Oktacron - Cyber Security RSS Feeds History

BlackCat Ransomware Raises Ante After FBI Disruption

krebsonsecurity Dec 19, 2023 Other

The U.S. Federal Bureau of Investigation (FBI) disclosed today that it infiltrated the world’s second most prolific ransomware gang, a Russia-based criminal group known as ALPHV and BlackCat. The FBI said it seized the gang’s darknet website, and released a decryption tool that hundreds of victim companies show more ...

can use to recover systems. Meanwhile, BlackCat responded by briefly “unseizing” its darknet site with a message promising 90 percent commissions for affiliates who continue to work with the crime group, and open season on everything from hospitals to nuclear power plants. A slightly modified version of the FBI seizure notice on the BlackCat darknet site (Santa caps added). Whispers of a possible law enforcement action against BlackCat came in the first week of December, after the ransomware group’s darknet site went offline and remained unavailable for roughly five days. BlackCat eventually managed to bring its site back online, blaming the outage on equipment malfunctions. But earlier today, the BlackCat website was replaced with an FBI seizure notice, while federal prosecutors in Florida released a search warrant explaining how FBI agents were able to gain access to and disrupt the group’s operations. A statement on the operation from the U.S. Department of Justice says the FBI developed a decryption tool that allowed agency field offices and partners globally to offer more than 500 affected victims the ability to restore their systems. “With a decryption tool provided by the FBI to hundreds of ransomware victims worldwide, businesses and schools were able to reopen, and health care and emergency services were able to come back online,” Deputy Attorney General Lisa O. Monaco said. “We will continue to prioritize disruptions and place victims at the center of our strategy to dismantle the ecosystem fueling cybercrime.” The DOJ reports that since BlackCat’s formation roughly 18 months ago, the crime group has targeted the computer networks of more than 1,000 victim organizations. BlackCat attacks usually involve encryption and theft of data; if victims refuse to pay a ransom, the attackers typically publish the stolen data on a BlackCat-linked darknet site. BlackCat formed by recruiting operators from several competing or disbanded ransomware organizations — including REvil, BlackMatter and DarkSide. The latter group was responsible for the Colonial Pipeline attack in May 2021 that caused nationwide fuel shortages and price spikes. Like many other ransomware operations, BlackCat operates under the “ransomware-as-a-service” model, where teams of developers maintain and update the ransomware code, as well as all of its supporting infrastructure. Affiliates are incentivized to attack high-value targets because they generally reap 60-80 percent of any payouts, with the remainder going to the crooks running the ransomware operation. BlackCat was able to briefly regain control over their darknet server today. Not long after the FBI’s seizure notice went live the homepage was “unseized” and retrofitted with a statement about the incident from the ransomware group’s perspective. The message that was briefly on the homepage of the BlackCat ransomware group this morning. Image: @GossiTheDog. BlackCat claimed that the FBI’s operation only touched a portion of its operations, and that as a result of the FBI’s actions an additional 3,000 victims will no longer have the option of receiving decryption keys. The group also said it was formally removing any restrictions or discouragement against targeting hospitals or other critical infrastructure. “Because of their actions, we are introducing new rules, or rather, we are removing ALL rules except one, you cannot touch the CIS [a common restriction against attacking organizations in Russia or the Commonwealth of Independent States]. You can now block hospitals, nuclear power plants, anything, anywhere.” The crime group also said it was setting affiliate commissions at 90 percent, presumably to attract interest from potential affiliates who might otherwise be spooked by the FBI’s recent infiltration. BlackCat also promised that all “advertisers” under this new scheme would manage their affiliate accounts from data centers that are completely isolated from each other. BlackCat’s darknet site currently displays the FBI seizure notice. But as BleepingComputer founder Lawrence Abrams explained on Mastodon, both the FBI and BlackCat have the private keys associated with the Tor hidden service URL for BlackCat’s victim shaming and data leak site. “Whoever is the latest to publish the hidden service on Tor (in this case the BlackCat data leak site), will resume control over the URL,” Abrams said. “Expect to see this type of back and forth over the next couple of days.” The DOJ says anyone with information about BlackCat affiliates or their activities may be eligible for up to a $10 million reward through the State Department’s “Rewards for Justice” program, which accepts submissions through a Tor-based tip line (visiting the site is only possible using the Tor browser). Further reading: CISA StopRansomware Alert on the tools, techniques and procedures used by ALPHV/BlackCat.

Sylhet Gang’s ‘DecemberStrom’ Campaign Targets UAE Ministry of Defence

cyberexpress Dec 19, 2023 Firewall Daily

The Self-proclaimed hacktivist group, Sylhet Gang, has claimed a cyberattack on the UAE’s Ministry of Defence. The attack allegedly targeted the website, stating that they had “paralyzed” the United Arab Emirates Ministry of Defence (MOD). The cyberattack claim was posted by the threat actor on its show more ...

