tech Expert to Cyber Security Leader (inforisktoday.com)
Is it time to split the CISO role? | CSO Online
ISC2/CIISec Tips on Recruitment, Retention in Cyber Security (govinfosecurity.com)
Law Enforcement Action and Take Downs
Nigerian national faces prison for $1.5M phishing scam • The Register
Former IT employee gets 2.5 years for wiping 180 virtual servers (bleepingcomputer.com)
UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week
Suspected dark-web Empire Market admins charged in the US • The Register
Two Men Plead Guilty to Hacking Law Enforcement Database for Doxing - Security Week
Convicted BEC scammer could face over 100 years in prison (bitdefender.com)
Rogue IT director pleads guilty to $2.1M scam charges • The Register
Sellafield pleads guilty to criminal charges over cyber security failings (yahoo.com)
Microsoft hacker avoids jail over multiple cyber attacks - BBC News
Misinformation, Disinformation and Propaganda
Addressing Misinformation in Critical Infrastructure Security (darkreading.com)
ISIS Created Fake CNN and Al Jazeera Broadcasts | WIRED
US election official: ‘Whack-a-mole’ strategies less effective to combat disinfo | CyberScoop
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Is Cyber Becoming a Primary Domain of Warfare? (inforisktoday.com)
Nation State Actors
China
Chinese Threats Aim for Government Sector - Security Boulevard
British army delays King Charles cap badges over China spying fears (ft.com)
Bug Bounty Programs, Hacking Contests Power China's Cyber Offense (darkreading.com)
China's 'Velvet Ant' APT Nests Inside Multiyear Espionage Effort (darkreading.com)
China-Linked Hackers Infiltrate East Asian Firm for 3 Years Using F5 Devices (thehackernews.com)
Chinese Cyber Espionage Targets Telecom Operators in Asia Since 2021 (thehackernews.com)
Russia
ICC probes cyber attacks in Ukraine as possible war crimes, sources say | Reuters
US Bans Kaspersky Software, Citing National Security Risks (thehackernews.com)
The Rise of the Outside Insider Threat | AFCEA International
France wants to remind you of Russia’s threat to democracy • The Register
Poland points to Russian hackers in disruption of Euro 2024 broadcast (therecord.media)
Sweden says Russia is interfering with Nordic satellites • The Register
USA and G7 to increase cyber security of their energy sector / The New Voice of Ukraine (nv.ua)
Russians report some outages on bank apps after cyber attack, says Kommersant daily (yahoo.com)
Iran
Germany Warns of Growing Espionage, Cyber Threats from Iran | Iran International (iranintl.com)
North Korea
NiceRAT Malware Targets South Korean Users via Cracked Software (thehackernews.com)
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
ISIS Created Fake CNN and Al Jazeera Broadcasts | WIRED
Hamas Hackers Sling Stealthy Spyware Across Egypt, Palestine (darkreading.com)
Tools and Controls
More than 70% of companies increased spending on proactive security | Security Magazine
Get your legal ducks in a row to contain a crisis - Katy MacAskill (scotsman.com)
The importance of collaborating AI with human expertise (securitybrief.co.nz)
Edge Devices: The New Frontier for Mass Exploitation Attacks - Security Week
Your company needs a BEC policy and five other email security trends (betanews.com)
The rise of SaaS security teams - Help Net Security
The Software Licensing Disease Infecting Our Nation's Cyber Security (darkreading.com)
Massachusetts 911 Outage Caused by Errant Firewall - Security Week
How Cyber Security Can Steer Organisations Toward Sustainability (darkreading.com)
How A Cyber Security Audit Can Identify Risk of Compromise | HealthLeaders Media
Defending your ever-changing attack surface - IT Security Guru
US, Allies Publish Guidance on Securing Network Access - Security Week
Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)
Microsoft 365's Security Gaps: Logging and Beyond (govinfosecurity.com)
From Reactive to Proactive Threat Hunting - GovInfoSecurity
Cyber Security Practices For Remote Working - TechRound
Tabletop exercises are headed to the next frontier: Space (talosintelligence.com)
What Will the Next-Gen of Security Tools Look Like? | HackerNoon
The NCSC’s Take on SaaS - Adaptive Shield (adaptive-shield.com)
Reports Published in the Last Week
Report urges extending scope of cyber security measures | UKAuthority
240528_McPartland_Review.pdf (stephen-mcpartland.com)
National Cyber Resilience Advisory Board (NCRAB) minutes: March 2024 - gov.scot (www.gov.scot)
The Annual SaaS Security Report: 2025 CISO Plans and Priorities (thehackernews.com)
Other News
The importance of collaborating AI with human expertise (securitybrief.co.nz)
Report urges extending scope of cyber security measures | UKAuthority
What is the current state of Security Culture in Europe? | TechRadar
Cyber attack shuts down Israeli pharma company's distribution | Ctech (calcalistech.com)
Sellafield pleads guilty to criminal charges over cyber security failings (yahoo.com)
How resilient is UK Critical National Infrastructure to cyber attack? - Committees - UK Parliament
Microsoft 365's Security Gaps: Logging and Beyond (govinfosecurity.com)
Massachusetts 911 Outage Caused by Errant Firewall - Security Week
Microsoft 'accepts responsibility' for cyber security failures, top exec says (qz.com)
What Does the Future of Cyber Security in Space Look Like? (govtech.com)
Space: The Final Frontier for Cyber Attacks (darkreading.com)
A new fear for CSOs: The sky is falling | CSO Online
The Software Licensing Disease Infecting Our Nation's Cyber Security (darkreading.com)
Cyber Security Challenges For UK Private Bankers - TechRound
New maritime cyber security body launches - Port Technology International
Vietnam's internet again in trouble as 3/5 sub cables cut • The Register
Cyber Attack Hits Software Provider for Car Dealers Across the US (claimsjournal.com)
Improving OT cyber security remains a work in progress - Help Net Security
Vulnerability Management
The Ultimate Guide to Troubleshooting Vulnerability Scan Failures - Security Boulevard
Zero-Day Exploits and Ransomware Trends for 2024 (govinfosecurity.com)
Vulnerabilities
Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica
New Wi-Fi Takeover Attack—All Windows Users Warned To Update Now (forbes.com)
Arm Memory Tag Extensions broken by speculative execution • The Register
VMware by Broadcom warns of critical vCenter flaws • The Register
Critical VMware Bugs Open Swaths of VMs to RCE, Data Theft (darkreading.com)
CISA warns of Windows bug exploited in ransomware attacks (bleepingcomputer.com)
Security Researchers Expose Critical Flaw in Ivanti Software (databreachtoday.co.uk)
New ARM 'TIKTAG' attack impacts Google Chrome, Linux systems (bleepingcomputer.com)
Dark-web kingpin puts 'stolen' internal AMD data up for sale • The Register
AMD Investigates Possible Breach Amid Hacker’s Sale of Company Data (pcmag.com)
Chrome 126 Update Patches Vulnerability Exploited at Hacking Competition - Security Week
Fortinet, Ivanti zero-day victims face evolved persistence by the espionage actor | CSO Online
SolarWinds Serv-U path traversal flaw actively exploited in attacks (bleepingcomputer.com)
Atlassian fixed six high-severity bugs in Confluence (securityaffairs.com)
ASUS fixed critical remote authentication bypass bug in several routers (securityaffairs.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory 19 June 2024 – Critical VMware vCenter Remote Code Execution and Privilege Escalation Vulnerability
Black Arrow Cyber Advisory 19 June 2024 – Critical VMware vCenter Remote Code Execution and Privilege Escalation Vulnerability
Executive summary
Broadcom have released patches addressing three vulnerabilities affecting VMware vCenter. Two of the vulnerabilities are critical severity, allowing remote code execution (CVE-2024-37079 and CVE-2024-37080) the other which allows an attacker to gain admin privileges (CVE-2024-37081).
What’s the risk to me or my business?
If the vulnerabilities are successfully exploited this will allow an attacker to perform arbitrary remote code execution, and the other will allow a local authenticated user to gain admin privileges. All of the vulnerabilities if exploited could have a high impact on the confidentiality, integrity and availability of the organisations data on affected systems.
What can I do?
There is no evidence that the vulnerabilities are being exploited in the wild, however Black Arrow recommends applying the available patches for the vulnerability as soon as possible, further information can be found in the Broadcast advisory below.
Technical Summary
CVE-2024-37039 and CVE-2024-37080 – vCenter Server contains a heap-overflow vulnerability in the Distributed Computing Environment/Remote Procedure Call (DCERPC) protocol. These vulnerabilities allow an attacker to potentially perform arbitrary remote code execution by sending specially crafted network packets.
CVE-2024-37081 – vCenter contains multi local privilege escalation vulnerabilities due to misconfigurations of sudo. This allows an authenticated local user with non-administrative privileges to elevate to root (admin) privileges on vCenter Server Appliance.
Further information on the VMware advisory can be found here:
https://core.vmware.com/resource/vmsa-2024-0012-questions-answers#introduction
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Briefing 14 June 2024
Black Arrow Cyber Threat Intelligence Briefing 14 June 2024:
-Phishing Attacks Targeting US and European Organisations Double
-78% of People Use the Same Password Across Multiple Accounts
-IT Downtime Cuts Enterprise Profit by 9%
-Financial Services, The Golden Target for Cyber Criminals
-Forced-Labour Camps Fuel Billions of Dollars in Cyber Scams
-Why You Must Consider the Security Risks of BYOD
-Cyber Criminals Work Faster Than Ever
-IoT Vulnerabilities Skyrocket, Becoming Key Entry Point for Attackers
-Cyber Security Is a Boardroom Issue
-An Evolving Threat Landscape: A Battle Between Good and Evil, with Small Business Cyber Security Threats on the Rise
-Ransomware Gangs are Adopting “More Brutal” Tactics Amid Crackdowns
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Phishing Attacks Targeting US and European Organisations Double
A recent report by Abnormal Security reveals a significant rise in phishing attacks targeting organisations, with Europe experiencing a 112.4% increase between April 2023 and April 2024, and the US seeing a 91.5% rise. The report, "Email Security Threats in Europe: Insights into Attack Trends," highlights that phishing, although not the most costly attack type, often serves as a gateway for further crimes. Additionally, business email compromise (BEC) attacks surged by 123.8% in Europe and 72.2% in the US, including vendor email compromise (VEC) schemes involving fraudulent payments and wire transfers.
78% of People Use the Same Password Across Multiple Accounts
A recent report from Forbes reveals troubling trends in password security. Based on a survey of 2,000 individuals, the survey found that 78% of individuals reuse passwords across multiple accounts, with 52% using the same password for at least three accounts. Notably, 22% of users do not use any safety measures to secure their passwords. Social media accounts are the most likely targets for password hacking at 29%, followed by email accounts at 15%. According to the survey respondents, the most common reason their passwords were hacked was due to weak passwords (35%) and repeated use of the same password (30%).
IT Downtime Cuts Enterprise Profit by 9%
A recent study by Splunk, titled “The Hidden Costs of Downtime,” reveals that eliminating downtime could save large enterprises $200 million annually, equivalent to a 9% increase in yearly profits. The study, conducted by Oxford Economics, found that nearly $49 million of downtime costs stem from lost revenue, with additional expenses from regulatory fines ($22 million), SLA penalties ($16 million), and legal costs ($15 million). While enterprises spend an average of $19 million on ransomware and data extortion payouts, they typically budget only $13.4 million for these incidents. Human error was identified as the leading cause of downtime, followed by malware and phishing attacks. Visibility is crucial in this context, as are risk-mitigation strategies that align with business risk objectives. Visibility serves as the basis for swift detection and response efforts, involving IT, security, and line-of-business leaders.
Financial Services, The Golden Target for Cyber Criminals
A recent IMF report highlights that the financial sector has faced over 20,000 cyber attacks, resulting in $12 billion in losses over the past 20 years. Despite being heavily regulated, the sector remains a prime target, with ransomware attacks increasing by 64% in 2023 compared to 2021. Digitalisation has introduced new vulnerabilities, particularly with unstructured data, which constitutes 80% of banks' data. Nearly 72% of businesses have over-provisioned access, leading to 78% experiencing security issues. With the average data breach costing $4.45 million and taking 204 days to detect, and only 54% of banking CEOs feeling well-prepared for cyber attacks, financial institutions must adopt stringent proven controls, foster a holistic security culture, and thoroughly test their systems, mitigate risks and protect critical data. It is essential too that financial services firms have rehearsed plans in place for what to do when incidents happen, as the even best technical controls in the world cannot stop every attack.
Forced-Labour Camps Fuel Billions of Dollars in Cyber Scams
A recent investigation revealed that Chinese crime syndicates, having shifted from illicit gambling to cyber fraud during the COVID-19 pandemic, have stolen over $64 billion through sophisticated scams, including a type of social engineering known as "pig butchering." Operating from cyber scam centres in Cambodia, Laos, and Myanmar, these syndicates exploit job seekers with the promise of well-paying jobs at reputable firms, but instead, force them into scamming roles. Despite regional government efforts, including China's law enforcement rescue of 45,000 workers, the scale of the operations remains vast. Financial institutions are urged to collaborate with law enforcement to combat these threats, as highlighted by Singapore's success in preventing $74 million in fraud through bank cooperation.
Why You Must Consider the Security Risks of BYOD
Research by the British Chambers of Commerce indicates that fewer than 30% of firms expect their workforce to be fully in-person over the next five years, prompting a shift towards hybrid and remote work models. This shift has led businesses to reduce in-office PCs, with employees often using their own laptops or devices, necessitating lightweight, powerful, and secure devices. The evolving security landscape is seeing increased phishing, quishing (tricking users with QR codes), and vishing (voice phishing) attacks targeting enterprise users, highlighting the critical need for robust security measures. While Bring Your Own Device (BYOD) policies may seem cost-effective, they pose significant security risks, including inadequate protection and potential data breaches, thus requiring careful consideration of long-term security and compliance costs. Employers are advised to invest in high-quality, secure devices to enhance employee satisfaction and maintain a secure work environment.
Cyber Criminals Work Faster Than Ever
Given the fast pace at which the threat landscape changes, it’s important to constantly monitor these changes if businesses are to have any chance of staying ahead of innovative cyber criminals. A recent report by Fortinet's FortiGuard Labs highlights the rapid evolution of the threat landscape, with cyber attacks commencing on average 4.76 days after new exploits are disclosed, a 43% increase in speed from early 2023. Notably, 98% of organisations detected vulnerabilities over five years old, emphasising the need for robust patching protocols. Additionally, 38 out of 143 Advanced Persistent Threat (APT) groups, including Lazarus and APT28, were noted as highly active. The report underscores the importance of collaboration and vigilance in cyber security efforts.
IoT Vulnerabilities Skyrocket, Becoming Key Entry Point for Attackers
A recent report by Forescout reveals a 136% surge in vulnerabilities within Internet of Things (IoT) devices, such as smart TVs, networking devices and printers, with 33% of nearly 19 million analysed devices found to be at risk, up from 14% in 2023. The riskiest devices include wireless access points, routers, printers, and IP cameras, which are frequently targeted by cyber criminals. The most vulnerable industries are technology, education, manufacturing, finance and healthcare.
Cyber Security Is a Boardroom Issue
A recent report highlights the increasing global momentum of cyber security regulations, driven by technologies such as cloud, containerisation, and artificial intelligence. These evolving regulatory initiatives in the US and EU are capturing the attention of boards of directors prompting them to prioritise cyber security, making it a central issue rather than just a CISO concern. Organisations must maintain a state of cyber readiness to prevent breaches, develop strategies to adapt to AI advancements, and balance compliance with security. This proactive approach is essential for mitigating threats and ensuring an integrated cyber security strategy. Being able to evidence that robust and appropriate controls are in place also puts Boards in a much more defensible position in the event of an incident when explaining actions to a regulator, customers or other stakeholders.
An Evolving Threat Landscape: A Battle Between Good and Evil, with Small Business Cyber Security Threats on the Rise
The recent Hiscox Cyber Readiness Report 2023 highlights that 41% of US small businesses experienced a cyber attack in the past year, often due to sophisticated digital tools like AI. Common threats include ransomware, phishing (53% of attacks), credential theft, and unpatched vulnerabilities. 43% of small businesses lack a network-based firewall, and 41% do not have data backup systems, indicating significant gaps in basic cyber security measures.
Further analysis by Sophos reveals that 75% of their 2023 cyber incident response cases involved small businesses, underscoring the urgent need for prudent cyber security investments. The commoditisation of advanced tools and the rise of 'cybercrime-as-a-service' have increased threats, with over 50% of organisations feeling outpaced by these dangers. Dark web marketplaces offer extensive tools, from ransomware to phishing kits, making cyber attacks accessible to low-skilled individuals. Organisations are urged to adopt actionable threat intelligence and robust solutions, including Managed Detection and Response (MDR), to stay ahead in the evolving cyber landscape.
Ransomware Gangs are Adopting “More Brutal” Tactics Amid Crackdowns
A recent report highlights the relentless rise of ransomware attacks, with 2023 witnessing record-breaking payments exceeding $1 billion globally. Healthcare and education sectors are frequently targeted, with 53% of ransomware attacks on small businesses originating from phishing. Despite increased police crackdowns, ransomware gangs are escalating their intimidation tactics, including direct threats and public data leaks. Notably, a 75% rise in data leak site posts was observed in 2023. Law enforcement operations like Operation Cronos and Operation Endgame are making strides in disrupting these operations, but any wins are unfortunately often short-lived. A large obstacle to reining in ransomware is the Hydra-esque nature of affiliates. After the LockBit disruption, analysts saw 10 new ransomware sites pop up almost immediately. The adaptable and proliferating nature of these gangs continues to challenge global cyber security efforts.
Sources
https://www.infosecurity-magazine.com/news/phishing-attacks-us-europe-double/
https://www.cio.com/article/2142338/it-downtime-cuts-enterprise-profit-by-9-says-study-3.html
https://www.finextra.com/blogposting/26288/financial-services-the-golden-target-for-cybercriminals
https://www.darkreading.com/cyber-risk/forced-labor-camps-fuel-billions-of-dollars-in-cyber-scams
https://www.infosecurity-magazine.com/opinions/security-risks-byod/
https://professionalsecurity.co.uk/products/cyber/cybercriminals-work-faster-than-ever/
https://www.infosecurity-magazine.com/news/iot-vulnerabilities-entry-point/
https://www.govinfosecurity.com/cybersecurity-now-boardroom-issue-a-25453
https://www.techradar.com/pro/an-evolving-threat-landscape-a-battle-between-good-and-evil
https://www.inc.com/hiscox/small-business-cybersecuritythreats-on-the-rise.html
Governance, Risk and Compliance
The CEO Is Next (darkreading.com)
Cyber Security Is Now a Boardroom Issue - GovInfoSecurity
The Need for Enhancing Cyber Preparedness in Financial Institutions (finextra.com)
Financial Services, the golden target for cyber criminals (finextra.com)
IT downtime cuts enterprise profit by 9%, says study | CIO
Cyber board-level reps | Professional Security
5 cyber security risks and challenges in supply chain | TechTarget
Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)
Small Business Cyber Security Threats on the Rise | Inc.com
CISO Strategies for Navigating Expanding Cyber Security Regulations (forbes.com)
What Tech Execs Can Learn From 2023’s Most Notable Cyber Security Breaches (forbes.com)
Assigning a Monetary Value to Cyber Risk | MSSP Alert
4 Ways to Help a Security Culture Thrive (darkreading.com)
Cloud migration expands the CISO role yet again - Help Net Security
Here’s how to create a security culture that adheres to the new SEC regs | SC Media (scmagazine.com)
How to Create a Cyber Risk Assessment Report (cybersaint.io)
Learning From Others' Gaps in the Wake of Major Attacks (inforisktoday.com)
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware Is ‘More Brutal’ Than Ever in 2024 | WIRED
Ransomware tracker: The latest figures [June 2024] (therecord.media)
Unpacking The Ten Most Dangerous Ransomware Gangs (informationsecuritybuzz.com)
Ransomware Group Exploits PHP Vulnerability Days After Disclosure - Security Week
Police arrest Conti and LockBit ransomware crypter specialist (bleepingcomputer.com)
Black Basta Actors Exploited Windows 0day Privilege Vulnerability (cybersecuritynews.com)
Why Akira could be the next big thing in ransomware • The Register
Should there be a total ban on ransom payments? (securityintelligence.com)
What to Do When Your Business Associate Suffers a Ransomware Attack | Dentons - JDSupra
Medical-Targeted Ransomware Is Breaking Records After Change Healthcare’s $22M Payout | WIRED
What Makes Healthcare a Prime Target for Ransomware? (govinfosecurity.com)
New Fog ransomware targets schools via hacked VPNs | TechRadar
Ransomware Victims
Christie's Says Ransomware Attack Impacts 45,000 People - Security Week
Ransomware Attack Targets Canada’s Largest School Board (bloomberglaw.com)
Cyber attack means Japanese site Niconico needs total rebuild • The Register
Phishing & Email Based Attacks
Look before you scan – the QR code scammers are phishing for business | John Naughton | The Guardian
More eggs Malware Disguised as Resumes Targets Recruiters in Phishing Attack (thehackernews.com)
New phishing toolkit uses PWAs to steal login credentials (bleepingcomputer.com)
Phishing emails abuse Windows search protocol to push malicious scripts (bleepingcomputer.com)
Most impersonated sectors, brands in phishing examined | SC Media (scmagazine.com)
BEC
Massachusetts town loses $445,000 in email scam | StateScoop
BEC attack comment | Professional Security
Other Social Engineering
How to Spot a SIM-Swap Attack (and What to Do Next) | Lifehacker
Protecting identity in a world of deepfakes and social engineering - Help Net Security
Cyber security pros change strategies to combat AI-powered threats - Help Net Security
Artificial Intelligence
Cyber security pros change strategies to combat AI-powered threats - Help Net Security
EmailGPT Exposed to Prompt Injection Attacks - Infosecurity Magazine (infosecurity-magazine.com)
The Double-Edged Sword of Generative AI - Infosecurity Magazine (infosecurity-magazine.com)
Chatham House Cyber 2024 - how AI creates new cyber security dimensions (diginomica.com)
How to spot a deepfake - Raconteur
New Attack Technique 'Sleepy Pickle' Targets Machine Learning Models (thehackernews.com)
Easily Exploitable Critical Vulnerabilities Found in Open Source AI/ML Tools - Security Week
Urgently needed: AI governance in cyber warfare - Help Net Security
Protecting identity in a world of deepfakes and social engineering - Help Net Security
GDPR turns six: Expert discusses AI impact - Help Net Security
The Emerging Ecosystem Dedicated to AI Accountability | Decipher (duo.com)
Elon Musk threatens to ban iPhones over OpenAI integration | Digital Trends
Microsoft’s Recall puts the Biden administration’s cyber credibility on the line | CyberScoop
2FA/MFA
Snowflake Breach Exposes 165 Customers' Data in Ongoing Extortion Campaign (thehackernews.com)
How scammers bypass 2FA | Securelist
Hackers Using OTP bots To Bypass Two-Factor Authentication (cybersecuritynews.com)
How to meet evolving MFA demands in the current threat landscape (bleepingcomputer.com)
Malware
China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics (thehackernews.com)
One of Microsoft’s main markets is full of malware - Softonic
WarmCookie Gives Cyber Attackers New Backdoor for Initial Access (darkreading.com)
Why malware matters most: 6 ways to foil software threats faster - Security Boulevard
Cyber Criminals Employ PhantomLoader to Distribute SSLoad Malware (thehackernews.com)
Malicious VSCode extensions with millions of installs discovered (bleepingcomputer.com)
Hundreds of Russian organisations hit with infostealer campaign | SC Media (scmagazine.com)
Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (thehackernews.com)
Mobile
How to Spot a SIM-Swap Attack (and What to Do Next) | Lifehacker
Two arrested in UK over fake cell tower smishing campaign • The Register
Why You Should Delete These 100 Dangerous Google Play Store Apps (forbes.com)
Apple Says iPhones Will Get Security Updates for at Least 5 Years - Security Week
Google Will Track Your Location For The Next 180 Days—Then It Stops
Security and privacy strategies for CISOs in a mobile-first world - Help Net Security
Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (thehackernews.com)
Security and privacy settings in WhatsApp | Kaspersky official blog
Denial of Service/DoS/DDOS
Hacktivists target Irish websites in EU-wide cyber attacks (rte.ie)
DDoS attacks target EU political parties as elections begin (bleepingcomputer.com)
Ireland Hit by Coordinated Cyber Attacks: NCSC Mobilises Response | Cork Safety Alerts
Second Australian Rare Earths Producer Suffers Cyber Attack (bloomberglaw.com)
Internet of Things – IoT
Report: Network equipment most at risk of cyber attacks | SC Media (scmagazine.com)
Dangerous Liaisons: The Interaction Between Threat Actors and High-Risk Devices - Security Week
Data Breaches/Leaks
Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica
Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)
Hotel Check-in Kiosks Expose Guest Data, Room Keys (darkreading.com)
Snowflake Is Working to Beef Up Security Controls as Firms Probe Breaches (yahoo.com)
23andMe data breach under investigation in UK and Canada (bleepingcomputer.com)
Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)
Cylance confirms the legitimacy of data offered for sale in the dark web (securityaffairs.com)
NYSE Parent Hit with $10M Fine for Failure to Report Cyber Breach | MSSP Alert
The mystery of an alleged data broker’s data breach | TechCrunch
Tile hacked: Customer data and internal tools accessed by hacker (bgr.com)
Student's flimsy bin bags blamed for latest NHS data breach • The Register
Frontier says 750,000 Social Security numbers accessed during April cyber attack (therecord.media)
'New York Times source code' leaks online via 4chan • The Register
Christie's Says Ransomware Attack Impacts 45,000 People - Security Week
White House report details all of 2023’s major gov breaches • The Register
Organised Crime & Criminal Actors
How Cyber Crime Empires Are Built (darkreading.com)
Cyber crime suspects often young, increasingly armed: Dutch police | NL Times
Forced-Labor Camps Fuel Billions of Dollars in Cyber Scams (darkreading.com)
Cyber criminals work faster than ever | Professional Security
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Cryptojacking Campaign Targets Misconfigured Kubernetes Clusters (thehackernews.com)
Insurance
Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)
Supply Chain and Third Parties
Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica
5 cyber security risks and challenges in supply chain | TechTarget
A Third-Party Risk Management Lifecycle for Cyber Security | UpGuard
Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)
Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)
What to Do When Your Business Associate Suffers a Ransomware Attack | Dentons - JDSupra
Cloud/SaaS
Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica
Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)
Snowflake Is Working to Beef Up Security Controls as Firms Probe Breaches (yahoo.com)
Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)
A CISO game plan for cloud security | InfoWorld
Why SaaS Security is Suddenly Hot: Racing to Defend and Comply (thehackernews.com)
Cloud migration expands the CISO role yet again - Help Net Security
Identity and Access Management
Protecting identity in a world of deepfakes and social engineering - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
78% of people use the same password across multiple accounts | Security Magazine
New phishing toolkit uses PWAs to steal login credentials (bleepingcomputer.com)
Regulations, Fines and Legislation
Is a US Nationwide Privacy Law Really Coming? (darkreading.com)
NYSE Parent Hit with $10M Fine for Failure to Report Cyber Breach | MSSP Alert
CISO Strategies For Navigating Expanding Cyber Security Regulations (forbes.com)
Google faces GDPR complaint over Privacy Sandbox • The Register
GDPR turns six: Expert discusses AI impact - Help Net Security
Here’s how to create a security culture that adheres to the new SEC regs | SC Media (scmagazine.com)
Data Protection
Is a US Nationwide Privacy Law Really Coming? (darkreading.com)
Careers, Working in Cyber and Information Security
Cyber Security Job Hunting May Come Down to Certifications (darkreading.com)
Cyber Security CPEs: Unraveling the What, Why & How (thehackernews.com)
The US cyber security industry needs an estimated 225,200 workers | Security Magazine
Preparing for a career in cyber security? Check out these statistics - Help Net Security
Strategies to Manage and Reduce Alert Fatigue in SOCs - IT Security Guru
70% of Cyber Security Pros Often Work Weekends - Infosecurity Magazine (infosecurity-magazine.com)
Men’s Mental Health Week: Resource Guide - IT Security Guru
Law Enforcement Action and Take Downs
Police arrest Conti and LockBit ransomware crypter specialist (bleepingcomputer.com)
Misinformation, Disinformation and Propaganda
Russia Is Targeting Germany With Fake Information as Europe Votes | WIRED
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Nation State Actors
China
Chinese hackers breached 20,000 FortiGate systems worldwide (bleepingcomputer.com)
Noodle RAT Reviewing the New Backdoor Used by Chinese-Speaking Groups | Trend Micro (US)
China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics (thehackernews.com)
Chinese Actor SecShow Conducts Massive DNS Probing on Global Scale (thehackernews.com)
The new front in China’s cyber campaign against America (economist.com)
Russia
Microsoft Says Russia 'More Aggressive' In Cyber Space (rferl.org)
bne IntelliNews - Russian cyberwar against Ukraine and the West
NATO to take tougher action on Russian spies, says Stoltenberg – POLITICO
'Sticky Werewolf' APT Stalks Aviation Sector (darkreading.com)
Russia Is Targeting Germany With Fake Information as Europe Votes | WIRED
The Paris Olympic games will likely present a high cyber risk | Security Magazine
Hundreds of Russian organisations hit with infostealer campaign | SC Media (scmagazine.com)
Putin's subs have exposed Ireland's shameless hypocrisy (telegraph.co.uk)
Tools and Controls
CISOs may be too reliant on EDR/XDR defenses | CSO Online
How to conduct an API risk assessment and improve security | TechTarget
A Third-Party Risk Management Lifecycle for Cyber Security | UpGuard
What is ELINT (electronic intelligence)? | Definition from TechTarget
9 out of 10 businesses seek AI-led threat detection and vulnerability management - IT Security Guru
What is IT incident management? | Definition from TechTarget
Strategies to Manage and Reduce Alert Fatigue in SOCs - IT Security Guru
A CISO game plan for cloud security | InfoWorld
Chinese Actor SecShow Conducts Massive DNS Probing on Global Scale (thehackernews.com)
Why SaaS Security is Suddenly Hot: Racing to Defend and Comply (thehackernews.com)
Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)
Windows Security vs. Microsoft Defender: Important differences you should know | PCWorld
Assigning a Monetary Value to Cyber Risk | MSSP Alert
20 Questions To Assess Cyber Security Risks Within An Organisation (forbes.com)
Top 10 Critical Pentest Findings 2024: What You Need to Know (thehackernews.com)
Modern fraud detection need not rely on PII - Help Net Security
How to meet evolving MFA demands in the current threat landscape (bleepingcomputer.com)
How Enterprise Browsers Enhance Security and Efficiency (inforisktoday.com)
What is communications intelligence (COMINT)? | Definition from TechTarget
Cyber Security Consolidation Ahead: Tool Sprawl Rolls Up to Platforms | MSSP Alert
AI cyber security solutions detect ransomware in under 60 seconds (securityintelligence.com)
Why CISOs need to build cyber fault tolerance into their business - Help Net Security
What Is Attack Path Mapping? - TechRound
How PE Firm CFOs Cost-Effectively Manage Cyber Risk | Kovrr - Security Boulevard
How to Create a Cyber Risk Assessment Report (cybersaint.io)
Other News
Microsoft president to testify about security lapses - Security - iTnews
Cyber attacks are hitting research institutions — with devastating effects (nature.com)
Introducing SMEs to cyber security (admin.ch)
Beware of these 7 new hacker tricks — and how to protect yourself | PCWorld
Microsoft Ignored Whistleblower Warnings Before SolarWinds Attack (pcmag.com)
Why CISOs need to build cyber fault tolerance into their business - Help Net Security
How to combat cyber threats and secure democracy in the digital age (federaltimes.com)
New Tallinn Paper focuses on Cyber Diplomacy Concepts and Practices
Microsoft in damage-control mode, says it will prioritize security over AI | Ars Technica
Microsoft now says employees will be graded on their cyber security contributions - Neowin
How PE Firm CFOs Cost-Effectively Manage Cyber Risk | Kovrr - Security Boulevard
Navigating cyber risk in the manufacturing sector | Retail Technology Review
5 Cost-Effective Cyber Security Tips To Boost Startup EBITDA (forbes.com)
Cyber Attacks on Higher Ed Rose Dramatically Last Year, Report Shows | EdTech Magazine
Vulnerability Management
9 out of 10 businesses seek AI-led threat detection and vulnerability management - IT Security Guru
Easily Exploitable Critical Vulnerabilities Found in Open Source AI/ML Tools - Security Week
Solving the systemic problem of recurring vulnerabilities - Help Net Security
AI’s role in accelerating vulnerability management - Help Net Security
Vulnerabilities
Exploit for critical Veeam auth bypass available, patch now (bleepingcomputer.com)
Exploit for Veeam Recovery Orchestrator auth bypass available, patch now (bleepingcomputer.com)
Chinese hackers breached 20,000 FortiGate systems worldwide (bleepingcomputer.com)
Microsoft June 2024 Patch Tuesday fixes 51 flaws, 18 RCEs (bleepingcomputer.com)
Chrome 126, Firefox 127 Patch High-Severity Vulnerabilities - Security Week
PoC Exploit Emerges for Critical RCE Bug in Ivanti Endpoint Manager (darkreading.com)
SolarWinds fixes severe Serv-U vulnerability (CVE-2024-28995) - Help Net Security
Cisco fixes WebEx flaw after government comms exposed • The Register
New PHP Vulnerability Exposes Windows Servers to Remote Code Execution (thehackernews.com)
Nvidia Patches High-Severity GPU Driver Vulnerabilities - Security Week
JetBrains warns of IntelliJ IDE bug exposing GitHub access tokens (bleepingcomputer.com)
Ransomware Group Exploits PHP Vulnerability Days After Disclosure - Security Week
Black Basta Actors Exploited Windows 0day Privilege Vulnerability (cybersecuritynews.com)
Multiple flaws in Fortinet FortiOS fixed (securityaffairs.com)
Netgear WNR614 flaws allow device takeover, no fix available (bleepingcomputer.com)
Adobe Plugs Code Execution Holes in After Effects, Illustrator - Security Week
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory 13 June 2024 – Microsoft Patches Critical RCE Flaw and Zero-Click Vulnerability
Black Arrow Cyber Advisory 13 June 2024 – Microsoft Patches Critical RCE Flaw and Zero-Click Vulnerability
Executive summary
Microsoft have released patches for a ‘critical’ remote code execution vulnerability (CVE-2024-30080) and a ‘high’ zero-click vulnerability (CVE-2024-30103) this week. The critical vulnerability allows an attacker to perform remote code execution by sending a specially crafted malicious Microsoft Message Queuing (MSMQ) technology packet to an MSMQ server. The zero-click vulnerability allows an attacker to bypass Outlook registry block lists and enable the creation of malicious files, which is initiated when an affected email is previewed in Outlook or opened.
