Oktacron - Cyber Security RSS Feeds History

Russia Sanctions May Spark Escalating Cyber Conflict

krebsonsecurity Feb 25, 2022 Latest Warnings

President Biden joined European leaders this week in enacting economic sanctions against Russia in response to its invasion of Ukraine. The West has promised tougher sanctions are coming, but experts warn these will almost certainly trigger a Russian retaliation against America and its allies, which could escalate show more ...

into cyber attacks on Western financial institutions and energy infrastructure. Michael Daniel is a former cybersecurity advisor to the White House during the Obama administration who now heads the Cyber Threat Alliance, an industry group focused on sharing threat intelligence among members. Daniel said there are two primary types of cyber threats the group is concerned about potentially coming in response to sanctions on Russia. The first involves what Daniel called “spillover and collateral damage” — a global malware contagion akin to a NotPeyta event — basically some type of cyber weapon that has self-propagating capabilities and may even leverage a previously unknown security flaw in a widely-used piece of hardware or software. Russia has been suspected of releasing NotPetya, a large-scale cyberattack in 2017 initially aimed at Ukrainian businesses that mushroomed into an extremely disruptive and expensive global malware outbreak. “The second level [is that] in retaliation for sanctions or perceived interference, Russia steps up more direct attacks on Western organizations,” Daniel said. “The Russians have shown themselves to be incredibly ingenious and creative in terms of how they come up with targets that seem to catch us by surprise. If the situation escalates in cyberspace, there could be some unanticipated organizations that end up in the crosshairs.” What kinds of attacks are experts most concerned about? In part because the Russian economy is so dependent on energy exports, Russia has invested heavily in probing for weaknesses in the cyber systems that support bulk power production and distribution. Ukraine has long been used as the testing grounds for Russian offensive hacking capabilities targeting power infrastructure. State-backed Russian hackers have been blamed for the Dec. 23, 2015 cyberattack on Ukraine’s power grid that left 230,000 customers shivering in the dark. Experts warn that Russia could just as easily use its arsenal of sneaky cyber exploits against energy systems that support U.S. and European nations. In 2014, then National Security Agency Director Mike Rogers told lawmakers that hackers had been breaking into U.S. power utilities to probe for weaknesses, and that Russia had been caught planting malware in the same kind of industrial computers used by power utilities. “All of that leads me to believe it is only a matter of when, not if, we are going to see something dramatic,” Rogers said at the time. That haunting prophecy is ringing anew as European leaders work on hammering out additional sanctions, which the European Commission president says will restrict the Russian economy’s ability to function by starving it of important technology and access to finance. A draft of the new penalties obtained by The New York Times would see the European Union ban the export of aircraft and spare parts that are necessary for the maintenance of Russian fleets. “The bloc will also ban the export of specialized oil-refining technology as well as semiconductors, and it will penalize more banks — although it will stop short of targeting VTB, Russia’s second-largest bank, which is already crippled by American and British sanctions,” The Times wrote. Dmitri Alperovitch is co-founder and former chief technology officer at the security firm CrowdStrike. Writing for The Economist, Alperovitch said America must tailor its response carefully to avoid initiating a pattern of escalation that could result in a potentially devastating hot war with Russia. “The proposed combination of sanctions on top Russian banks and implementation of export controls on semiconductors would be likely to severely debilitate the Russian economy,” Alperovitch wrote. “And although many in the West may initially cheer this outcome as righteous punishment for Russia’s blatant violation of Ukrainian sovereignty, these measures will probably trigger significant Russian retaliation against America. That prospect all but guarantees that the conflict will not come to an end with an invasion of Ukraine.” Faced with a potentially existential threat to its economic well-being — and seeing itself as having nothing more to lose — Russia will have several tools at its disposal with which to respond, he said: One of those will be carrying out cyber-attacks against American and European financial institutions and energy infrastructure. “Having already