Telegram channel, where it shared screenshots of the attack, accompanied by the #DecemberStrom hashtag, indicating that follow-up attacks could be a possibility. However, despite these claims, the website of UAE’s Ministry of Defence seems to be operational and doesn’t show any sign of the attack. UAE Ministry of Defence Hack According to a screenshot shared on X (formerly Twitter) by a cybersecurity research organization, a message posted on the Telegram channel of the Sylhet gang reads, “We paralyzed the Ministry of Defense website of Zionist Emirates.” Credit: FalconFeedsio on “X” The Sylhet gang has openly called UAE which is an Islamic nation, a “Zionist Emirates”. As a preconceived notion in geopolitics, Islamic countries are generally on an ideological crossover with the non-Islamic ones. Calling UAE a “Zionist” can be considered a gibe at the country for having condemned Islamic terror organization Hamas in the Israel-Hamas war for its atrocities on the Jewish people. The alleged UAE Ministry of Defence hack is not the first incident of its kind. Before this, The Cyber Express team reported multiple incidents of Islamic-backed hacker and hacktivist groups have been targeting UAE-based organizations, primarily government agencies and other critical infrastructure. UAE Ministry of Climate Change and Environment Also Targeted Along with the UAE Ministry of Defence hack, the Ministry of Climate Change and Environment has also been allegedly targeted by the hacker group following a series of cyberattack targeted towards UAE’s government organizations. Credit: FalconFeedsio on “X” In a screenshot posted by a cybersecurity research organization, the Sylhet gang has claimed, “They have relationship with the Zionist entity,” as “the reason” of the alleged hack of UAE’s Ministry of Climate Change and Environment. About the Sylhet Gang’s #DecemberStorm DDoS Campaign Cybersecuirty experts are considering these series of cyberattacks (including the UAE Ministry of Defence hack) to be happening for one sole reason, which is, support for Israel and “Zionist” entities. A prominent cybersecurity research organization has stated on X (formerly Twitter), “In recent developments on the cybersecurity front, the notorious hacktivist group known as Sylhet Gang announces their latest DDoS campaign, #DecemberStorm. The group is known for its past attacks on countries including Israel, India, France, Ukraine, South Korea, UAE, Italy, and the United States, is once again making headlines with their malicious intentions.” The self proclaimed hacktivist Sylhet gang has also claimed to have targeted Zionist entities and their ideological supporters like India, France, Ukraine, South Korea, UAE, Italy, and US. The have claimed, “So in last 3 months we struck 200+ Zionist and their supporter entities.” This time, the Sylhet gang claims to target the “Muslim countries who have relationship with Israel with a new campaign #DecemberStorm”. They have also stated that they will continue targeting Zionist entities for the sake of “Allah” and the muslims living in Palestine. The Sylhet gang promises to continue targeting “them until the Israeli occupation stops and the victory is achieved.” In summary, the recent Sylhet Gang-led UAE Ministry of Defence hack and Ministry of Climate Change and Environment cyberattack reveal a blend of geopolitics and cybersecurity. The use of “Zionist Emirates” suggests a response to UAE’s stance on the Israel-Hamas conflict. The #DecemberStorm campaign extends beyond the UAE, targeting countries with perceived ties to Israel. This underscores the intersection of ideology and cyber warfare, emphasizing the need for global collaboration and robust cybersecurity measures in the face of evolving geopolitical cyber threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

FBI Cracks BlackCat Ransomware Network, Offers Lifeline to 500+ Global Victims

cyberexpress Dec 19, 2023 Firewall Daily

FBI Takes Down BlackCat/Alphv Ransomware! The U.S. Department of Justice (DOJ) recently announced a major breakthrough in cybersecurity efforts with the disruption of the BlackCat ransomware group, also known as ALPHV or Noberus. This group has been a significant threat, targeting over 1,000 computer networks show more ...

globally, including critical U.S. infrastructure. Over the past 18 months, ALPHV/Blackcat emerged as the second most prolific ransomware-as-a-service variant in the world, demanding hundreds of millions of dollars in ransoms from its victims. FBI’s Strategic Takedown of ALPHV/BlackCat Ransomware The FBI played a crucial role in this operation by developing a decryption tool, which was distributed to over 500 affected victims around the world, as revealed in the detailed press release by the Department of Justice. This tool enabled these victims to restore their systems, saving them from ransom demands totaling approximately $68 million. The FBI’s intervention allowed businesses, schools, healthcare, and emergency services to reopen and come back online. “In disrupting the BlackCat ransomware group, the Justice Department has once again hacked the hackers,” said Deputy Attorney General Lisa O. Monaco, stated the official release. “With a decryption tool provided by the FBI to hundreds of ransomware victims worldwide, businesses and schools were able to reopen, and health care and emergency services were able to come back online. We will continue to prioritize disruptions and place victims at the center of our strategy to dismantle the ecosystem fueling cybercrime,” Monaco added. (Source: Twitter) In a significant operational success, the FBI breached the ALPHV ransomware operation’s servers to monitor their activities and obtain decryption keys. This access allowed them to silently monitor the ransomware operation for months, during which they gathered valuable information and siphoned decryption keys. The operation’s success is partly attributed to the unsealing of a search warrant in the Southern District of Florida, which detailed the FBI’s infiltration into the group’s computer network and the seizure of several websites operated by the group. FBI Takes Down BlackCat/Alphv: What the Experts Have to Say? Numerous cybersecurity experts are discussing the FBI’s takedown of the ALPHV ransomware on social media. However, cybersecurity analyst Dominic Alvieri highlighted a concerning point in a post, noting that despite the takedown, the newly hashed Black Cat leak site remains operational. “This is crazy but the newly hashed BlackCat leak site is still up and running,” he wrote while sharing screenshot of the text displaying on the BlackCat website. Ferhat Dikbiyik, PhD, who leads research at Black Kite, a platform specializing in third-party risk intelligence, had earlier predicted that a major group like AlphV might face shutdown, though he anticipated this event in 2024. According to Ferhat, the end of AlphV doesn’t signify the end of such threats. He compares these ransomware groups to the legendary Conti, suggesting that when one is defeated, others emerge in its place. He notes that when the Conti group was dismantled, its extortion branch, Karakurt, evolved into an independent ransomware entity. BlackCat Ransomware Group Seized! The BlackCat ransomware group is known for using a multiple extortion model, where they exfiltrate sensitive data before encrypting the victim’s system. They then demand a ransom for decrypting the system and not publishing the stolen data. This approach puts immense pressure on victims to pay the ransom. This disruption is part of the DOJ’s ongoing strategy to combat cybercrime, focusing on dismantling the ecosystem fueling these crimes and prioritizing victim safety and recovery. The DOJ, along with international partners like Europol and law enforcement agencies from several countries, has been actively working on this case, highlighting the global nature of the threat posed by ransomware groups like BlackCat. Victims of the BlackCat ransomware are encouraged to contact their local FBI field office for assistance and further information. The FBI continues to pursue criminal actors in this domain aggressively, aiming to bring them to justice and prevent future attacks. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Episode 254: Dennis Giese’s Revolutionary Robot Vacuum Liberation Movement

