Oktacron - Cyber Security RSS Feeds History

NoName Targets Multiple Websites in Lithuania, Blames it for Aiding Ukraine

cyberexpress Jan 15, 2024 Firewall Daily

Several prominent organizations in Lithuania, including Compensa Vienna Insurance Group, If Insurance, Lithuanian Roads Association, AD REM, INIT, and Balticum, have allegedly fallen victim to the NoName attack. The threat actors, identified as the NoName ransomware group, have been actively sharing posts detailing show more ...

the impact of the cyberattack on Lithuania websites. The threat actors have posted messages indicating the severity of the cyberattack on Lithuania websites. Some of these posts highlight the inaccessibility of websites, such as if.lt/privatiems and compensa.lt, with error messages suggesting issues related to internet connectivity and server response times. The Cyber Express has reached out to the affected organizations for official statements, but as of now, no responses have been received. NoName Ransomware’s Cyberattack on Lithuania Websites Source: Twitter In a disturbing twist, the threat actor responsible for the cyberattack on Lithuania’s websites posted claims of sending “DDoS missiles to sites” and condemned Lithuanian Ambassador Valdemaras Sarapinas for supporting Ukraine in the ongoing Russia-Ukraine conflict. The threat actor post highlights the geopolitical motives behind the attack, linking it to Lithuania’s strong support for Ukraine, as reported by the Lithuanian Ambassador. Source: Twitter Several of the targeted companies displayed a “took too long to respond” message, which could potentially be a result of a Distributed Denial of Service (DDoS) attack. DDoS attacks overwhelm websites with excessive traffic, causing servers to struggle to handle requests. This overload leads to delays in processing legitimate user requests, resulting in slow response times or server timeouts. When a website experiences a DDoS attack, users may encounter error messages like “took too long to respond” or “connection timed out.” This can disrupt the normal functioning of the affected websites and create challenges for users trying to access services. DDoS attacks can have severe consequences, impacting the availability and reliability of online platforms. DDoS Attack on Lithuania; Russia-Ukraine Conflict Continues Lithuania has been a strong supporter of Ukraine in the conflict, ranking first in terms of the volume of support relative to its economy. The Lithuanian Ambassador Valdemaras Sarapinas, in his column for European Pravda, emphasized that according to the German Kiel Institute of World Economics, Lithuania provided support to Ukraine equivalent to 1.8% of its GDP. In February 2022, Russian troops, led by Putin’s build-up along the Ukraine border, launched an attack on Ukraine, firing missiles at military and civilian targets. Following which a war ensued, which forced over 2 million people to become refugees, fleeing the conflict. Despite global appeals for peace, the war has persisted. The United States, the United Kingdom, and other nations provided military aid to Ukraine and imposed economic sanctions on Russia, attempting to halt the conflict. However, the fighting continued unabated, causing human suffering and geopolitical tension. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Anonymous Collective Launches Cyberattack on Bahrain Over Yemen Airstrikes

cyberexpress Jan 15, 2024 Firewall Daily

The Anonymous Collective has orchestrated an alleged cyberattack on Bahrain, pointing to the country’s support for the US and UK strikes on Yemen. According to the hacker collective, the distributed denial-of-service (DDoS) attack has affected several websites, including prominent media outlets like Akhbar show more ...