exhausted the power of economic sanctions, America and its European allies would have few choices other than to respond to these attacks with offensive cyber-strikes of their own,” Alperovitch wrote. “This pattern of tit-for-tat cyber retaliation could place Russia and the West on a worrying path. It could end with the conflict spilling out of cyberspace and into the realm of a hot conflict. This outcome—a hot conflict between two nuclear powers with extensive cyber capabilities—is one that everyone in the world should be anxious to avoid.” In May 2021, Russian cybercriminals unleashed a ransomware attack against Colonial Pipeline, a major fuel distributor in the United States. The resulting outage caused fuel shortages and price spikes across the nation. Alperovitch says a retaliation from Russia in response to sanctions could make the Colonial Pipeline attack seem paltry by comparison. “The colonial pipeline is going to be like child’s play if the Russians truly unleash all their capability,” Alperovitch told CNBC this week. For example, having your organization’s computers and servers locked by ransomware may seem like a day at the park compared to getting hit with “wiper” malware that simply overwrites or corrupts data on infected systems. Kim Zetter, a veteran Wired reporter who now runs her own cybersecurity-focused Substack newsletter, has painstakingly documented two separate wiper attacks launched in the lead-up to the Russian invasion that targeted Ukrainian government and contractor networks, as well as systems in Latvia and Lithuania. One contractor interviewed by Zetter said the wiper attacks appeared to be extremely targeted, going after organizations that support the Ukrainian government — regardless of where those organizations are physically located. “The wiper, dubbed HermeticaWiper, appears to have been in the works for months but was only released on computers today,” Zetter wrote. “It follows on a previous wiper attack that struck Ukrainian systems in January called WhisperGate. Like that previous infection, HermeticaWiper is designed to overwrite files on systems to render them inoperable.” A joint advisory last week by the FBI, National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) warned that Russian cyber actors have been targeting cleared defense contractors, and that since January 2020 and continuing through this month, the cyber actors had maintained a persistent presence on those contractor networks. The advisory said the attackers exfiltrated email and data, and were able to “acquire sensitive, unclassified information, as well as proprietary and export-controlled technology.” A report Thursday by NBC News suggested President Biden had been presented with options for massive cyberattacks against Russia, including the disruption of Internet access across Russia, shutting off the power, and stopping trains in their tracks. But White House National Security Council spokesperson Emily Home told Reuters the NBC News report was “wildly off base and does not reflect what is actually being discussed in any shape or form.” That’s good news, according to Jim Lewis, director of the public policy program at the Center for Strategic and International Studies. Lewis said the United States and its allies have far more to lose if the West gets embroiled in an escalation of cyber attacks with Russia over sanctions. “The asymmetry in pressure points makes the idea of us doing something probably not a good idea,” Lewis told KrebsOnSecurity. “If Putin hasn’t gone completely nuts, he’ll be cautious of doing anything that might be construed under international law as the use of force through cyber means.” Lewis said a more likely response from Russia would include enlisting cybercriminals throughout Russia and the Commonwealth of Independent States to step up ransomware and other disruptive attacks against high-impact targets in specific industries. “The pressure points for Putin are his political support — the oligarchs and security services,” Lewis said. “If we want to squeeze him, that’s where we have to squeeze, things like seizing all their real estate in Miami Beach, or putting them on no-fly lists. If you want to hurt Putin, a cyberattack probably wouldn’t do it. Unless it was against his bank account.” In a call to action issued earlier this week dubbed “Shields Up,” CISA warned that Russia could escalate its destabilizing actions in ways that may impact others outside of Ukraine. CISA also published a new catalog of free public and private sector cybersecurity services.

Ransomware wreaked havoc last year, manufacturing was most targeted

cyware Feb 25, 2022 Trends, Reports, Analysis

While phishing was the most common cause of cyberattacks in general in the past year, there was a 33% increase in attacks caused by vulnerability exploitation of unpatched software.