securityledger Dec 19, 2023 Business

Security researcher and IoT hacker Dennis Giese talks about his mission to liberate robot vacuums from the control of their manufacturers, letting owners tinker with their own devices and - importantly - control the data they collect about our most intimate surroundings. The post Episode 254: Dennis Giese’s show more ...

Revolutionary Robot Vacuum...Read the whole entry... » Click the icon below to listen. Related StoriesBlack Hat: Colin O’Flynn On Hacking An Oven To Make It Stop LyingEpisode 250: Window Snyder of Thistle on Making IoT Security EasyEpisode 251: Kry10 CEO Boyd Multerer on building a secure OS for the IoT

Comcast Xfinity Breached via CitrixBleed; 35M Customers Affected

darkreading Dec 19, 2023 Feed

A trove of personal data belonging to millions of Americans is just the latest bullet point in a bad year for Citrix customers.

Microsoft: Multiple Perforce Server Flaws Allow for Network Takeover

darkreading Dec 19, 2023 Feed

The most critical of the bugs gives attackers privileged access to the local Windows system, paving the way for unauthenticated RCE and installing backdoors.

Microsoft Outlook Zero-Click Security Flaws Triggered by Sound File

darkreading Dec 19, 2023 Feed

Attackers can chain the vulnerabilities to gain full remote code execution.

Changing How We Think About Technology

darkreading Dec 19, 2023 Feed

To make real change, organizations need to augment logical thinking with critical thinking.

Unsung GitHub Features Anchor Novel Hacker C2 Infrastructure

darkreading Dec 19, 2023 Feed

More and more hackers are choosing to host their malicious campaigns from public services, and they're pioneering new ways of doing it.

SANS Institute Research Shows What Frameworks, Benchmarks, and Techniques Organizations Use on their Path to Security Maturity

darkreading Dec 19, 2023 Feed

Expel-sponsored research unveils how companies measure SOC performance and the frameworks they rely on to assess and guide their security strategies

Console & Associates, P.C.: Comcast Xfinity Reports Data Breach Exposing Confidential Information of 35M Customers

darkreading Dec 19, 2023 Feed

Salvador Technologies Raises $6M to Empower Cyber Resilience in Operational Technologies and Critical Infrastructures

darkreading Dec 19, 2023 Feed

Salvador Technologies' platform prevents downtime damages and enables full operational recovery and continuity in just 30 seconds.

What Do CISOs Have to Do to Meet New SEC Regulations?

darkreading Dec 19, 2023 Feed

As stringent new SEC reporting rules take effect, CISOs need to assess internal processes and understand their responsibilities. But there's a bright side.

Israel Blames Iran for Hospital Data Breach

darkreading Dec 19, 2023 Feed

Israeli intelligence said a cyber unit of Hezbollah also was involved in the cyberattack.

Why I Chose Google Bard to Help Write Security Policies

darkreading Dec 19, 2023 Feed

Large language models (LLMs) like Bard and ChatGPT can help produce simpler, more readable security documentation in a fraction of the time it takes to do it manually.

API Security: The Big Picture

darkreading Dec 19, 2023 Feed

Hype won't solve operational security problems. Here are 10 important points to consider when evaluating API security solutions.

xorbot: A Stealthy Botnet Family That Defies Detection

cyware Dec 19, 2023 Malware and Vulnerabilities

Xorbot utilizes encryption and decryption algorithms, borrowed from the Mirai source code, to encrypt communication with its command and control server and store sensitive information.

Microsoft is Working on a More Secure Print System for Windows

cyware Dec 19, 2023 Computer, Internet Security

Microsoft has introduced Windows Protected Print Mode (WPP) to enhance security and eliminate vulnerabilities in the Windows print system. These changes aim to reduce the attack surface and enhance user safety.

Researchers Disclose Zero-Click Exploit for Microsoft Outlook

cyware Dec 19, 2023 Malware and Vulnerabilities

The vulnerabilities, CVE-2023-35384 and CVE-2023-36710, allow an attacker to bypass security measures and execute code on a victim's machine by tricking Outlook into downloading a specially crafted sound file.