al-Khaleej, Al-Ayam, Gulf Daily News, and Al-Bilad. As of now, some news websites appear to be operational, showing no immediate signs of the Anonymous Collective cyberattack. However, a few sites are experiencing issues, displaying a “403 Forbidden” error code on their front-end pages. Decoding the Cyberattack on Bahrain; Several News Outlets Down Source: Twitter The Anonymous Collective, in a statement on its dark web channel, declared, “! In retaliation to the Bahrain attacks and bombing operation in Yemen, we have conducted a massive cyberattack on the main media outlets of the country. We will not back down. Bahrain will pay for their actions!” The listed organizations, known for their involvement in the media and news sector, have yet to issue an official statement or response regarding this cyberattack on Bahrain and the involvement of Anonymous Collective hacker group, leaving the claims unverified. The Cyber Express has reached out to some of the available organizations to learn more about this cyberattack but due to communication errors only a limited number of organizations were available. This incident echoes a previous event where Lulzsec hacktivists leaked American bank logins in protest against Yemen airstrikes. The hacktivist group released purported logins for American banks in response to the ongoing airstrikes in Yemen by the US, UK, and their allies. Speculation arose about the origin of these logins, suggesting they might have been obtained from earlier data breaches. Hacktivist Groups United in Retaliation of Yemen Airstrikes Source: Twitter In a similar vein, hacktivist groups are emerging to express their opposition amidst the airstrikes in Yemen. Lulzsec, the first to declare their intent, hinted at cyber reprisals following physical responses by Iran proxy groups in the Middle East. The situation in Yemen continues to escalate, with explosions rocking cities like Sanaa, Hodeidah, Saada, and Dhamar in response to the US and UK airstrikes against Houthi targets. Reports indicate the presence of British and American warplanes in Yemeni airspace. Hezbollah, an Iran-backed Lebanese group, voiced concerns about the security of maritime navigation in the Red Sea, now considered a conflict zone due to U.S. and British actions. The group, part of an Iran-aligned regional alliance, including the Houthis, vowed to continue targeting ships belonging to Israel or heading to its ports. Hezbollah leader Sayyed Hassan Nasrallah emphasized the disruption of maritime security, stating, “The more dangerous thing is what the Americans did in the Red Sea will harm the security of all maritime navigation, even the ships that are not going to Palestine, even the ships which are not Israeli, even the ships that have nothing to do with the matter because the sea has become a theatre of fighting, missiles, drones, and warships”, reported Reuters. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Tura Scandinavia AB Encounters Another Cyberattack Following intrusion in December

cyberexpress Jan 15, 2024 Firewall Daily

Tura Scandinavia AB allegedly finds itself targeted by the LockBit ransomware group, marking another episode in the company’s history of cybersecurity challenges. This cyberattack on Tura Scandinavia AB, accompanied by a now-closed deadline date, was posted on the dark web where the threat actor, the LockBit show more ...

ransomware group, posted its claims of the intrusion. The LockBit ransomware group has escalated the situation by adding Tura Scandinavia AB to its dark web portal, claiming to sell access to the corporate network. The cybercriminals boast possession of all login credentials and passwords to both internal and external services. Notably, the website is currently non-functional, and the ransom deadline timer has been temporarily halted. The Tura Scandinavia AB Cyberattack; LockBit takes Responsibility Source: Twitter According to the threat actor’s post, the alleged cyberattack on Tura Scandinavia AB succeeded because several vulnerabilities in Tura Scandinavia’s corporate network facilitated unauthorized access. Shockingly, LockBit claimed that the internal servers lacked fundamental security measures such as monitoring systems, antivirus software, and firewalls. The ransomware group alleges that Tura Scandinavia’s refusal to address these issues and reluctance to meet their demands have led to the sale of access to the compromised corporate network eventually causing the Tura Scandinavia AB cyberattack. The Cyber Express sought clarification on the situation by reaching out to Tura Scandinavia AB. As of now, no official statement or response has been received, leaving the claims surrounding the cyberattack on Tura Scandinavia AB unverified. Speculation arises regarding a potential ransom deal, suggested by the paused ransom timer, yet the lack of an official update from the organization leaves the situation ambiguous. The Last Year’s Cybersecurity Incident; Threat Actor Unknown Source: Tura Scandinavia AB This incident is not the first time Tura Scandinavia AB has encountered a cyberattack. In an official notice from the previous year, the company addressed a “cybercrime” affecting its IT systems and operations. The notice emphasized the ongoing efforts to restore normal operations, minimize data loss, and assess the financial impact of the attack. Notably, law enforcement was notified, reflecting the seriousness of the situation. Apart from the previous incident, The Cyber Express is closely monitoring the situation of the current one, awaiting updates on the Tura Scandinavia AB cyberattack and any potential data leak. Given the organization’s history, questions linger about the similarity between the current incident and the previous year’s attack. We’ll update this post once we have more information on the hacker claims and any new developments surrounding the Tura Scandinavia AB data breach. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Cloud SSO implementations, and how to reduce attack risks

kaspersky Jan 15, 2024 Business

Credentials leaks are still among attackers most-used penetration techniques. In 2023 Kaspersky Digital Footprint Intelligence experts found on the darknet more than 3100 ads offering access to corporate resources – some of them owned by Fortune 500 companies. To more effectively manage associated risks, minimize show more ...