Zenly Social-Media App Bugs Allow Account Takeover

cyware Feb 25, 2022 Malware and Vulnerabilities

Zenly, a social app from Snap that allows users to see the locations of friends and family on a live map, contains a pair of vulnerabilities that could endanger those being tracked.

Vishing Makes Phishing Campaigns Three Times More Successful

cyware Feb 25, 2022 Trends, Reports, Analysis

Phishing emerged as the number one threat vector in 2021, but cases of vulnerability exploitation surged 33% year-on-year thanks to the impact of Log4Shell, according to IBM.

New Flaws Discovered in Cisco's Network Operating System for Switches

cyware Feb 25, 2022 Malware and Vulnerabilities

Cisco has released software updates to address four security vulnerabilities in its software that could be weaponized by malicious actors to take control of affected systems.

US braces for Russian cyberattacks as Ukraine conflict escalates. Here's how that might play out

cyware Feb 25, 2022 Trends, Reports, Analysis

The US government is on high alert for the possibility of the conflict spilling over into cyberspace, where Russia has shown an ability to cause significant disruption and damage in the past.

White House Denies Mulling Massive Cyberattacks Against Russia

cyware Feb 25, 2022 Geopolitical, Terrorism

The White House has denied reports that President Biden has been presented with a number of ways to launch cyberattacks on Russia to disrupt its ability to sustain its military operations in Ukraine.

US Defense Contractors Hit by Stealthy Attacks Using SockDetour Windows Backdoor

cyware Feb 25, 2022 Malware and Vulnerabilities

A new custom malware dubbed SockDetour found on systems belonging to US defense contractors has been used as a backup backdoor to maintain access to compromised networks.

Asia most targeted region in 2021, taking on one in four cybersecurity attacks

cyware Feb 25, 2022 Trends, Reports, Analysis

Financial services and manufacturing sectors bore the brunt of attacks, taking on about 60% of incidents in the region with Japan, Australia, and India being the prime targets, according to IBM.

New ‘Electron Bot’ Malware Infiltrates Microsoft App Store via Cloned Apps

cyware Feb 25, 2022 Malware and Vulnerabilities

A backdoor that can take over social media accounts, including Facebook, Google, and Soundcloud, infiltrated Microsoft’s official store by cloning popular games such as Temple Run or Subway Surfer.

Cuba Ransomware Operations Exploits Microsoft Exchange Servers to Gain Access to Corporate Networks

cyware Feb 25, 2022 Malware and Vulnerabilities

The Cuba ransomware operation is exploiting Exchange vulnerabilities to gain access to corporate networks and encrypt devices. Cuba is a ransomware operation that launched at the end of 2019.

Cheq Raises $150M in Series C Funding

cyware Feb 25, 2022 Companies to Watch

The Series C round, which brings total funding to date to $183M, was led by Tiger Global with participation from Battery Ventures, Hanaco, Phoenix Insurance, and Key1 Capital.

Ransomware used as decoy in data-wiping attacks on Ukraine

cyware Feb 25, 2022 Malware and Vulnerabilities

The ransomware decoy also dropped a ransom note on compromised systems, with a political message saying that "The only thing that we learn from new elections is we learned nothing from the old!"

New York to Get Statewide Cybersecurity Center

cyware Feb 25, 2022 Govt., Critical Infrastructure

The center was announced by state governor Kathy Hochul on Tuesday at a joint conference held with the mayors of New York City, Albany, Buffalo, Rochester, Syracuse, and Yonkers.

Cyberattackers Leverage DocuSign to Steal Microsoft Outlook Logins

cyware Feb 25, 2022 Identity Theft, Fraud, Scams

A phishing campaign aimed at a “major, publicly-traded integrated payments solution company located in North America” used DocuSign and a compromised third party’s email domain, researchers said.

GE SCADA Product Vulnerabilities Show Importance of Secure Configurations

cyware Feb 25, 2022 Malware and Vulnerabilities

GE Digital has released patches for two high-severity vulnerabilities affecting its Proficy CIMPLICITY HMI/SCADA software, which is used by plants globally to monitor and control operations.