Alleged LockBit Operator to Face New Cybercrime Charges in Canada

cyware Dec 19, 2023 Incident Response, Learnings

A Canadian-Russian man, Mikhail Vasiliev, who is facing extradition to the United States for his alleged involvement in the LockBit ransomware group, is now facing new cybercrime charges in Ontario.

Update: October Cyberattack Leaked Data of 14.7 Million People, Mortgage Giant Mr. Cooper Says

cyware Dec 19, 2023 Breaches and Incidents

The accessed data included sensitive details such as names, addresses, phone numbers, Social Security numbers, and bank account numbers of individuals associated with mortgage loans serviced by Mr. Cooper.

CISA Urges Manufacturers to Eliminate Default Passwords to Thwart Cyber Threats

cyware Dec 19, 2023 Security Tips and Advice

Manufacturers are advised to follow Secure by Design principles, provide unique setup passwords or disable them after a preset time period, and implement phishing-resistant multi-factor authentication methods to mitigate these risks.

Iran Hit by Major Cyberattack Targeting Nation's Fuel Supply

cyware Dec 19, 2023 Breaches and Incidents

Gas stations in Iran experienced widespread disruptions due to a cyberattack claimed by the group Predatory Sparrow, which has previously targeted Iranian critical infrastructure.

Apparel Giant VF Corporation Reports Cyberattack on First Day of SEC Disclosure Rule

cyware Dec 19, 2023 Breaches and Incidents

VF Corporation, one of the largest apparel companies in the world, reported a cyberattack to the U.S. Securities and Exchange Commission (SEC) on the first day of a new cyber incident reporting rule.

What the SEC Weighed in Finalizing the Cyber Disclosure Rules

cyware Dec 19, 2023 Laws, Policy, Regulations

The SEC does not aim to manage security but wants better disclosures. The final rule requires the disclosure of material cybersecurity incidents, but does not require specific technical details to avoid providing a roadmap for future attacks.

Insights from the CISA Healthcare and Public Health Sector Risk and Vulnerability Assessment

cyware Dec 19, 2023 Threat Intel & Info Sharing

The external assessment did not identify any significant vulnerabilities that would allow easy access to the organization's network, but the internal assessment revealed multiple weaknesses that led to domain compromise.

US Regulators Warn of AI Risk to Financial Systems

cyware Dec 19, 2023 Trends, Reports, Analysis

The Financial Stability Oversight Council has classified artificial intelligence as an "emerging vulnerability" in the financial system, acknowledging both its potential for innovation and the risks it poses.

FBI, CISA, and ACSC Release Joint Advisory on Play Ransomware

cyware Dec 19, 2023 Threat Intel & Info Sharing

The Play ransomware group has been targeting businesses and critical infrastructure in North America, South America, and Europe since June 2022. They use a double-extortion model, encrypting systems after exfiltrating data.

Ransomware Attack on Westpole Disrupted Digital Services for Italian Public Administration

cyware Dec 19, 2023 Breaches and Incidents

One of Westpole's customers, PA Digitale, which serves 1300 public administrations including 540 municipalities, was targeted. The incident has led to manual operations for some services and may affect salary payments.

Xfinity Discloses Massive Data Breach Affecting Over 35 Million People

cyware Dec 19, 2023 Breaches and Incidents

The breach occurred after attackers exploited a critical vulnerability, known as Citrix Bleed, that had been actively exploited as a zero-day since August 2023. The company has asked users to reset their passwords.

Novel SMTP Smuggling Technique Slips Past DMARC, Email Protections

cyware Dec 19, 2023 Malware and Vulnerabilities

Attackers can exploit SMTP smuggling to send spoofed emails with fake sender addresses, bypassing email security checks and putting organizations and individuals at risk for targeted phishing attacks.

US Agencies Release Security Guidance on Managing SBOMs and Open Source Software

cyware Dec 19, 2023 Security Tips and Advice

The report provides guidance on open source software adoption, including criteria for selection, risk assessment, licensing, export control, maintenance, vulnerability response, and secure software delivery.

Microsoft Discovers Critical RCE Flaw in Perforce Helix Core Server

cyware Dec 19, 2023 Malware and Vulnerabilities

Four vulnerabilities, including a critical one, have been discovered in the widely used Perforce Helix Core Server, posing a significant risk to organizations in the gaming, government, military, and technology sectors.

New Scam Involving Remote Jobs on Social Media Platforms

cyware Dec 19, 2023 Identity Theft, Fraud, Scams

Researchers at Bitdefender Labs have uncovered a new scam involving remote jobs on social media platforms. Scammers are promising payment for simply liking YouTube videos.

Xfinity Customer Data Compromised In Attack Exploiting CitrixBleed Vulnerability

packetstormsecurity Dec 19, 2023 headline,hacker,privacy,data loss,flaw

Mr. Cooper Breach Affects 14.6 Million Customers

packetstormsecurity Dec 19, 2023 headline,hacker,privacy,data loss

New QakBot Phishing Campaign Appears After FBI Takedown

packetstormsecurity Dec 19, 2023 headline,hacker,government,usa,phish,fbi

Hacktivists Shut Down Iran's Gas Pumps

packetstormsecurity Dec 19, 2023 headline,hacker,government,iran

Brazil's First Lady To Sue Musk's X Over Hacked Account

packetstormsecurity Dec 19, 2023 headline,hacker,privacy,data loss,passwo

Atlassian Confluence Improper Authorization / Code Execution

packetstormsecurity Dec 19, 2023 Feed

This improper authorization vulnerability allows an unauthenticated attacker to reset Confluence and create a Confluence instance administrator account. Using this account, an attacker can then perform all administrative actions that are available to the Confluence instance administrator. This Metasploit module uses show more ...

the administrator account to install a malicious .jsp servlet plugin which the user can trigger to gain code execution on the target in the context of the of the user running the confluence server.