the number of vulnerable accounts, and detect and block unauthorized access attempts quicker, companies are adopting identity management systems, which we covered in detail previously. However, an effective identity management process isnt feasible until most corporate systems support unified authentication. Internal systems usually depend on a centralized catalog – such as Active Directory – for unified authentication, whereas external SaaS systems talk to the corporate identity catalog via a single sign-on (SSO) platform, which can be located externally or hosted in the companys infrastructure (such as ADFS). For employees, it makes the log-in process as user-friendly as it gets. To sign in to an external system – such as Salesforce or Concur – the employee completes the standard authentication procedure, which includes entering a password and submitting a second authentication factor: a one-time password, USB token, or something else – depending on the companys policy. No other logins or passwords are needed. Moreover, after you sign in to one of the systems in the morning, youll be authenticated in the others by default. In theory the process is secure, as the IT and infosec teams have full centralized control over accounts, password policies, MFA methods, and logs. In real life however, the standard of security implemented by external systems that support SSO may prove not so high. SSO pitfalls When the user signs in to a software-as-a-service (SaaS) system, the system server, the users client device, and the SSO platform go through a series of handshakes as the platform validates the user and issues the SaaS and the device with authentication tokens that confirm the users permissions. The token can get a range of attributes from the platform that have a bearing on security. These may include the following: Token (and session) expiration, which requires the user to get authenticated again Reference to a specific browser or mobile device Specific IP addresses or IP range limits, which enable things like geographic restrictions Extra conditions for session expiration, such as closing the browser or signing out of the SSO platform The main challenge is that some cloud providers misinterpret or even ignore these restrictions, thus undermining the security model built by the infosec team. On top of that, some SaaS platforms have inadequate token validity controls, which leaves room for forgery. How SSO implementation flaws are exploited by malicious actors The most common scenario is some form of a token theft. This can be stealing cookies from the users computer, intercepting traffic, or capturing HAR files (traffic archives). The same token being used on a different device and from a different IP address is generally an urgent-enough signal for the SaaS platform that calls for revalidation and possibly, reauthentication. In the real world though, malicious actors often successfully use stolen tokens to sign in to the system on behalf of the legitimate user, while circumventing passwords, one-time codes, and other infosec protections. Another frequent scenario is targeted phishing that relies on fake corporate websites and, if required, a reverse proxy like evilginx2, which steals passwords, MFA codes, and tokens too. Improving SSO security Examine your SaaS vendors. The infosec team can add SSO implementation of the SaaS provider to the list of questions that vendors are required to respond to when submitting their proposals. In particular, these are questions about observing various token restrictions, validation, expiration, and revocation. Further examination steps can include application code audits, integration testing, vulnerability analysis, and pentesting. Plan compensatory measures. Theres a variety of methods to prevent token manipulation and theft. For example, the use of EDR on all computers significantly lowers the risk of being infected with malware, or redirected to a phishing site. Management of mobile devices (EMM/UEM) can sort out mobile access to corporate resources. In certain cases, we recommend barring unmanaged devices from corporate services. Configure your traffic analysis and identity management systems to look at SSO requests and responses, so that they can identify suspicious requests that originate from unusual client applications or non-typical users, in unexpected IP address zones, and so on. Tokens that have excessively long lifetimes can be addressed with traffic control as well. Insist on better SSO implementation. Many SaaS providers view SSO as a customer amenity, and a reason for offering a more expensive enterprise plan, whereas information security takes a back seat. You can partner with your procurement team to get some leverage over this, but things will change rather slowly. While talking to SaaS providers, its never a bad idea to ask about their plans for upgrading the SSO feature – such as support for the token restrictions mentioned above (geoblocking, expiration, and so on), or any plans to transition to using newer, better-standardized token exchange protocols – such as JWT or CAEP.

MLK Day: Here’s What Every CISO Can Learn from Martin Luther King Jr.

cyberexpress Jan 15, 2024 Firewall Daily

MLK Day 2024: As the world commemorates Martin Luther King Jr. Day on January 15, 2024, it’s an opportune time to reflect on the enduring impact of Dr. King’s leadership. His qualities and vision not only shaped the civil rights movement but also offered timeless insights for today’s leaders, particularly Chief show more ...