What’s the risk to me or my business?
If the vulnerabilities are successfully exploited this will allow an attacker to perform arbitrary remote code execution, and the other will allow for malicious DLL files to be created. Both vulnerabilities if exploited could have a high impact on the confidentiality, integrity and availability of the organisations data on affected systems.
What can I do?
Black Arrow recommends applying the available patches for the vulnerability as soon as possible following their organisations update policies due to the severity.
Technical Summary
CVE-2024-30080 – This vulnerability allows an attacker to completely take over an affected server by sending a specially crafted malicious MSMQ packet to a MSMQ server, performing arbitrary remote code execution on the server side.
CVE-2024-30103 – This vulnerability allows an authenticated malicious actor using valid Exchange user credentials to bypass the Outlook registry block lists and enable the creation of malicious DLL files, allowing them to perform other malicious activities.
Further information on Microsoft Patches released this week can be found here:
https://msrc.microsoft.com/update-guide/releaseNote/2024-Jun
Further information on the RCE vulnerability can be found here:
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30080
Further information on the Zero-Click vulnerability can be found here:
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30103
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 12 June 2024 – Fortinet FortiGate SSL VPN Vulnerability Leads to 20,000 Systems Being Breached by China Globally
Black Arrow Cyber Advisory 12 June 2024 – Fortinet FortiGate SSL VPN Vulnerability Leads to 20,000 Systems Being Breached by China Globally
Executive summary
The Dutch cyber security agency has recently State-sponsored threat actors backed by China have gained access to 20,000 Fortinet Fortigate systems globally between 2022 and 2023 through the Coathanger malware campaign. The vulnerability (CVE-2022-42475) allows a malicious actor to remotely execute malicious code. The Coathanger malware is persistent and remains on the devices even after reboots and firmware and software updates. While Fortinet silently released an update to fix this vulnerability in November 2022, they did not announce this until December 2022 in which during this time 14,000 devices were backdoored.
What’s the risk to me or my business?
The vulnerability in Fortinet’s products affected by this could pose a significant risk to your organisation. If exploited it could allow an attacker to remain in the product even after reboots and firmware updates. It also could allow an attacker to remotely execute malicious code. This could compromise the confidentiality, integrity, and availability of your organisation’s data
What can I do?
The vulnerability is difficult to identify and remove even if the patch has been installed to fix this vulnerability, indicators of compromise can be found in the link below. If you are unsure of what to do, please contact Black Arrow for further help and guidance.
Technical Summary
CVE-2022-42475: This is a heap-based buffer overflow vulnerability which may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.
The affected products are:
· FortiOS version 7.2.0 through 7.2.2
· FortiOS version 7.0.0 through 7.0.8
· FortiOS version 6.4.0 through 6.4.10
· FortiOS version 6.2.0 through 6.2.11
· FortiOS version 6.0.0 through 6.0.15
· FortiOS version 5.6.0 through 5.6.14
· FortiOS version 5.4.0 through 5.4.13
· FortiOS version 5.2.0 through 5.2.15
· FortiOS version 5.0.0 through 5.0.14
· FortiOS-6K7K version 7.0.0 through 7.0.7
· FortiOS-6K7K version 6.4.0 through 6.4.9
· FortiOS-6K7K version 6.2.0 through 6.2.11
· FortiOS-6K7K version 6.0.0 through 6.0.14
· FortiProxy version 7.2.0 through 7.2.1
· FortiProxy version 7.0.0 through 7.0.7
· FortiProxy version 2.0.0 through 2.0.11
· FortiProxy version 1.2.0 through 1.2.13
· FortiProxy version 1.1.0 through 1.1.6
· FortiProxy version 1.0.0 through 1.0.7
Further information from the National Cyber Security Centre can be found here:
Further information on the FortiGuard Advisory can be found here:
https://www.fortiguard.com/psirt/FG-IR-22-398
Further information on the Indicators of compromise can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 11 June 2024 – Active exploitation of Check Point Zero-Day Vulnerability
Black Arrow Cyber Advisory 11 June 2024 – Active exploitation of Check Point Zero-Day Vulnerability
Executive summary
Recent exploitation of Check Point VPN zero-days have been ramping up since the proof of concept was released to the public. The actively exploited zero-day (CVE2024-24919) has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog and could allow an attacker to access sensitive information on Check Point Security gateways and allow them to obtain admin privileges. Check Point have recently stated that it is thought exploitation to have begun in early April, however Checkpoint is not due to release any patches until 20 June.
What’s the risk to me or my business?
The vulnerability in Check Point’s products could pose a significant risk to your organisation. If exploited, it could potentially allow an attacker to access sensitive information from your Check Point Security Gateways. In some instances, the attacker might even gain domain admin privileges. This could compromise the confidentiality, integrity, and availability of your organisation’s data
What can I do?
Check Point have not released any patches for this vulnerability however they have released automatic interim preventative measures deployed through AutoUpdater utility. Black arrow recommends following Check Points advice, which can be found in their advisory linked below.
Technical Summary
CVE-2024-24919 - A path traversal vulnerability, which could allow an attacker to read any file on the system. No specific privilege level is required to exploit this vulnerability.
The affected products are:
· CloudGuard Network
· Quantum Maestro
· Quantum Scalable Chassis
· Quantum Security Gateways
· Quantum Spark Appliances
A security gateway is vulnerable if one of the configurations is applied:
· If the “IPSec VPN” blade has been enabled and the Security Gateway device is part of the “Remote Access” VPN community.
· If the “Mobile Access” blade has been enabled.
The advisory provided by Check Point can be found here:
https://support.checkpoint.com/results/sk/sk182336
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Briefing 07 June 2024
Black Arrow Cyber Threat Intelligence Briefing 07 June 2024:
-Urgent Training Gap Exposed as a Quarter of Organisations Provide No Cyber Training to End-Users
-UK SMEs Unaware of the True Cost of Cyber Attacks, Whilst 78% of SMBs Fear Cyber Attacks Could Shut Down Their Business
-Major Cyber Crime Networks Dismantled in US and Europe Deemed a Wake-Up Call for Businesses, Ransomware Rises Despite Law Enforcement Takedowns
-Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT, or How the Smart TV in your Office Could Infect Your Whole Business with Malware
-CISOs Are Facing a ‘Tsunami of Regulations’; Here’s Why It’s Crucial They Focus on Quantifying Cyber Risk
-90% of Threats are Social Engineering
-UK Businesses Faced with Month-Long Recoveries from Supply Chain Attacks
-Account Takeovers Outpace Ransomware as Top Security Concern
-The Impact of Legacy Vulnerabilities in Today's Cyber Security Landscape
-Nearly All FTSE 100 Companies Exposed to Third and Fourth-Party Breaches
-Snowflake Denies Breach, Blames Data Theft on Poorly Secured Customer Accounts
-97 percent of Security Experts Worry about AI Security Related Threats and Incidents
-85% of Managed Service and Security Providers Face “Significant” Challenges Maintaining Security Compliance for Clients
-Cyber Attack Causes Critical Incident in London Hospitals with Operations Cancelled and Emergency Patients Diverted
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Urgent Training Gap Exposed as a Quarter of Organisations Provide No Cyber Training to End-Users
A recent survey by Hornetsecurity highlights a concerning gap in IT security training among organisations, with 26% not providing any training to end-users. While 79% of organisations believe their training is moderately effective, 39% admit it fails to address recent AI-powered threats adequately. Notably, 31% of respondents found the training unengaging. The survey also revealed that 23% of organisations experienced a cyber security breach in the past year, leading 94% to implement additional controls. However, 52% of end-users often ignore identified threats, emphasising the need for ongoing, engaging, and adaptive training programmes.
Black Arrow supports organisations of all sizes in designing and delivering proportionate user education and awareness programmes, including in-person and online training as well as simulated phishing campaigns. Our programmes help secure employee engagement and build a cyber security culture to protect the organisation.
UK SMBs Unaware of True Cost of Cyber Attacks, 78% of SMBs Fear Cyber Attacks Could Shut Down Their Business
New research reveals that UK SMBs underestimate the financial impact of cyber attacks by nearly £85,000. SMBs that have not experienced an attack estimate losses at £39,633, while those that have suffered breaches report actual losses at £123,984.
A separate report by ConnectWise reveals that 94% of SMBs have experienced at least one cyber attack in the last year, up from 64% in 2019, highlighting a significant rise in cyber threats. The report shows that 76% of SMBs lack in-house cyber security skills, driving demand for externally sourced third party security experts. Additionally, 78% of SMBs fear a severe cyber attack could jeopardise their operations. The study found that 56% have faced a cyber attack so far this year, with 89% anticipating another within six months. 83% of SMBs plan to increase their cyber security budgets by an average of 19% over the next year to bolster defences.
Major Cyber Crime Networks Dismantled in US and Europe Deemed a Wake-Up Call for Businesses, Although Ransomware Rises Despite Law Enforcement Takedowns
The recent crackdown on cyber crime by the US and Europe underscores the critical need for robust cyber security measures for businesses. The US Department of Justice arrested Chinese national YunHe Wang, who allegedly compromised over 19 million devices, resulting in $5.9 billion in fraudulent claims. Europol simultaneously apprehended key figures in Armenia and Ukraine, dismantling ransomware networks extorting millions in cryptocurrency. Despite these efforts, a recent report from Mandiant reveals a 75% increase in ransomware activity in 2023, with nearly 1,400 victims across 110 countries.
Factors driving this resurgence include new ransomware entrants, partnerships between groups, and the use of remote management tools, which featured in 41% of intrusions. Established groups like ALPHV/BlackCat and LockBit were prominent, but the landscape also saw 50 new ransomware variants, with a trend towards updating existing families rather than creating new ones.
Businesses must adopt comprehensive security training, regular system updates, advanced threat detection, and incident response planning to mitigate these substantial threats.
Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT, or How the Smart TV in your Office Could Infect Your Whole Business with Malware
A recent report underscores the escalating cyber risks linked to the Internet of Things (IoT), especially for critical infrastructure. Vulnerable legacy IoT devices, often manually updated, pose significant security risks.
Additionally, there is now more malware specifically targeting IoT devices, such as the Pandoraspear malware, which targets smart TVs via free streaming sites accessed on smartphones. This malware turns TVs into part of a botnet for Distributed Denial of Service (DDoS) attacks. The botnet has compromised over 170,000 endpoints, with estimates suggesting it involves 1.3 million unique IP addresses.
These findings highlight the critical need for enhanced cyber security measures to safeguard against IoT threats, including changing default passwords, network isolation, encrypting data, and conducting regular software updates.
CISOs Are Facing a ‘Tsunami of Regulations’; Here’s Why It’s Crucial They Focus on Quantifying Cyber Risk
Recent discussions emphasise the challenges CISOs encounter when trying to quantify cyber risk in the face of an influx of new regulations such as NIS2 in Europe and SEC requirements in the US that are transforming the way security leaders handle risks. CISOs must translate diverse threats into simplified metrics to communicate effectively with boards. The importance of continuous assessment over annual checks to keep up with evolving vulnerabilities cannot be stressed enough. A mature approach involves visibility, prioritisation, communication, and quantification of risks. The focus should be on defending yourself against the attacker by maintaining credible controls, not on defending yourself against the regulator through a weak tick box exercise.
90% of Threats are Social Engineering
The Avast Q1 2024 Threat Report reveals that nearly 90% of threats were social engineering-based, with scams and phishing utilising deepfake technology and hijacked YouTube channels. Over 90% of mobile threats were scams, including adware and banker malware. YouTube was heavily exploited for phishing and crypto scams.
UK Businesses Faced with Month-Long Recoveries from Supply Chain Attacks
New research by BlackBerry shows that 38% of British organisations face month-long recovery times following software supply chain attacks. The survey, involving 200 IT decision-makers, found that 74% of UK IT leaders were notified of supply chain attacks or vulnerabilities in the past year. While regulatory requirements are encouraging proactive monitoring, a lack of technical knowledge and confidence to act on threats persists. Notably, only 22% of organisations perform real-time inventories of their software environment. The impacts of these attacks include financial loss (62%), data loss (59%), and reputational damage (57%).
Account Takeovers Outpace Ransomware as Top Security Concern
A recent survey by Abnormal Security highlights account takeover attacks as the primary threat to organisations. According to the 2024 State of Cloud Account Takeover Attacks Report, 83% of organisations experienced at least one such attack in the past year, with 77% of security leaders ranking them among their top four threats. Nearly half faced these attacks over five times annually, and 20% encountered more than ten incidents. Despite common defences like multi-factor authentication and strong password policies, 63% of respondents doubted MFA’s effectiveness. The survey emphasises the need for solutions offering cross-platform visibility and automated remediation to combat these pervasive threats effectively.
The Impact of Legacy Vulnerabilities in Today's Cyber Security Landscape
Research shows that the vulnerabilities most affecting small to medium sized businesses (SMBs) are older, known vulnerabilities rather than newer highly publicised zero-days. According to SonicWall’s data from January 2022 to March 2024, the top five network attacks included Log4j (43%) and Heartbleed (35%), both of which target vulnerabilities up to a decade old. Despite advancements in AI and novel threats, these older vulnerabilities remain significant risks due to their ease of exploitation and how widespread they continue to be. SMBs, especially in critical industries, are advised to utilise industry-leading tools and automated patches, ensuring robust cyber security measures against both old and new threats.
Nearly All FTSE 100 Companies Exposed to Third and Fourth-Party Breaches
A recent report by SecurityScorecard reveals that virtually all FTSE 100 companies had suppliers experiencing breaches in the past year. The UK Top 100 Companies: Cybersecurity Threat Report graded firms A-F based on factors predicting a security breach. While UK firms generally scored higher than their continental counterparts, 97% had breaches in their third-party ecosystem. This shows the increasing threat of supply chain attacks, with 97% also experiencing fourth-party breaches. Notably, the energy and basic materials sectors were the most secure, with only 12% and 16% reporting third-party breaches, respectively, while the communications sector had the lowest security posture.
Snowflake Denies Breach, Blames Data Theft on Poorly Secured Customer Accounts
Recent incidents involving cloud storage provider Snowflake highlights the risks associated with compromised credentials. A threat actor claimed to have breached Snowflake’s infrastructure, accessing data from Santander, Ticketmaster and others. However, Snowflake maintains that the theft resulted from stolen customer login details, not a vulnerability or misconfiguration in their system. Snowflake’s CISO clarified that a former employee's demo account was accessed, which was not protected by two-factor authentication (2FA). Santander confirmed a third-party database breach, and Ticketmaster identified unauthorised activity in a Snowflake-hosted database. Snowflake, alongside Crowdstrike and Mandiant, found no evidence implicating Snowflake's platform itself.
97 percent of Security Experts Worry about AI Security Related Threats and Incidents
A new report from Deep Instinct reveals that 97% of security professionals fear AI-generated security incidents, prompting 75% to alter their cyber security strategies over the past year, with 73% focusing more on prevention. The survey of 500 senior experts from large enterprises also shows a 61% rise in deepfake incidents, primarily targeting CEOs and C-suite members. Stress levels have increased for 66% of cyber security professionals due to these threats. Despite 41% relying on endpoint detection and response (EDR) solutions, only 31% plan to boost EDR investments, while 53% feel board pressure to adopt preventative tools against AI threats. This report highlights the need for predictive prevention to enhance resilience.
85% of Managed Service and Security Providers Face “Significant” Challenges Maintaining Security Compliance for Clients
Recent reports by Apptega and Sophos reveals that 85% of managed service providers (MSPs) face significant challenges in maintaining compliance for customers due to resource, expertise, and technology gaps. The MSP Perspectives 2024 survey reveals that MSPs struggle to keep pace with evolving threats and industry trends, with 91% of ransomware attacks occurring outside business hours.
Cyber Attack Causes Critical Incident in London Hospitals with Operations Cancelled and Emergency Patients Diverted
Major hospitals in London declared a critical incident earlier in the week after a cyber attack led to operations being cancelled and emergency patients being diverted elsewhere. It applies to hospitals partnered with Synnovis, a provider of pathology services which suffered a ransomware attack linked to Russian threat actors. King’s College Hospital, Guy’s and St Thomas’, the Royal Brompton and the Evelina London Children’s Hospital, as well as primary care services, were among those affected.
The incident has had a "major impact" on the delivery of services, especially blood transfusions and test results. Some procedures were cancelled or were redirected to other NHS providers as the hospitals tried to establish what work can be carried out safely.
Sources:
https://www.commsbusiness.co.uk/content/news/uk-smes-unaware-of-the-true-cost-of-cyberattacks
https://www.helpnetsecurity.com/2024/06/06/smbs-cyberattack-frequency/
https://www.infosecurity-magazine.com/news/ransomware-rise-2023-mandiant/
https://www.insurancejournal.com/news/international/2024/06/06/778306.htm
https://www.helpnetsecurity.com/2024/06/06/social-engineering-threats-video/
https://www.infosecurity-magazine.com/news/uk-businesses-recoveries-supply/
https://www.infosecurity-magazine.com/news/ato-outpace-ransomware-top/
https://www.techradar.com/pro/the-impact-of-legacy-vulnerabilities-in-todays-cybersecurity-landscape
https://www.infosecurity-magazine.com/news/ftse-100-exposed-third-fourth/
https://www.helpnetsecurity.com/2024/06/01/snowflake-breach-data-theft/
https://betanews.com/2024/06/03/97-percent-of-organizations-worried-about-ai-security-threats/
https://www.businesswire.com/news/home/20240605033270/en
https://www.bbc.co.uk/news/articles/c288n8rkpvno
https://securityaffairs.com/164142/cyber-crime/ransomware-attack-synnovis-london-hospitals.html
Governance, Risk and Compliance
78% of SMBs fear cyber attacks could shut down their business - Help Net Security
26% of organisations lack any form of IT security training - Help Net Security
Cyber attacks on financial services firms hit 20m people in 2023 - CIR Magazine
Small Firms Need to Stretch Security Budgets - Infosecurity Magazine (infosecurity-magazine.com)
Microsoft: weak cyber defences set to hit economic growth (cityam.com)
How to Prove Security Effectiveness with a Cyber Security Board Report - Security Boulevard
Skills shortages exposing MSPs to security risks | Microscope (computerweekly.com)
Is your workplace ‘cyber savvy’? (siliconrepublic.com)
Governance Essentials for Businesses in the AI Era | News | GRC World Forums
49% of organisations feel somewhat prepared to handle a breach | Security Magazine
Mastering Cyber Risk Quantification Methods: A Strategic Approach - Security Boulevard
Deciding cyber security spend: how much is enough? | Propertymark
Effective Incident Response: A Cyber Security Playbook for Executives - Security Boulevard
1/3 of CISOs in the UK ignore NCSC cyber security guidance (verdict.co.uk)
4 communication mistakes to avoid during a data breach - PR Daily
80 percent of organisations not ready for CISA rules on security practices (betanews.com)
Threats
Ransomware, Extortion and Destructive Attacks
RansomHub extortion gang linked to now-defunct Knight ransomware (bleepingcomputer.com)
RansomHub Actors Exploit ZeroLogon Vuln in Recent Ransomware Attacks (darkreading.com)
FBI recovers 7,000 LockBit keys, urges ransomware victims to reach out (bleepingcomputer.com)
Security industry has ransomware-as-a-service model wrong, says expert | SC Media (scmagazine.com)
'Fog' Ransomware Rolls in to Target Education, Recreation Sectors (darkreading.com)
New Gitloker attacks wipe GitHub repos in extortion scheme (bleepingcomputer.com)
Cyber insurance isn't the answer for ransom payments - Help Net Security
Linux version of TargetCompany ransomware focuses on VMware ESXi (bleepingcomputer.com)
What is ransomware? 7 things you must know before it's too late | PCWorld
Ransomware Victims
MediSecure in administration just weeks after confirming large cyber attack - ABC News
A ransomware attack on Synnovis impacted several London hospitals (securityaffairs.com)
Consulting Firm Greylock Hit With Ransomware Attack Class Action (bloomberglaw.com)
RansomHub gang claims the hack of Frontier Communications (securityaffairs.com)
Christie's avoids leak of stolen data, is sold instead • The Register
FBI recovers 7,000 LockBit keys, urges ransomware victims to reach out (bleepingcomputer.com)
Ransomware ravaged schools and cities in May | TechTarget
What If The Scathing UnitedHealth Cyber Rebuke Was Yours? (forbes.com)
Hack of UK Hospitals Highlights Growing Threat (itprotoday.com)
UK School Forced to Close Following Cyber Attack - Infosecurity Magazine (infosecurity-magazine.com)
Ransomware Gang Leaks Data From Australian Mining Company - Security Week
Phishing & Email Based Attacks
90% of threats are social engineering - Help Net Security
AI Will Increase the Quantity—and Quality—of Phishing Scams - Schneier on Security
New V3B phishing kit targets customers of 54 European banks (bleepingcomputer.com)
AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)
Microsoft: The brand attackers love to imitate | CSO Online
AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say | FedScoop
Why your inbox is still so bad at blocking malware and spam - 9to5Mac
The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)
BEC
90% of threats are social engineering - Help Net Security
US Authorities Attempting to Recover $5.3 Million Stolen in BEC Scam - Security Week
Other Social Engineering
Have you answered a spam call by accident? Your next move is extremely important
Artificial Intelligence
AI Will Increase the Quantity—and Quality—of Phishing Scams - Schneier on Security
AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)
97% of security experts worry about AI-related security incidents | Security Magazine
Coinbase's top cyber exec warns deepfake threat is growing | Fortune Crypto
Five AI-based threats security pros need to understand | SC Media (scmagazine.com)
AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say | FedScoop
Forrester report highlights 2024 IAM trends & AI impact (securitybrief.co.nz)
ChatGPT privacy tips: Two important ways to limit the data you share with OpenAI | ZDNET
AI Company Hugging Face Detects Unauthorized Access to Its Spaces Platform (thehackernews.com)
2FA/MFA
Snowflake’s Lack of MFA Control Leaves Companies Vulnerable, Experts Say (informationweek.com)
What is MFA bombing? Apple users were targeted using this phishing technique (securitybrief.co.nz)
Security keys unlock nothing but inconvenience (techmonitor.ai)
Malware
FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)
Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)
Europol identifies 8 cyber criminals tied to malware loader botnets (bleepingcomputer.com)
Europol's Hunt Begins for Emotet Malware Mastermind (darkreading.com)
Beware: Fake Browser Updates Deliver BitRAT and Lumma Stealer Malware (thehackernews.com)
DarkGate Malware Replaces AutoIt with AutoHotkey in Latest Cyber Attacks (thehackernews.com)
Ukrainian Systems Hit by Cobalt Strike Via a Malicious Excel File (darkreading.com)
Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan (thehackernews.com)
Comms Business - Malware targeting endpoints on the rise, finds report
Non-mobile malware statistics, Q1 2024 | Securelist
Stealthier DarkGate malware campaign emerges | SC Media (scmagazine.com)
Hackers Exploit Legitimate Packer Software to Spread Malware Undetected (thehackernews.com)
Mobile
The NSA advises you to turn your phone off and back on once a week - here's why | ZDNET
37 Vulnerabilities Patched in Android - Security Week
361 million account credentials leaked on Telegram: Are yours among them? - Help Net Security
Android malware and unwanted software statistics for Q1 2024 | Securelist
Denial of Service/DoS/DDOS
Conflicts Drive DDoS Attacks Surge in EMEA - Infosecurity Magazine (infosecurity-magazine.com)
Internet of Things – IoT
Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT (insurancejournal.com)
That smart TV in your office could be infecting your whole business with malware | TechRadar
Over 600,000 SOHO routers were destroyed by Chalubo malware in 72 hours (securityaffairs.com)
Data Breaches/Leaks
The Ticketmaster Data Breach May Be Just the Beginning | WIRED
Ticketmaster confirms massive breach after stolen data for sale online (bleepingcomputer.com)
Snowflake denies breach, blames data theft on poorly secured customer accounts - Help Net Security
Snowflake account hacks linked to Santander, Ticketmaster breaches (bleepingcomputer.com)
Snowflake’s Lack of MFA Control Leaves Companies Vulnerable, Experts Say (informationweek.com)
The Snowflake Attack May Be Turning Into One of the Largest Data Breaches Ever | WIRED
The Billericay School pupils have details exposed in cyber attack - BBC News
Crooks threaten to leak 2.9B records of personal info • The Register
Threat actor considers leaking 3B records from background check firm | SC Media (scmagazine.com)
Secrets Exposed in Hugging Face Hack - Security Week
Google's hidden logs detail thousands of privacy breaches - CyberGuy
Blackbaud Class Action Lawsuit Denied by Federal Court | MSSP Alert
Club Penguin fans breached Disney Confluence server, stole 2.5GB of data (bleepingcomputer.com)
Check-in terminals used by thousands of hotels leak guest info (bleepingcomputer.com)
Debt Collector Data Breach Exposes Data on 3 Million+ Americans | PCMag
Nearly 400,000 affected by data breach at eye care management services company (therecord.media)
Over 2.5 billion free Android VPN users at risk of data leaks | TechRadar
Advance Auto Parts stolen data for sale after Snowflake attack (bleepingcomputer.com)
Organised Crime & Criminal Actors
International Cyber Crime Ringleaders Arrested In Armenia, Ukraine – Eurasia Review
Authorities Ramp Up Efforts to Capture the Mastermind Behind Emotet (thehackernews.com)
4 cuffed following probe into holiday scheme for cyber crooks • The Register
Security industry has ransomware-as-a-service model wrong, says expert | SC Media (scmagazine.com)
Why Hackers Love Logs - Security Week
Police dismantle pirated TV streaming network that made $5.7 million (bleepingcomputer.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Hackers exploit Chrome plugin to steal millions from Binance accounts (cointelegraph.com)
Microsoft India’s X account hijacked in Roaring Kitty crypto scam (bleepingcomputer.com)
Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers | Trend Micro (US)
Insider Risk and Insider Threats
4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)
Insurance
Cyber insurance isn't the answer for ransom payments - Help Net Security
The top three cyber policy gaps - Insurance News | InsuranceNewsNet
Supply Chain and Third Parties
Third-party vendors pose serious cyber security threat to national security - Help Net Security
London NHS hospitals revert to paper records after cyber attack | NHS | The Guardian
Third-party software supply chain threats continue to plague CISOs | CSO Online
Ticketmaster Breach Showcases SaaS Data Security Risks (darkreading.com)
Basic cyber security can protect from rising supply chain attacks | TechRadar
Advance Auto Parts stolen data for sale after Snowflake attack (bleepingcomputer.com)
Cloud/SaaS
Snowflake denies breach, blames data theft on poorly secured customer accounts - Help Net Security
Snowflake account hacks linked to Santander, Ticketmaster breaches (bleepingcomputer.com)
Snowflake Recommends Customers Take Steps to Prevent Unauthorized Access | CISA
2024-State-of-Multicloud-Security-Risk-Report.pdf (microsoft.com)
Shadow IT and Zombie Accounts: Sabotaging Your SaaS Security - Security Boulevard
Azure Service Tags tagged as security risk, Microsoft disagrees (bleepingcomputer.com)
Identity and Access Management
The Top Trends Shaping Identity And Access Management I... | Forrester
Why (and how) threat actors target your Active Directory (bleepingcomputer.com)
Encryption
WhatsApp encryption isn't the problem, metadata is | TechRadar
Using entangled particles to create unbreakable encryption (phys.org)
Linux and Open Source
CISA warns of actively exploited Linux privilege elevation flaw (bleepingcomputer.com)
Passwords, Credential Stuffing & Brute Force Attacks
Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)
Understanding Credential Phishing - Security Boulevard
Should Employee Password Management Be Mandatory? (forbes.com)
361 million account credentials leaked on Telegram: Are yours among them? - Help Net Security
Prevent Account Takeover with Better Password Security (thehackernews.com)
Security keys unlock nothing but inconvenience (techmonitor.ai)
Social Media
Microsoft India’s X account hijacked in Roaring Kitty crypto scam (bleepingcomputer.com)
TikTok fixes zero-day bug used to hijack high-profile accounts (bleepingcomputer.com)
Donald Trump Joins TikTok, App He Tried to Ban as President (variety.com)
Malvertising
Google Chrome’s plan to limit ad blocking extensions kicks off next week | Ars Technica
Training, Education and Awareness
26% of organisations lack any form of IT security training - Help Net Security
Is your workplace ‘cyber savvy’? (siliconrepublic.com)
4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)
The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)
Regulations, Fines and Legislation
Here’s what a US surveillance law means for European data privacy | Euronews
80 percent of organisations not ready for CISA rules on security practices (betanews.com)
Data Protection
Here’s what a US surveillance law means for European data privacy | Euronews
Careers, Working in Cyber and Information Security
Narrowing the Stubborn Cyber Security Worker Gap - Security Boulevard
What is a typical day like as an SOC analyst? (siliconrepublic.com)
Law Enforcement Action and Take Downs
Europol identifies 8 cyber criminals tied to malware loader botnets (bleepingcomputer.com)
Authorities Ramp Up Efforts to Capture the Mastermind Behind Emotet (thehackernews.com)
4 cuffed following probe into holiday scheme for cyber crooks • The Register
Police dismantle pirated TV streaming network that made $5.7 million (bleepingcomputer.com)
Misinformation, Disinformation and Propaganda
Poland Suspects Russia Behind False PAP Story on Mobilization (bloomberglaw.com)
Information Warfare: The Future Is Here | Proceedings - June 2024 Vol. 150/6/1,456 (usni.org)
Microsoft Security is warning of Russian misinformation campaigns during the 2024 Olympics - Neowin
Fake Tom Cruise warns of violence at Paris Olympics in pro-Russian info op | CyberScoop
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Information Warfare: The Future Is Here | Proceedings - June 2024 Vol. 150/6/1,456 (usni.org)
Conflicts Drive DDoS Attacks Surge in EMEA - Infosecurity Magazine (infosecurity-magazine.com)
Cyber Attacks and the Risk of Real War: A NATO Perspective - Defence News | The Financial Express
Nation State Actors
China
China outsourcing its cyber attacks to hackers-for-hire - Asia Times
Donald Trump Joins TikTok, App He Tried to Ban as President (variety.com)
Russia
Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)
Europe subjected to multi-phase APT28 cyberespionage attacks | SC Media (scmagazine.com)
Poland Suspects Russia Behind False PAP Story on Mobilization (bloomberglaw.com)
FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)
Ukrainian Systems Hit by Cobalt Strike Via a Malicious Excel File (darkreading.com)
Pro-Russia group claims responsibility for cyber attacks on first day of EU elections | Euronews
Poland sees ‘Russian cyber attack’ behind fake military draft report – Euractiv
Russia jams Elon Musk’s Starlink sats in Ukraine for the first time (interestingengineering.com)
Microsoft Security is warning of Russian misinformation campaigns during the 2024 Olympics - Neowin
Fake Tom Cruise warns of violence at Paris Olympics in pro-Russian info op | CyberScoop