Notorious TrickBot Malware Gang Shuts Down its Botnet Infrastructure

cyware Feb 25, 2022 Malware and Vulnerabilities

The modular Windows crimeware platform shuttered its infrastructure on Thursday after reports emerged of its imminent retirement amid a lull in its activity for almost two months.

Ofcom Set to Crack Down on Phone Fraud

cyware Feb 25, 2022 Trends, Reports, Analysis

Fraudsters often try to spoof the number of banks and other institutions in order to persuade targets of the legitimacy of their request for personal and financial information.

Iranian Government-Sponsored MuddyWater APT Conducting Malicious Cyber Operations Against Critical Infrastructure

cyware Feb 25, 2022 Threat Intel & Info Sharing

US and UK agencies today shared information on new malware deployed by the Iranian-backed MuddyWatter hacking group in attacks targeting critical infrastructure worldwide.

India’s Personal Data Privacy Bill: What does it mean for individuals and businesses?

cyware Feb 25, 2022 Laws, Policy, Regulations

Indian authorities want to bring the country’s data protection law in line with international best practice, with the European Union’s General Data Protection Regulation (GDPR) as the preferred model.

Multiple Hacking Groups Targeting ICS/OT Systems

cyware Feb 25, 2022 Trends, Reports, Analysis

A new report on industrial cybersecurity has revealed three new threat groups, besides LockBit 2.0 and Conti, that have been targeting the industrial sector. Experts spotted three new groups Petrovite, Kostovite, and Erythrite, that have been targeting ICS/OT systems. To protect from threats, the industrial sector ought to have an in-depth security strategy to overcome and withstand such attacks.

Russian Sandworm Distributes New Cyclops Blink Malware

cyware Feb 25, 2022 Threat Actors

The U.S. and U.K released a joint security advisory warning that Russian-backed Sandworm has started using a new malware, dubbed Cyclops Blink. The group has mostly deployed the Cyclops Blink to WatchGuard devices. The joint advisory recommends referring to indicators of compromise and provides guidance on how to better detect any possible activity on networks.

Email Security and Brand Protection Firm Red Sift Raises $54 Million

cyware Feb 25, 2022 Companies to Watch

The latest funding round was led by Highland Europe, with participation from new and existing investors, including Sands Capital, MMC Ventures, and Oxford Capital Partners.

Official website of Russian Parliament, MoD and Kremlin go offline

cyware Feb 25, 2022 Breaches and Incidents

The affected websites include the Kremlin (kremlin.ru) which is the official website of President Vladimir Putin, the Russian Ministry of Defense, and the official website of the Russian parliament.

Integrity360 acquires Caretower to strengthen its cybersecurity services

cyware Feb 25, 2022 Companies to Watch

Ireland-based Integrity360 and Caretower announced that they have joined forces with Caretower becoming an Integrity360 company. The terms of the transaction were not disclosed.

Data Breach Impacts DNA Data of Sexual Assault Victims Reported to Oklahoma City Police Department

cyware Feb 25, 2022 Breaches and Incidents

The laboratory processed the DNA evidence from rape victims, known as ‘rape kits’, for the Oklahoma City Police Department (OKCPD), amongst other clients, over a two-year period.

Russian Forces Are Inching Closer To Kyiv

packetstormsecurity Feb 25, 2022 headline,government,russia,military

White House Denies Mulling Massive Cyberattacks Against Russia

packetstormsecurity Feb 25, 2022 headline,government,usa,russia,cyberwar

Ukraine Military Calls On Citizens With Hobby Drones To Help Kyiv

packetstormsecurity Feb 25, 2022 headline,russia,cyberwar

Cyberwarfare Looms As Russia Invades, Shells Ukraine

packetstormsecurity Feb 25, 2022 headline,government,usa,russia,cyberwar