Information Security Officers (CISOs) and cybersecurity experts. In these times where cybersecurity challenges are increasingly complex, Dr. King’s principles provide a guiding light for CISOs striving to protect their organizations in a dynamic digital landscape. This day prompts us to look beyond conventional leadership paradigms and draw lessons from one of history’s most influential figures. For CISOs, it means adapting these lessons to lead with more impact and resilience in the face of emerging cyber threats. What CISOs Can Learn from Dr. King’s Leadership Lessons? In the rapidly evolving space of cybersecurity, staying informed about the latest trends and emerging threats is imperative. This pursuit of knowledge isn’t just about formal education; it extends to constantly seeking new information, approaches, and techniques. For a CISO, this means embracing innovation and reimagining traditional cybersecurity strategies, stepping beyond the comfort zone to find creative solutions to new challenges. This constant learning also involves engaging with diverse perspectives, understanding global cybersecurity trends, and anticipating future risks. It’s about creating a culture of curiosity and continuous improvement within the cybersecurity team, ensuring they are always at the forefront of combating cyber threats. Confidence is the key Self-confidence, a standout trait of Dr. King, is crucial for CISOs facing high-stakes decisions. This confidence, rooted in knowledge and ethical standards, fosters trust among team members and stakeholders. Moreover, in the field of cybersecurity, where ethical dilemmas frequently arise, adhering to a strong moral compass and ethical principles is essential. Upholding data privacy and advocating for responsible security practices mirror Dr. King’s commitment to ethical leadership and social responsibility. This MLK Day is a reminder that this ethical leadership extends to how CISOs handle data breaches, manage customer information, and ensure transparency in their operations. It’s about setting a standard for integrity and accountability in every action and decision, thereby building a reputation of trustworthiness and reliability in the digital realm. Build a Visionary Cybersecurity Strategy In his “I Have a Dream” speech, Dr. King demonstrated the power of having a compelling vision. For CISOs, creating and sharing a clear cybersecurity vision is just as crucial. This vision serves as a north star, guiding the security team and the entire organization. It’s about seeing beyond the day-to-day operations and imagining what cybersecurity can and should be. A visionary approach inspires the team, fosters a proactive security culture, and aligns cybersecurity goals with the organization’s broader objectives. By articulating this vision, CISOs can rally their teams around a common goal, ensuring everyone understands their role in the larger security strategy. It also involves communicating this vision to stakeholders, helping them see the value of investing in cybersecurity and understanding its role in the organization’s success. Drawing from Dr. King’s approach on this MLK Day to handling disappointment, CISOs can learn the importance of resilience. The path to cybersecurity excellence is fraught with challenges, including technological setbacks, evolving threats, and even organizational resistance. Embracing Dr. King’s philosophy of accepting finite disappointment but never losing infinite hope is key for CISOs. This mindset not only aids in navigating through tough times but also ensures that learning and growth are derived from every challenge faced. This resilience also means being prepared for the inevitable cyber attacks and having robust recovery plans in place. It’s about not just defending against threats but also being able to quickly and effectively respond to and recover from incidents, minimizing their impact on the organization. MLK Day: Why Do Cybersecurity Experts Need Guidance from History? Dr. King’s advice to “keep moving forward” is particularly pertinent in cybersecurity. The sector is marked by rapid changes and frequent disruptions. For CISOs, this means persisting in the face of difficulties, continually advancing their strategies, and adapting to new realities. The focus should always be on making progress, whether in big leaps or small steps, ensuring the organization’s digital assets are continuously protected and secured. This perseverance is about more than just enduring; it’s about actively seeking opportunities for growth and improvement, even in adverse conditions. It involves regularly reviewing and updating security policies, staying ahead of potential security risks, and fostering a culture where every team member is committed to the organization’s cybersecurity goals. Fostering a Culture of Courage and Innovation In his call for courage over cowardice, Dr. King outlined a principle that is vital for CISOs. Facing evolving cyber threats and complex security landscapes requires bold and innovative decision-making. CISOs must have the courage to push boundaries, challenge the status quo, and implement groundbreaking security measures. This courage not only sets the tone for the security team but also demonstrates to the entire organization the importance of being proactive and forward-thinking in cybersecurity practices. Fostering this culture of innovation and courage means encouraging the team to experiment with new ideas, embrace cutting-edge technologies, and think outside the box in developing security solutions. It’s about creating an environment where calculated risks are taken, creativity is valued, and new ideas are welcomed and nurtured. MLK Day: Honoring Dr. King’s Legacy in Cybersecurity Leadership As we honor Martin Luther King Jr. on his day, it’s crucial for CISOs to reflect on the lessons his leadership offers. By embracing continuous learning, leading with confidence and ethics, building a visionary strategy, showing resilience in adversity, persisting with perseverance, and fostering a culture of courage and innovation, CISOs can effectively navigate the complex cybersecurity landscape, drive innovative security strategies, and lead their organizations toward a more secure and innovative digital future. This Martin Luther King Jr. Day, let’s remember and apply these timeless leadership lessons in our ongoing cybersecurity endeavors, honoring Dr. King’s legacy by embodying his principles in the ever-evolving world of digital security. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