I2P 2.4.0

packetstormsecurity Dec 19, 2023 Feed

I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties. This is the source code release version.

Debian Security Advisory 5580-1

packetstormsecurity Dec 19, 2023 Feed

Debian Linux Security Advisory 5580-1 - The Zoom Offensive Security Team discovered that processing a SVG image may lead to a denial-of-service.

Red Hat Security Advisory 2023-7878-03

packetstormsecurity Dec 19, 2023 Feed

Red Hat Security Advisory 2023-7878-03 - An update for the postgresql:10 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Issues addressed include an integer overflow vulnerability.

Massive Cyberattacks Hit Washington County with 60,000 System Intrusions

cyberexpress Dec 19, 2023 Data Breach News

Washington County is on the frontlines of a massive cyberattack that began last Friday. This Washington County cyberattack has hit the computer systems with over 60000 attempts till Sunday. Tad Sours, the communications director, has compiled a record highlighting the alarming scale of this ongoing threat. On Friday, show more ...

the assailants launched over 14,000 waves of attack, which increased to 17,000 on Saturday. Then on Sunday, they unleashed an overwhelming 33,000 attempts. The bot is still up and running, and this fact confirmed the concerns of county officials when they said it’s no ordinary cyberattack going on. Tad Sours stated that they were trying to break into the county’s servers. “They’re trying to log in to random emails to see if they can break through our security,” said Sours. “They’re trying to get into our system to send things out using a ‘.gov’ email address so that more people would fall for a scam.” Washington County Cyberattack Explained Tad Sours assured that the defenders of their servers had successfully fended off attempts to break in. The assault was mainly directed at public servers, such as the Thai national email system and GIS mapping information. County Assessor Bobby Hill, assured residents that although a few inquiries into county property records had been refused earlier owing to an application being filled out incorrectly, there had not otherwise been any interruption of access to such information. County officials, including Tad Sours, say the cyberattack can be termed a “dictionary attack”. This method is implemented by using every word in a dictionary, one at a time, as the password for entry to files or folders with sensitive information. The technique is based on computer users’ habit of choosing passwords that are easy for perpetrators to guess, which usually comprise common words. The public information officer for the Washington County Sheriff’s Office, Kelly Cantrell stated that the servers used by submitters generally failed while those of the sheriff remained pretty much intact with only email services being affected, reported Northwest Arkansas Democrat Gazette. This Washington County cyberattack triggered shutdowns to avert a data leak disaster, cutting phone lines and disrupting internet connection. It’s also taken down certain pages on the county’s website many times. “They attack thousands of municipalities, businesses, and government agencies all the time, looking for [something] they haven’t found here,” said Sours, reported 5o News. The Washington County cyberattack highlights substantial vulnerabilities and highlights how cyber threats are always changing for local governments. The deliberate assaults on public servers, which encompassed the national email system of Thailand and GIS mapping data, underscore the possibility of jeopardizing crucial public utilities and confidential government information. This Washington County cyberattack highlights the necessity for ongoing awareness and adaptive cybersecurity measures to resist emerging methods by demonstrating the persistent and strategic nature of modern cyber threats. The attempt to send fraudulent messages using a ‘.gov’ email address and the attackers’ goal to scan random emails for potential frauds highlight the dangers associated with social engineering assaults. Apart from the short-term disturbances, these strategies have the potential to weaken confidence in government channels of communication, resulting in false information, monetary losses, and reputational harm. The Washington County cyberattack also demonstrates the importance of digital defenses to guarantee the integrity of sensitive data, local governments must invest in advanced threat detection, incident response capabilities, and thorough employee training as their reliance on digital infrastructure grows. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The North Face, Vans Owner VF Corporation Strives Hard to Reclaim Control Post Cyberattack

cyberexpress Dec 19, 2023 Data Breach News

VF Corporation, the esteemed apparel brand owner behind Vans, Supreme, and The North Face, faces a major setback following a cyberattack. This breach has severely impacted the company’s ability to meet Christmas orders, a crucial event in the retail calendar. In a regulatory statement released on Monday, the show more ...