Poland launches investigation into Russian, Belarusian political influence (voanews.com)
Polish government will spend more than $ 3 billion on cyber security - BiznesAlert EN
Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan (thehackernews.com)
Russian hackers claim cyber attack on Spanish defence company | Reuters
Iran
North Korea
A US Company Enabled a North Korean Scam That Raised Money for WMDs | WIRED
Tools and Controls
26% of organisations lack any form of IT security training - Help Net Security
How to Prove Security Effectiveness with a Cyber Security Board Report - Security Boulevard
Mastering Cyber Risk Quantification Methods: A Strategic Approach - Security Boulevard
Should Employee Password Management Be Mandatory? (forbes.com)
Security challenges mount as companies handle thousands of APIs - Help Net Security
Comms Business - Malware targeting endpoints on the rise, finds report
Why Hackers Love Logs - Security Week
Security experts call for unity again... - Mobile World Live
The Top Trends Shaping Identity And Access Management I... | Forrester
Lawyers Ask Forensics Investigators for Help Outside Cyber Security (darkreading.com)
Why (and how) threat actors target your Active Directory (bleepingcomputer.com)
4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)
The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)
Deciding cyber security spend: how much is enough? | Propertymark
Effective Incident Response: A Cyber Security Playbook for Executives - Security Boulevard
4 communication mistakes to avoid during a data breach - PR Daily
Reports Published in the Last Week
The Top Trends Shaping Identity And Access Management I... | Forrester
2024-State-of-Multicloud-Security-Risk-Report.pdf (microsoft.com)
Other News
Cyber attacks on financial services firms hit 20m people in 2023 - CIR Magazine
National infrastructure cyber attacks ‘have increased dramatically’ (power-technology.com)
What Cyber Security Memes Reveal About the Industry (itprotoday.com)
What Could Possibly Go Wrong?: New Study Examines Aftermath of Cyber Attacks | HealthLeaders Media
Security experts call for unity again... - Mobile World Live
Achieving Cyber Security in Finance Through Collaborative Efforts (finextra.com)
Lawyers Ask Forensics Investigators for Help Outside Cyber Security (darkreading.com)
Apple refused to pay bug bounty to Russian cyber security firm Kaspersky Lab (therecord.media)
A Major Industrial Cyber Security Threat: Living off the Land Attacks - Security Boulevard
Germany: Major hack targets center-right CDU party – DW – 06/01/2024
Public sector security debt is becoming a pervasive issue | ITPro
New Military Program Aids Cyber Defences in Latin America and the Caribbean | AFCEA International
Moldova Cracks Down On Interpol Evasion Scheme With Help From France, US, Britain (rferl.org)
Vulnerability Management
The impact of legacy vulnerabilities in today's cyber security landscape | TechRadar
NIST turns to IT consultants to help clear NVD backlog • The Register
Vulnerabilities
Exploitation of Recent Check Point VPN Zero-Day Soars - Security Week
CISA warns of actively exploited Linux privilege elevation flaw (bleepingcomputer.com)
Critical Apache Log4j2 flaw still threatens global finance - Security Affairs
FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)
High-risk Atlassian Confluence RCE fixed, PoC available (CVE-2024-21683) - Help Net Security
Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions (thehackernews.com)
37 Vulnerabilities Patched in Android - Security Week
PoC Exploit Released for macOS Root Access Vulnerability (cybersecuritynews.com)
Cisco addressed Webex flaws used to compromise German government meetings (securityaffairs.com)
RansomHub Actors Exploit ZeroLogon Vuln in Recent Ransomware Attacks (darkreading.com)
CISA says 'patch now' to 7-year-old Oracle WebLogic bug • The Register
Azure Service Tags tagged as security risk, Microsoft disagrees (bleepingcomputer.com)
Critical Progress Telerik vulnerability under attack | TechTarget
TikTok fixes zero-day bug used to hijack high-profile accounts (bleepingcomputer.com)
Zyxel Releases Patches for Firmware Vulnerabilities in EoL NAS Models (thehackernews.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 31 May 2024
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Santander Staff and '30 million' Customers Hacked via Cloud Provider Breach
Hackers known as ShinyHunters claim to have stolen confidential data from Santander, affecting all staff globally and millions of customers in Chile, Spain, and Uruguay. The breach includes 30 million bank account details, 6 million account numbers and balances, and 28 million credit card numbers. Santander confirmed the theft but assured no transactional data or online banking credentials were compromised. The attack is linked to an ongoing hack of cloud storage company Snowflake, accessed through a former employee's demo account. Santander is proactively contacting affected individuals and continues to ensure secure transactions. ShinyHunters have this week also claimed responsibility for the massive Ticketmaster breach below.
Source: [BBC]
ABN Amro Disclose Data Breach Following an Attack on a Third-Party Provider
A recent disclosure by Dutch bank ABN Amro revealed a data breach due to a ransomware attack on their third-party service provider, AddComm. This attack potentially exposed data of some ABN Amro clients, prompting the bank to notify affected clients and the Dutch Data Protection Authority. AddComm has since contained the incident, restored affected systems, and is investigating the breach with external security experts. While there are no signs of misuse of client data, ABN Amro has ceased using AddComm's services and warned clients to remain vigilant against phishing attempts.
Source: [SecurityAffairs]
Ticketmaster Confirms Massive Breach of 560m Users After Stolen Data Offered for Sale Online
Live Nation has confirmed a data breach at Ticketmaster, attributed to unauthorised activity within a third-party cloud database, believed to be Snowflake. The breach, identified on May 20, 2024, exposed data of over 560 million users, including personal details and ticket information. A threat actor known as ShinyHunters, the same threat actor claiming responsibility for the Santander attack above, has been attempting to sell this data on the dark web for $500,000. Despite the severity, Live Nation stated the breach is not expected to materially impact business operations or financial condition. The company is working with law enforcement and notifying affected users and regulatory authorities
Source: [BleepingComputer]
Material Cyber Attacks a Concern Among Many CISOs, with Human Error Still Perceived as the Achilles’ Heel of Cyber Security
A recent survey from Proofpoint reveals that 70% of CISOs feel at risk of a significant cyber attack within the next 12 months, up from 68% last year and 48% in 2022. Despite this, only around half feel prepared for such an attack. Human error remains a key vulnerability, with 74% identifying it as the most significant risk. Notably, 87% of CISOs are deploying AI-powered solutions to mitigate these risks. The top concerns include ransomware (41%), malware (38%), and email fraud (36%), with a notable increase in ransomware threats.
Sources: [HelpNetSecurity] [SCMagazine]
Old But Gold: Why Shoulder Surfing is an Underacknowledged Cyber Threat
A recent incident in the UK has highlighted the persistent threat of shoulder surfing, a social engineering tactic where sensitive information is obtained by observing someone's device screen. On 22 May 2024, The Times reported that information from a private memo by British Cabinet Minister Johnny Mercer was leaked after a fellow train passenger photographed Mercer's laptop screen. The memo contained accusations against Downing Street officials and advisors, illustrating the ease with which malicious actors can access confidential information through simple observation. This event underscores the need for heightened awareness and protective measures to combat shoulder surfing, including being mindful of your surroundings and using privacy screen filters.
Source: [ITPro]
Hackers Phish Finance Orgs Using Trojanised Minesweeper Clone
A recent cyber security alert highlights that hackers are leveraging code from a clone of Microsoft's Minesweeper game to conceal malicious scripts in attacks targeting financial institutions in Europe and the US. The threat actor, identified as 'UAC-0188,' uses this legitimate code to hide Python scripts that install remote management software on compromised systems. At least five breaches have been identified across financial and insurance sectors. The attack initiates with an email from "support@patient-docs-mail.com," prompting recipients to download a malicious file from Dropbox, which includes both innocuous and malicious code to evade security detection.
Source: [BleepingComputer]
Deepfake Scams Have Robbed Companies of Millions. Experts Warn It Could Get Worse
A recent surge in deepfake scams has resulted in millions of dollars in losses for companies globally, with experts predicting an increase in such frauds as criminals leverage generative AI. In one major incident, a Hong Kong finance worker was deceived into transferring over $25 million to fraudsters using deepfake technology to impersonate senior executives on a video call. UK engineering firm Arup confirmed involvement in this case, though details remain under investigation. The accessibility of AI tools like OpenAI’s Chat GPT has lowered the entry barrier for cyber criminals, enhancing both the volume and sophistication of these types of scams.
Source: [CNBC]
Ransomware in the Finance Sector: Emerging threats
A recent analysis highlights ransomware as a critical threat, particularly to the financial services sector due to its integral role in the global economy and sensitive data handling. Cyber criminals have enhanced their tactics, including pre-emptive data exfiltration, to coerce victims into paying ransoms. Phishing emails remain the primary delivery method, exploiting user unawareness to execute these attacks. These emails allow attackers to reach numerous targets cost-effectively, increasing the likelihood of successful breaches. This evolution in ransomware strategies underscores the need for heightened cyber security measures across all sectors.
Source: [Verdict]
Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware
A coordinated law enforcement effort codenamed Operation Endgame led by Europol has dismantled the infrastructure of several malware loader operations, including IcedID, SystemBC, PikaBot, SmokeLoader, Bumblebee, and TrickBot. The operation, conducted between May 27 and May 29, resulted in the takedown of over 100 servers worldwide and the arrest of four individuals in Armenia and Ukraine. Europol's actions targeted high-value criminal infrastructure, resulting in the seizure of more than 2,000 domains and the disruption of services used to facilitate ransomware and other malicious attacks. One suspect allegedly profited €69 million ($74.6 million) from renting out these criminal services.
Source: [TheHackerNews]
Hacktivist Attacks on Europe Have Doubled Since 2023, Top EU Cyber Security Official says: ‘This is Part of the Russian War of Aggression’
A recent surge in disruptive digital attacks, largely attributed to Russia-backed groups, has doubled within the European Union, targeting critical infrastructure and election-related services. Juhan Lepassaar, head of the European Union Agency for Cybersecurity (ENISA), reported a significant increase in hacktivist attacks since Russia's invasion of Ukraine, with methods often tested in Ukraine before extending to the EU. Upcoming elections in the EU and other countries have heightened security concerns. ENISA has been working to bolster the resilience of election agencies and noted a rise in ransomware targeting public institutions. The agency also warned of the growing threat of AI-enabled disinformation campaigns.
Source: [Fortune]
North Korean 'Moonstone Sleet' Threat Group Melds Espionage, Financial Goals - Microsoft
A recent report by Microsoft has uncovered the North Korean threat group "Moonstone Sleet," which engages in both espionage and financial cyber attacks. Initially overlapping with the DPRK's Diamond Sleet, Moonstone Sleet has since developed its own unique tactics, using techniques like fake job offers, custom ransomware, and trojanised software delivered via social media. The group has targeted aerospace, education, and software organisations by masquerading as legitimate companies such as "StarGlow Ventures" and "C.C. Waterfall." Their methods, including using trusted platforms like LinkedIn and Telegram, complicate defensive measures and exploit the inherent trust in these platforms.
Source: [DarkReading]
Europe on High Alert after Suspected Moscow-linked Arson and Sabotage
A recent spate of arson and sabotage attacks across Europe, potentially linked to Russian operatives, has heightened security concerns. Incidents include a fire at an Ikea in Lithuania, an arson attack in east London, antisemitic graffiti in Paris, and in Germany suspicions of foreign intelligence-driven attacks in addition to a wave of cyber-attacks in 2023 by a hacker group linked to Russian intelligence. Security services suspect these acts aim to destabilise the West amidst its support for Ukraine. Polish authorities have arrested nine individuals for alleged sabotage under Russian orders, while Estonia and Germany report similar threats. This issue, discussed at a Brussels summit, highlights the need for increased vigilance against hybrid attacks orchestrated by foreign entities.
Source: [TheGuardian]
Making the Case for 'Reasonable' Cyber Security
A recent white paper from the Center for Internet Security (CIS) discusses the concept of "reasonable cyber security" and its alignment with privacy laws. This standard, highlighted at the RSA Conference, is context-dependent and varies by industry. For instance, while the Payment Card Industry Data Security Standard (PCI DSS) prescribes specific controls, the GDPR emphasises transparency and good faith efforts. The importance of quantifying cyber risk was underscored by the US Federal Reserve emphasising improved data on cyber threats for better risk assessment. Implementing security frameworks like the NIST Cybersecurity Framework can help meet these evolving regulatory and insurance requirements
Source: [DarkReading]
Hundreds of Thousands of Internet Routers Destroyed in Attack on Telco
A significant cyber attack last October targeted a US telecoms company, disabling over 600,000 internet routers across multiple states, according to Lumen Technologies' Black Lotus Labs. The attack, undisclosed until recently, involved malicious firmware updates that rendered the routers inoperable. Researchers did not identify the hackers or the affected company. The malware, still circulating online, disrupted internet access from October 25 to 27. This attack is considered one of the most severe against the US telecommunications sector and illustrates the vulnerability of telecoms provided routers to these types of attacks.
Source: [YahooFinance]
Governance, Risk and Compliance
New KnowBe4 phishing report reveals top choices for phishing scams – PCR (pcr-online.biz)
Material cyber attacks a concern among many CISOs | SC Media (scmagazine.com)
The Link Between Cyber Security and Reputation Management for Executives - Security Boulevard
The SEC’s SolarWinds Case: What CISOs Should Do Now (darkreading.com)
Old but gold: Why shoulder surfing is an underacknowledged cyber threat | ITPro
70% of CISOs feel vulnerable to a material cyber attack in 2024 | Security Magazine
The evolution of security metrics for NIST CSF 2.0 - Help Net Security
Cyber security teams gear up for tougher challenges in 2024 - Help Net Security
4-Step Approach to Mapping and Securing Your Organisation's Most Critical Assets (thehackernews.com)
Cyber security Skills Shortage Is Ranked as the Biggest Risk (globenewswire.com)
How Corporate Boards Are Setting CEO’s Up For Cyber Security Failure (forbes.com)
CISO priorities must shift in a heightened threat landscape - Raconteur
Cyber security is the cause of all MSPs’ headaches • The Register
Bridging Cyber Security Expectations And Reality To Empower CISOs (forbes.com)
Making the Case for 'Reasonable' Cyber Security (darkreading.com)
Why cyber criminals and hackers are targeting small businesses - Marketplace
Widespread data silos slow down security response times - Help Net Security
Absolute Security Survey Reveals UK CISOs Ignore NCSC Guidance | Business Wire
Reducing CIO-CISO tension requires recognizing the signs | CIO
Threats
Ransomware, Extortion and Destructive Attacks
‘World’s largest botnet’ knocked offline after raking in billions | The Independent
Ransomware Networks Brought Down In Major Global Police Operation | HuffPost Latest News
Massive ransomware network taken down by ‘Endgame’ international police operation | Fortune Europe
Ransomware in the finance sector: Emerging threats - Verdict
New ShrinkLocker ransomware uses BitLocker to encrypt your files (bleepingcomputer.com)
Ransomware operators shift tactics as law enforcement disruptions increase - Help Net Security
6 Facts About How INTERPOL Fights Cyber crime (darkreading.com)
Potent youth cyber crime ring made up of 1,000 people, FBI official says | CyberScoop
LockBit Black Ransomware Bot Sprays “Millions of Messages” | MSSP Alert
Microsoft links North Korean hackers to new FakePenny ransomware (bleepingcomputer.com)
How to improve ransomware attack outcomes | SC Media (scmagazine.com)
Why healthcare data is often the target of ransomware attacks (techtarget.com)
Essential Strategies for Recovering from Ransomware Attacks - Security Boulevard
Ransomware Victims
Phishing & Email Based Attacks
New KnowBe4 phishing report reveals top choices for phishing scams – PCR (pcr-online.biz)
Phishing-as-a-service (PhaaS): What is it and How it work? (todayq.com)
Hackers phish finance orgs using trojanized Minesweeper clone (bleepingcomputer.com)
New Tricks in the Phishing Playbook: Cloudflare Workers, HTML Smuggling, GenAI (thehackernews.com)
LockBit Black Ransomware Bot Sprays “Millions of Messages” | MSSP Alert
Google: Stop Trying to Trick Employees With Fake Phishing Emails | PCMag
Free Piano phish targets American university students, staff (bleepingcomputer.com)
BEC
Other Social Engineering
Old but gold: Why shoulder surfing is an underacknowledged cyber threat | ITPro
No 10 neglecting popular MPs, laments minister in leaked memo (thetimes.co.uk)
Artificial Intelligence
Kroll cyber threat landscape report: AI assists attackers | CSO Online
'GODMODE GPT': Hacker releases jailbroken version of ChatGPT (newsbytesapp.com)
Critical Flaw in AI Platform Exposes Proprietary Data (darkreading.com)
NIST Releases Risk ‘Profile’ for Generative AI | Polsinelli - JDSupra
OODA Loop - The Cyber Arms Race Gives Way to AI Weaponization
Four Security Questions to Ask Your Enterprise Generative AI Provider (darkreading.com)
OpenAI sets up safety committee as it starts training new model | Reuters
Malware
‘World’s largest botnet’ knocked offline after raking in billions | The Independent
Over 100 malware servers shut down in 'largest ever' operation against botnets (therecord.media)
Ransomware Networks Brought Down In Major Global Police Operation | HuffPost Latest News
Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware (thehackernews.com)
Massive ransomware network taken down by ‘Endgame’ international police operation | Fortune Europe
Why cloud attacks no longer need malware [Q&A] (betanews.com)
Is Your Computer Part of ‘The Largest Botnet Ever?’ – Krebs on Security
Trio of Chinese botnet operators sanctioned by United States • The Register
macOS version of elusive 'LightSpy' spyware tool discovered (bleepingcomputer.com)
Cyber criminals pose as "helpful" Stack Overflow users to push malware (bleepingcomputer.com)
Law enforcement operation takes aim at an often-overlooked cyber crime linchpin | Ars Technica
CERT-UA warns of malware campaign conducted by threat actor UAC-0006 (securityaffairs.com)
Pirated Microsoft Office delivers malware cocktail on systems (bleepingcomputer.com)
Mobile
Hacking phones is too easy. Time to make it harder (economist.com)
Privacy vs. Mobile Security: Why You Don’t Have to Choose | MSSP Alert
90+ Malicious Apps Totaling 5.5M Downloads Lurk on Google Play (darkreading.com)
Phones of journalists and activists in Europe targeted with Pegasus | CyberScoop
NSA Warns iPhone & Android Users To Turn It Off And On Again (forbes.com)
Denial of Service/DoS/DDOS
New DoS Attack ‘DNSBomb’ Exploiting DNS Queries & Responses (cybersecuritynews.com)
Internet Archive is continuing to face DDoS attacks after several days - Neowin
Internet of Things – IoT
These are the most insecure devices you might still have in your home (xda-developers.com)
Hundreds of thousands of US internet routers destroyed in newly discovered 2023 hack (yahoo.com)
Data Breaches/Leaks
ABN Amro discloses data breach following an attack on a third-party provider (securityaffairs.com)
Data breach exposes details of 25,000 current and former BBC employees | BBC | The Guardian
Dutch Social housing tenants' data may have been stolen after IT supplier hack | NL Times
Almost all citizens of city of Eindhoven have their personal data exposed (bitdefender.com)
Critical Flaw in AI Platform Exposes Proprietary Data (darkreading.com)
Cencora data breach exposes US patient info from 11 drug companies (bleepingcomputer.com)
400% rise in MoD data breaches fuels fear of cyber threat from Russia and China (inews.co.uk)
MITRE December 2023 attack: threat actors created rogue VMs to evade detection (securityaffairs.com)
Nearly 3 million affected by Sav-Rx data breach (therecord.media)
First American December data breach impacts 44,000 people (bleepingcomputer.com)
Hackers Claim Ticketmaster Data Breach: 560 Million Users' Info Up for Sale (hackread.com)
MPs email passwords exposed on the dark web, study suggests (cityam.com)
Everbridge warns of corporate systems breach exposing business data (bleepingcomputer.com)
FBCS Data Breach Impact Grows to 3.2 Million Individuals - SecurityWeek
Cooler Master hit by data breach exposing customer information (bleepingcomputer.com)
Spyware maker pcTattletale says it's 'out of business' and shuts down after data breach | TechCrunch
Organised Crime & Criminal Actors
Digital Arrests: The New Frontier of Cyber crime | MSSP Alert
Cyber crime study finds global human-initiated digital attack rate up 19% | Chain Store Age
Phishing-as-a-service (PhaaS): What is it and How it work? (todayq.com)
Hackers Sell Fake Pegasus Spyware on Clearnet and Dark Web (hackread.com)
Hacker defaces spyware app’s site, dumps database and source code (bleepingcomputer.com)
BreachForums returns just weeks after FBI-led takedown • The Register
6 Facts About How INTERPOL Fights Cyber Crime (darkreading.com)
Russian indicted for selling access to US corporate networks (bleepingcomputer.com)
Potent youth cyber crime ring made up of 1,000 people, FBI official says | CyberScoop
Cyber criminals pose as "helpful" Stack Overflow users to push malware (bleepingcomputer.com)
US arrests man allegedly behind enormous botnet that enabled cyber attacks and fraud - The Verge
Law enforcement operation takes aim at an often-overlooked cyber crime linchpin | Ars Technica
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Indian man stole $37 million in crypto using fake Coinbase Pro site (bleepingcomputer.com)
Former FTX executive Salame sentenced to over 7 years in prison - BBC News
Insider Risk and Insider Threats
Human error still perceived as the Achilles' heel of cyber security - Help Net Security
New Research Warns About Weak Offboarding Management and Insider Risks (thehackernews.com)
Insurance
Supply Chain and Third Parties
Cloud/SaaS
34% of organisations lack cloud cyber security skills - Help Net Security
Impact of Remote Work and Cloud Migrations on Security Perimeters (securityaffairs.com)
Why cloud attacks no longer need malware [Q&A] (betanews.com)
Identity and Access Management
Encryption
Passwords, Credential Stuffing & Brute Force Attacks
Why strong passwords are still the first line of defence against cyber threats (securitybrief.co.nz)
Password auditing: Purge weak passwords from your organisation | ITPro
Enhancing cyber security with 'moving trees' (techxplore.com)
Malvertising
Training, Education and Awareness
Using Scary but Fun Stories to Aid Cyber Security Training - Security Boulevard
Beyond the Code: Modern Cyber Security Training for 2024 (informationweek.com)
Regulations, Fines and Legislation
New cyber attack reporting requirement for Swiss financial institutions (cms-lawnow.com)
The SEC’s SolarWinds Case: What CISOs Should Do Now (darkreading.com)
GDPR Turns Six: Reflecting on a Global Privacy Benchmark - IT Security Guru
The SEC's New Take on Cyber Security Risk Management (darkreading.com)
Models, Frameworks and Standards
The evolution of security metrics for NIST CSF 2.0 - Help Net Security
How NIST Cybersecurity Framework 2.0 Tackles Risk Management (securityintelligence.com)
Data Protection
Careers, Working in Cyber and Information Security
34% of organisations lack cloud cyber security skills - Help Net Security
Cyber security Skills Shortage Is Ranked as the Biggest Risk (globenewswire.com)
New cyber security school to pay students $4K monthly salary
Law Enforcement Action and Take Downs
‘World’s largest botnet’ knocked offline after raking in billions | The Independent
Over 100 malware servers shut down in 'largest ever' operation against botnets (therecord.media)
Ransomware Networks Brought Down In Major Global Police Operation | HuffPost Latest News
Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware (thehackernews.com)
Massive ransomware network taken down by ‘Endgame’ international police operation | Fortune Europe
BreachForums returns just weeks after FBI-led takedown • The Register
Indian man stole $37 million in crypto using fake Coinbase Pro site (bleepingcomputer.com)
Ransomware operators shift tactics as law enforcement disruptions increase - Help Net Security
6 Facts About How INTERPOL Fights Cyber crime (darkreading.com)
Russian indicted for selling access to US corporate networks (bleepingcomputer.com)
US arrests man allegedly behind enormous botnet that enabled cyber attacks and fraud - The Verge
Law enforcement operation takes aim at an often-overlooked cyber crime linchpin | Ars Technica
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
OODA Loop - The Cyber Arms Race Gives Way to AI Weaponization
Could the Next War Begin in Cyberspace? (informationweek.com)
Global stability issues alter cyber threat landscape, ESET reports | CSO Online
Cyber Psychological Warfare: Hacking Operational Technology (inforisktoday.com)
Negotiations over new NATO cyber centre still ongoing weeks from planned launch (therecord.media)
Nation State Actors
China
400% rise in MoD data breaches fuels fear of cyber threat from Russia and China (inews.co.uk)
Ongoing Chinese cyberespionage operation targets government orgs | SC Media (scmagazine.com)
Trio of Chinese botnet operators sanctioned by United States • The Register
Russia
400% rise in MoD data breaches fuels fear of cyber threat from Russia and China (inews.co.uk)
Putin hijacked Austria’s spy service. Now he’s going after its government – POLITICO
Map shows Russia's campaign of terror, sabotage and hacking in Europe | World News | Metro News
Critics of Putin and his allies targeted with spyware inside the EU | Hacking | The Guardian
FlyingYeti phishing crew grounded after failed Ukraine ops • The Register
Europe on high alert after suspected Moscow-linked arson and sabotage | Russia | The Guardian
German officer gave up secrets to Russia 'to prevent nuclear war'
Germany's cyber ambassador on the response to Russia: 'All of this takes time' (therecord.media)
FlyingYeti Exploits WinRAR Vulnerability to Deliver COOKBOX Malware in Ukraine (thehackernews.com)
CERT-UA warns of malware campaign conducted by threat actor UAC-0006 (securityaffairs.com)
Russia Has Figured Out How to Mess up Ukraine's Starlink Internet: NYT (businessinsider.com)
Surveillance Risk: Apple's Wi-Fi-Based Positioning System (govinfosecurity.com)
Major Russian delivery company down for three days due to cyber attack (therecord.media)
Russian indicted for selling access to US corporate networks (bleepingcomputer.com)
Most EU election interference domestic in origin, not Russian: Meta (therecord.media)
North Korea
Microsoft Uncovers 'Moonstone Sleet' — New North Korean Hacker Group (thehackernews.com)
Global stability issues alter cyber threat landscape, ESET reports | CSO Online
Microsoft: 'Moonstone Sleet' APT Melds Espionage, Financial Goals (darkreading.com)
New North Korean group tied to ransomware, gaming campaigns • The Register
Microsoft links North Korean hackers to new FakePenny ransomware (bleepingcomputer.com)
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Vulnerability Management
The Importance of Patching Vulnerabilities in Cyber Security - Security Boulevard
NIST expects to clear backlog in vulnerabilities database by end of fiscal year (therecord.media)
The most dangerous CVEs of 2023 and 2024: fix these today (kaspersky.co.uk)
NIST says NVD will be back on track by September 2024 - Help Net Security
59% of public sector apps carry long-standing security flaws - Help Net Security
NIST Getting Outside Help for National Vulnerability Database - SecurityWeek
An Argument for Coordinated Disclosure of New Exploits (darkreading.com)
Vulnerabilities
Cisco Releases May 2024 Cisco ASA, FMC, and FTD Software Security Publication | CISA
Critical Flaw in AI Platform Exposes Proprietary Data (darkreading.com)
High-severity flaw affects Cisco Firepower Management Center (securityaffairs.com)
Hackers target Check Point VPNs to breach enterprise networks (bleepingcomputer.com)
Exploit released for maximum severity Fortinet RCE bug, patch now (bleepingcomputer.com)
Check Point VPN zero-day exploited in attacks since April 30 (bleepingcomputer.com)
VMware Workstation and Fusion: Critical Security Flaws Fixed - Security Boulevard
Google fixes eighth actively exploited Chrome zero-day this year (bleepingcomputer.com)
An XSS flaw in GitLab allows attackers to take over accounts (securityaffairs.com)
WordPress Plugin Exploited to Steal Credit Card Data from E-commerce Sites (thehackernews.com)
The most dangerous CVEs of 2023 and 2024: fix these today (kaspersky.co.uk)
Critical WordPress Plugin Flaws Exploited to Inject Malicious Scripts and Backdoors - SecurityWeek
FlyingYeti Exploits WinRAR Vulnerability to Deliver COOKBOX Malware in Ukraine (thehackernews.com)
Security flaw in this TP-Link Archer router receives 10 out of 10 severity rating | TechSpot
Tools and Controls
Why strong passwords are still the first line of defence against cyber threats (securitybrief.co.nz)
Microsoft battens security hatches on Windows admin accounts | PCWorld
34% of organisations lack cloud cyber security skills - Help Net Security
New DoS Attack ‘DNSBomb’ Exploiting DNS Queries & Responses (cybersecuritynews.com)
Farewell VBScript: Microsoft confirms plans to begin phasing out the programming language | ITPro
The evolution of security metrics for NIST CSF 2.0 - Help Net Security
4-Step Approach to Mapping and Securing Your Organisation's Most Critical Assets (thehackernews.com)
How to combat alert fatigue in cyber security - Help Net Security
Network Segmentation: Top Challenges And How To Solve Them (forbes.com)
New Research Warns About Weak Offboarding Management and Insider Risks (thehackernews.com)
Identity-related incidents becoming severe, costing organisations a fortune - Help Net Security
Password auditing: Purge weak passwords from your organisation | ITPro
Beyond the blind spots: why CISOs must embrace deep observability - Raconteur
How NIST Cybersecurity Framework 2.0 Tackles Risk Management (securityintelligence.com)
AI’s role in FS businesses’ cyber defence and risk assessment (finextra.com)
Report: The Dark Side of Phishing Protection (thehackernews.com)
Essential Strategies for Recovering from Ransomware Attacks - Security Boulevard
Reports Published in the Last Week
Other News
Why cyber criminals and hackers are targeting small businesses - Marketplace
Shell says 'potential cyber security incident' under investigation | CTV News
Defending Professional Sports Organisations Against Cyber Threats (forbes.com)
How Manufacturers Can Build Their Cyber Defence (forbes.com)
Manufacturing Is #1 in Cyber Attacks for Third Straight Year. What Can Be Done? | IndustryWeek
How Can Small Businesses Alleviate Cyber Risks? (forbes.com)
Cyber security is the cause of all MSPs’ headaches • The Register
Most EU election interference domestic in origin, not Russian: Meta (therecord.media)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 24 May 2024
Black Arrow Cyber Threat Intelligence Briefing 24 May 2024:
-Human Error and AI Tops Cyber Threats as 70% of CISOs Worry About Risk
-Threat Research Highlights Growing Mobile Security Risks
-The State of Cyber Security: AI and Geopolitics Mean a Bigger Threat Than Ever
-Family Offices Become Prime Targets for Cyber Hacks and Ransomware
-Ransomware Fallout - 94% Experience Downtime, 40% Face Work Stoppage
-Employee Discontent - Insider Threat No. 1
-Report Reveals 341% Rise in Advanced Phishing Attacks
-Ransomware and GenAI Raise Security Challenges, Driving Cyber Investment
-New Rules Prompt 93% of Organisations to Rethink Cyber Security Plans
-HR and IT Related Phishing Scams Still Most Popular According to KnowBe4’s Latest Phishing Report
-80% of Exposures from Misconfigurations, as 15 Vendors Account for 62% of Global Attack Surface
-UK to Propose Mandatory Reporting for Ransomware Attacks and Licensing Regime for all Payments
-UK’s Legal Sector Needs to Improve its Cyber Security, Says Experts
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Human Error and AI Tops Cyber Threats as 70% of CISOs Worry About Risk
According to a survey of 1,600 CISOs, 70% worry about the risk of a material cyber attack over the next 12 months. Additionally, nearly 31% believe an attack is very likely, compared to 25% in 2023. Amongst the largest concerns were human error, with 75% of CISOs identifying it as their most significant cyber vulnerability, up from 60% in 2023. Furthermore, 80% anticipate that human risk and employee negligence in particular will be major cyber security issues in the next two years. Additionally, artificial intelligence was identified as an emerging concern for 54% of CISOs.