TCE Exclusive: McDonald’s Data Breach 2024, a Continuation of Cybersecurity Dilemmas

cyberexpress Jan 15, 2024 Dark Web News

In a developing story that underscores the persistent challenges of cybersecurity in the corporate world, an alleged new McDonald’s data breach was reported on Sunday, January 13, 2024. The information about this latest McDonald’s data breach surfaced on BreachForums, where a user named show more ...

‘euphoria’ claimed to have accessed a significant volume of McDonald’s internal data. According to the post, the compromised data includes sensitive fields such as OrgName, Username, Realname, LastChange, Expiration, Permission, Status, and StatusNote, indicating a potentially deep breach into the corporation’s systems. A 2024 McDonald’s Data Breach Surfaces on BreachForums BreachForums Post by Euphoria This 2024 McDonald’s data breach reportedly involves not just employee and customer names and emails, but also internal tools and bank logs, signifying a serious breach of security protocols. Distinctively, the threat actor ‘euphoria’ appears to be seeking private transactions for the data, rather than making the information public or demanding a ransom, a strategy that could signify a shift in the tactics employed by cybercriminals. This McDonald’s data breach, while still alleged, raises considerable concerns about the robustness of McDonald’s cybersecurity defenses. The Cyber Express, in covering this latest McDonald’s data breach, has reached out to McDonald’s Corporation for an official comment but is yet to receive a response. Turning back to the 2022 McDonald’s data breach, another alleged cybersecurity incident was reported by The Cyber Express. Previous McDonald’s Cyberattacks and Data Breaches A data dump from an alleged cyber attack on McDonald’s in 2022 concluded with the last bit of information being released on the dark web in mid-June 2023. According to threat researchers, a post by Snatch ransomware was believed to be the ultimate data dump stemming from the alleged 2022 cyber attack on the fast-food chain. A breach that involved the theft of approximately 500 gigabytes of data from McDonald’s. The alleged 2022 McDonald’s data breach was notable not just for the volume of data stolen but also for the sophistication of the attack, highlighting the evolving nature of cyber threats faced by global corporations. Prior to this, in 2021, another significant McDonald’s data breach had occurred. This breach affected customer data in South Korea and Taiwan, with hackers accessing personal details such as email addresses, delivery addresses, and phone numbers. Although financial information was not compromised in the 2021 McDonald’s data breach, the exposure of customer personal data was a major concern, indicating vulnerabilities in McDonald’s data protection measures. The Data Breach Saga Continues As the situation develops, the focus will likely remain on how McDonald’s responds to this alleged breach and what steps it will take to further bolster its cybersecurity infrastructure. This ongoing story will continue to unfold as more details about the McDonald’s data breach in 2024 come to light and as the corporation’s response to these allegations becomes clear. Stakeholders, customers, and the cybersecurity community will be watching closely to see how McDonald’s addresses this latest challenge and what lessons can be learned to prevent similar incidents in the future. The McDonald’s data breach incidents from 2021, 2022, data dumps of 2023, and now 2024, collectively underline the relentless nature of cyber threats and the necessity for continuous vigilance and innovation in cybersecurity practices. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Database Sale on Dark Web Puts GEICO in the Attackers Crosshairs Again

cyberexpress Jan 15, 2024 Dark Web News

A threat actor identified as ‘wangfei19860902055’ recently advertised the sale of a database related to Government Employees Insurance Company (GEICO) on a popular dark web forum. The alleged GEICO data breach incident came to light on January 14, 2024, when the threat actor posted details on the Nuovo show more ...