company stated that it had “detected unauthorized occurrences” on its IT systems and stated that the VF Corporation cyberattack interfered with “business operations by encrypting some IT systems and stole data from the company, including personal data.” The websites for the company’s different subsidiary brands remain operational, facilitating customer purchases. Additionally, some of its IT systems are functional both in retail outlets and online. However, according to VF Corporation’s regulatory filing, it’s still “experiencing certain operational disruptions,” such as difficulties filling orders. VF Corporation Cyberattack Explained In a filing with federal regulators, the company stated that it was the victim of the VF Corporation cyberattack that began on December 13 and involved hackers who disrupted business operations “by encrypting some IT systems and stole data from the company, including personal data,” which appears to be a ransomware attack. The company further stated that its retail locations across the world are open and that customers can buy the products online. The firm did not specify when orders are expected to ship. The details surrounding the VF Corporation cyberattack remain shrouded in mystery. The company has not revealed the method of the breach, the specific personal information accessed, or the scale of those affected. Moreover, no ransomware group has come forward to claim responsibility, leaving the perpetrators behind this attack still unidentified. In the regulatory filing, the VF Corporation issued a cautionary statement, highlighting the substantial effect of the cyberattack on its operations until system restoration. The document notes that “the full scope, nature, and impact of the incident are not yet known as the investigation into the incident is ongoing. The incident was made public by VF Corporation on the same day that the new data breach disclosure guidelines from the US Securities and Exchange Commission went into effect. According to this rule, companies have four business days to notify the federal government’s securities regulator of any cybersecurity issue, including data breaches. About VF Corporation VF Corporation (VFC) is a multinational apparel, footwear and accessories firm. Founded in 1899 by John Barbey, the company is located in Denver, Colorado. VF Corporation’s 13 brands are organized into three categories: Outdoor, Active, and Work. Some of their brands include: Vans, The North Face, Timberland, Dickies and JanSport. VF Corporation is one of the world’s biggest makers of apparel, footwear and accessories. In 2023, the company was included in the Fortune 500 list. What Does the Cyberattack on VF Corporation Mean? The cyberattack on VF Corporation can have serious repercussions in all aspects of its business operations. Its data breach could expose sensitive customer and employee data which will create grave privacy concerns as well as negatively affect stakeholders’ trust in the company. The repercussions in terms of money could be huge, adding to costs for investigations and clean-up work as well as recovery claims. Downtime and financial losses may result in hampering productivity and supply chain management of the VF Corporation. Given that VF Corporation does in all likelihood possess valuable designs, patents, and proprietary information, the theft of intellectual property is another serious threat. In addition, the VF Corporation cyberattack affects the company’s image in the public eye. Customers may lose confidence that their shopping experience is safe with this company nor that their private data and transactions will be securely handled by it. Regulatory consequences, such as fines or legal action for violation of data protection laws are another thing to worry about. Cybersecurity awareness training is now part of a typical employee training program to reduce the vulnerability of being exposed to employees’ faults. High levels of investment in cybersecurity technologies and constant upgrading are necessary to maintain the ability of organizations to resist evolving threats. Working with experts in cybersecurity helps to make sure that the company is secure from developing threats and employs industry-standard methods for defense, further strengthening its posture. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

CISA’s 2024 Cybersecurity Strategy: TIES Binds Nation Together in Collective Defense

cyberexpress Dec 19, 2023 Firewall Daily

CISA or the Cybersecurity and Infrastructure Security Agency has released its new cybersecurity information sharing strategy for 2024 to strengthen the nation’s cyber defenses in the coming year. CISA has brought this new strategy to deliver timely and useful cybersecurity information at a time when threats are show more ...

emerging faster than ever. Now the agency is planning a strategic effort at enterprise-level sharing of threat response plans and procedures. From Siloed Secrets to Seamless Sharing: Cybersecurity Strategy Evolves Around a decade ago, CISA introduced the Automated Indicator Sharing (AIS) program. This was a sign that it would be important for all parties concerned about their own IT security or information integrity operations to share machine-readable cyber threat information widely and automatically without exception. Since change is the only constant in cybersecurity, CISA understands that its information-sharing approaches must similarly adjust to conform with rapidly changing threat conditions. In CISA‘s daily assessment of the threat landscape, one must consider not only vulnerabilities that are known to exist but also assess how ready each entity throughout the nation is on a defensive footing. This insight comes from several sources, including open-source reporting through classified channels; Government and industry operations with which CISA works jointly on missions; the lessons that we learn during assessments or incident responses within our organization itself; and information shared by members of the cybersecurity community via organizations like AIS. AIS: A novel model When AIS first came on the scene, it filled an important vacuum in cyber threat intelligence for many organizations. It was speed that mattered, to meet the needs of immediate time. In an era where the cybersecurity industry has matured significantly, ten years later it is no longer about swiftness but rather context, detail and customized insights. “As we stand on the brink of 2024, it’s time for a change,” stated CISA. But the agency agrees that current offerings are already meeting information needs of most organizations. The Road Ahead: TIES Unleashed In 2024, CISA plans to begin a new strategic initiative aimed at modernization of the way that enterprise cyber threat information is shared. Perhaps the linchpin of this effort is TIES (Threat Intelligence Enterprise Services), an ambitious initiative that envisions making sharing cyber threat information significantly easier. CISA plans to shift and coordinate its customer-facing cyber threat intelligence offerings under TIES. TIES Exchange Platform will be the hub, drawing together under a single unifying name user communities who need to share information with other sister agencies or specific users of their networks. This move is designed to simplify the transmission of cyber threat information from partners and commercial sources, so there’s uniformity. It gives everyone a single picture in order for them to talk the same language with each other while also engaging based on the level of whatever particular threat exists at that time. As CISA incorporates these transformative changes, it remains dedicated to the partner-centered design model. Driven by the needs of its Partners, which include federal agencies, critical infrastructure organizations, and state, and local. tribal territorial governments The aim is to make sure that CISA does not just repeat existing capabilities. CISA will solicit ecumenical feedback as it builds out the platform according to human-centered design principles so that even under-resourced organizations can easily use the tools. Learning from Experience: Following Successes and Challenges CISA recognizes the lessons it has learned from watching the former AIS system. The new system has to be convenient for sharing information and receiving it. It also must provide enough context so we can focus on what needs doing first. Those that improve the current level of cybersecurity capabilities in some meaningful way are accepted. Based on the proven successes of its AIS program, the agency intends to strengthen privacy and confidentiality by design. Looking Ahead: Collective Cyber Defense The overarching goal in this transformative initiative, with which CISA works to increase transparency and improve collective, automated cyber defense. During this period of transition, the AIS program will continue to be open. CISA welcomes users to continue making use of this capability and requests them to be active in sharing indicators with the agency. The philosophy behind this initiative is clear: Shared visibility into the threats to our networks is one of our most effective weapons. Shared information The danger shifts back to defenders when organizations can share actionable knowledge in a network of collaborators. To establish lasting change, the actionable information needs to be turned into strategic investments in seeing through structural changes such as these most critical mitigations. At this time of year, CISA encourages all organizations to make a resolution committing themselves to cybersharing. Whether it’s incident information, indicators of compromise (IOC), or useful feedback–all are a joint effort that contributes to strengthening the nation’s defenses in cyberspace. Keep your ears open about TIES and other modernization efforts for cyber threat exchange going on at CISA as 2024 begins to unfurl. The agency hopes that a day when collective cyber defense is not merely an objective but the norm will arrive. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Mr. Cooper Group in Crisis: Cyberattack Exposes Data of Over 14 Million Customers