Sources: [The Register] [Infosecurity Magazine] [Cryptopolitan]
The State of Cyber Security: AI and Geopolitics Mean a Bigger Threat Than Ever
A recent report by Check Point reveals that global organisations faced an average of 1,158 weekly cyber attacks in 2023, an increase from 2022. In the UK, 50% of businesses experienced cyber attacks in the past year, with medium and large-sized businesses more affected at 70% and 74%, respectively. A ClubCISO survey found 62% of CISOs believe organisations are ill-equipped for AI-driven attacks, yet 77% haven't increased cyber security spending.
Additionally, a British Foreign Policy Group (BFPG) article highlights cyber threats from geopolitical tensions, with a recent attack on the Ministry of Defence exposing HR and payroll data. The National Cyber Security Centre attributes such attacks to state-affiliated actors like China and Russia. Despite efforts to establish international cyber norms, enforcement remains challenging. Businesses must recognise that cyber security is now deeply intertwined with geopolitics, affecting strategic partnerships and procurement.
Threat Research Highlights Growing Mobile Security Risks
A recent report by a cloud security vendor focusing on the mobile threat landscape found that in the first quarter of 2024, the number of phishing, malicious, denylisted and offensive links delivered to their customers’ mobile devices tripled compared to Q1 2023. The report, which bases its data on 220 million devices, 325 million apps and billions of web items, found that the most common misconfiguration in mobiles was out of date operating systems (37%). When it came to the prevalence of attacks, 75% of organisations reported experiencing mobile phishing attempts targeting their employees.
This comes as a representative from the US Cybersecurity and Infrastructure Security Agency told the Federal Communications Commission earlier this year that there had been “numerous incidents of successful, unauthorised attempts” to steal location data, monitor voice and text messages, and deliver spyware.
Sources: [Economist] [Business Wire]
Family Offices Become Prime Targets for Cyber Hacks and Ransomware
A recent Dentons survey reveals that nearly 80% of family offices perceive a dramatic increase in cyber attack threats, with a quarter experiencing an attack in 2023, up from 17% in 2020. Despite their wealth, family offices often lack the staff and technology to manage these risks effectively. Less than a third report well-developed cyber risk management processes, and only 29% believe their cyber training programs are sufficient. This gap between awareness and action highlights the need for family offices to prioritise comprehensive cyber security measures, including better training, updated policies, and secure communication practices.
Source: [CNBC]
Ransomware Fallout: 94% Experience Downtime, 40% Face Work Stoppage
According to a report by cyber security provider Arctic Wolf, within the last 12 months 48% of organisations identified evidence of a successful breach within their environment and 70% of organisations were the targets of attempted Business Email Compromise (BEC) attacks, with 29% of these targets becoming victims of one or more successful BEC occurrences.
In its survey, the company says “45% of the organizations we spoke with admitted to being the victim of a ransomware attack within the last 12 months”, an increase from the prior year. Of those impacted by ransomware, 86% of attacks including successful data exfiltration and 94% of those impacted by a ransom event experienced a significant downtime and delays. 40% of victims stated they experienced a period of total work stoppage due to ransomware.
Source: [Help Net Security]
Employee Discontent: Insider Threat No. 1
Chief Information Security Officers (CISOs) must integrate human factors into insider risk management (IRM), not just rely on detection technologies. IRM must consider factors such as those raised by recent research where only half of US workers are very satisfied with their jobs, and 28% feel their employers don't care about them. CISOs themselves are affected by job satisfaction; the 2024 IANS/Artico report shows three out of four CISOs are ready to leave their roles. DTEX Systems found 77% of malicious insiders concealed their activities, emphasising the importance of human engagement and feedback in mitigating risks.
Source: [CSO]
Report Reveals 341% Rise in Advanced Phishing Attacks
A recent report has revealed malicious emails increased by 341% over the past 6 months. This included a 217% increase in credential harvesting phishing attacks and a 29% increase in Business Email Compromise (BEC) attacks. The report highlighted the impact of artificial intelligence, noting that since the launch of ChatGPT in November 2022, there has been a 4,151% surge in malicious phishing messages.
Source: [Security Magazine] [ Infosecurity Magazine]
Ransomware and GenAI Raise Security Challenges, Driving Cyber Investment
A recent study by Infosecurity Europe reveals that nearly 40% of cyber security leaders are increasing investments to combat the growing threats of ransomware and AI-generated attacks. A separate survey found 94% of organisations have or plan to implement generative AI use policies, and a third strictly forbid AI tech in their environment. This data highlights the ongoing effort to balance AI benefits with security risks, indicating that there isn’t a one-size-fits-all strategy for formalising AI adoption and usage policies.
Source: [Security Boulevard] [Infosecurity Magazine]
New Rules Prompt 93% of Organisations to Rethink Cyber Security Plans
A recent report reveals that 93% of organisations have re-evaluated their cyber security strategies due to new regulations, with 58% reconsidering their entire approach. The survey, which included 500 cyber security decision-makers from the US and UK, found that 92% reported increased security budgets, with 36% seeing rises of 20-49% and 23% experiencing over 50% increases. Despite this, only 40% feel confident in their resources to comply with regulations, and just one-third believe they can meet all requirements, highlighting significant gaps in preparedness.
Source: [security magazine]
HR and IT Related Phishing Scams Still Most Popular According to KnowBe4’s Latest Phishing Report
A recent KnowBe4 report reveals that HR-related phishing emails account for 42% of top-clicked phishing attempts, followed by IT-related emails at 30%. These phishing tactics exploit employees' trust and evoke immediate responses by mimicking legitimate business communications about dress code changes, tax updates, and training notifications. The report also highlights that nearly a third of users are vulnerable to phishing, emphasising the need for robust security awareness training. A well-trained workforce is essential in defending against increasingly sophisticated phishing attacks that leverage AI and emotional manipulation.
Source: [IT Security Guru]
80% of Exposures from Misconfigurations, as 15 Vendors Account for 62% of Global Attack Surface
A recent XM Cyber report highlights a significant gap in cyber security focus with identity and credential misconfigurations accounting for 80% of security exposures. The study, based on hundreds of thousands of attack path assessments, found that 62% of the global attack surface is concentrated in just 15 vendors. Furthermore, 41% of organisations had at least one compromised device, and 11% experienced ransomware incidents. The report underscores the need for a shift from patching all vulnerabilities to addressing high-impact exposures, especially those around identity management and critical asset protection.
Sources: [Security Magazine] [The Hacker News]
UK to Propose Mandatory Reporting for Ransomware Attacks and Licensing Regime for all Payments
A forthcoming proposal in Britain aims to overhaul the response to ransomware by mandating victims to report incidents and obtain a license before making extortion payments. This initiative, part of a public consultation, includes a ban on ransom payments for critical national infrastructure to deter attacks. The National Cyber Security Centre has highlighted concerns over underreporting, with a 2023 increase in ransomware-related data breaches. The plan’s success hinges on replacing the delayed Action Fraud reporting platform. This proposal marks a significant step in global ransomware policy, with Britain leading international efforts against cyber criminals.
Source: [The Record Media]
UK’s Legal Sector Needs to Improve its Cyber Security, Says Experts
One in ten UK data breaches in 2023 occurred in the legal sector, highlighting that UK law firms are attractive targets for cyber criminals. A recent analysis of the UK’s Information Commissioner's Office (ICO) data found that the legal sector is one of the worst performing sectors for data breaches, with nearly 86 per cent of the incidents within the legal sector involving breaches of personal identifiable information, including instances also affecting sensitive economic and financial data.
Sources [CITY AM]
Governance, Risk and Compliance
UK's legal sector needs to improve its cyber security, say experts (cityam.com)
How to stay on top of evolving cyber security legislation | RSM UK
New rules prompt 93% of organisations to rethink cyber security plans | Security Magazine
One CISO Can’t Fill Your Board’s Cyber Security Gaps (mit.edu)
Security Compliance 101: What It Is and How to Master It - Security Boulevard
Family offices become prime targets for cyber hacks and ransomware (cnbc.com)
Worried about job security, cyber teams hide security incidents - Help Net Security
Law firms warn global risks on the rise (emergingrisks.co.uk)
Financial companies must have data breach incident plans, SEC says | SC Media (scmagazine.com)
Businesses must overcome security communication roadblocks – Channel EYE
Why Culture is the Bedrock of Cyber Security - Infosecurity Magazine (infosecurity-magazine.com)
IT Security Leaders Are Failing to Close a Boardroom Credibility Gap (prnewswire.com)
Effective GRC programs rely on team collaboration - Help Net Security
Understanding cyber risks beyond data breaches - Help Net Security
De-risking the business - how to evolve your approach to security | TechRadar
IT and security data is siloed in most organisations (betanews.com)
Can Cyber Security Be a Unifying Factor in Digital Trade Negotiations? (darkreading.com)
Threats
Ransomware, Extortion and Destructive Attacks
Family offices become prime targets for cyber hacks and ransomware (cnbc.com)
Ransomware fallout: 94% experience downtime, 40% face work stoppage - Help Net Security
Ransomware Attacks Evolve as Average Ransom Demand Tops $1.26 Million - Security Boulevard
Ransomware gang targets Windows admins via PuTTy, WinSCP malvertising (bleepingcomputer.com)
Cyber criminals shift tactics to pressure more victims into paying ransoms - Help Net Security
This wiper malware takes data destruction to a whole new level | TechRadar
A Surge in Ransomware: Insights from Our 2024 Cyber Threat Report | Huntress
Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard
LockBit takedown taking toll as gang plummets down rankings • The Register
First LockBit, now BreachForums: Are cops winning the war? • The Register
2024 sees continued increase in ransomware activity - Help Net Security
Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern (thehackernews.com)
What role does an initial access broker play in the RaaS model? | TechTarget
Casino cyber attacks put a bullseye on Scattered Spider • The Register
Ransomware innovation slowdown a product of crims' success • The Register
Ransomware Victims
OmniVision Says Personal Information Stolen in Ransomware Attack - Security Week
LockBit says they stole data in London Drugs ransomware attack (bleepingcomputer.com)
Phishing & Email Based Attacks
Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide (thehackernews.com)
Phishing statistics that will make you think twice before clicking - Help Net Security
Phishing, BEC, and Beyond: Tackling the Top Cyber Threats to UK Banks (prnewswire.co.uk)
Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns (thehackernews.com)
Only 60 percent of brands can protect their customers from digital impersonation (betanews.com)
A phish by any other name should still not be clicked – Computerworld
Active Chinese Cyber espionage Campaign Rifling Email Servers (inforisktoday.com)
YouTube has become a significant channel for cyber crime - Help Net Security
BEC
The last six months shows a 341% increase in malicious emails | Security Magazine
Phishing, BEC, and Beyond: Tackling the Top Cyber Threats to UK Banks (prnewswire.co.uk)
Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard
10 Years in Prison for $4.5 million BEC Scammer Who Bought Ferrari to Launder Money | Tripwire
Other Social Engineering
Artificial Intelligence
The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict
Three Questions Every Leader Needs To Ask About AI Cyber Security (forbes.com)
Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard
Beware – Your Customer Chatbot is Almost Certainly Insecure: Report - Security Week
Human Error and AI Tops Cyber Security Threats in CISO Survey | Cryptopolitan
Consumers continue to overestimate their ability to spot deepfakes - Help Net Security
CIO’s 2024 Checklist: Generative AI, Digital Transformation And More (forbes.com)
Deepfakes Rank As the Second Most Common Cyber Security Incident for US Businesses (darkreading.com)
Data regulator looking into Microsoft’s AI Recall feature | The Independent
US Intelligence Agencies’ Embrace of Generative AI Is at Once Wary and Urgent - Security Week
User Outcry as Slack Scrapes Customer Data for AI Model Training - Security Week
Balancing generative AI cyber security risks and rewards | TechTarget
AI Is The Past, Present And Future Of Cyber Security (forbes.com)
US AI Experts Targeted in SugarGh0st RAT Campaign (darkreading.com)
Transparency is sorely lacking amid growing AI interest | ZDNET
2FA/MFA
Malware
Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide (thehackernews.com)
400K Linux Servers Recruited by Resurrected Ebury Botnet (darkreading.com)
Another nasty Mac malware is spoofing legitimate software to target macOS users | TechRadar
Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal (thehackernews.com)
What Does Malware Look Like? Check Out These Real-World Examples (pcmag.com)
Cyber Criminals Exploit GitHub and FileZilla to Deliver Malware Cocktail (thehackernews.com)
Malware Delivery via Cloud Services Exploits Unicode Trick to Deceive Users (thehackernews.com)
MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks (thehackernews.com)
Keylogger Embedded Microsoft Exchange Server Steals Login Credentials (cybersecuritynews.com)
Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns (thehackernews.com)
Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica
US AI Experts Targeted in SugarGh0st RAT Campaign (darkreading.com)
New BiBi Wiper version also destroys the disk partition table (bleepingcomputer.com)
Novel EDR-Killing 'GhostEngine' Malware Is Built for Stealth (darkreading.com)
Malicious actors are cat-phishing targets in order to spread malware | Security Magazine
Mobile
It is dangerously easy to hack the world’s phones (economist.com)
How often should you turn off your phone? Here's what the NSA says | PCWorld
North Korea-linked Kimsuky APT attack targets victims via Messenger (securityaffairs.com)
US Official Warns a Cell Network Flaw Is Being Exploited for Spying | WIRED
How to recognise if the security of your work device has been breached (siliconrepublic.com)
Vultur Malware Mimic As Mobile Antivirus Steals Login Credentials (cybersecuritynews.com)
‘Unblockable’ HMRC scam message on iPhones sparks warning (yahoo.com)
Lookout Threat Research Highlights Growing Mobile Security Risks | Business Wire
Internet of Things – IoT
Data Breaches/Leaks
Aon reveals cyber attack/data breach as top risk for financial institutions - Reinsurance News
NYSE parent fined $10M for breach reporting failure • The Register
Were The Ashley Madison Hackers Ever Caught? (screenrant.com)
49 Million Customers Impacted by API Security Flaw - Security Boulevard
Army personnel fear for their jobs after huge MoD cyber attack | The Independent
Criminal record database of millions of Americans dumped online | Malwarebytes
Optus denies claims of ‘cloaking’ Deloitte cyber attack report findings - Lawyers Weekly
Record breaking number of data breaches reported | Bailiwick Express
55,000 Impacted by Cyber Attack on California School Association - Security Week
Organised Crime & Criminal Actors
Were The Ashley Madison Hackers Ever Caught? (screenrant.com)
HP Catches Cyber Criminals 'Cat-Phishing' Users (darkreading.com)
Cyber crime on the rise as account takeovers become leading method (investmentnews.com)
YouTube has become a significant channel for cyber crime - Help Net Security
Ransomware innovation slowdown a product of crims' success • The Register
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking (thehackernews.com)
Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica
Dutch police tracked a crypto theft to one of world’s worst botnets (thenextweb.com)
He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market | WIRED
Insider Risk and Insider Threats
Human Error and AI Tops Cyber Security Threats in CISO Survey | Cryptopolitan
Can we fix the human error problem in cyber security? (siliconrepublic.com)
Insurance
Should You Buy Cyber Insurance in 2024? Pros & Cons (techopedia.com)
Cyber insurance trends: reshaping the industry - SiliconANGLE
Supply Chain and Third Parties
Implementing Third-Party Risk Management Workflows | UpGuard
JAVS courtroom recording software backdoored in supply chain attack (bleepingcomputer.com)
Cloud/SaaS
Critical Bug Allows DoS, RCE, Data Leaks in All Major Cloud Platforms (darkreading.com)
Security concerns impeding cloud migration | SC Media (scmagazine.com)
Malware Delivery via Cloud Services Exploits Unicode Trick to Deceive Users (thehackernews.com)
Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)
Identity and Access Management
Encryption
Linux and Open Source
The economic model that made the internet, and the hack that almost broke it : Planet Money : NPR
400K Linux Servers Recruited by Resurrected Ebury Botnet (darkreading.com)
Are all Linux vendor kernels insecure? A new study says yes, but there's a fix | ZDNET
Passwords, Credential Stuffing & Brute Force Attacks
Social Media
YouTube has become a significant channel for cyber crime - Help Net Security
How Secure Is The Metaverse? (A Look At Cyber Threats And Defences) (forbes.com)
Malvertising
Ransomware gang targets Windows admins via PuTTy, WinSCP malvertising (bleepingcomputer.com)
The mystery of the targeted ad and the library patron • The Register
Windows admins targeted with clever malvertising scam | TechRadar
Training, Education and Awareness
Regulations, Fines and Legislation
NYSE parent fined $10M for breach reporting failure • The Register
Intercontinental Exchange Will Pay $10 Million to Resolve SEC Cyber Probe (wsj.com)
UK considering mandatory reporting for ransomware attacks (computing.co.uk)
How to stay on top of evolving cyber security legislation | RSM UK
Security Compliance 101: What It Is and How to Master It - Security Boulevard
Singapore updates cyber security law to expand regulatory oversight | ZDNET
The Dawn of DORA: Building a Resilient Financial Infrastructure (finextra.com)
What American Enterprises Can Learn From Europe's GDPR Mistakes (darkreading.com)
Preparing Your Organisation for Upcoming Cyber Security Deadlines (darkreading.com)
Backup and Recovery
Data Protection
Careers, Working in Cyber and Information Security
The IT skills shortage situation is not expected to get any better - Help Net Security
UK Government ramps up efforts to bridge cyber security skills gap (holyrood.com)
Persistent Burnout Is Still a Crisis in Cyber Security (darkreading.com)
5 Ways SMBs Can Bridge the Cyber Security Skills Gap | Mimecast
Law Enforcement Action and Take Downs
Dutch police tracked a crypto theft to one of world’s worst botnets (thenextweb.com)
Police caught circumventing city bans on face recognition • The Register
10 Years in Prison for $4.5 million BEC Scammer Who Bought Ferrari to Launder Money | Tripwire
LockBit takedown taking toll as gang plummets down rankings • The Register
He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market | WIRED
Casino cyber attacks put a bullseye on Scattered Spider • The Register
First LockBit, now BreachForums: Are cops winning the war? • The Register
No time to take eye of the ball despite recent cyber success – report (emergingrisks.co.uk)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
World War War III May Already Have Started—in the Shadows (reason.com)
The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict
Nation State Actors
China
The Security Interviews: What is the real cyber threat from China? | Computer Weekly
UK not heeding warning over China threat, says ex-cyber security chief (yahoo.com)
Newly Detected Chinese Group Targeting Military, Government Entities - Security Week
Spies, trade and tech: China’s relationship with Britain (economist.com)
Google, Meta warned that undersea internet cables at risk for Chinese espionage: report (nypost.com)
UK military in data breach - and other cyber security news | World Economic Forum (weforum.org)
Researchers Warn of Chinese-Aligned Hackers Targeting South China Sea Countries (thehackernews.com)
Active Chinese Cyberespionage Campaign Rifling Email Servers (inforisktoday.com)
State hackers turn to massive ORB proxy networks to evade detection (bleepingcomputer.com)
Stronger critical infrastructure defence aimed by Army Cyber Command | SC Media (scmagazine.com)
Former Royal Marine charged with spying for China found dead (thetimes.co.uk)
Russia
New Star Wars Plan: Pentagon Rushes to Counter Threats in Orbit - The New York Times
British man, 64, charged with assisting Russian intelligence service | The Independent
Iran
North Korea
North Korea-linked Kimsuky APT attack targets victims via Messenger (securityaffairs.com)
US Official Warns a Cell Network Flaw Is Being Exploited for Spying | WIRED
North Korea-linked IT workers infiltrated hundreds of US firms (securityaffairs.com)
High-ranking military officials' e-mail hacked, possibly by N. Korea (koreaherald.com)
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Vulnerability Management
93% of vulnerabilities unanalysed by NVD since February | TechTarget
How AI-driven patching could transform cyber security | TechTarget
Vulnerabilities
Microsoft Edge gets fixes for five more security vulnerabilities - Neowin
Critical Bug Allows DoS, RCE, Data Leaks in All Major Cloud Platforms (darkreading.com)
Veeam warns of critical Backup Enterprise Manager auth bypass bug (bleepingcomputer.com)
Microsoft Has Yet to Patch 7 Pwn2Own Zero-Days (darkreading.com)
Critical Flaw in AI Python Package Can Lead to System and Data Compromise - Security Week
This devious Wi-Fi security flaw could let hackers eavesdrop on your network with ease | TechRadar
Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal (thehackernews.com)
Intel's Max Severity Flaw Affects AI Model Compressor Users (govinfosecurity.com)
15 QNAP NAS bugs and one PoC disclosed, update ASAP! (CVE-2024-27130) - Help Net Security
Keylogger Embedded Microsoft Exchange Server Steals Login Credentials (cybersecuritynews.com)
Chrome 125 Update Patches High-Severity Vulnerabilities - Security Week
Ivanti Patches Critical Code Execution Vulnerabilities in Endpoint Manager - Security Week
Unauthenticated RCE Vulnerability in Fortinet FortiSIEM: PoC Published (cybersecuritynews.com)
Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern (thehackernews.com)
VMware Abused in Recent MITRE Hack for Persistence, Evasion - Security Week
High-severity GitLab flaw lets attackers take over accounts (bleepingcomputer.com)
CISA Warns of Actively Exploited Apache Flink Security Vulnerability (thehackernews.com)
Tools and Controls
New rules prompt 93% of organisations to rethink cyber security plans | Security Magazine
Microsoft to Mandate Multi-Factor Authentication for All Azure Users (cybersecuritynews.com)
What is a Third-Party Risk Assessment in Cyber Security? | UpGuard
Should You Buy Cyber Insurance in 2024? Pros & Cons (techopedia.com)
The Critical Role Of Web Filtering To Secure A Modern Workplace (forbes.com)
We put too much faith in our web browsers, here's why we shouldn't (xda-developers.com)
Windows 11 to Deprecate NTLM, Add AI-Powered App Controls and Security Defences (thehackernews.com)
Google says Microsoft can’t be trusted after email security blunders | ITPro
Fighting identity fraud? Here's why we need better tech - Help Net Security
77 percent of organisations suffer cyber attacks due to identity issues (betanews.com)
Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica
Microsoft's latest Windows 11 security features aim to make it 'more secure out of the box' | ZDNET
Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)
Cyber insurance trends: reshaping the industry - SiliconANGLE
The Evolution of Security Operations Centres in the Past Decade | Information Security Buzz
When to Automate and When Not to Automate Security - Security Boulevard
Critical Capabilities of Cyber Security Risk Assessment Tools (cybersaint.io)
How AI-driven patching could transform cyber security | TechTarget
Reports Published in the Last Week
Other News
Aon reveals cyber attack/data breach as top risk for financial institutions - Reinsurance News
15 companies account for 62% of global attack surface | Security Magazine
Cyber attacks are soaring—treat them as an 'act of war', health care exec warns | Fortune Well
If the Lights Went Out: Exploring a Power Grid Failure (greydynamics.com)
Wars in Ukraine and Gaza raise UK infrastructure cyber threat level | New Civil Engineer
Malware power threat real and growing – researchers (emergingrisks.co.uk)
Microsoft’s President to Testify to House Panel on Cyber Security (bloomberglaw.com)
5 Ways SMBs Can Bridge the Cyber Security Skills Gap | Mimecast
Why cyber security is front and centre for rail - Railway Technology (railway-technology.com)
Mitigating cyber security risks in the technology sector | TechRadar
Cyber attacks on construction firms jump, new report finds | News | Building
FUD: How Fear, Uncertainty, and Doubt can ruin your security program - Security Boulevard
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Alert 20 May 2024 – Flaw in Popular PDF Reader Foxit Exploited by Hackers to Deliver Variety of Malware
Black Arrow Cyber Alert 20 May 2024 – Flaw in Popular PDF Reader Foxit Exploited by Hackers to Deliver Variety of Malware
Executive summary
An active campaign has been identified in which a flaw in Foxit, a popular PDF reader, is being exploited by attackers to deploy a variety of malware. Check Point, who have identified the campaign have said that it has been used by multiple threat actors in campaigns ranging “from e-crime to espionage”. The campaign takes advantage of a flaw in which the PDF reader is set to accept a document as trusted by default. Once a user clicks OK on this, a second display pops up which has the default option of allowing the PDF to open additional programs and execute commands.