BreachForums. According to the information obtained, the compromised database contains 552,900 records with various personal information fields such as first name, last name, phone number, address, city, and state. The Cyber Express has attempted to contact GEICO for a statement regarding this alleged data breach. However, as of now, there has been no official response from the company, leaving the claims unconfirmed from the company’s perspective. Breaking Down the GEICO Data Breach Claims Source: Twitter The threat actor posted claims of the dark web first. The alleged GEICO data leak post reads, “GEICO Private Automobile Insurance Company of America, total 552,900 entries, de-focused, all screened open WS First-hand data, see screenshot below for formatting. Sold as a whole, not split, for data security reasons. Samples are as follows.” Moreover, this is not the first time GEICO has faced a cybersecurity incident. In August 2023, the company encountered a nationwide class action lawsuit, accusing it of compromising customer privacy through the unauthorized release of driver’s license numbers. These released numbers were later exploited by identity thieves to secure fraudulent unemployment benefits. The GEICO Data Leak Lawsuit The lawsuit, proceeding in the US District Court, alleges that GEICO’s practice of auto-populating driver’s license numbers during the online insurance quote process enabled criminals to breach the system between November 24, 2020, and March 1, 2021. This GEICO data breach resulted in the fraudulent application for unemployment benefits under victims’ names. Despite the ongoing legal battle, GEICO is now facing another potential data breach, raising concerns about the company’s cybersecurity measures. It’s important to note that while the previous incident involved the release of driver’s license numbers, there is no evidence suggesting a direct correlation between the two incidents. US District Judge Kiyo Matsumoto, who presided over the previous lawsuit, emphasized that it would be premature to dismiss GEICO’s responsibility for the plaintiffs’ injuries. The decision was based on the understanding that the data theft was part of a larger “concerted campaign by fraudsters” targeting the online quotation systems of insurance companies. As the situation unfolds, it remains unclear whether the current data breach is linked to previous incidents. This is an ongoing story, and further updates will be provided as more information becomes available or upon any official confirmation from GEICO. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Unmasking the Resurgence of Azorult Malware: Cyble Detects A New Dark Web Campaign

cyberexpress Jan 15, 2024 Dark Web News

The notorious Azorult malware has resurfaced on the dark web again, demonstrating a renewed and sophisticated approach. First identified in 2016, Azorult operates as a powerful information-stealing threat, specializing in the extraction of sensitive data such as browsing history, login credentials, and cryptocurrency show more ...

details. Cyble Research & Intelligence Labs (CRIL) recently found several PDF files leading to a final payload for Azorult. This is a trimmed-down version of the report shedding light on the Azorult campaign, including the techniques, features, infection chain, and evasive techniques employed by information stealers. What is Azorult Malware? Azorult, a malware variant originating from Russian underground forums, functions both as an information stealer and a downloader for additional threats. Its primary objective is to clandestinely harvest a diverse range of sensitive information from compromised systems, making it a persistent and formidable adversary. According to CRIL, the discovery of multiple link samples distributing Azorult has unveiled an ongoing campaign with a focus on compromising unsuspecting users. In the latest iteration of the Azorult campaign, the initial attack vector involves a zip file containing a malicious shortcut file masquerading as a PDF document. This deceptive shortcut file, laced with an obfuscated PowerShell script, triggers a chain of events leading to the deployment of the Azorult payload. The Azorult Infection Chain Source: Cyble The Azorult campaign follows a meticulous multistage infection chain, orchestrated with precision to avoid detection. The malicious shortcut file, upon execution, drops and executes a batch file through the task scheduler. Subsequent stages include downloading an additional loader from a remote server, injecting shellcode into memory, and ultimately executing the Azorult malware. Notably, all stages occur within the system’s memory, leaving no traces on the disk and effectively evading detection. PowerShell Script Analysis Source: Cyble The intricacy of the campaign becomes apparent as we analyze the PowerShell scripts involved. The malicious scripts download auxiliary loaders, dynamically identify specific fields within assemblies, and execute a loader responsible for fetching configuration data from a command-and-control server. The campaign’s complexity lies in its ability to adapt dynamically, making analysis and detection challenging. Loader Characteristics Source: Cyble The loader executable, known as “helper.exe,” undergoes several checks to ensure it operates in a legitimate environment. Language code checks and virtual environment verifications contribute to the loader’s evasion capabilities. Source: Cyble The loader extracts a unique machine identifier, communicates with C&C servers, and proceeds with malicious activities based on the received configuration. Azorult Payload Analysis Source: Cyble The ultimate payload, a 32-bit Azorult .Net executable, exhibits a range of malicious activities. These include generating cryptographic keys, performing system checks, and targeting crypto wallets, browsers, and various applications. Source: Cyble Azorult goes beyond data theft by capturing screenshots of the system, creating a comprehensive profile of the compromised system. Conclusion The resurgence of the Azorult malware in this complex campaign highlights the ongoing threat it poses to cybersecurity. With its ability to adapt, employ obfuscation techniques, and execute entirely within the system’s memory, Azorult remains a formidable adversary. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Zero Trust, AI, Capital Markets Drive Consolidation in Cloud Security