cyberexpress Dec 19, 2023 Data Breach News

Formerly known as Nationstar Mortgages, Mr. Cooper Group, a prominent player in the nation’s mortgage and loan sector, is grappling with the aftermath of a significant cyberattack. On October 31, 2023, Mr. Cooper Group fell prey to a cyberattack that compromised the personal information of a staggering 14 show more ...

million individuals, as detailed in a filing with the Securities and Exchange Commission. A separate filing with the Maine attorney general’s office reveals that the cyberattack on Mr. Cooper has rendered both current and former customers vulnerable, impacting the entire spectrum of Mr. Cooper’s customer base. According to the company’s statement submitted to the Maine attorney general’s office, malicious actors managed to infiltrate Mr. Cooper’s systems undetected for several days, spanning from October 30, 2023, to November 1, 2023. The company’s subsequent investigation brought to light that unauthorized access resulted in the acquisition of files containing sensitive details, including names, addresses, phone numbers, Social Security numbers, dates of birth, and bank account numbers. Mr. Cooper Cyberattack: Swift and Proactive Company Response In the wake of the cyberattack, Mr. Cooper Group invoked a well-orchestrated response plan. The company engaged cybersecurity experts and collaborated with law enforcement agencies to comprehensively investigate the incident. A crucial decision was made to shut down systems, not only to mitigate the ongoing threat but also to protect the vast troves of customer information. Understanding the magnitude of the cyberattack, Mr. Cooper Group has undertaken proactive measures to mitigate the potential fallout. The company has committed to providing two years of free credit monitoring and identity protection services to those affected. This step is aimed at not only alleviating the immediate concerns of the impacted individuals but also at fortifying the long-term security of their personal information. Jay Bray’s Sympathetic Address Concerning Mr. Cooper Cyberattack In a heartfelt statement, Jay Bray, the Chairman and CEO of Mr. Cooper Group, expressed deep regret for the anxiety and frustration the incident may have caused customers. He emphasized the company’s unwavering commitment to the smooth homeownership journey of its clients and pledged to make amends to regain their trust. “We take our role as a mortgage company very seriously, and there is nothing more important to us than maintaining our customers’ trust. I want you to know how sorry I am for any concern or frustration this may have caused. Making the homeownership journey as smooth as possible is our top priority, and we intend to make this right for our customers,” said Jay Bray, Chairman and CEO, Mr. Cooper Group in a press statement. Holistic Customer Support Approach To further assist affected individuals, Mr. Cooper Group has established a dedicated call center, supported by TransUnion, and is offering free identity protection services through Cyberscout and Identity Force. Notification letters containing detailed enrollment instructions for these services will be dispatched to affected customers. Customers seeking more information or assistance related to Mr. Cooper cyberattack can contact the dedicated call center at 1-833-960-4745 (toll-free), Monday through Friday, 8:00 am to 8:00 pm ET. Additionally, a wealth of updates and resources are available on the Mr. Cooper Incident website. As the firm diligently continues its investigation into the Mr. Cooper Cyberattack, this incident serves as a reminder of the escalating threats posed by cyberattacks, underlining the critical need for robust cybersecurity measures to safeguard the sensitive data entrusted by customers. The aftermath of Mr. Cooper cyberattack will undoubtedly reshape the landscape of cybersecurity discussions within the financial and mortgage industry. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Xfinity Data Breach Confirmed, Company Issues Security Patches

cyberexpress Dec 19, 2023 Firewall Daily

Xfinity is reaching out to its customers to inform them about a data security incident that unfolded in October 2023. The Citrix vulnerability notice, initiated today, shares details into the incident and the type of data compromised. The Xfinity data security incident originated with a vulnerability in software show more ...