What’s the risk to me or my business?
There is a risk that organisations using Foxit PDF reader are vulnerable to this exploitation, which has a low detection rate. Additionally, this risk extends to employees who have access to corporate data on their personal device and are using Foxit. In both cases, the confidentiality, integrity and availability of information is at risk.
Reports indicate that the malicious PDF’s are being distributed in traditional manners including email, as well as social media such as Facebook, capitalising on the low-level of detection of this exploit.
What can I do?
Black Arrow recommends organisations evaluate the most suitable risk treatment approach for their environment. This may involve exploring alternative software solutions or uninstalling the affected software altogether. Additionally, disabling non-essential features, such as command prompt and PowerShell execution, for standard users is recommended. Cyber awareness training should also emphasise the importance of not opening unexpected files or granting permissions via pop-up windows to mitigate risks.
#threatadvisory #threatintelligence #cybersecurity
Further information from Check Point can be found here:
https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/
Black Arrow Cyber Threat Briefing 17 May 2024
Black Arrow Cyber Threat Intelligence Briefing 17 May 2024:
-Social Engineering is the Biggest Cyber Threat as Study Finds Most Workers Have Clicked on a Suspicious Email Link
-Business Leaders are Stressing Out Over Pace of Technological Change, as Cyber Security Incidents Seen as Main Business Disruptor
-ICO Warns That Many UK Businesses Neglect Basic Cyber Security: More Ransomware and Cyber Attacks Last Year Than Ever Before
-Data Breaches are Getting Worse, Many are Employee Errors or Social Engineering Attacks
-Why Cyber Insurance isn’t a Substitute for Cyber Risk Management
-China Presents Defining Challenge to Global Cyber Security, Says GCHQ
-Botnet Sent Millions of Emails in LockBit Black Ransomware Campaign
-Global Financial Stability at Risk Due to Cyber Threats, IMF warns
-Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls
-Santander Data Breach via Third-Party Provider Impacted Customers and Employees
-40% of Cyber Teams Have Held Back from Reporting Cyber Attacks Over Fear of Losing Jobs
-Digital Resilience – a Step Up from Cyber Security
-UK Lags Europe on Exploited Vulnerability Remediation
-Cyber Threats Demand More Focus Says Zurich, as UK Insurance And NCSC Join Forces to Fight Ransomware Payments
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Social Engineering is the Biggest Cyber Threat, as Study Finds Most Workers Have Clicked on a Suspicious Email Link
According to a recent report, half of office workers have clicked on a link or attachment within a suspicious email sent to their work address within the last 12 months, and of those that interacted with the email, half of them claimed to be confident in their ability to identify phishing emails.
With 68% of breaches involving the human element, your organisation must be cognisant of its employees. Hackers know that no matter what your tech stack is, you will always have employees and where there is an employee, there is a way into your organisation. It is far cheaper to exploit an employee who already has the access you require, than to develop a new exploit. It only takes one human to make a mistake by granting access to an attacker.
When it came to training, only 41% of respondents said their employer had provided formal cyber security awareness training and 79% said their previous training is not sufficient to keep pace with modern cyber threats.
Source: [HackerNoon] [BusinessPlus]
Business Leaders are Stressing Out Over Pace of Technological Change, as Cyber Security Incidents Seen as Main Business Disruptor
A recent report commissioned by BT reveals that 86% of UK business leaders suffer from 'tech-related stress,' particularly concerning AI and cyber security, a phenomenon they have termed as 'Bytmares.' The report found that 59% of business leaders worry about the rapid and relentless pace of tech advancement, and whether appropriate controls are in place to protect it.
According to a different survey, 74% of business leaders view cyber security incidents as the main disruptive threat to their organisations either currently or over the next twelve months. This was followed by cloud computing, internet of things and artificial intelligence.
These findings highlight the critical importance of robust cyber security measures in today’s interconnected world. As organisations increasingly rely on digital infrastructure, safeguarding sensitive data and systems becomes paramount. Cyber threats can disrupt operations, compromise customer trust, and result in financial losses. Remember, cyber security is not just an IT concern; it is a strategic imperative for every organisation.
Sources: [Beta News] [Telecoms] [Verdict]
ICO Warns That Many UK Businesses Neglect Basic Cyber Security: More Ransomware and Cyber Attacks Last Year Than Ever Before
A recent update from the UK’s Information Commissioner’s Office (ICO) has revealed that ransomware attacks in the UK have surpassed all previous years, up 52% from the previous year. The report found that finance, retail and education sectors are suffering the most incidents.
The leading causes of breaches include phishing, brute force attacks, errors and supply chain attacks. The ICO noted that many organisations still neglect basic cyber security measures and has called for enhanced efforts to combat the escalating threat, emphasising the importance of foundational controls.
Sources: [Tech Monitor] [Government Business] [The Record Media] [Tech Monitor]
Data Breaches are Getting Worse, Many are Employee Errors or Social Engineering Attacks
The latest Verizon Business Data Breach Investigations Report (DBIR) highlights that employee error is the leading cause of cyber security incidents in the EMEA region, accounting for 49% of cases. The top reasons for these incidents are “miscellaneous errors, system intrusion, and social engineering,” making up 87% of all breaches. Hackers primarily target personal information (64%), internal data (33%), and login credentials (20%). Despite zero-day vulnerabilities being a significant threat, with exploitation rising to 14% of breaches, the report emphasises the critical need for ongoing employee training and awareness to mitigate these risks.
Source: [TechRadar]
Why Cyber Insurance isn’t a Substitute for Cyber Risk Management
While cyber insurance can be beneficial in mitigating financial loss from cyber attacks, it is not a substitute for comprehensive cyber risk management. Many firms with cyber insurance have still fallen victim to attacks, highlighting that cyber insurance primarily transfers residual risk. Effective cyber risk management includes conducting proper risk assessments and implementing robust cyber security controls. Cyber insurance cannot resolve issues like business disruption, breach of client confidentiality, and compliance with legal obligations; this stresses the need for proactive measures and independent assurance to protect against cyber threats.
Source: [ Law Society of Scotland]
China Presents Defining Challenge to Global Cyber Security, Says GCHQ
A recent speech by the new director of the UK’s GCHQ highlighted China's growing cyber threat, describing it as an "epoch-defining challenge." She warned that China's destabilising actions undermine global internet security. The current head of the UKs’ NCSC echoed these concerns, pointing to the Chinese state-sponsored hacking group Volt Typhoon which has infiltrated critical sectors like energy and transportation. The National Cyber Director at the White House added that China’s cyber capabilities pose a significant threat to global infrastructure, particularly in crisis scenarios, as Chinese hackers increasingly use sophisticated techniques to pre-position within networks.
Source: [Infosecurity Magazine]
Botnet Sent Millions of Emails in LockBit Black Ransomware Campaign
Since April, millions of phishing emails have been sent through a botnet known as “Phorpiex” to conduct a large-scale LockBit Black ransomware campaign. In a warning from New Jersey’s Cybersecurity and Communications Integration Cell, it was explained that the attackers use ZIP attachments containing an executable that deploys the LockBit Black payload, which encrypts the recipients' systems if launched. The emails are sent from 1,500 unique IP addresses worldwide.
Sources: [Bleeping Computer]
Global Financial Stability at Risk Due to Cyber Threats, IMF warns
A new International Monetary Fund (IMF) report highlights the severe threat cyber attacks pose to global financial stability, revealing that nearly 20% of reported cyber incidents in the past two decades targeted the financial sector, causing $12 billion in direct losses. Since 2020, these attacks have led to an estimated $2.5 billion in direct losses. The report underscores that cyber incidents threaten financial institutions' operational resilience, potentially leading to funding challenges and reputational damage. The IMF calls for bolstered cyber security measures, including stress testing, information-sharing arrangements, and enhanced national cyber security strategies to mitigate these growing risks.
Source: [World Economic Forum]
Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls
An ongoing social engineering campaign that is bombarding enterprises with spam calls and emails has been uncovered. The campaign involves a threat actor overwhelming a user’s email with junk, followed by a call offering to assist in removing the junk. From here, the threat actor aims to convince the victim to download remote monitoring and management software such as AnyDesk or Microsoft’s built in Quick Assist feature to allow the attacker remote access to the victim’s machine.
Source: [The Hacker News]
Santander Data Breach via Third-Party Provider Impacted Customers and Employees
A recent disclosure by the Spanish bank Santander revealed a data breach at a third-party provider affecting customers in Chile, Spain, and Uruguay. Unauthorised access to a database hosted by the provider compromised information on all current and some former employees, but did not include transactional data, online banking details, or passwords. Santander said they swiftly implemented measures to contain the incident, blocking access to the compromised database and enhancing fraud prevention controls. The bank assured that its operations and systems remain unaffected, allowing customers to continue transacting securely. The number of impacted individuals remains unspecified.
There is a continued trend in third party providers being used as the soft underbelly to attack larger and better defended organisations, requiring all organisations to consider the security controls of their third parties.
Source: [securityaffairs.com]
40% of Cyber Teams Have Held Back from Reporting Cyber Attacks Over Fear of Losing Jobs
Recent research has revealed that 40% of cyber teams have not reported a cyber attack due to the fear of losing their job. Unfortunately, this leaves businesses at risk of being non-compliant, without even knowing so. When it came to challenges faced by organisations, it was found that nearly 20% of companies say a lack of qualified talent is a key challenge to overcoming cyber attacks and 32% did not have the resources to hire new staff. This is not to say however, they are unable to outsource some of their cyber function to cyber specialists. This lack of allocated resources prevents the organisation from being confident that any incidents have been appropriately remediated.
Source: [Business Wire]
Digital Resilience – a Step Up from Cyber Security
In an increasingly digital world, many organisations are unaware of how truly reliant they are on digital technology, and the accompanying risks. As we move toward an even more digitally dependent future, the need for digital resilience is more critical than ever. Digital resilience refers to the ability to maintain, change, or recover technology-dependent operations. Organisations should begin with an internal audit to assess their digital resilience, involving all departments and ensuring senior management oversight, as board involvement is essential for effective cyber security programmes.
Digital resilience goes beyond cyber security to encompass change management, business resilience, and operational risk. Implementing digital resilience strategies requires continuous adaptation, cross-functional collaboration, and embedding resilience thinking throughout the organisation. Businesses must integrate digital resilience into their strategic planning to ensure ongoing competitiveness and adaptability in an ever-evolving digital landscape.
Sources: [CSO Online] [CSO Online]
UK Lags Europe on Exploited Vulnerability Remediation
A new report by Bitsight reveals that UK organisations lag behind their European counterparts in remediating software flaws listed in the US ‘Known Exploited Vulnerability’ (KEV) catalogue. UK organisations take an average of 225 days to address KEVs, compared to 220 days for European entities and just 21 days for German organisations. Non-KEV vulnerabilities are patched at an even slower rate, with UK entities taking over two years (736 days) to patch. Globally, the average time to resolve KEVs is around six months (180 days). Despite fewer KEVs detected in UK environments (30% versus 43% in Europe), the slow remediation poses significant risks, emphasising the need for faster and more proactive cyber security measures, specifically robust vulnerability scanning and patching.
Source: [Infosecurity Magazine]
Cyber Threats Demand More Focus Says Zurich, as UK Insurance And NCSC Join Forces to Fight Ransomware Payments
A recent discussion at the British Insurance Brokers' Association (BIBA) conference highlighted the increasing importance of cyber security for businesses, driven by the surge in cyber attacks and the use of AI by criminal gangs. Zurich Resilience Solutions UK noted that businesses face greater scrutiny from underwriters over their cyber exposures.
BIBA, together with the Association of British Insurers (ABI), and the International Underwriting Association (IUA), have united with the UK’s National Cyber Security Centre (NCSC) in a joint effort to tackle ransom payments. As a result of their collaboration, they have published new best practice guidance, which aims to reduce the number of payments being made by UK victims as well as the disruption businesses face.
Source: [Emerging Risks] [NCSC] [Infosecurity Magazine]
Governance, Risk and Compliance
Business leaders consider cyber security main disruptor – Q1 2024 survey - Verdict
The Growing Cyber Security Disconnect Leaves Enterprises Exposed (forbes.com)
Cyber threats demand more focus – Zurich (emergingrisks.co.uk)
Digital resilience – a step up from cyber security | CSO Online
UK business leaders are stressing out over pace of technological change (telecoms.com)
Cyber attacks threaten global financial stability, IMF warns | World Economic Forum (weforum.org)
BISO: Enhancing cyber security in modern enterprises - SiliconANGLE
Dell Data Breach Underscores Cost of Cyber Security Complacency (pymnts.com)
Cyber and Financial Crime, Through the FBI Lens (govinfosecurity.com)
Maximizing cyber security ROI: A strategic approach | TechRadar
Many CISOs don't feel they get the right respect from their board | TechRadar
Cyber high on agenda at BIBA amid concerns over threats (emergingrisks.co.uk)
Are you meeting your cyber insurance requirements? - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
Botnet sent millions of emails in LockBit Black ransomware campaign (bleepingcomputer.com)
UK hit by more ransomware and cyber attacks last year than ever before (therecord.media)
The ups and downs (and ups again) of the ransomware risk - Digital Journal
Hackers Target Children of Corporate Executives in Ransomware Attacks (businessinsider.com)
CISA: Black Basta ransomware breached over 500 orgs worldwide (bleepingcomputer.com)
Cyber attacks leave significant financial impact on hacked organisations (kwch.com)
As the FBI Closes In, Scattered Spider Attacks Finance, Insurance Orgs (darkreading.com)
UK insurance industry begins to acknowledge role in tackling ransomware (therecord.media)
The UK may not have a choice on a ransomware payment ban | Computer Weekly
64% Jump in Ransomware Claims on Remote Access Tools, Report Shows (claimsjournal.com)
Organisations struggle to defend against ransomware - Help Net Security
Ransomware statistics that reveal alarming rate of cyber extortion - Help Net Security
Most ransomware-hit enterprises report to authorities, but level of support varies | ZDNET
Ransomware negotiator weighs in on the payment debate • The Register
OODA Loop - The Social Engineering Tactics of Ransomware-as-a-Service Operator Black Basta
INC ransomware source code selling on hacking forums for $300,000 (bleepingcomputer.com)
Ransomware Defence Strategies: Never Trust a Criminal (inforisktoday.com)
Ransomware Victims
More than 470 legal actions against HSE over cyber attack (rte.ie)
Christie's Just Postponed the Rare Watches Auction Due to Cyber Attack (robbreport.com)
Singing River Health System: Data of 895,000 stolen in ransomware attack (bleepingcomputer.com)
Repeat Offenders: Black Basta’s Latest Healthcare Cyber Attack (informationweek.com)
E-prescription provider MediSecure impacted by a ransomware attack (securityaffairs.com)
Phishing & Email Based Attacks
Most Workers Have Clicked on a Suspicious Email Link (businessplus.ie)
Botnet sent millions of emails in LockBit Black ransomware campaign (bleepingcomputer.com)
Stay In The Loop On Emerging And Evolving Email Threat Trends (informationsecuritybuzz.com)
Collaboration tools are now at the frontline in the battle against phishing (securitybrief.co.nz)
5 Common Phishing Vectors and Examples - 2024 (cybersecuritynews.com)
BEC
Other Social Engineering
Low-tech tactics still top the IT security risk chart | CSO Online
Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls (thehackernews.com)
What is vishing and quishing, and how do you protect yourself? | PCWorld
Beware of fake calls, ward off cyber criminals: Govt - The Statesman
OODA Loop - The Social Engineering Tactics of Ransomware-as-a-Service Operator Black Basta
Artificial Intelligence
UK agency releases tools to test AI model safety | TechCrunch
Security industry struggles to consolidate against AI threats - SiliconANGLE
Cyber Security Races to Unmask New Wave of AI Deepfakes (darkreading.com)
Only one-third of firms deploy safeguards against generative AI threats, report finds | CIO Dive
CISOs Reconsider Their Roles in Response to GenAI Integration - Security Boulevard
AI's rapid growth puts pressure on CISOs to adapt to new security risks - Help Net Security
AI-driven attacks seen as chief cloud security threat | TechTarget
The Cyber Security Survival Guide For Generative AI (forbes.com)
2FA/MFA
Malware
Malware was almost 50% of threat detections in Q1 2024 | Security Magazine
North Korean Hackers Deploy New Golang Malware 'Durian' Against Crypto Firms (thehackernews.com)
FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT (thehackernews.com)
Microsoft fixes Windows zero-day exploited in QakBot malware attacks (bleepingcomputer.com)
Ebury botnet malware infected 400,000 Linux servers since 2009 (bleepingcomputer.com)
Kimsuky hackers deploy new Linux backdoor via trojanized installers (bleepingcomputer.com)
Mobile
Malicious Android Apps Pose as Google, Instagram, WhatsApp to Steal Credentials (thehackernews.com)
Google Issues Critical Update For Millions Of Pixel Users (forbes.com)
Apple Patch Day: Code Execution Flaws in iPhones, iPads, macOS - Security Week
Threat actors may have exploited a zero-day in older iPhones, Apple warns (securityaffairs.com)
Apple warns of increased iPhone security risks – Computerworld
Unwanted Tracking Alerts Rolling Out to iOS, Android - Security Week
Apple blocked $7 billion in fraudulent App Store purchases in 4 years (bleepingcomputer.com)
Android boosting security with Theft Detection Lock, factory reset protection (9to5google.com)
Data Privacy: All the Ways Your Cellphone Carrier Tracks You and How to Stop It
Your Android phone could have stalkerware — here’s how to remove it | TechCrunch
Internet of Things – IoT
Attack makes autonomous vehicle tech ignore road signs • The Register
Millions of IoT Devices at Risk From Integrated Modem (darkreading.com)
Prison for cyber security expert selling private videos from inside 400,000 homes (bitdefender.com)
IoT Vulnerabilities and BotNet Infections: A Risk for Executives - Security Boulevard
Data Breaches/Leaks
Over 5.3 billion data records exposed in April 2024 | Computer Weekly
MoD contractor hacked by China failed to report breach for months | Hacking | The Guardian
Data breaches are getting worse - and many are coming from a familiar source | TechRadar
Notorious threat actor IntelBroker claims the hack of the Europol (securityaffairs.com)
Hacker claims another breach into Dell systems | SC Media (scmagazine.com)
Dell Data Breach Underscores Cost of Cyber Security Complacency (pymnts.com)
Hacker claims to have stolen Dell customer data, twice. Here's how to protect yourself | ZDNET
Santander Data Breach Impacts Customers, Employees - Security Week
The legal sector's data breach conundrum: insights from ICO's latest report - Solicitors Journal
JPMorgan Fixes Security Flaw, Affects 450K Retirement Plans | Entrepreneur
Europol confirms incident after data break-in claims • The Register
Largest non-bank lender in Australia warns of a data breach (bleepingcomputer.com)
Guernsey data breaches: More than 1,000 people affected - BBC News
Up to 120,000 affected by data breach at City of Helsinki (helsinkitimes.fi)
Camden Council cyber attack warning after NRS Healthcare cyber attack | Ham & High (hamhigh.co.uk)
Lessons learned from high-profile data breaches | TechTarget
Zscaler Confirms Only Isolated Test Server Was Hacked - Security Week
Nissan North America data breach impacts over 53,000 employees (bleepingcomputer.com)
Organised Crime & Criminal Actors
FBI, DoJ Shut Down BreachForums, Launch Investigation (darkreading.com)
Cyber and Financial Crime, Through the FBI Lens (govinfosecurity.com)
FBI working towards nabbing Scattered Spider hackers, official says | Reuters
Low-tech tactics still top the IT security risk chart | CSO Online
Top 5 Most Dangerous Cyber Threats in 2024 (darkreading.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
North Korean Hackers Deploy New Golang Malware 'Durian' Against Crypto Firms (thehackernews.com)
Tornado Cash cryptomixer dev gets 64 months for laundering $2 billion (bleepingcomputer.com)
US brothers arrested for stealing $25m in crypto in just 12 seconds - BBC News
Insider Risk and Insider Threats
Low-tech tactics still top the IT security risk chart | CSO Online
Data breaches are getting worse - and many are coming from a familiar source | TechRadar
The Human Element in Cyber Security: Safeguarding your organisation (thebusinessmagazine.co.uk)
CISOs call to ditch the 'stigma of blame' in cyber security (computing.co.uk)
Insurance
NCSC guide to help businesses facing ransomware demands (biba.org.uk)
UK insurance industry begins to acknowledge role in tackling ransomware (therecord.media)
Lloyd’s provides tighter guidance on cyber war wordings | Insurance Insider
Cyber high on agenda at BIBA amid concerns over threats (emergingrisks.co.uk)
Are you meeting your cyber insurance requirements? - Help Net Security
Supply Chain and Third Parties
Cloud/SaaS
How to create a cloud security policy, step by step | TechTarget
AI-driven attacks seen as chief cloud security threat | TechTarget
Singapore Cyber Security Update Puts Cloud Providers on Notice (darkreading.com)
Secrecy Concerns Mount Over Spy Powers Targeting US Data Centres | WIRED
Encryption
Linux and Open Source
Ebury botnet malware infected 400,000 Linux servers since 2009 (bleepingcomputer.com)
Kimsuky hackers deploy new Linux backdoor via trojanized installers (bleepingcomputer.com)
Establishing a security baseline for open source projects - Help Net Security
Passwords, Credential Stuffing & Brute Force Attacks
Social Media
Training, Education and Awareness
Regulations, Fines and Legislation
Singapore Cyber Security Update Puts Cloud Providers on Notice (darkreading.com)
Clock is ticking for companies to prepare for EU NIS2 Directive | CSO Online
Nigeria Halts Cyber Security Tax After Public Outrage (darkreading.com)
Models, Frameworks and Standards
Careers, Working in Cyber and Information Security
The cyber security skills shortage: A CISO perspective | CSO Online
Why cyber security staff burn out, and what to do about it (computing.co.uk)
Law Enforcement Action and Take Downs
As the FBI Closes In, Scattered Spider Attacks Finance, Insurance Orgs (darkreading.com)
FBI, DoJ Shut Down BreachForums, Launch Investigation (darkreading.com)
Most ransomware-hit enterprises report to authorities, but level of support varies | ZDNET
Prison for cyber security expert selling private videos from inside 400,000 homes (bitdefender.com)
Tornado Cash cryptomixer dev gets 64 months for laundering $2 billion (bleepingcomputer.com)
US brothers arrested for stealing $25m in crypto in just 12 seconds - BBC News
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Nation State Actors
China
Cyber threat landscape permanently altered by Chinese operations, US officials say (therecord.media)
Tracking the Progression of Earth Hundun's Cyber espionage Campaign in 2024 | Trend Micro (US)
Can't blame all Chinese cyber attacks on the government - Asia Times
How the West has struggled to keep up with China’s spy threat - BBC News
Stifling Beijing in cyber space big focus for UK operatives • The Register
China focuses on non-military ways to take Taiwan, reports warn - Washington Times
It’s time to ban TikTok for the sake of our democracy and security (politicshome.com)
Asian Threat Actors Use New Techniques to Attack Familiar Targets (darkreading.com)
Chinese Crime Ring Uses Franchise Model to Grow Fake Online Shops (businessinsider.com)
Three men charged with aiding Hong Kong intelligence service, says Met | UK news | The Guardian
Russia
File Not Found: Russia Is Hacking Evidence of Its War Crimes - War on the Rocks
NATO Draws a Cyber Red Line in Tensions With Russia - Security Week
Pro-Russia hackers targeted Kosovo government websites (securityaffairs.com)
UK 'increasingly concerned' about Russian intelligence links to hacktivists (therecord.media)
To the Moon and back(doors): Lunar landing in diplomatic missions (welivesecurity.com)
New backdoors on a European government's network appear to be Russian (therecord.media)
'Russian' hackers deface potentially hundreds of local British news sites (therecord.media)
Investigation: How Russia's Warplanes Get Their 'Brain Power' From The West, Despite Sanctions
The Three Seas Initiative: A Vanguard in Digitization and Cyber Security | Warsaw Institute
Iran
North Korea
Vulnerability Management
Not Just MOVEit: 2023 Was a Banner Year for Zero-Days (inforisktoday.com)
(Cyber) Risk = Probability of Occurrence x Damage (thehackernews.com)
Critical vulnerabilities take 4.5 months on average to remediate - Help Net Security
The Fall of the National Vulnerability Database (darkreading.com)
Backlogs at National Vulnerability Database prompt action from NIST and CISA | CSO Online
Log4J shows no sign of fading, spotted in 30% of CVE exploits - Help Net Security
Heartbleed: When Is It Good to Name a Vulnerability? (darkreading.com)
Vulnerabilities
Google Chrome emergency update fixes 6th zero-day exploited in 2024 (bleepingcomputer.com)
Google patches third exploited Chrome zero-day in a week (bleepingcomputer.com)
Threat actors may have exploited a zero-day in older iPhones, Apple warns (securityaffairs.com)
Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days (thehackernews.com)
Microsoft fixes Windows zero-day exploited in QakBot malware attacks (bleepingcomputer.com)
Log4J shows no sign of fading, spotted in 30% of CVE exploits - Help Net Security
D-Link Routers Vulnerable to Takeover Via Exploit for Zero-Day (darkreading.com)
New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks (thehackernews.com)
Intel Publishes 41 Security Advisories for Over 90 Vulnerabilities - Security Week
Google Issues Critical Update For Millions Of Pixel Users (forbes.com)
Apple Patch Day: Code Execution Flaws in iPhones, iPads, macOS - Security Week
CISA and FBI Issue Alert on Path Traversal Vulnerabilities - Security Boulevard
VMware Patches Severe Security Flaws in Workstation and Fusion Products (thehackernews.com)
Firefox 126: Telemetry, privacy feature, and security fixes - gHacks Tech News
SAP Patches Critical Vulnerabilities in CX Commerce, NetWeaver - Security Week
Adobe Patches Critical Flaws in Reader, Acrobat - Security Week
Cisco Releases Security Updates for Multiple Products | CISA
Microsoft shares temp fix for Outlook encrypted email reply issues (bleepingcomputer.com)
Tools and Controls
Digital resilience – a step up from cyber security | CSO Online
How To Implement Threat Modeling To Protect Your Business - Minutehack
How to create a cloud security policy, step by step | TechTarget
Hackers use DNS tunneling for network scanning, tracking victims (bleepingcomputer.com)
AWS CISO: In AI gold rush, folks forget application security • The Register
Maximizing cyber security ROI: A strategic approach | TechRadar
The Human Element in Cyber Security: Safeguarding your organisation (thebusinessmagazine.co.uk)
Addressing the Cyber Security Vendor Ecosystem Disconnect (darkreading.com)
How to Think About Foundation Models for Cyber Security | Andreessen Horowitz (a16z.com)
Other News
Microsoft president summoned to House over security blunders • The Register
National Cyber Security Centre: Tech market not working - The Business Magazine
Critical infrastructure security needs everyone's help • The Register
Your Hospital Is Under Cyber Attack. Now What? (newsweek.com)
BT, TalkTalk, Virgin Media and Vodafone on UK Router Security and Upgrades - ISPreview UK
Hackers use DNS tunnelling for network scanning, tracking victims (bleepingcomputer.com)
NCSC CTO: Broken market must be fixed to usher in new tech • The Register
Public Sector IT is Broken: Turning the System Back On - IT Security Guru
The Cyber Security Implications Of Gen Z’s Tech-Savvy Lifestyle (forbes.com)
Classes cancelled as 'sinister' school cyber attacks rise - BBC News
Irony abounds as UK NCSC’s simple door codes revealed • The Register
Candidates to get cyber security support amid general election interference fears (nation.cymru)
Too many ICS assets are exposed to the public internet - Help Net Security
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Advisory 15 May 2024 – Microsoft, Adobe, Apple, Mozilla Firefox, Google Chrome, SAP and VMware Updates
Black Arrow Cyber Advisory 15 May 2024 – Microsoft, Adobe, Apple, Mozilla Firefox, Google Chrome, SAP and VMware Updates
Executive summary
Microsoft’s May Patch Tuesday provides updates to address 61 security issues across its product range. Notably, the update tackles two actively exploited zero-day vulnerabilities. The zero-days include a security feature bypass and an elevation of privilege vulnerability. Among the updates provided by Microsoft were 1 critical vulnerability, allowing an attacker remote code execution.
In addition to the Microsoft updates this week also saw Adobe, Apple, Firefox, Google Chrome, SAP and VMware all provide updates for vulnerabilities in a variety of their products, including multiple zero-days and critical vulnerabilities.
What’s the risk to me or my business?
The actively exploited vulnerabilities could allow an unauthenticated attacker to gain code execution as well as elevating to system privileges, the highest available. Both of which compromise the confidentiality, integrity and availability of data stored by an organisation.
What can I do?
Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have an available patch should be updated as soon as possible.