darkreading Jan 15, 2024 Feed

Companies that quickly shifted to cloud-native operations are looking for greater visibility and protection — and AI benefits — while an uncertain economic future has VCs looking toward safety.

Name That Toon: Cast Adrift

darkreading Jan 15, 2024 Feed

Feeling creative? Submit your caption and our panel of experts will reward the winner with a $25 Amazon gift card.

As Enterprise Cloud Grows, So Do Challenges

darkreading Jan 15, 2024 Feed

Parenting teaches many lessons, including that difficulties get more complicated as you grow. Here's what to look for in a partner to share the "big-kid problems" of distributed cloud.

First Step in AI/ML Security Is Finding Them

darkreading Jan 15, 2024 Feed

Security teams need to start including AI tools and machine learning models when thinking about the software supply chain: They can't protect what they don't know they have.

Vast Voter Data Leaks Cast Shadow Over Indonesia ’s 2024 Presidential Election

cyware Jan 15, 2024 Breaches and Incidents

Multiple breaches have resulted in the leak of millions of voter records, including personally identifiable information, which could be used for targeted information warfare campaigns during the election and beyond.

Data Insights on AgentTesla and OriginLogger Victims

cyware Jan 15, 2024 Malware and Vulnerabilities

AgentTesla, also known as OriginLogger, is a prevalent commodity malware that steals sensitive information from Windows systems. It is commonly distributed via email attachments and has been a persistent threat since 2014.

US CISA Must Improve Water Sector Assistance, Says Watchdog

cyware Jan 15, 2024 Govt., Critical Infrastructure

Funding shortfalls and aging IT infrastructure contribute to poor cybersecurity in the water and wastewater sector, which is operated mainly by municipal and county governments.

Hacker Spins up One Million Virtual Servers to Illegally Mine Crypto

cyware Jan 15, 2024 Breaches and Incidents

A 29-year-old man in Ukraine was arrested for using hacked accounts to create 1 million virtual servers and mine $2 million in cryptocurrency, highlighting the growing threat of cryptojacking.

Cloud Security Predictions for 2024

cyware Jan 15, 2024 Expert Blogs and Opinion

Businesses and cybersecurity professionals must prioritize understanding the intricacies of identity and access management (IAM) in a cloud-dominated era to ensure a robust security posture.

Apple Fixed a Bug in Magic Keyboard That Allows to Monitor Bluetooth Traffic

cyware Jan 15, 2024 Malware and Vulnerabilities

Apple has released a firmware update for its Magic Keyboard to address a recently discovered vulnerability that allows an attacker with physical access to the keyboard to extract its Bluetooth pairing key and spy on Bluetooth traffic.

Critical RCE Vulnerability Uncovered in Juniper SRX Firewalls and EX Switches

cyware Jan 15, 2024 Malware and Vulnerabilities

The vulnerability, rated 9.8 on the CVSS scoring system, could allow an unauthenticated attacker to cause a Denial-of-Service (DoS) or execute remote code with root privileges.

Microsoft to Keep All European Cloud Customers’ Personal Data Within EU

cyware Jan 15, 2024 Security Products & Services

Microsoft has announced that it will store all customer data in the European Union (EU) rather than transferring it abroad. This move is aimed at complying with varying privacy regulations across jurisdictions.

Human Error and Insiders Expose Millions in UK Law Firm Data Breaches

cyware Jan 15, 2024 Trends, Reports, Analysis

Insider actions and human error account for the majority of data breaches in UK law firms, emphasizing the need for robust cybersecurity measures to protect sensitive information.

China Warns of Apple AirDrop De-Anonymization Flaw

cyware Jan 15, 2024 Malware and Vulnerabilities

The Beijing Wangshendongjian Judicial Appraisal Institute Institute's claim that AirDrop's anonymization techniques can be easily circumvented raises concerns about the vulnerability of user identities and the potential for surveillance.

