Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Ransomware operators ...

 Business

When ransomware enters a corporate network, it usually does so through e-mail, software vulnerabilities, or unprotected remote connections. Having an insider deliberately deploy malware seems implausible. However, as real-world evidence shows, some attackers think this method of delivering ransomware is effective, and   show more ...  

some attackers are now recruiting company employees by offering them a percentage of the ransom. A creative delivery scheme As absurd as it may sound, some seek out accomplices through spam. For example, one message directly offers “40%, $1 million in bitcoin” to anyone willing to install and deploy DemonWare ransomware on their organization’s main Windows server. Researchers masquerading as interested accomplices received a link to a file along with instructions for launching the malware. However, the person behind the mailing was apparently an inexperienced cybercriminal; the researchers had no trouble getting him to talk. The threat actor in question was a young Nigerian man who had scoured LinkedIn, looking for senior executives to contact. He abandoned his original plan — e-mailing malware — once he realized how strong corporate cybersecurity systems are. What’s wrong with the scheme? To convince his targets their participation would be safe, the threat actor claimed the ransomware would erase all evidence of the crime, including any potential security footage, and recommended deleting the executable file to avoid leaving any clues. One might expect the criminal planned to trick his accomplices — arguably, once the server was encrypted, he would not care what happened to the person who did it — but he doesn’t appear to have understood how digital forensics investigations  work. The decision to use DemonWare also betrayed his inexperience. Although attackers do still use DemonWare, it is actually rather unsophisticated malware whose source code is available on GitHub. The malware’s creator allegedly made it to demonstrate how easy it is to write ransomware. How to stay safe Although this example is just that — one specific example — insiders taking part in a ransomware attack is entirely realistic. Far more likely than someone launching malware on a network, however, is a scenario in which someone sells access to an organization’s information system. The market for access to corporate networks has long existed on the dark web, and ransomers often purchase access from other cybercriminals — so-called Initial Access Brokers. It’s they who may be specifically interested in buying data for remote access to the organization’s network or cloud servers. Ads for such purchases aimed at disgruntled or fired employees float around the dark web. To ensure no one jeopardizes your company’s security by letting ransomers into its networks, we recommend you: Adopt a strategy of least privilege; Keep careful records of access attempts to the organization’s network and servers, and revoke rights and change passwords when employees are dismissed; Install on every server security solutions that can counter today’s malware; Use Managed Detection and Response solutions, which help identify suspicious activity in your infrastructure before attackers have a chance to inflict serious damage.

 Trends, Reports, Analysis

Every attack allows attackers to gain more knowledge about OT systems, including their operations, physical processes, and technology. This knowledge allows attackers to enhance their capabilities.

 Trends, Reports, Analysis

From 2017 to June 30, 2021, the FTC received over 800,000 consumer reports from service members, including veterans, active duty, reservists, and their families. Total losses tally up to $822 million.

 Govt., Critical Infrastructure

Despite security improvements over the last seven years, the U.S. Agency for International Development (USAID) needs to better protect personally identifiable data, according to an OIG report.

 Trends, Reports, Analysis

Businesses the world over have been faced with rising levels of opportunist criminals preying on vulnerabilities during the pandemic, and the financial services sector didn’t go unscathed.

 Malware and Vulnerabilities

Mirai-based botnet operators were found exploiting a new security flaw in the Realtek SDK, impacting hundreds of thousands of devices worldwide. The vulnerabilities were spotted in Realtek chipsets just two days ago. Vulnerable device owners are recommended to apply the patch as soon as possible.

 Malware and Vulnerabilities

A set of malware campaigns have been discovered spreading commodity RATs and using a .NET-based crypter service 3losh to target travel and hospitality businesses in Latin America. These campaigns use either compromised or attacker-controlled websites to host their tools and payloads. Furthermore, security analysts stumbled across multiple campaigns using the same 3losh crypter and infection scripts to spread RATs.

 Malware and Vulnerabilities

Mozi, a P2P botnet known to target IoT products, has gained new capabilities to aim at network gateways created by Huawei, Netgear, and ZTE. Mozi propagates by exploiting weak and default remote access passwords and unpatched vulnerabilities. The key security recommendation is always to use a strong password and regularly update the firmware of the network devices.

 Feed

Ubuntu Security Notice 5051-1 - John Ouyang discovered that OpenSSL incorrectly handled decrypting SM2 data. A remote attacker could use this issue to cause applications using OpenSSL to crash, resulting in a denial of service, or possibly change application behaviour. Ingo Schwarze discovered that OpenSSL incorrectly   show more ...  

handled certain ASN.1 strings. A remote attacker could use this issue to cause OpenSSL to crash, resulting in a denial of service, or possibly obtain sensitive information. Various other issues were also addressed.

 Feed

I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties. This is the source code release version.

 Feed

Ubuntu Security Notice 5037-2 - USN-5037-1 fixed vulnerabilities in Firefox. The update introduced a regression that caused Firefox to repeatedly prompt for a password. This update fixes the problem. Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website,   show more ...  

an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, trick a user into accepting unwanted permissions, or execute arbitrary code. Various other issues were also addressed.

 Feed

A computer retail company based in the U.S. was the target of a previously undiscovered implant called SideWalk as part of a recent campaign undertaken by a Chinese advanced persistent threat group primarily known for singling out entities in East and Southeast Asia. Slovak cybersecurity firm ESET attributed the malware to an advanced persistent threat it tracks under the moniker SparklingGoblin

 Feed

I'm sure you would agree that, in today's digital world, the majority of applications we work on require some type of credentials – to connect to a database with a username/password, to access computer programs via authorized tokens, or API keys to invoke services for authentication. Credentials, or sometimes just referred to as 'Secrets,' are pieces of user or system-level confidential

 Feed

A financially motivated threat actor notorious for setting its sights on retail, hospitality, and entertainment industries has been observed deploying a completely new backdoor on infected systems, indicating the operators are continuously retooling their malware arsenal to avoid detection and stay under the radar. The previously undocumented malware has been dubbed "Sardonic" by Romanian

 Feed

Cybersecurity researchers have disclosed five previously unreported security vulnerabilities affecting B. Braun's Infusomat Space Large Volume Pump and SpaceStation that could be abused by malicious parties to tamper with medication doses without any prior authentication. McAfee, which discovered and reported the flaws to the German medical and pharmaceutical device company on January 11, 2021, 

 Feed only

Graham Cluley Security News is sponsored this week by the folks at 1Password. Thanks to the great team there for their support! The shift to remote and hybrid work has introduced new vulnerabilities, putting your critical data at risk. With less oversight into security protocols and the behavior of your staff, it’s   show more ...  

more important than … Continue reading "Build and improve your company’s culture of security with 1Password"

2021-08
Aggregator history
Wednesday, August 25
SUN
MON
TUE
WED
THU
FRI
SAT
AugustSeptemberOctober