Technical Summary
Microsoft
CVE-2024-30040 – A security feature bypass, in which an unauthenticated attacker can gain code execution through convincing a user to open a malicious document. It is now known how this flaw was abused in attacks.
CVE-2024-30051- A flaw in Windows DWM Core Library which upon exploitation, allows an attacker to elevate to system privileges, the highest available.
Apple
Apple have addressed multiple vulnerabilities in its products, including 16 vulnerabilities on iPhone and iPads. This includes include one vulnerability which the company say “may have been exploited”.
Adobe
Adobe have addressed 37 vulnerabilities in its products, including 9 critical vulnerabilities in Adobe Acrobat and Reader, , 2 critical vulnerabilities in Adobe Commerce, Adobe InDesign, Adobe Experience manager, 1 critical vulnerability in Adobe Media Encoder and Adobe Bridge, 3 critical vulnerabilities in Adobe Illustrator and 2 critical vulnerabilities in Adobe Animate. The company said it was not aware of any exploits in the wild for any of the documented issues.
Firefox
Firefox has upgraded to version 126. The new version addresses 16 unique security issues. None of the vulnerabilities are currently under active exploitation. The release also comes with some quality-of-life changes such as search telemetry changes and copy link without site tracking.
Google Chrome
Google Chrome released an emergency update to fix their 6th zero-day exploited this year, just one week after a previous one. Google are aware that an exploit for the vulnerability exists in the wild. Users are recommended to update as soon as possible.
SAP
This month, SAP has released 17 patches, which include 14 new fixes and 3 updates from previous releases. Two patches and one update have been given the “hot news” priority in SAP, the highest severity. The vulnerabilities encompass a range of issues, including CSS Injection, Remote Code Execution, File Upload flaws, and Cross-Site Scripting (XSS).
VMWare
Multiple security flaws, including one critical vulnerability, have been addressed by VMware after their exploitation was demonstrated at a security event. Some of the vulnerabilities do not have a fix yet and as such, users are advised to disable Bluetooth support and 3D acceleration as temporary workarounds until patches are applied.
More info:
Microsoft
Further details on other specific updates within Microsoft’s May patch Tuesday can be found here:
https://www.ghacks.net/2024/05/14/microsoft-releases-the-may-2024-security-updates-for-windows/
Apple
Further details of the vulnerabilities in Apple can be found here:
https://support.apple.com/en-gb/HT201222
Adobe
Further details of the vulnerabilities in Adobe Acrobat and Reader can be found here:
https://helpx.adobe.com/security/products/acrobat/apsb24-29.html
Further details of the vulnerabilities in Adobe Photoshop can be found here:
https://helpx.adobe.com/security/products/photoshop/apsb24-16.html
Further details of the vulnerabilities in Adobe Commerce can be found here:
https://helpx.adobe.com/uk/security/products/magento/apsb24-18.html
Further details of the vulnerabilities in Adobe InDesign can be found here:
https://helpx.adobe.com/uk/security/products/indesign/apsb24-20.html
Further details of the vulnerabilities in Adobe Experience Manager can be found here:
https://helpx.adobe.com/uk/security/products/experience-manager/apsb24-21.html
Further details of the vulnerabilities in Adobe Media Encoder can be found here:
https://helpx.adobe.com/uk/security/products/media-encoder/apsb24-23.html
Further details of the vulnerabilities in Adobe Bridge can be found here:
https://helpx.adobe.com/uk/security/products/bridge/apsb24-24.html
Further details of the vulnerabilities in Adobe Illustrator can be found here:
https://helpx.adobe.com/uk/security/products/illustrator/apsb24-25.html
Further details of the vulnerabilities in Adobe Animate can be found here:
https://helpx.adobe.com/uk/security/products/animate/apsb24-26.html
Firefox
Further details on the vulnerabilities addressed in the Firefox release can be found here:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/
Google Chrome
Further details on the vulnerabilities addressed in the Google Chrome update can be found here:
https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html
SAP
Further details on the vulnerabilities addressed in SAP can be found here:
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html
VMware
Further details on the vulnerabilities addressed by VMware can be found here:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Threat Briefing 10 May 2024
Black Arrow Cyber Threat Intelligence Briefing 10 May 2024:
-China Suspected of Hacking MoD, Through Its Payroll Provider
-Security Tools Fail to Translate Risks for Executives
-Gang Accused of MGM Hack Shifts Attacks to Finance Sector
-Are SMEs Paving the Way for Cyber Attacks on Larger Companies?
-Misconfigurations Drive 80% of Security Exposure, Report Finds
-Only 45% of Organisations Employ MFA Protections
-You Cannot Protect What You Do Not Know You Have, as Criminals are Exploiting Vulnerabilities Faster Than Ever
-The Rise and Stealth of The Socially Engineered Insider
-Over 70% of Staff Use AI At Work, But Only 30% of European Organisations Provide AI Training
-Don't Be the Weakest Link – You and Your Team's Crucial Role in Cyber Security
-Ransomware Activity Thrives, Despite Law enforcement Efforts
-NATO Warns of Russian Hybrid Warfare
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
China Suspected of Hacking UK Ministry of Defence, Through Its Payroll Provider
UK Defence Secretary Grant Shapps has confirmed that over 270,000 personal details have been leaked after the MoD was hacked through its third-party payroll provider, SSCL. The affected systems have been pulled offline since the attack. SSCL’s website describes that it manages HR for the armed forces, the Metropolitan Police and other areas of British government. The commercial supply chain, and in particular HR and payroll providers, is increasing being used as the soft underbelly to attack larger and better protected organisations.
Sources: [LBC] [The Register] [Sky News]
Security Tools Fail to Translate Risks for Executives
Organisations are struggling with internal communication barriers, hindering their ability to address and mitigate cyber security threats, according to a report which found that seven out of 10 C-suite executives said their security teams talk in technical terms without providing business context. However, in contrast, 75% of CISO’s highlight the issue is rooted in security tools that cannot generate the insights C-level executives and boards can use to understand business implications. The role of a good CISO should be to take the output of these tools and turn that data into metrics the Boards can understand.
The issues highlight the necessity for organisations to have someone in their organisation, whether an employee or a third-party, who is able to ingest technical results and translate them into a style that the C-suite can understand for business risk management.
Source: [Help Net Security]
Gang Accused of MGM Hack Shifts Attacks to Finance Sector
The hacking group responsible for the infamous hack on MGM and Caesar’s Palace resorts is engaged in a new campaign targeting the financial sector. The group known as Scattered Spider has targeted 29 companies since 20 April this year, compromising at least 2 insurance companies so far. The research has stated that the attackers are purchasing lookalike domains that match the name of target companies, hosting fake log-in pages. Links to these are sent to employees, in an attempt to direct them there. The most recent attack took place just days ago, with more expected.
Sources: [Bloomberg Law] [Claims Journal]
Are SMEs Paving the Way for Cyber Attacks on Larger Companies?
A recent study highlights the escalating cyber threats facing businesses, particularly SMEs and supply chains. The study found that 32% of UK businesses, including 69% of large and 59% of mid-sized organisations, suffered a cyber attack last year. The situation is worse for SMEs, with weaker security systems and 77% lacking in-house cyber security. SMEs can become entry points for hackers targeting larger partners through interconnected supply chains. Meanwhile, Verizon’s latest data breaches report revealed a 68% increase in supply chain breaches, accounting for 15% of all breaches in 2023, up from 9% in 2022. These breaches are primarily driven by third-party software vulnerabilities exploited in ransomware and extortion attacks. Experts emphasise proactive cyber policies, vulnerability scans, and employee education for SMEs to bolster defences. They also urge organisations to consider third-party bugs as both vulnerability and vendor management problems, make better vendor choices, and use external signals like SEC disclosures in the United States to guide decisions. These measures can help prevent SMEs from becoming gateways for larger attacks and manage the rising threat of supply chain breaches.
Sources: [Insurance Times] [Dark Reading]
Misconfigurations Drive 80% of Security Exposure, Report Finds
A recent report has found that 80% of security exposures are caused by identity and credential misconfigurations, with a third of these putting critical assets at risk of a breach. According to the report, the majority of this is within an organisation’s network user management (Active Directory) and 56% of breaches that impact critical assets are within cloud platforms. There is often the misconception that cloud-based environments are secure by default, but misconfigurations can undo any security benefits and still leave you exposed. Just because someone else built and maintains your house, it is still your responsibility to lock the doors and windows.
Sources: [Security Magazine]
Only 45% of Organisations Employ MFA Protections
A recent report of IT decision-makers has found that 97% are facing challenges with identity verification and 52% are very concerned about credential compromise, followed by account takeover (50%). When it comes to reinforcing identity verification, only 45% used multi-factor authentication (MFA). By using MFA, organisations are forcing two identification verifications: simply knowing a username and password is not enough, especially given the speeds with which attackers can crack passwords, with average 8 character passwords able to be cracked in less than a minute. Whilst no control is 100% impenetrable, enabling MFA will aid in increasing your organisation's cyber resilience.
Source: [Help Net Security]
You Cannot Protect What You Do Not Know You Have, as Criminals are Exploiting Vulnerabilities Faster Than Ever
For many organisations, visibility of their information assets can be incredibly hard to obtain and maintain, with different tools, under-reporting and shadow IT contributing to the problem. Unfortunately, cyber criminals are getting faster at exploiting vulnerabilities, and if you do not know you have the vulnerability in your estate then you cannot patch against it. In their recent report, Fortinet found that attacks started on average 4.76 days after new exploits were publicly disclosed.
Interestingly though, while zero-day threats garner much attention (these are ‘new’ vulnerabilities that are being exploited by attackers but for which there are no security patches yet available), one third of all exploits are for older vulnerabilities. This highlights the need for a comprehensive and robust approach to network security and vulnerability management, beyond simply patching what Microsoft puts out once a month. To have effective patch management, organisations must know what they need to patch and therefore must have visibility of the corporate environment. A good starting block is the creation of a robust information asset register.
Sources: [Security Brief] [Help Net Security] [IT Security Guru]
The Rise and Stealth of The Socially Engineered Insider
Social engineering has become increasingly prevalent as the preferred tactic for foreign adversaries. Insiders are prime targets due to their privileged access to sensitive data. This is particularly affecting the technology, pharma, and critical infrastructure sectors. Advances in AI and social platforms have made it easier to exploit these vulnerabilities. These advances allow threat actors to tailor attacks with unprecedented speed and realism. Using methods like coercion or deception, these actors exploit employees to gain high-value data that can be weaponised. As a result, the threat landscape has become more complex, blurring the lines between internal and external risks. To bolster their defences, organisations are now investing in insider risk management and AI. They are also emphasising employee education and cross-sector collaboration.
Source: [Forbes]
Over 70% of Staff Use AI At Work, But Only 30% of European Organisations Provide AI Training
An ISACA study and the AI Security & Governance Report reveal a complex landscape of AI adoption and security. 73% of European organisations and 54% of global organisations use AI, with 79% increasing their AI budgets, however training and policy development lag behind. Only 30% offer limited training, 40% provide none, and a mere 17% have a comprehensive AI policy. Despite AI’s potential, 80% of data experts find it complicates security, with concerns high around generative AI exploitation (61% of respondents) and AI-powered attacks (over 50% of business leaders). Data poisoning and privacy issues persist, yet 85% of leaders express confidence in their data security strategies, with 83% revising privacy and governance guidelines. With 86% recognising a need for AI training within two years, the call for dynamic governance strategies and formal education is clear to manage evolving threats.
Sources: [Help Net Security] [IT Security Guru]
Don't Be the Weakest Link – You and Your Team's Crucial Role in Cyber Security
Cyber security success depends on more than just technology. Bad actors are always looking for the easiest entry point, meaning that employees’ everyday actions are crucial, when even one careless click or a weak password can be an open door for hackers. However, empowered with the right knowledge and tools, staff can become a robust defence. Nearly 80% of organisations have reported an increase in phishing attacks, but training programs like role-playing exercises and phishing simulations significantly reduce these risks. Effective cyber security also hinges on C-suite leaders promoting a security-first culture, ensuring all employees understand the risks and follow strict protocols like MFA and strong password policies. Consistent training and open communication are vital in fostering a resilient, security-aware workforce.
Source: [JDSupra]
Ransomware Activity Thrives, Despite Law enforcement Efforts
Despite the recent law enforcement takedowns on ransomware groups, ransomware remains rife. Whilst the takedown of a group can come as an initial relief in that the group has gone, it simply forces ransomware affiliates to diversify. This is reflected in ransomware continuing its growth in the first quarter of 2024, with 18 new leak sites, the largest number in a single quarter, emerging over this period. When comes to those at risk, both financial services and healthcare remain a prominent target.
Sources: [Help Net Security ] [Infosecurity Magazine] [Help Net Security]
NATO Warns of Russian Hybrid Warfare
NATO has issued a statement in which it describes it is “deeply concerned about Russia's hybrid actions and the threat that they constitute to NATO security”. The actions are described to include sabotage, acts of violence, cyber and electronic interference, and disinformation campaigns. This comes as many countries including the UK and US are due to have elections this year.
Sources: [EU Reporter] [Financial Times]
Governance, Risk and Compliance
You cannot protect what you do not understand (securitybrief.co.nz)
Security tools fail to translate risks for executives - Help Net Security
It Costs How Much?!? The Financial Pitfalls of Cyber Attacks on SMBs (thehackernews.com)
Now More Than Ever, it's Crucial for Companies to Get Cyber Security Right (newsweek.com)
Why SMBs are facing significant security, business risks - Help Net Security
Are SMEs paving the way for cyber attacks on larger companies? | Insurance Times
Don't Be the Weakest Link – Your Team's Crucial Role in Cyber Security | NAVEX - JDSupra
The Art Of Cyber Security Governance: Safeguarding Beyond Code (forbes.com)
CISOs Are Worried About Their Jobs & Dissatisfied With Their Incomes (darkreading.com)
92% of CISOs Question the Future of Their Role Amidst Growing AI Pressures | Business Wire
Three strategies for winning the cyber security arms race | Fintech Nexus
Rethinking Cyber Security Investment Amid Rising Threats (govinfosecurity.com)
CIOs and CFOs, two parts of the same whole - IT Security Guru
Threats
Ransomware, Extortion and Destructive Attacks
Gang Accused of MGM Hack Turns Its Sights on Finance Sector (bloomberglaw.com)
Cybercrime Unicorns: What Everyone Needs to Know About Ransomware Gangs (pcmag.com)
Why Paying Should Be A Last Resort In Ransomware Attacks (forbes.com)
Ransomware activity is back on track despite law enforcement efforts - Help Net Security
Ransomware evolves from extortion to 'psychological attacks' • The Register
Russian Hacker Dmitry Khoroshev Unmasked as LockBit Ransomware Administrator (thehackernews.com)
Ransomware attacks impact 20% of sensitive data in healthcare orgs - Help Net Security
An overwhelming majority of organisations paid ransomware last year - eCampus News
The Growing Threat of Advanced Ransomware Attacks (inforisktoday.com)
Law enforcement seized Lockbit group's website again (securityaffairs.com)
Consultant charged with $1.5M extortion of IT giant • The Register
IT chiefs plan to spend and innovate their way out of ransomware swamp | TechRadar
Ransomware crooks SIM swap kids to pressure parents • The Register
Scattered Spider group a unique challenge for cyber cops, FBI leader says (therecord.media)
97% of Organisations Hit by Ransomware Worked with Law Enforcement (globenewswire.com)
CISA boss: Secure software needed to stop ransomware • The Register
Shields Up: How to Minimize Ransomware Exposure - Security Week
Ransomware Victims
UnitedHealth’s 'egregious negligence' led to that ransomware • The Register
Ascension healthcare takes systems offline after cyber attack (bleepingcomputer.com)
London Drugs president tight-lipped over recent cyber attack | CBC News
Boeing confirms attempted $200 million ransomware extortion attempt | CyberScoop
Cyber attack disrupts operations at major US health care network | CNN Business
City of Wichita Shuts Down Network Following Ransomware Attack - Security Week
Patient appointments imperilled by cyber attack on French radiologist (therecord.media)
Ransomware attack hits Brandywine Realty Trust | SC Media (scmagazine.com)
Phishing & Email Based Attacks
Other Social Engineering
The Rise And Stealth Of The Socially Engineered Insider (forbes.com)
Iranian hackers harvest credentials through advanced social engineering campaigns | CSO Online
What is social engineering penetration testing? | Definition from TechTarget
Artificial Intelligence
Organisations go ahead with AI despite security risks - Help Net Security
Innovation, Not Regulation, Will Protect Corporations From Deepfakes (darkreading.com)
Strategies for preventing AI misuse in cyber security - Help Net Security
AI is changing the game when it comes to cyber security | ITPro
Why the Cyber Security Industry Is Obsessed With AI Right Now - CNET
LLMs & Malicious Code Injections: 'We Have to Assume It's Coming' (darkreading.com)
Cyber Security, Deepfakes and the Human Risk of AI Fraud (govtech.com)
Criminal Use of AI Growing, But Lags Behind Defenders - Security Week
2FA/MFA
Only 45% of organisations use MFA to protect against fraud - Help Net Security
UnitedHealth Attack: Stolen Credentials, No MFA | MSSP Alert
Malware
ZLoader Malware adds Zeus's anti-analysis feature (securityaffairs.com)
Russia-linked APT28 and crooks are still using the Moobot botnet (securityaffairs.com)
Iranian hackers pose as journalists to push backdoor malware (bleepingcomputer.com)
New 'Cuckoo' Persistent macOS Spyware Targeting Intel and Arm Macs (thehackernews.com)
Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version (thehackernews.com)
Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery (thehackernews.com)
Mobile
Mobile Banking Malware Surges 32% - Infosecurity Magazine (infosecurity-magazine.com)
Android bug can leak DNS traffic with VPN kill switch enabled (bleepingcomputer.com)
European Threat To End-To-End Encryption Would Invade Phones (forbes.com)
Ransomware crooks SIM swap kids to pressure parents • The Register
Denial of Service/DoS/DDOS
Data Breaches/Leaks
How does a data breach affect you and why should you care? | TechRadar
Dell customer order database stolen, for sale on dark web • The Register
The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics | WIRED
Cyber attack: Large volume of data stolen in attack on Scottish health board (scotsman.com)
Security breach affects 6,000 German military VC meetings (avinteractive.com)
Security company exposes 1.2M guard and suspect records • The Register
Children's mental health records published after cyber attack - BBC News
Georgia education agency's MOVEit data theft impacted 800K • The Register
Data Brokers: What They Are and How to Safeguard Your Privacy - IT Security Guru
Zscaler Investigates Hacking Claims After Data Offered for Sale - Security Week
UK government departments reveal rise in data breaches & lost devices (datacentrenews.uk)
'Sophisticated' cyber attacks involving British Colombia government networks found | CBC News
Over 380K more NYC students had info leaked, bringing total to over 1M (nypost.com)
Dating apps kiss'n'tell all sorts of sensitive user info • The Register
Organised Crime & Criminal Actors
Hackers of all kinds are attacking routers across the world | TechRadar
These Dangerous Scammers Don’t Even Bother to Hide Their Crimes | WIRED
Massive webshop fraud ring steals credit cards from 850,000 people (bleepingcomputer.com)
Scattered Spider group a unique challenge for cyber cops, FBI leader says (therecord.media)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
Insider Risk and Insider Threats
The Rise And Stealth Of The Socially Engineered Insider (forbes.com)
Don't Be the Weakest Link – Your Team's Crucial Role in Cyber Security | NAVEX - JDSupra
Supply Chain and Third Parties
UK Military Data Breach a Reminder of Third-Party Risk (darkreading.com)
Details of UK military personnel exposed in huge payroll data breach | AP News
Firm at centre of MoD 'China' hack handles data for several Whitehall departments (inews.co.uk)
DBIR: Supply Chain Breaches Up 68% Year Over Year (darkreading.com)
The complexities of third-party risk management - Help Net Security
Cloud/SaaS
Encryption
Cop complaints won't stop E2EE, says encryption advocate • The Register
European Threat To End-To-End Encryption Would Invade Phones (forbes.com)
Linux and Open Source
Open-Source Cyber Security Is a Ticking Time Bomb (gizmodo.com)
Spies Among Us: Insider Threats in Open Source Environments (darkreading.com)
Passwords, Credential Stuffing & Brute Force Attacks
Iranian hackers harvest credentials through advanced social engineering campaigns | CSO Online
Microsoft introduces Passkeys support for consumer accounts - gHacks Tech News
Google Announces Passkeys Adopted by Over 400 Million Accounts (thehackernews.com)
UnitedHealth Attack: Stolen Credentials, No MFA | MSSP Alert
Hackers can crack average 8-character passwords in under a minute (newsbytesapp.com)
How secure is the “Password Protection” on your files and drives? - Help Net Security
Social Media
Training, Education and Awareness
Regulations, Fines and Legislation
The EU Cyber Diplomacy Toolbox: Shaping Global Cyber Security Standards | UpGuard
The NIS2 Compliance Deadline Is Nearing. Are You Prepared? - Security Boulevard
Innovation, Not Regulation, Will Protect Corporations From Deepfakes (darkreading.com)
Models, Frameworks and Standards
Data Protection
Careers, Working in Cyber and Information Security
How workforce reductions affect cyber security postures - Help Net Security
One in Four Tech CISOs Unhappy with Compensation - Security Boulevard
Law Enforcement Action and Take Downs
Ransomware activity is back on track despite law enforcement efforts - Help Net Security
LockBit's seized darknet site resurrected by police, teasing new revelations (therecord.media)
LockBit leader unmasked and sanctioned - National Crime Agency
Israeli private investigator wanted for hacking in US is arrested in London | The Independent
German police bust Europe's 'largest' scam call centre – DW – 05/02/2024
Consultant charged with $1.5M extortion of IT giant • The Register
97% of Organisations Hit by Ransomware Worked with Law Enforcement (globenewswire.com)
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Israeli private investigator wanted for hacking in US is arrested in London | The Independent
Cyber Attacks on US Utilities: New Trends in Cyber Warfare - ClearanceJobs
'The Mask' Espionage Group Resurfaces After 10-Year Hiatus (darkreading.com)
Nation State Actors
China
Firm at centre of MoD 'China' hack handles data for several Whitehall departments (inews.co.uk)
Lessons from LOCKED SHIELDS 2024 cyber exercise | SC Media (scmagazine.com)
China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion (thehackernews.com)
Russia
Malice from Moscow: NATO warns of Russian hybrid warfare - EU Reporter
Russia plotting sabotage across Europe, intelligence agencies warn (ft.com)
How Nato could respond after wave of Russian spy arrests across Europe (inews.co.uk)
EU, NATO denounce Russia's cyber attacks on Germany, Czechia (kyivindependent.com)
Russia Cyber Attack Germany's Ruling Party, Defence | Silicon UK
Foreign Ministry: Czech institutions targeted by GRU cyber attacks | Radio Prague International
Russia-linked APT28 and crooks are still using the Moobot botnet (securityaffairs.com)
Ukraine records increase in financially motivated attacks by Russian hackers (therecord.media)
Cyber War? EU rages over alleged Russian cyber attack on German’s ruling SPD (brusselssignal.eu)
Lessons from LOCKED SHIELDS 2024 cyber exercise | SC Media (scmagazine.com)
A (Strange) Interview With the Russian-Military-Linked Hackers Targeting US Water Utilities | WIRED
Russia says Germany using baseless 'hacker myths' to destroy ties | Reuters
Poland says it too was targeted by Russian hackers – POLITICO
Kaspersky denies claims it helped Russia with drones • The Register
Iran
Iranian hackers pose as journalists to push backdoor malware (bleepingcomputer.com)
Iranian hackers harvest credentials through advanced social engineering campaigns | CSO Online
North Korea
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Vulnerability Management
Cyber criminals are getting faster at exploiting vulnerabilities - Help Net Security
Misconfigurations drive 80% of security exposures | Security Magazine
Patch management vs. vulnerability management: Key differences | TechTarget
What is Risk-Based Vulnerability Management (RBVM)? (techtarget.com)
CISA’s KEV list improving private and public-sector patching • The Register
CISA Announces CVE Enrichment Project 'Vulnrichment' - Security Week
Vulnerabilities
Citrix Addresses High-Severity NetScaler Servers Flaw (darkreading.com)
Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw (bleepingcomputer.com)
Veeam fixes RCE flaw in backup management platform (CVE-2024-29212) - Help Net Security
LiteSpeed Cache WordPress plugin actively exploited in the wild (securityaffairs.com)
New BIG-IP Next Central Manager bugs allow device takeover (bleepingcomputer.com)
Microsoft: April Windows Server updates also cause crashes, reboots (bleepingcomputer.com)
Android bug can leak DNS traffic with VPN kill switch enabled (bleepingcomputer.com)
Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery (thehackernews.com)
Tools and Controls
Behind Closed Doors: The Rise of Hidden Malicious Remote Access (cybereason.com)
Security tools fail to translate risks for executives - Help Net Security
Misconfigurations drive 80% of security exposures | Security Magazine
NSA, FBI Alert on North Korean Hackers Spoofing Emails from Trusted Sources (thehackernews.com)
Microsoft plans to lock down Windows DNS like never before. Here’s how. | Ars Technica
Novel attack against virtually all VPN apps neuters their entire purpose | Ars Technica
Strategies for preventing AI misuse in cyber security - Help Net Security
Shadow APIs: An Overlooked Cyber Risk for Orgs (darkreading.com)
What is social engineering penetration testing? | Definition from TechTarget
How workforce reductions affect cyber security postures - Help Net Security
What is Risk-Based Vulnerability Management (RBVM)? (techtarget.com)
Top 10 physical security considerations for CISOs | CSO Online
IT chiefs plan to spend and innovate their way out of ransomware swamp | TechRadar
A SaaS Security Challenge: Getting Permissions All in One Place (thehackernews.com)
Tips for Controlling the Costs of Security Tools - The New Stack
Rethinking Cyber Security Investment Amid Rising Threats (govinfosecurity.com)
Microsoft confirms Windows 11 24H2 turns on Device Encryption by default (windowslatest.com)
Reports Published in the Last Week
Other News
Microsoft overhaul treats security as ‘top priority’ after a series of failures - The Verge
The EU Cyber Diplomacy Toolbox: Shaping Global Cyber Security Standards | UpGuard
Complexity leads to trade-off between risk and innovation (betanews.com)
When has the UK faced cyber attacks in the past? | The Independent
Man-in-the-middle attack: The new cyber security threat | YourStory
Paris 2024 gearing up to face unprecedented cyber security threat | Reuters
38% of riskiest cyber physical systems neglected, warns Claroty report (securitybrief.co.nz)
Why undersea cables need high-priority protection • The Register
GAO: NASA Faces 'Inconsistent' Cyber Security Across Spacecraft (darkreading.com)
Cyber security regulations: Are non-compliant cars more vulnerable? | Autocar
Fujitsu sets aside £200m as calls mount for Post Office scandal payout
FE News | Why the education sector needs to do the homework on cyber security as attacks soar
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Threat Briefing 03 May 2024
Black Arrow Cyber Threat Intelligence Briefing 03 May 2024:
-Most Attacks Impacting SMB’s Target Older, Unpatched Vulnerabilities
-91% of Ransomware Victims Paid At least One Ransom in the Past Year, as 1 in 5 Ransomware Attacks Triggers Lawsuit
-BEC and Fund Transfer Fraud Top Insurance Claims
-Correlating Cyber Investments with Business Outcomes
-Vulnerability Exploitation up 180%, 68% of Breaches involved Humans and Supply Chain Weak Link
-MOVEit & Change Healthcare Attacks Designated as Cyber Catastrophe Loss Events by Insurer
-Securing Your Organisation’s Supply Chain: Reducing the Risks of Third Parties
-Why Remote Desktop Tools are Facing an Onslaught of Cyber Threats
-95% of Organisations Revamped Cyber Security Strategies in the Last Year: Make Sure Yours is Right
-Human Factor a Significant Risk for Small and Medium-Sized Businesses.
-Microsoft CEO Says it is Putting Security Above All Else in Major Refocus
-Ending the Culture of Silence in Cyber Security; Three Ways to Empower Teams
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Most Attacks Impacting SMB’s Target Older, Unpatched Vulnerabilities
Attackers continue to aggressively target small and mid-size businesses using specific high-profile vulnerabilities dating back a decade or more, network telemetry shows. Findings have shown that this is due to these vulnerabilities featuring in a wide range of products. Due to their prevalence, they can often become missed by organisations conducting patch management and therefore leave the organisation open.
For this reason it is critical that all organisations, including smaller organisations, have internal as well as external vulnerability scanning. You might believe your systems are patched up to date but there is no way to confirm without scanning , or to know which patches might have been missed.
Sources: [Infosecurity Magazine]
91% of Ransomware Victims Paid At least One Ransom in the Past Year, as 1 in 5 Ransomware Attacks Triggers Lawsuit
Ransomware attacks saw a significant surge in 2023, following a dip in 2022. The number of victims increased by 66% from 2022 to 2023, with 91% of those affected paying at least one ransom. 58% of organisations have been targeted six times or more.
The Sophos State of Ransomware 2023 report highlighted ransom payments rose by 500%; nearly two-thirds exceeded $1m or more, with an average payment of $2m. Furthermore, 30% of the demands were for over $5m.
In the US, 18% of incidents led to litigation, with 123 lawsuits filed in 2023 and 355 over five years. Data breaches, affecting 283.3 million records, primarily triggered these lawsuits, especially in healthcare and finance sectors. The resolution rate is 59%, with the highest settlement at $8.7m. Regulatory fines added nearly $10m to the financial impact. These figures underscore the significant financial implications of ransomware attacks and the urgent need for robust cyber security measures.
Sources: [ZD Net] [Infosecurity Magazine] [Security Magazine] [PrNewsWire] [Infosecurity Magazine]
BEC and Fund Transfer Fraud Top Insurance Claims
Cyber Insurer Coalition's 2024 Cyber Claims Report highlights a significant trend in cyber security threats, identifying email-based fraud as the predominant cause of insurance claims in 2023, accounting for 53% of all claims. Business email compromise (BEC) and funds transfer fraud (FTF) topped the list, contributing to 28% of claims and increasing claim amounts by 24% to an average loss exceeding $278,000. In contrast, ransomware, while less frequent at 19% of claims, also saw a rise in both frequency and severity, with average losses climbing to over $263,000. The report also notes a 13% year-on-year surge in overall claims, with substantial losses tied to compromised network security devices and a notable vulnerability in organisations using exposed remote desktop protocols.