Amazon Appeals Privacy Fine of $817 Million

cyware Jan 15, 2024 Incident Response, Learnings

Amazon is challenging a significant privacy fine imposed by the Luxembourg data protection authority, accusing them of attacking the company based on unfounded allegations.

Australian Travel Agency Data Leak Puts Thousands of Tourists at Risk

cyware Jan 15, 2024 Breaches and Incidents

The exposed data includes high-resolution passport images, travel visa certificates, and itinerary or ticket files, putting the affected individuals at risk of identity theft and fraud.

CISA Urges Critical Infrastructure to Patch Urgent ICS Vulnerabilities

cyware Jan 15, 2024 Threat Intel & Info Sharing

The CISA's ICS advisories highlight high and critical severity vulnerabilities in products from companies like Rapid Software, Horner Automation, Schneider Electric, and Siemens.

FCC Presses Carmakers, Wireless Providers to Protect Domestic Abuse Survivors From Stalking Tools

cyware Jan 15, 2024 Laws, Policy, Regulations

The FCC is requesting detailed information from auto manufacturers and wireless providers on how they support survivors, handle geolocation data, and comply with the Safe Connections Act.

NoName Targets Websites of Financial Services, Transportation, and Telecom Firms in Lithuania

cyware Jan 15, 2024 Breaches and Incidents

Several prominent organizations in Lithuania, including Compensa Vienna Insurance Group, If Insurance, Lithuanian Roads Association, AD REM, INIT, and Balticum, have been targeted by the NoName ransomware group.

HelloFresh Fined $178K After Sending 80 Million Spam Messages

cyware Jan 15, 2024 Incident Response, Learnings

The Information Commissioner's Office found that HelloFresh breached regulations by not informing customers about the extent of their data usage for marketing purposes and continuing to send unwanted messages even after customers requested to stop.

Anonymous Collective Launches Cyberattack on Bahrain Over Yemen Airstrikes

cyware Jan 15, 2024 Breaches and Incidents

The Anonymous Collective has launched a cyberattack on Bahrain in retaliation for its support of US and UK airstrikes on Yemen. Several Bahraini media outlets, including Akhbar al-Khaleej and Gulf Daily News, have been affected by the cyberattack.

Update: British Library Catalogue Back Online After Ransomware Attack

cyware Jan 15, 2024 Incident Response, Learnings

The recovery process is ongoing and will involve a full technical rebuild, with the Library working closely with the UK government to ensure a secure and financially sustainable recovery.

Azorult Malware Comes to the Fore in New Dark Web Campaign

cyware Jan 15, 2024 Malware and Vulnerabilities

The Azorult malware, known for stealing sensitive data, has resurfaced with a sophisticated approach. It is distributed through malicious PDF files that contain a shortcut file.

Report: DDoS Attacks on the Environmental Services Industry Surge by 61,839% in 2023

cyware Jan 15, 2024 Trends, Reports, Analysis

The environmental services industry experienced an alarming surge in HTTP-based DDoS attacks during COP 28, highlighting the increasing intersection between environmental issues and cyber security.

Opera MyFlaw Bug Could Let Hackers Run Any File on Your Mac or Windows

cyware Jan 15, 2024 Malware and Vulnerabilities

The vulnerability was addressed through updates on November 22, 2023, after responsible disclosure, and was related to a long-forgotten version of the My Flow landing page.

Juniper Networks Patches Critical Remote Code Execution Flaw In Firewalls, Switches

packetstormsecurity Jan 15, 2024 headline,flaw,patch,juniper

Information Stealer Exploits Windows SmartScreen Bypass

packetstormsecurity Jan 15, 2024 headline,hacker,microsoft,data loss,flaw

GitLab Patches Critical Password Reset Vulnerability

packetstormsecurity Jan 15, 2024 headline,flaw,password,patch

FBot Hacking Tool Targets Major Cloud Services

packetstormsecurity Jan 15, 2024 headline,hacker,amazon,data loss

Number Of Orgs Compromised Via Ivanti VPN Zero Days Grows As Mandiant Weighs In

packetstormsecurity Jan 15, 2024 headline,hacker,cyberwar,google,zero day

US Lawmakers Urge SEC To Fix Cybersecurity After X Account Hack

packetstormsecurity Jan 15, 2024 headline,hacker,government,usa,twitter