utilized by Xfinity, among numerous other global companies. Citrix, a prominent cloud computing and virtualization technology provider, identified the vulnerability on October 10, 2023, and promptly released a security patch. Additional mitigation guidance followed on October 23, 2023. Acting swiftly, Xfinity applied the necessary security patch and mitigated the Citrix vulnerability within its systems. Understanding Xfinity Data Security Incident and Citrix Vulnerability Despite these proactive measures, a routine cybersecurity exercise on October 25 revealed suspicious activity within Xfinity’s internal systems. Subsequent investigation determined that between October 16 and October 19, 2023, unauthorized access occurred as a consequence of the Citrix vulnerability. Xfinity, promptly notified federal law enforcement and initiated an investigation to understand the nature and scope of the incident. On November 16, 2023, it was confirmed that some information had been likely acquired. A thorough review conducted on December 6, 2023, revealed that the compromised customer information included usernames and hashed passwords. For certain customers, additional details such as names, contact information, last four digits of social security numbers, dates of birth, and/or secret questions and answers may have been included. Mitigation over Xfinity Data Security Incident and Citrix vulnerability To safeguard affected accounts, Xfinity has enforced password resets for its customers. Additionally, the company strongly recommends the adoption of two-factor or multi-factor authentication to enhance the security of Xfinity accounts. Acknowledging the potential risk of password reuse across multiple accounts, Xfinity advises customers to change passwords for any other accounts utilizing the same login credentials or security questions. Customers seeking clarification or assistance can contact Xfinity’s dedicated call center at 888-799-2560, which operates 24 hours a day, seven days a week. Further details are available on the Xfinity website at www.xfinity.com/dataincident. Xfinity reassures its customers of its commitment to data protection and security. Despite this incident, the company remains dedicated to ongoing investments in technology, protocols, and expertise to safeguard its customers from potential cybersecurity threats. Xfinity understands the trust customers place in the company to protect their information and emphasizes its serious commitment to maintaining a secure and resilient data environment. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Futureproofing Cybersecurity: Kapil Jaiswal’s Perspective on Securing India’s Premier Institutions

cyberexpress Dec 19, 2023 Cybersecurity News

AI is poised to be a game-changer, not just for hackers but also as a shield against cyber threats. As we approach 2024, understanding and tackling these challenges becomes essential. This is where insights from industry leaders and experts become invaluable. In a recent interview by The Cyber Express at The World show more ...

CyberCon in Mumbai, Kapil Jaiswal, a prominent figure in cybersecurity as the CISO & Director of Research (InfoSec & AI/ML) at the Government of India, offered illuminating insights. A former Army officer, Kapil adeptly articulated both the proactive measures adopted and the daunting challenges faced by these entities in safeguarding their online infrastructure. His expertise not only sheds an understanding of the dynamic cybersecurity space but also emphasizes the strategic efforts imperative for shielding critical national assets against the constantly evolving domain of cyber threats. Addressing Targeted Attacks on National Institutes Jaiswal emphasized the heightened vulnerability of prestigious national institutions, such as space agencies, which often become prime targets for cyber assaults. He acknowledged the prevalence of attacks on premier institutes, citing the increased geopolitical complexities influencing such malicious activities. These organizations, conscious of the looming threats, have established dedicated teams and implemented effective measures to fortify their online defenses. “ISRO and other premier Institutes have become the target of this, this kind of attacks. Now, these organizations are privy to that, they are conscious about this and there are effective measures have been taken. They are dedicated teams, which protect their online infrastructure,” he told The Cyber Express, adding that, there’s a conscious effort to keep all critical infrastructure isolated from the internet. He highlighted two primary strategies adopted by these institutes. The first involves a meticulous approach to restrict sensitive information solely to internal networks or systems not directly exposed to the internet. By limiting the presence of critical data on internet-facing devices or services, these entities aim to reduce susceptibility to cyber threats inherently. The second strategy involves isolating crucial infrastructure from the internet, ensuring an additional layer of protection. By deliberately keeping certain systems disconnected from online access, organizations mitigate the risks associated with potential cyber intrusions. Insights on Cybersecurity Readiness Across Sectors During the interview, Jaiswal offered insights into India’s overall cybersecurity readiness across sectors, notably discussing the healthcare sector’s vulnerability to increasing targeting by hacker collectives. “We had an attack on All India Institute of Medical Sciences. That was an eye-opener for most of us. It is one of the institutes with national repute and serves the public; you can’t isolate it too much.” Elaborating on the evolving approach post-attacks, he added, “With that thing coming in, a lot of efforts are going in to protect these institutes in other ways. The earlier emphasis was to protect critical information and structures, with only a few things classified. Now, you have to realize there is a second envelope that has to be created.” He stressed the significance of adapting to evolving technologies, especially in sensitive domains like healthcare and defense. Anticipating Future Threats and Trends Looking ahead to 2024, Jaiswal urged vigilance against emerging hacker groups and evolving cyber threats. He emphasized the importance of staying abreast of upcoming trends in cybersecurity, cautioning organizations to remain vigilant against potential hacker groups targeting critical infrastructure. “I will say it is not what the hacker group has said but I will say the trend is towards the utilization of artificial intelligence and machine learning both from the offensive and defensive perspective. The defensive aspect is much more difficult and that is where the dedicated effort is required to be placed. That is where we are. Kapil Jaiswal’s expertise and observations highlight the criticality of proactive cybersecurity measures for safeguarding national institutes against the evolving landscape of cyber threats.