Source: [Infosecurity Magazine]
Correlating Cyber Investments with Business Outcomes
The US Securities and Exchange Commission (SEC) has implemented stringent new rules compelling organisations to report significant cyber incidents within four days and to annually disclose details concerning their cyber security risk management, strategy, and governance. These mandates are seen as giving “more teeth to the idea that cyber security is a business problem” and “bringing an element of cyber security to the boardroom” according to cyber security solutions provider SecurityGate. Highlighted in the "Cybersecurity Insights" podcast, experts argue for simplifying cyber security strategies, advocating sustained resource allocation over reactive measures, and emphasising the importance of training over expensive solutions. These steps are deemed crucial for enhancing organisational resilience and security in a landscape where cyber threats are increasingly sophisticated and pervasive.
Source: [InfoRisk Today]
Verizon: Vulnerability Exploitation up 180%, 68% of Breaches involved Humans and Supply Chain Weak Link
Verizon has released the findings of its 17th Annual Data Breach Investigations Report, which showed security incidents doubled year over year in 2023 to a record high 30,458 security events and 10,626 confirmed breaches. Some of the key takeaways from the 100-page report include zero-day attacks on unpatched systems and devices rising 180% in 2023, most breaches (68%) involving a non-malicious human element and the median time for users to fall for phishing emails falling just south of 60 seconds. In its first inclusion as a separate metric, supply chain attacks were found to contribute to 15% of all attacks.
Sources: [MSSP Alert] [Verizon]
MOVEit & Change Healthcare Attacks Designated as Cyber Catastrophe Loss Events by Insurer
Verisk’s Property Claim Services (PCS) has recently identified the MOVEit and Change Healthcare cyber attacks as significant Cyber Catastrophe Loss Events. These designations are part of PCS’s Global Cyber solution, which tracks cyber incidents and their potential impact on the insurance market. The designation indicates that each attack is anticipated to result in insurance industry losses exceeding USD 250 million.
The MOVEit attack, linked to the Russian-affiliated group Cl0p, compromised over 2,700 organisations globally, affecting up to 90 million individuals. The Change Healthcare attack, attributed to the ALPHV/Blackcat gang, notably disrupted UnitedHealth Group’s operations, with projected costs and lost revenue totalling up to USD 1.6 billion. These designations highlight the escalating scale and financial impact of cyber incidents on global markets.
Source: [Reinsurance News]
Securing Your Organisation’s Supply Chain: Reducing the Risks of Third Parties
Nearly every organisation is part of a supply chain, where a significant amount of data is transferred. When data leaves your infrastructure, its security depends on the third party. The risks of a cyber incident increases as the supply chain increases.
Organisations need to mitigate the risks that their third party brings. This requires an understanding of the supply chain actors, and performing cyber security assessments of the most critical ones. The objective is to ensure that your organisation is satisfied with the third party’s security controls, or to work together to remediate any gaps.
Source: [Help Net Security]
Why Remote Desktop Tools are Facing an Onslaught of Cyber Threats
In the era of hybrid work, remote desktop tools have become crucial yet vulnerable points within corporate networks, attracting significant cyber criminal attention. A study by Barracuda Networks underscores the challenges of securing these tools. Virtual Network Computing (VNC) is particularly susceptible; it is targeted in 98% of these types of attacks due to its use of multiple, sometimes unsecured ports. VNC attacks predominantly exploit weak password practices, notably through brute force methods. Conversely, Remote Desktop Protocol (RDP) accounts for about 1.6% of these attacks but is favoured for more extensive network breaches, often involving ransomware or crypto mining. The study highlights a pressing need for robust endpoint management and heightened security measures to mitigate these threats.
Source: [ITPro]
95% of Organisations Revamped Cyber Security Strategies in the Last Year: Make Sure Yours is Right
A recent report found that 95% of companies have altered their cyber security strategies in the last twelve months. This was driven by keeping pace with the shifting regulatory landscape (98%), the need to meet customer expectations for data protection and privacy (89%), and the rise of AI-driven threats and solutions (65%). Almost half (44%) of non-security executives do not understand the regulatory requirements their organisation must adhere to.
When it came to reporting, the study found that security teams aren’t reporting on key operational metrics that define whether their security investments and strategy changes have a measurable impact. It is evident that there is a disconnect between security and non-security professionals when it comes to the business strategy.
Sources: [Business Wire] [Security Magazine]
Human Factor a Significant Risk for Small and Medium-Sized Businesses.
A survey of business and IT security in small and medium-sized businesses (SMBs) conducted by LastPass found that roughly one in five business leaders admits to circumventing security policies, as do one in 10 IT security leaders. The survey found that password management is critically important to cyber security, with nearly half (47%) reporting recent breaches due to compromised passwords.
Sources: [Beta News] [Business Wire]
Microsoft CEO Says it is Putting Security Above All Else in Major Refocus
Following a series of high-profile attacks in recent months and a report by the US Cyber Safety Review Board (CSRB), Microsoft’s CEO has revealed it will now focus its efforts on an increase in the commitment to security. Investigating a summer 2023 attack, Microsoft was deemed to have made a series of “avoidable errors”, including the failure to detect several compromises, the CSRB said.
Sources: [TechRadar]
Ending the Culture of Silence in Cyber Security; Three Ways to Empower Teams
A recent discussion on workplace errors highlights the significant repercussions of cyber breaches compared to typical office mistakes. In the UK, nearly a third of businesses face cyber attacks weekly, with each breach costing approximately £4,000. However, a concerning trend is that 41% of these breaches are not reported to internal leadership, often due to fears among staff about the consequences of admitting faults. A three-pronged approach has been suggested to foster a blame-free culture: providing tailored and evolving cyber training, establishing safe zones for admitting mistakes, and implementing robust recovery plans. This approach not only prepares employees to handle potential breaches more effectively but also encourages them to report incidents promptly, reducing the overall impact and aiding quicker recovery. Such strategies are essential for maintaining resilience against increasingly sophisticated cyber threats.
Source: [Minute Hack]
Governance, Risk and Compliance
Verizon 2024 Data Breach Investigations Report: 5 Takeaways | MSSP Alert
Verizon DBIR: Vulnerability exploitation in breaches up 180% | TechTarget
Verizon DBIR: Basic Security Gaffes Cause Breach Surge (darkreading.com)
95% of Organisations Revamped Their Cyber Security Strategies in the Last Year | Business Wire
95% of organisations adjusted cyber security strategies this past year | Security Magazine
1 in 5 US Ransomware Attacks Triggers Lawsuit - Infosecurity Magazine (infosecurity-magazine.com)
Are Enterprises Overconfident About Cyber Security Readiness? (govinfosecurity.com)
How CISOs Can Contend with Increasing Scrutiny from Regulators (informationweek.com)
Correlating Cyber Investments with Business Outcomes (inforisktoday.com)
Ending The Culture of Silence In Cyber Security – 3 Ways To Empower Teams - Minutehack
97% of security leaders have increased SaaS security budgets - Help Net Security
The rise in CISO job dissatisfaction – what’s wrong and how can it be fixed? | CSO Online
Should Cyber Security Leadership Finally be Professionalized? - SecurityWeek
What needs to change to overcome nonchalant security approaches | TechRadar
Agile by Design: Cyber Security at the Heart of Transformation (noeticcyber.com)
Threats
Ransomware, Extortion and Destructive Attacks
Q1 2024 Ransomware Report: 21% Increase in Q1 2023 Ransomware Activity (corvusinsurance.com)
91% of ransomware victims paid at least one ransom in the past year, survey finds | ZDNET
1 in 5 US Ransomware Attacks Triggers Lawsuit - Infosecurity Magazine (infosecurity-magazine.com)
There was an 81% year-over-year increase in ransomware attacks | Security Magazine
Ransom recovery costs reach $2.73 million - Help Net Security
Cactus Ransomware Group Targets Qlik Sense Servers | Decipher (duo.com)
How AI and data protection intersect in today's threat era - SiliconANGLE
Better hygiene may mitigate the need to ban ransomware payments | Computer Weekly
Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million (thehackernews.com)
How Businesses Should Grapple With Ransomware Threats (eetimes.eu)
Cyber security consultant arrested after allegedly extorting IT firm (bleepingcomputer.com)
Ransomware Victims
Change Healthcare breached via Citrix portal with no MFA | TechTarget
Almost all US hospitals took financial hit from Change hack, AHA says | Reuters
Another major pharmacy chain shuts following possible cyber attack | TechRadar
Hack That Paralyzed US Health Care Turns Up Scrutiny on Insurer (claimsjournal.com)
Cyber attack to cost Western Isles Council half a million pounds (holyrood.com)
LockBit publishes confidential data stolen from Cannes hospital in France (therecord.media)
French hospital CHC-SV refuses to pay LockBit extortion demand (bleepingcomputer.com)
'Cybersecurity incident' closes London Drugs' pharmacies • The Register
Phishing & Email Based Attacks
AI-driven phishing attacks deceive even the most aware users - Help Net Security
US Post Office phishing sites get as much traffic as the real one (bleepingcomputer.com)
If you receive a Shein mystery box, do not open it | TechRadar
Why the automotive sector is a target for email-based cyber attacks - Help Net Security
BEC
BEC and Fund Transfer Fraud Top Insurance Claims - Infosecurity Magazine (infosecurity-magazine.com)
Other Social Engineering
FBI warns of fake verification schemes targeting dating app users (bleepingcomputer.com)
A Lot of People Are Falling for Those 'Your Package Cannot Be Delivered' Texts | PCMag
Artificial Intelligence
AI-driven phishing attacks deceive even the most aware users - Help Net Security
AI is creating a new generation of cyber attacks - Help Net Security
Combating the Rising Tide of AI-Driven Cyber Crime (cryptopolitan.com)
Businesses turn to generative AI but many don't have policies on it (betanews.com)
How AI and data protection intersect in today's threat era - SiliconANGLE
Understanding emerging AI and data privacy regulations - Help Net Security
To understand the risks posed by AI, follow the money – O’Reilly (oreilly.com)
From Risk to Resilience: Managing Data Security in AI-Driven Enterprises | Inc.com
Cyber security experts face AI risks, deepfakes, burnout | Fortune
US Government Releases New AI Security Guidelines for Critical Infrastructure (thehackernews.com)
Why Using Microsoft Copilot Could Amplify Existing Data Quality and Privacy Issues - SecurityWeek
2FA/MFA
Malware
New "Goldoon" Botnet Targets D-Link Routers With Decade-Old Flaw (thehackernews.com)
New SOHO router malware aims for cloud accounts, internal company resources - Help Net Security
Guarding the Gates: The Growing Abundance of Linux Malware - VMRay
Bogus npm Packages Used to Trick Software Developers into Installing Malware (thehackernews.com)
Millions of Malicious 'Imageless' Containers Planted on Docker Hub Over 5 Years (thehackernews.com)
ZLoader Malware Evolves with Anti-Analysis Trick from Zeus Banking Trojan (thehackernews.com)
New Cuttlefish malware infects routers to monitor traffic for credentials (bleepingcomputer.com)
Mobile
Powerful 'Brokewell' Android Trojan Allows Attackers to Takeover Devices - SecurityWeek
Google Prevented 2.28 Million Malicious Apps from Reaching Play Store in 2023 (thehackernews.com)
New Wpeeper Android malware hides behind hacked WordPress sites (bleepingcomputer.com)
Microsoft warns of "Dirty Stream" attack impacting Android apps (bleepingcomputer.com)
Denial of Service/DoS/DDOS
Internet of Things – IoT
NCSC: New UK law bans default passwords on smart devices (securityaffairs.com)
A glaring Android TV security flaw might put your Gmail at risk | Android Central
Data Breaches/Leaks
PSNI data breach: Almost 5,000 officers and staff in legal action - BBC News
Kaiser Permanente data breach may have impacted 13.4 million patients (securityaffairs.com)
FBCS data breach impacted 2M individuals (securityaffairs.com)
States shares health debt data of 5,000 in an email | Guernsey Press
Qantas app exposed sensitive traveller details to random users (bleepingcomputer.com)
Philadelphia Inquirer: Data of over 25,000 people stolen in 2023 breach (bleepingcomputer.com)
Australian pubgoers' personal info posted to leak site • The Register
Monash Health data breach exposes sexual assault and family violence claims (smh.com.au)
Panda Restaurant Group disclosed a data breach (securityaffairs.com)
Organised Crime & Criminal Actors
AI is creating a new generation of cyber attacks - Help Net Security
Combating the Rising Tide of AI-Driven Cyber Crime (cryptopolitan.com)
Router Roulette: Cyber Criminals and Nation-States Sharing Compromised Networks | Trend Micro (US)
Insider Risk and Insider Threats
How insider threats can cause serious security breaches - Help Net Security
Ex-NSA Employee Sentenced to 22 Years for Trying to Sell U.S. Secrets to Russia (thehackernews.com)
Insurance
Cyber facility in capacity raise as risk severity grows (emergingrisks.co.uk)
Hack That Paralyzed US Health Care Turns Up Scrutiny on Insurer (claimsjournal.com)
Supply Chain and Third Parties
Cloud/SaaS
New SOHO router malware aims for cloud accounts, internal company resources - Help Net Security
97% of security leaders have increased SaaS security budgets - Help Net Security
Encryption
UK's Investigatory Powers Bill approved to become law • The Register
Ten years of Heartbleed: Lessons learned | SC Media (scmagazine.com)
Linux and Open Source
Passwords, Credential Stuffing & Brute Force Attacks
Change Healthcare breached via Citrix portal with no MFA | TechTarget
Okta warns of "unprecedented" credential stuffing attacks on customers (bleepingcomputer.com)
NCSC: New UK law bans default passwords on smart devices (securityaffairs.com)
New Cuttlefish malware infects routers to monitor traffic for credentials (bleepingcomputer.com)
How to use a YubiKey to log into Windows and macOS (xda-developers.com)
Social Media
How TikTok Grew From a Fun App for Teens Into a Potential National Security Threat - SecurityWeek
Facebook at 20: Contemplating the Cost of Privacy (darkreading.com)
Training, Education and Awareness
Ending The Culture Of Silence In Cyber Security – 3 Ways To Empower Teams - Minutehack
Everyone's an Expert: How to Empower Your Employees for Cyber Security Success (thehackernews.com)
Regulations, Fines and Legislation
UK's Investigatory Powers Bill approved to become law • The Register
UK rolls out new consumer safeguards for smart devices (betanews.com)
FCC fines major wireless carriers over illegal location data sharing - Help Net Security
Understanding emerging AI and data privacy regulations - Help Net Security
CISA's incident reporting requirements go too far, trade groups and lawmakers say | CyberScoop
Data Protection
Careers, Working in Cyber and Information Security
Cyber security experts face AI risks, deepfakes, burnout | Fortune
The rise in CISO job dissatisfaction – what’s wrong and how can it be fixed? | CSO Online
Agencies to turn toward ‘skill-based hiring’ for cyber and tech jobs, ONCD says | CyberScoop
Cyber Security Degrees, Are They Really Worth It? | HackerNoon
Beyond the Buzz: Rethinking Alcohol as a Cyber Security Bonding Ritual - SecurityWeek
Law Enforcement Action and Take Downs
Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million (thehackernews.com)
Police shuts down 12 fraud call centres, arrests 21 suspects (bleepingcomputer.com)
Cyber security consultant arrested after allegedly extorting IT firm (bleepingcomputer.com)
CEO who sold fake Cisco devices to US military gets 6 years in prison (bleepingcomputer.com)
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
Nation State Actors
China
‘Honeypots’ and influence operations: China’s spies turn to Europe (ft.com)
Philippines Pummelled by Cyber Attacks & Misinformation Tied to China (darkreading.com)
Germany grapples with wave of spying threats from Russia and China - BBC News
How TikTok Grew From a Fun App for Teens Into a Potential National Security Threat - SecurityWeek
Think tank: Tech companies spread China's propaganda • The Register
China's attacks on critical infrastructure ‘tip of the iceberg' | SC Media (scmagazine.com)
Chinese Hackers Have Been Probing DNS Networks Globally for Years: Report - SecurityWeek
Muddling Meerkat hackers manipulate DNS using China’s Great Firewall (bleepingcomputer.com)
Chinese government website security has big problems • The Register
Espionage breaches account for 25% in APAC, report reveals (securitybrief.co.nz)
Russia
Router Roulette: Cyber Criminals and Nation-States Sharing Compromised Networks | Trend Micro (US)
Russian Hackers Target Industrial Systems in North America, Europe - SecurityWeek
Pro-Russia hacktivists attacking vital tech in water and other sectors, agencies say | CyberScoop
Germany grapples with wave of spying threats from Russia and China - BBC News
Ukraine Targeted in Cyber Attack Exploiting 7-Year-Old Microsoft Office Flaw (thehackernews.com)
Germany Warns Of Consequences For Alleged Russian Cyber Attack (rferl.org)
Hackers Claim to Have Infiltrated Belarus’ Main Security Service - SecurityWeek
Military Tank Manual, 2017 Zero-Day Anchor Latest Ukraine Cyber Attack (darkreading.com)
Sweden prepares for Eurovision amidst fears of protests, cyber attacks and unrest | Euronews
Ex-NSA Employee Sentenced to 22 Years for Trying to Sell U.S. Secrets to Russia (thehackernews.com)
Two British men charged with helping Russian intelligence - BBC News
Two hackers in Ukraine accused of spreading Russian propaganda (therecord.media)
Iran
North Korea
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Vulnerability Management
When is One Vulnerability Scanner Not Enough? (thehackernews.com)
Vulnerability exploitation nearly tripled in 2023 (telecoms.com)
Vulnerabilities
Cisco devices again targeted by state-linked threat campaign - TechCentral.ie
Okta warns of "unprecedented" credential stuffing attacks on customers (bleepingcomputer.com)
1,200+ Vulnerabilities Detected In Microsoft Products In 2023 (gbhackers.com)
Most attacks affecting SMBs target five older vulnerabilities | CSO Online
Severe Flaws Disclosed in Brocade SANnav SAN Management Software (thehackernews.com)
UnitedHealth hackers took advantage of Citrix vulnerability to break in, CEO says (yahoo.com)
Palo Alto Updates Remediation for Max-Critical Firewall Bug (darkreading.com)
WordPress plugin vulnerability poses severe security risk, allows for site takeovers | TechSpot
Ukraine Targeted in Cyber Attack Exploiting 7-Year-Old Microsoft Office Flaw (thehackernews.com)
New R Programming Vulnerability Exposes Projects to Supply Chain Attacks (thehackernews.com)
Grafana Tool Vulnerability Let Attackers Inject SQL Queries (gbhackers.com)
Microsoft says April Windows updates break VPN connections (bleepingcomputer.com)
NTLM auth traffic spikes after Windows Server patch • The Register
New "Goldoon" Botnet Targets D-Link Routers With Decade-Old Flaw (thehackernews.com)
Four Critical Vulnerabilities Expose HPE Aruba Devices to RCE Attacks (thehackernews.com)
Ten years of Heartbleed: Lessons learned | SC Media (scmagazine.com)
1,400 GitLab Servers Impacted by Exploited Vulnerability - SecurityWeek
Tools and Controls
Why remote desktop tools are facing an onslaught of cyber threats | ITPro
Correlating Cyber Investments With Business Outcomes (inforisktoday.com)
When is One Vulnerability Scanner Not Enough? (thehackernews.com)
Microsoft CEO says it is "putting security above all else" in major refocus | TechRadar
Can automating security relieve CISO pressure? (techinformed.com)
10 Critical Endpoint Security Tips You Should Know (thehackernews.com)
Businesses turn to generative AI but many don't have policies on it (betanews.com)
Ending The Culture Of Silence In Cyber Security – 3 Ways To Empower Teams - Minutehack
Organisations Struggle with Zero Trust: Gartner | MSSP Alert
Tech Tip: Why Haven't You Set Up DMARC Yet? (darkreading.com)
97% of security leaders have increased SaaS security budgets - Help Net Security
DPRK's Kimsuky APT Abuses Weak DMARC Policies, Feds Warn (darkreading.com)
How to Red Team GenAI: Challenges, Best Practices, and Learnings (darkreading.com)
Chinese Hackers Have Been Probing DNS Networks Globally for Years: Report - SecurityWeek
Muddling Meerkat hackers manipulate DNS using China’s Great Firewall (bleepingcomputer.com)
Why LLMs are predicting the future of compliance and risk management | VentureBeat
Other News
Microsoft CEO says it is "putting security above all else" in major refocus | TechRadar
A Season Of Health Breaches, A Season Of Changes (forbes.com)
Bank of England tells payment firms to step up disruption mitigation plans (yahoo.com)
NCSC updates warning over hacktivist threat to CNI | Computer Weekly
The EU's Strategy for a Cyber Secure Digital Single Market | UpGuard
To Damage OT Systems, Hackers Tap USBs, Old Bugs & Malware (darkreading.com)
During National Small Business Week, Take Steps to Secure Your Business | CISA
At Microsoft, years of security debt come crashing down | Cybersecurity Dive
Sweden prepares for Eurovision amidst fears of protests, cyber attacks and unrest | Euronews
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
It’s World Password Day today; if you are protecting your systems access using a password, then you need to know this
It’s World Password Day today; if you are protecting your systems access using a password, then you need to know this
Passwords are one of the basic ways that we confirm our identity when we access systems on our company network, or our own person email account for example. Although many organisations have a policy that requires users to create passwords of a certain length and complexity, the challenge is that the user can fulfil those criteria even if they create a weak password that can be easily guessed or cracked by an attacker. This is yet another intersection of technology and human behaviours that can make or break cyber security.
Did you know that attackers exchange lists of passwords from previous attacks, which they use at high speed in combination with a user’s email address for example, to try to break into a system?
If you are told that you need to create a password that uses upper and lower case letters, with numbers and special characters, the chances are you will use a word that starts with a capital letter, then add a number and use an exclamation point or similar at the end. The attackers know this, and they have millions of examples of them in their password listing. Equally, passwords like querty12345 are, sadly, still frequently used.
The trick is for us all to avoid using ‘weak’ passwords that are likely to feature on the password listing, which means we need to avoid falling into predictable human behaviour patterns. Equally, users need to avoid obvious passwords, like the name of their town or their pet dog, which can be guessed or cracked by a dedicated attacker.
As a solution consider using a passphrase such as “BananaHippoCyclist” and if you want it even more complex, trying adding a few numbers and special characters. And make sure every access you have uses a different password. We all live in the real world, and it can be hard to manage multiple passwords, so you could consider a password manager application to store your passwords, providing you use a very strong master password to access it.
Even strong passwords need extra security, which is why they should be used in conjunction with other multi-factor authentication methods such as facial recognition or biometrics (something you are) or verification codes received on your mobile phone (something you have). Utilising multiple methods of authentication makes it significantly harder for attackers to compromise your accounts.
If you are wondering how to implement this in your organisation, then reach out to us for a free 30-minute consultation to discuss your specific needs and proportionate options. We love discussing this and other aspects of cyber security, so contact us through our website page www.blackarrowcyber.com/contact, and we will get back to you shortly.
In the meantime, Happy World Password Day!
Black Arrow Cyber Insight 30 April 2024 – UK’s New IoT Legislation Aiming to Protect Consumers From Cyber Attacks Comes in to Force
Black Arrow Cyber Insight 30 April 2024 – UK’s New IoT Legislation Aiming to Protect Consumers From Cyber Attacks Comes in to Force
Executive summary
The UK Government has released new legislation to protect consumers from cyber criminals.
The regime comprises of two pieces of legislation:
Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022; and
The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.
Now that this new legislation is in force, the UK’s consumer connectable product security regime will be enforced, aiming to protect consumers against hacking and cyber attacks. This regulation sets out the minimum-security standards that all IoT (Internet of Things) devices are now legally obliged to meet.
What are the security requirements?
The regulations set out specific requirements that the relevant people, manufacturer, importer and distributor of the products have to follow:
1. Passwords must be unique per the product. This includes banning common and easily guessable passwords for example admin or 12345 to prevent vulnerabilities and hacking.
2. The manufacturer must provide clear and transparent information on how to report security issues about their product. Manufacturers are also obligated to provide information on timescales of acknowledging, reporting and updating the status of security issues to the consumer until they have been resolved.
3. The manufacturers and retailers must publish to consumers in a clear and accessible way, the minimum time they can expect to receive important security updates. This information should be available without prior request in English and free of charge.
While these security requirements demonstrate the seriousness in which the Government regards cyber security, they should not be relied upon alone and organisations ensure they are employing their own controls such as changing default passwords, performing vulnerability scanning and conducting timely patch management. Effective cyber security requires multiple layers of defence
The official UK Government legislation can be found below:
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 30 April 2024 – New Android Malware Disguised as Chrome Update can Steal Your Data and Access Your Banking Information
Black Arrow Cyber Advisory 30 April 2024 – New Android Malware Disguised as Chrome Update can Steal Your Data and Access Your Banking Information
Executive summary
A new strain of Android mobile malware dubbed “Brokewell” is being used to spread fake browser updates to steal user data. The malware has the ability to overlay banking application screens, capturing credentials without the users knowledge, as well as allowing remote access by an attacker. The malware has also been recorded as using popular ‘buy now, pay later’ service “Klarna” in addition to the fake Google Chrome update. Research indicates that the malware is in active development.
What’s the risk?
Due to the sensitive nature of the information sought by the malware, there is a genuine risk to the confidentiality and integrity of data. Features of the malware include the ability to overlay applications to steal user credentials and allow an attacker remote access, including the commands which record audio, take screenshots, access locations, and send communications from the victim phone.
The list of potential targets is extensive, especially so with many employees using personal devices for corporate purposes, including the storage of corporate credentials. A recent report from Google owned Mandiant found that 10% of intrusions began with evidence of stolen credentials.
What can I do?
It is recommended to employ a multi-layer defence to mitigate the risk of such malware succeeding. This should include only downloading updates from the official application in the Google Play store and enabling Google Play Protect will help to prevent malware. To further bolster defence, it is recommended that anti-virus applications are run in parallel.
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Further information can be found below:
https://www.threatfabric.com/blogs/brokewell-do-not-go-broke-by-new-banking-malware
Black Arrow Cyber Threat Briefing 26 April 2024
Black Arrow Cyber Threat Intelligence Briefing 26 April 2024:
-Coalition Finds More Than Half of Cyber Insurance Claims Originate in the Email Inbox
-Unmasking the True Cost of Cyber Attacks: Beyond Ransom and Recovery
-Why Cyber Security Should Be Driving Your Enterprise Risk Management Strategy
-Ransomware Double-Dip - Re-Victimisation in Cyber Extortion
-AI is a Major Threat and Many Financial Organisations Are Not Doing Enough to Fight the Threat
-6 out of 10 Businesses Struggle to Manage Cyber Risk
-'Junk Gun' Ransomware: New Low-Cost Cyber Threat Targets SMBs
-Penetration Testing Infrequency Leaves Security Gaps
-Bank Prohibited from Opening New Accounts After Regulators Lose Patience With Poor Cyber Security Governance
-The Psychological Impact of Phishing Attacks on Your Employees
-Where Hackers Find Your Weak Spots
-The Role of Threat Intelligence in Financial Data Protection
-Government Cannot Protect Business and Services from Cyber Attack, Decision Makers Say
Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Coalition Finds More Than Half of Cyber Insurance Claims Originate in the Email Inbox
The 2024 Cyber Claims Report by insurer Coalition reveals critical vulnerabilities and trends affecting cyber insurance policyholders. Notably, over half of the claims in 2023 stemmed from funds transfer fraud (FTF) and business email compromise (BEC), underlining the critical role of email security in cyber risk management. The report also indicated heightened risks associated with boundary devices like firewalls and VPNs, particularly if they are exposed online and have known vulnerabilities. Additionally, the overall claims frequency and severity rose by 13% and 10% respectively, pushing the average loss to $100,000. These insights emphasise the necessity of proactive cyber security measures and the valuable role of cyber insurance in mitigating financial losses from cyber incidents.
Sources: [IT Security Guru] [Emerging Risks]
Unmasking the True Cost of Cyber Attacks: Beyond Ransom and Recovery
The global cost of cyber crime is expected to soar to $10.5 trillion annually by 2025, a steep rise from $3 trillion in 2015, underscoring a significant improvement in the methods of cyber criminals, according to Cybersecurity Ventures. Beyond direct financial losses like ransomware payments, the hidden costs of cyber attacks for businesses include severe operational disruptions, lost revenue, damaged reputations, strained customer relationships, and regulatory fines. These incidents, further exacerbated by increased insurance premiums, collectively contribute to substantial long-term financial burdens. The report indicates that 88% of data breaches are attributable to human error, underscoring the importance of comprehensive employee training alongside technological defences. To combat these evolving cyber threats effectively, organisations must adopt a multi-pronged strategy that includes advanced security technologies, regular system updates, employee education, and comprehensive security audits.
According to another report from SiliconAngle, cyber insurance claims increased 13% year-over-year in 2023, with the 10% rise in overall claims severity attributed to mounting ransomware attack claims.
Sources: [The Hacker News] [Huntress] [SC Media]
Why Cyber Security Should Be Driving Your Enterprise Risk Management Strategy
Cyber security has transformed from a secondary concern into the cornerstone of corporate risk management. The historical view of cyber security as merely a component of broader risk strategies is outdated; it now demands a central role in safeguarding against operational, financial, and reputational threats. Many businesses, recognising the vital role of technology in all operations, have begun elevating the position of Chief Information Security Officer (CISO) to integrate cyber security into their overall enterprise risk frameworks. This shift not only enhances visibility and strategic alignment at the highest organisational levels but also fosters more robust defences against cyber threats. As such, adopting a cyber security-centric approach is crucial for compliance and long-term resilience in the face of growing digital threats.
Source: [Forbes]
Ransomware Double-Dip: Re-Victimisation in Cyber Extortion
A recent cyber security study reveals a troubling trend of re-victimisation among organisations hit by cyber extortion or ransomware attacks. Analysis of over 11,000 affected organisations shows recurring victimisation due to repeated attacks, data reuse among criminal affiliates, or cross-affiliate data sharing. Notably, cyber extortion incidents have surged by 51% year-on-year. Additionally, a separate study reports payments exceeding $1 billion and a 20% increase in ransomware attack victims since early 2023. These findings underscore the increasing sophistication and persistence of cyber criminals. Despite law enforcement efforts, adaptable cyber crime groups swiftly resume operations, complicating effective threat mitigation. Organisations must enhance their cyber security measures to avoid becoming repeated targets.
Sources: [Security Magazine] [The Hacker News] [SC Media]
AI is a Major Threat and Many Financial Organisations Are Not Doing Enough
Artificial intelligence (AI) is a major concern for organisations, especially for the financial services sector due to the information they hold. Recent reports have found that AI has driven phishing up by 60% and AI tools have been linked to data exposure in 1 in 5 UK organisations. But it is not just attackers utilising AI: a separate report found that 20% of employees have exposed data via AI.
Currently, many financial organisations are not doing enough to secure themselves to fight AI. In a recent survey, 69% of fraud-management decision makers, AML professionals, and risk and compliance leaders reported that criminals are more advanced at using AI for financial crime than firms are in defending against it.
Sources: [Verdict] [Beta News] [Infosecurity Magazine] [TechRadar] [Security Brief]
6 out of 10 Businesses Struggle to Manage Cyber Risk
A report has found that 6 in 10 businesses are struggling to manage their cyber risk and just 43% have confidence in their ability to address cyber risk. Further, 35% of total respondents worry that senior management does not see cyber attacks as a significant risk; the same percentage also reported a struggle in hiring skilled professionals. When it came to implementing their security policy, half of respondents found difficulty, and when it came to securing the supply chain, a third reported worries.
Given the inevitability of a cyber attack, organisations need to prepare themselves. Those that struggle to manage their cyber risk and/or hire skilled professions will benefit from outsourcing to skilled, reputable cyber security organisations who can guide them through the process.
Sources: [PR Newswire] [Beta News]
'Junk Gun' Ransomware: New Low-Cost Cyber Threat Targets SMBs
Sophos’ research reveals a concerning trend: ‘junk gun’ ransomware variants are now traded on the dark web. Rather than going the traditional route of selling or buying ransomware to or as an affiliate, attackers have now begun creating and selling unsophisticated ransomware variants for a one-time cost. Priced at a median of $375, they attract lower-skilled attackers, especially those targeting small and medium-sized businesses (SMBs). As major ransomware players fade, these variants pose significant threats, accounting for over 75% of cyber incidents affecting SMBs in 2023.
Source: [Security Brief] [Tripwire]
Penetration Testing Infrequency Leaves Security Gaps
Many organisations are struggling to maintain the balance between penetration testing and IT changes within the organisation, leaving security gaps according to a recent report. The report found that 73% of organisations reported changes to their IT environments at least quarterly, however only 40% performed penetration testing at the same frequency.
The issue arises where there is a significant duration during which changes have been implemented without undergoing assessment, leaving organisations open to risk for extended periods of time. Consider the situation in which an organisation moves their infrastructure from on-premise to the cloud: they now have a different IT environment, and with that, new risks.
Black Arrow always recommends that a robust penetration test should be conducted whenever changes to internet facing infrastructure have been made, and at least annually.
Source: [MSSP Alert]
Bank Prohibited from Opening New Accounts After Regulators Lose Patience with Poor Cyber Security Governance
A bank in India has been banned from signing up new customers, and instructed to focus on improving its cyber security after “serious deficiencies and non-compliances” were found within their IT environment. The compliances provided by the bank were described as “inadequate, incorrect or not sustained”. The bank is now subject to an external audit, which if passed, will consider the lifting of the restrictions placed upon them.
Source: [The Register]
The Psychological Impact of Phishing Attacks on Your Employees
Phishing remains one of the most prevalent attack vectors for bad actors, and its psychological impact on employees can be severe, with many employees facing a loss in confidence and job satisfaction as well as an increase in anxiety. In a study by Egress, it was found that 74% of employees were disciplined, dismissed or left voluntarily after suffering a phishing incident, which can cause hesitation when it comes to reporting phishing.
Phishing incidents and simulations where employees have clicked should be seen as an opportunity to learn, not to blame, and to understand why a phish was successful and what can be done in future to prevent it. Organisations should perform security education and awareness training to help employees lessen their chance of falling victim, as well as knowing the reporting procedures.
Source: [Beta News]
Where Hackers Find Your Weak Spots
A recent analysis highlights social engineering as a primary vector for cyber attacks, emphasising its reliance on meticulously gathered intelligence to exploit organisational vulnerabilities. Attackers leverage various intelligence sources; Open Source Intelligence (OSINT) for public data, Social Media Intelligence (SOCMINT) for social media insights, Advertising Intelligence (ADINT) from advertising data, Dark Web Intelligence (DARKINT) from the DarkWeb, and the emerging AI Intelligence (AI-INT) using artificial intelligence. These methods equip cyber criminals with detailed knowledge about potential victims, enabling targeted and effective attacks. The report underscores the critical importance of robust information management and employee training to mitigate such threats, specifically advocating for regular training, AI-use policies, and proactive intelligence gathering by organisations to protect against the substantial risks posed by social engineering.
Source: [Dark Reading]
The Role of Threat Intelligence in Financial Data Protection
The financial industry’s reliance on digital processes has made it vulnerable to cyber attacks. Criminals target sensitive customer data, leading to financial losses, regulatory fines, and reputational damage. To combat these threats such as phishing, malware, ransomware, and social engineering, financial institutions must prioritise robust cyber security measures. One effective approach is threat intelligence, which involves ingesting reliable threat data, customised to your sector and the technology you have in place, and dark web monitoring.
Source: [Security Boulevard]
Government Cannot Protect Business and Services from Cyber Attack, Decision Makers Say
According to a recent report, 66% of surveyed IT leaders expressed a lack of confidence in their government’s ability to defend people and enterprises from cyber attacks, especially those from nation state actors. This scepticism arises from the growing complexity of threats and the rapid evolution of cyber warfare. While governments play a critical role in national security, their agility in adapting to the ever-changing digital landscape leaves organisations finding themselves increasingly responsible for their own protection.
Source: [TechRadar] [Security Magazine]
Governance, Risk and Compliance
Ransomware triggers cyber insurance claims increase | SC Media (scmagazine.com)
Six out of 10 businesses struggle to manage cyber risk (betanews.com)
Email inbox cyber crime leaps as claims soar (emergingrisks.co.uk)
It Costs How Much?!? The Financial Pitfalls of Cyber Attacks on SMBs | Huntress
Why Cyber Security Should Be Driving Your Enterprise Risk Management Strategy (forbes.com)
Cyber attacks are on the rise, and that includes small businesses. Here's what to know | AP News
Cyber staff priority as threats continue – report (emergingrisks.co.uk)
UK government cannot protect businesses and services from cyber attacks, IT pros say | TechRadar
Why cyber attacks shouldn’t be viewed as isolated incidents - Raconteur
Bank banned from opening new accounts over IT risks • The Register
Battening down the hatches: Navigating third-party cyber threats | SC Media (scmagazine.com)
Cyber Attacks Keep Rising. Here's What Small Businesses Need to Know | Inc.com
73% of SME security pros missed or ignored critical alerts - Help Net Security
Unmasking the True Cost of Cyber Attacks: Beyond Ransom and Recovery (thehackernews.com)
4 steps CISOs can take to raise trust in their business | TechTarget
NCSC Says Newer Threats Need Network Defence Strategy | Trend Micro (US)
Uncertainty is the most common driver of noncompliance - Help Net Security
Threats
Ransomware, Extortion and Destructive Attacks
Ransomware triggers cyber insurance claims increase | SC Media (scmagazine.com)
Report finds a near 20% increase in ransomware victims year-over-year | Security Magazine
Ransomware Double-Dip: Re-Victimization in Cyber Extortion (thehackernews.com)
'Junk gun' ransomware: New low-cost cyber threat targets SMBs (securitybrief.co.nz)
Mandiant: Attacker dwell time down, ransomware up in 2023 | TechTarget
Behavioural patterns of ransomware groups are changing - Help Net Security
Record ransomware attacks in March 2024, report finds (securitybrief.co.nz)
Ransomware payments drop to record low of 28% in Q1 2024 (bleepingcomputer.com)
Hackers use developing countries as testing ground for new ransomware attacks (ft.com)
Ransomware Still On Rise Despite Better Defences, Firm Says - Law360
Hackers are using developing countries for ransomware practice | Ars Technica
Dark web inundated by cheap ransomware tools | SC Media (scmagazine.com)
Unmasking the True Cost of Cyber Attacks: Beyond Ransom and Recovery (thehackernews.com)
Action needed amid escalating ransomware attacks, record-high payments | SC Media (scmagazine.com)
HelloKitty ransomware rebrands, releases CD Projekt and Cisco data (bleepingcomputer.com)
Rising Ransomware Issue: English-Speaking Western Affiliates (govinfosecurity.com)
CL0P ransomware gang is on the rise | Hogan Lovells - JDSupra
Proportion paying ransoms declines in Q1 2024, even as takings break a new record (computing.co.uk)
Megazord Ransomware Attacking Healthcare & Govt Entities (cybersecuritynews.com)
CISA ransomware warning program set to fully launch by end of 2024 | CyberScoop
Cyber Hygiene Helps Organisations Mitigate Ransomware-Related Vulnerabilities | CISA
Ransomware attacks rise in global food & agriculture sector (securitybrief.co.nz)
Ransomware Victims
Hackers Were in Change Healthcare 9 Days Before Attack (pymnts.com)
UnitedHealth BlackCat Attack Cost is $872M in Q1 | MSSP Alert
UnitedHealth admits breach could affect large chunk of US • The Register
Back from the Brink: UnitedHealth Offers Sobering Post-Attack Update (darkreading.com)
UnitedHealth Paid Ransom to Protect Patient Data | MSSP Alert
UNDP, City of Copenhagen Targeted in Data-Extortion Cyber Attack (darkreading.com)
Cannes Hospital Cancels Medical Procedures Following Cyber Attack - Security Week
Small medical practices will close because of Change cyber attack, says AMA | Healthcare IT News
HelloKitty ransomware rebrands, releases CD Projekt and Cisco data (bleepingcomputer.com)
Sweden's liquor shelves to run empty this week due to ransomware attack (therecord.media)
Authentication failure blamed for Change Healthcare ransomware attack | CSO Online
Ransomware feared as Octapharma Plasma closes 150+ centers • The Register
Red Ransomware takes credit for Targus attack | SC Media (scmagazine.com)
Ransomware Gang Leaks Data Allegedly Stolen From Government Contractor - Security Week
Carpetright unable to trade after cyber attack - Retail Gazette
Street lights in Leicester City cannot be turned off due to a cyber attack (securityaffairs.com)
Phishing & Email Based Attacks
The psychological impact of phishing attacks on your employees (betanews.com)
Hackers Create Legit Phishing Links With Ghost GitHub, GitLab Comments (darkreading.com)
Authorities investigate LabHost users after phishing service shut down | SC Media (scmagazine.com)
LA County Health Services: Patients' data exposed in phishing attack (bleepingcomputer.com)
BEC
Other Social Engineering
LastPass Users Lose Master Passwords to Ultra-Convincing Scam (darkreading.com)
Open Source Groups Warn of Social Engineering Backdoors | MSSP Alert
Artificial Intelligence
AI is a major threat and financial organisations are not doing enough to fight it | Biometric Update
Fifth of CISOs Admit Staff Leaked Data Via GenAI - Infosecurity Magazine (infosecurity-magazine.com)
Five Eyes agencies publish report on AI security | Hogan Lovells - JDSupra
AI tools linked to data exposure in 1 in 5 UK organisations (securitybrief.co.nz)
CSOs say AI is 'biggest cyber threat' to organisations | TechRadar
Man arrested for 'framing colleague' with AI-generated voice • The Register
Microsoft Warns: North Korean Hackers Turn to AI-Fueled Cyber Espionage (thehackernews.com)
People doubt their own ability to spot AI-generated deepfakes - Help Net Security
A National Security Insider Does the Math on the Dangers of AI | WIRED
40% of organisations have AI policies for critical infrastructure | Security Magazine
GPT-4 can exploit real vulnerabilities by reading advisories • The Register
25 cyber security AI stats you should know - Help Net Security
Cyber Threats in the Age of AI: Protecting Your Digital DNA - Security Boulevard
6 security items that should be in every AI acceptable use policy | CSO Online
'Poisoned' data could wreck AIs in wartime, warns Army software acquisition chief - Breaking Defence
The use of AI in war games could change military strategy (theconversation.com)
2FA/MFA
Strengths & Weaknesses of MFA Methods Against Cyber Attacks | Duo Security
What is multi-factor authentication (MFA), and why is it important? - Help Net Security
Malware
ToddyCat APT Is Stealing Data on 'Industrial Scale' (darkreading.com)
Report says over 10 million devices were infected by data-stealing malware in 2023 - PhoneArena
New Brokewell malware takes over Android devices, steals data (bleepingcomputer.com)
GitLab affected by GitHub-style CDN flaw allowing malware hosting (bleepingcomputer.com)
Microsoft unmasks Russia-linked ‘GooseEgg’ malware (therecord.media)
Hackers hijack antivirus updates to drop GuptiMiner malware (bleepingcomputer.com)
eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners (thehackernews.com)
Beware! Notorious Samurai Stealer Used in Targeted Attacks (cybersecuritynews.com)
Threat Actor Uses Multiple Infostealers in Global Campaign - Security Week
Seedworm Hackers Exploit RMM Tools to Deliver Malware (cybersecuritynews.com)
Antivirus updates hijacked to drop dangerous malware | TechRadar
Hackers infect users of antivirus service that delivered updates over HTTP | Ars Technica
Researchers sinkhole PlugX malware server with 2.5 million unique IPs (bleepingcomputer.com)
Millions of IPs remain infected by USB worm years after its creators left it for dead | Ars Technica
North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures (thehackernews.com)
Mobile
Report says over 10 million devices were infected by data-stealing malware in 2023 - PhoneArena
Ukrainian soldiers’ apps increasingly targeted for spying, cyber agency warns (therecord.media)
iPhone password reset attacks are real – how to protect yourself | Mashable
New Brokewell malware takes over Android devices, steals data (bleepingcomputer.com)
Godfather Banking Trojan Spawns 1.2K Samples Across 57 Countries (darkreading.com)
Give Your iPhone a Security Boost With This iOS 17.4 Feature - CNET
Data Breaches/Leaks
5.3M World-Check records may be leaked; how to check your records | SC Media (scmagazine.com)
Hackers stole 7,000,000 people's DNA. But what can they do with it? | Tech News | Metro News
AT&T Offers All Customers Free Security Bundle After Data Breach (tech.co)
App bug exposes 1M neighbourhood watchers to data harvesters • The Register
Fifth of CISOs Admit Staff Leaked Data Via GenAI - Infosecurity Magazine (infosecurity-magazine.com)
Organised Crime & Criminal Actors
Rising Ransomware Issue: English-Speaking Western Affiliates (govinfosecurity.com)
Russian FSB Counterintelligence Chief Gets 9 Years in Cyber Crime Bribery Scheme – Krebs on Security
Authorities investigate LabHost users after phishing service shut down | SC Media (scmagazine.com)
To Catch a Cyber Criminal -- and the Fallout That Follows (informationweek.com)
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners (thehackernews.com)
Lazarus On the Hunt: How North Korean Hackers are Targeting Crypto via LinkedIn (bitcoinist.com)
Insider Risk and Insider Threats
Most people still rely on memory or pen and paper for password management - Help Net Security
CesiumAstro claims former exec spilled trade secrets to upstart competitor AnySignal | TechCrunch
Insurance
Ransomware triggers cyber insurance claims increase | SC Media (scmagazine.com)
Email inbox cyber crime leaps as claims soar (emergingrisks.co.uk)
Coalition: Insurance claims for Cisco ASA users spiked in 2023 | TechTarget
Supply Chain and Third Parties
Battening down the hatches: Navigating third-party cyber threats | SC Media (scmagazine.com)
Ransomware Gang Leaks Data Allegedly Stolen From Government Contractor - Security Week
Cloud/SaaS
How Attackers Can Own a Business Without Touching the Endpoint (thehackernews.com)
5 Hard Truths About the State of Cloud Security 2024 (darkreading.com)
Identity and Access Management
How Attackers Can Own a Business Without Touching the Endpoint (thehackernews.com)
Identity-based security threats are growing rapidly: report | CSO Online
Encryption
Europol asks tech firms, governments to get rid of E2EE • The Register
How tech firms are tackling the risks of quantum computing | World Economic Forum (weforum.org)
Australian authorities call for Big Tech help with decryption • The Register
Linux and Open Source
Passwords, Credential Stuffing & Brute Force Attacks
Most people still rely on memory or pen and paper for password management - Help Net Security
New Password Cracking Analysis Targets Bcrypt - Security Week
Brute Force Password Cracking Takes Longer - Don't Celebrate Yet (technewsworld.com)
Social Media
Dutch govt body: Don't use Facebook if unsure about privacy • The Register
North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures (thehackernews.com)
Malvertising
Training, Education and Awareness
Regulations, Fines and Legislation
Preparing for NIS2: A Compliance Guide For Covered Entities | UpGuard
NIS2: Preparing for EU’s New Cyber Security Rules | Wilson Sonsini Goodrich & Rosati – JDSupra
Compliance in 2024: Cutting through the noise (federalnewsnetwork.com)
Google Postpones Third-Party Cookie Deprecation Amid UK Regulatory Scrutiny (thehackernews.com)
A view from Brussels: To be sovereign, or not to be (iapp.org)
Cyber Security | UK Regulatory Outlook April 2024 - Lexology
Net neutrality has been restored in the US - Help Net Security
Models, Frameworks and Standards
Fortifying your business with ISO 27001 - DCD (datacenterdynamics.com)
Preparing for NIS2: A Compliance Guide For Covered Entities | UpGuard
Taking Time to Understand NIS2 Reporting Requirements - Security Boulevard
Data Protection
Boost your data protection with insights from Dell's report - SiliconANGLE
A view from Brussels: To be sovereign, or not to be (iapp.org)
Careers, Working in Cyber and Information Security
Cyber staff priority as threats continue – report (emergingrisks.co.uk)
Three Ways Organisations Can Overcome the Cyber Security Skills Gap - Security Boulevard
Addressing the cyber skills shortage: 5 key steps to take | CSO Online
Five Essential Steps To Land Your First Cyber Security Job (forbes.com)
Expert Insight: Outdated Recruitment Methods Are Impeding The Global Cyber Army - IT Security Guru
Law Enforcement Action and Take Downs
Authorities investigate LabHost users after phishing service shut down | SC Media (scmagazine.com)
To Catch a Cyber Criminal -- and the Fallout That Follows (informationweek.com)
Man arrested for 'framing colleague' with AI-generated voice • The Register
Misinformation, Disinformation and Propaganda
Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity
Cyber Warfare and Cyber Espionage
State-Sponsored Hackers Exploit Two Cisco Zero-Day Vulnerabilities for Espionage (thehackernews.com)
China
ToddyCat APT Is Stealing Data on 'Industrial Scale' (darkreading.com)
Chinese, Russian espionage campaigns increasingly targeting edge devices (therecord.media)
UK mulls fresh controls on 'sensitive tech' after China cyber claim (thenextweb.com)
FBI Director Wray Issues Dire Warning on China's Cyber Security Threat (darkreading.com)
Head of Belgian Foreign Affairs Committee says she was hacked by China | Reuters
New tool used in China-linked attacks against Asia-Pacific | SC Media (scmagazine.com)
Dutch intelligence warns of stronger threats from China, jihadists and extremists | NL Times
MITRE breached by nation-state threat actor via Ivanti zero-days - Help Net Security
Ads on .gov.uk websites raise eyebrows over privacy • The Register
Russia
Microsoft: APT28 hackers exploit Windows flaw reported by NSA (bleepingcomputer.com)
Microsoft issues warning over ‘GooseEgg’ tool used in Russian hacking campaigns | ITPro
Chinese, Russian espionage campaigns increasingly targeting edge devices (therecord.media)
Russia's Fancy Bear Pummels Windows Print Spooler Bug (darkreading.com)
Overflowing Water Tank Linked to Russian Cyber Attack (govtech.com)
Russia accused of jamming GPS signal on flights from UK causing route chaos (inews.co.uk)
Russian Sandworm hackers targeted 20 critical orgs in Ukraine (bleepingcomputer.com)
Russian FSB Counterintelligence Chief Gets 9 Years in Cyber Crime Bribery Scheme – Krebs on Security
Campaigns and political parties are in the crosshairs of election meddlers | CyberScoop
Mandiant: Russia, Iran pose biggest threat to 2024 elections • The Register
Ukrainian soldiers’ apps increasingly targeted for spying, cyber agency warns (therecord.media)
MITRE breached by nation-state threat actor via Ivanti zero-days - Help Net Security
Ukraine participates in NATO cyber security exercise in Estonia / The New Voice of Ukraine (nv.ua)
Cyber attacks on Poland surged after election of pro-Ukraine regime (thenextweb.com)
Iran
Campaigns and political parties are in the crosshairs of election meddlers | CyberScoop
Mandiant: Russia, Iran pose biggest threat to 2024 elections • The Register
Iranian nationals charged with hacking US companies, Treasury and State departments | CyberScoop
The Biggest 2024 Elections Threat: Kitchen-Sink Attack Chains (darkreading.com)
North Korea
Hackers hijack antivirus updates to drop GuptiMiner malware (bleepingcomputer.com)
Microsoft Warns: North Korean Hackers Turn to AI-Fuelled Cyber Espionage (thehackernews.com)
North Korea's Lazarus Group Deploys New Kaolin RAT via Fake Job Lures (thehackernews.com)
Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence
Vulnerability Management
Third-Party Software Patching: Your Cyber Armor in 2024 | MSSP Alert
Automated patch management: 9 best practices for success | TechTarget
Vulnerabilities Versus Intentionally Malicious Software Components - The New Stack
GPT-4 can exploit real vulnerabilities by reading advisories • The Register
CISA ransomware warning program set to fully launch by end of 2024 | CyberScoop
Vulnerabilities
22,500 Palo Alto firewalls "possibly vulnerable" to ongoing attacks (bleepingcomputer.com)
Palo Alto Networks Discloses More Details on Critical PAN-OS Flaw Under Attack (thehackernews.com)
Russia's Fancy Bear Pummels Windows Print Spooler Bug (darkreading.com)
'MagicDot' Windows Weakness Allows Unprivileged Rootkit Activity (darkreading.com)
Microsoft: APT28 hackers exploit Windows flaw reported by NSA (bleepingcomputer.com)
MITRE says state hackers breached its network via Ivanti zero-days (bleepingcomputer.com)
GitLab affected by GitHub-style CDN flaw allowing malware hosting (bleepingcomputer.com)
Google Patches Critical Chrome Vulnerability - Security Week
Microsoft releases Exchange hotfixes for security update issues (bleepingcomputer.com)
PoC Exploit Released For Critical Oracle VirtualBox Vulnerability (gbhackers.com)
Critical Forminator plugin flaw impacts over 300k WordPress sites (bleepingcomputer.com)
Major Security Flaw in Popular Keyboard Apps Puts Millions at Risk (cybersecuritynews.com)
Patch Now: CrushFTP Zero-Day Cloud Exploit Targets US Orgs (darkreading.com)
GitHub vulnerability leaks sensitive security reports | TechTarget
New Password Cracking Analysis Targets Bcrypt - Security Week
Maximum severity Flowmon bug has a public exploit, patch now (bleepingcomputer.com)
Tools and Controls
Seedworm Hackers Exploit RMM Tools to Deliver Malware (cybersecuritynews.com)
Third-Party Software Patching: Your Cyber Armour in 2024 | MSSP Alert
The Role of Threat Intelligence in Financial Data Protection - Security Boulevard
Automated patch management: 9 best practices for success | TechTarget
Rethinking How You Work with Detection and Response Metrics (darkreading.com)
Choosing SOC Tools? Read This First [2024 Guide] - Security Boulevard
Research Shows How Attackers Can Abuse EDR Security Products - SecurityWeek
What is multi-factor authentication (MFA), and why is it important? - Help Net Security
Strengths & Weaknesses of MFA Methods Against Cyber Attacks | Duo Security
Zero Trust Takes Over: 63% of Orgs Implementing Globally (darkreading.com)
5 Hard Truths About the State of Cloud Security 2024 (darkreading.com)
Explore CASB use cases before you decide to buy | TechTarget
SD-WAN: Don't Build a Dead End, Prepare for Future-Proof Secure Networking - SecurityWeek
Identity-based security threats are growing rapidly: report | CSO Online
Microsoft criticized for charging for security add-ons • The Register
5 insights from new Microsoft CNAPP guide | Microsoft Security Blog
The Peril of Badly Secured Network Edge Devices (inforisktoday.com)
VPNs, Firewalls' Nonexistent Telemetry Lures APTs (darkreading.com)
The first steps of establishing your cloud security strategy - Help Net Security
40% of organizations have AI policies for critical infrastructure | Security Magazine
Understand the Benefits and Limitations of Automated Tools in Penetration Testing (prweb.com)
World´s most advanced cyber defence exercise kicks off in Tallinn
CISA ransomware warning program set to fully launch by end of 2024 | CyberScoop
Reports Published in the Last Week
Mandiant's M-Trends Report Reveals New Insights from Frontline Cyber Investigations (prnewswire.com)
Boost your data protection with insights from Dell's report - SiliconANGLE
Rising Cyber Threats Pose Serious Concerns for Financial Stability (imf.org)
Cyber Security in the UK - House of Commons Library (parliament.uk)
Other News
Why Educating HR Professionals on Cyber Risk Is Crucial (thehrdirector.com)
Network Threats: A Step-by-Step Attack Demonstration (thehackernews.com)
UK cyber agency NCSC announces Richard Horne as its next chief executive (therecord.media)
Internet cable at Cali airport cut in apparent sabotage • The Register
EU Statement – UN General Assembly 1st Committee: Cyber Security | EEAS (europa.eu)
Why Tourists Are Particularly Vulnerable To Cyber Attacks (maltatoday.com.mt)
AI Is Going Well For Microsoft, But Cyber Security Is Not - Microsoft (NASDAQ:MSFT) - Benzinga
Questions for IT and cyber leaders from the CSRB Microsoft report | Computer Weekly
World´s most advanced cyber defence exercise kicks off in Tallinn
Why Cyber Security Is Key To Solving Global Crises (forbes.com)
Colleges spending more than ever on cyber security efforts (insidehighered.com)
Foreign states targeting UK universities, MI5 warns - BBC News
Cyber resilience in the public sector: lessons for UK Councils (techinformed.com)
Digital Blitzkrieg: Unveiling Cyber Logistics Warfare (darkreading.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.
Black Arrow Cyber Insight 25 April 2024 – Understanding Infostealers: The Malicious Software Targeting Your Information
Black Arrow Cyber Insight 25 April 2024 – Understanding Infostealers: The Malicious Software Targeting Your Information
Executive summary
A recent report conducted by Kaspersky found that nearly 10 million devices fell victim to data-stealing malware, also known as “InfoStealers” in 2023. Put simply, an InfoStealer is malware that is built to collect and transmit sensitive information to unauthorised parties. Once stolen and transmitted, this information can be used or sold. Unlike ransomware, which often announces its presence with dramatic demands, infostealers operate in the shadows, harvesting your information.
What’s the risk?
Due to the sensitive nature of the information sought by InfoStealers, there is a genuine risk to the confidentiality of data. The data sought by an InfoStealer can include credentials, financial information, cookies, MFA tokens, text files, and machine information. The list of potential targets is extensive, especially so with many employees storing their credentials on personal devices. In a recent report, Mandiant, which is owned by Google, found that 10% of intrusions began with evidence of stolen credentials.
Infostealers can be delivered in a variety of ways, including through malicious attachments, unofficial software downloads and compromised websites. InfoStealers often try to disguise themselves as legitimate, in some cases tricking a victim in to running them and keeping them on their device. Anti-virus is not enough to stop them.
What can I do?
Mitigating the threat of InfoStealers requires practicing robust cyber hygiene. Organisations should adhere to leading practices, including downloading software exclusively from official sources, exercising caution with email links and attachments and maintaining visibility of the software ecosystem within their corporate environment.
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity
Black Arrow Cyber Advisory 25 April 2024 – Cisco ASA and FTD Zero-days Exploited by Nation-state Hackers, Patch Now
Black Arrow Cyber Advisory 25 April 2024 – Cisco ASA and FTD Zero-days Exploited by Nation-state Hackers, Patch Now
Executive summary
Cisco has published a security advisory warning regarding an active attack campaign labelled as “ArcaneDoor”. The campaign involves threat actors exploiting vulnerabilities in Cisco Adaptive Security Appliance (ASA) or Cisco Firepower Threat Defense (FTD) to implant previously unknown malware, execute commands and exfiltrate data. Activity is thought to have begun in early January 2024.
What’s the risk to me or my business?
There is a risk that organisations running vulnerable software versions of Cisco ASA or FTD are leaving themselves at risk of allowing an attacker to implant malware, execute commands and exfiltrate data, impacting the confidentiality, integrity and availability of data. There is no current workaround, and Cisco advises to upgrade to a fixed software release immediately.
What can I do?
Black Arrow recommends following Cisco’s advice, and applying patches immediately. Additionally, organisations can also open a case with Cisco Technical Assistance Center, referencing the keyword “ArcaneDoor” to verify the integrity of their Cisco ASA or FTD devices. Further information on this can be found in the advisory provided by Cisco.
Technical Summary
CVE-2024-20353- a denial of service vulnerability impacting Cisco ASA and FTD software.
CVE-2024-20359- A privilege escalation vulnerability, which could allow an authenticated local attacker to execute code with the highest level of privilege. Administrator level privileges are required to exploit this vulnerability.
Further information can be found below.
The advisories provided by Cisco can be found here:
https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_attacks_event_response
Need help understanding your gaps, or just want some advice? Get in touch with us.
#threatadvisory #threatintelligence #cybersecurity