Oktacron - Cyber Security RSS Feeds History

Ransomware Actors Exploit VMware ESXi Hypervisor Bug: Microsoft

cyberexpress Jul 30, 2024 Cybersecurity News

Microsoft researchers have observed multiple ransomware operators exploiting a recently patched vulnerability in ESXi hypervisors to gain full administrative control over domain-joined ESXi servers. This flaw, tracked as CVE-2024-37085, grants these threat actors the ability to encrypt file systems and disrupt show more ...

critical virtual machines. ESXi hypervisors, bare-metal hypervisors directly installed onto physical servers, host virtual machines essential to network operations. Gaining administrative permissions on these hypervisors gives ransomware operators the leverage to halt operations and potentially exfiltrate data. How Ransomware Gangs are Exploiting the VMware ESXi Bug The vulnerability resides in a domain group named “ESX Admins.” By default, any member of this group receives full administrative access to the ESXi hypervisor, without proper validation. This group doesn’t exist by default in Active Directory, yet ESXi hypervisors treat it as a legitimate admin group if created. Microsoft disclosed this flaw to VMware via Coordinated Vulnerability Disclosure (CVD), leading VMware to release a security update. Microsoft advises ESXi server admins to apply these updates immediately to safeguard their systems. Ransomware operators like Storm-0506, Storm-1175, Octo Tempest, and Manatee Tempest have already leveraged this technique. These operators have deployed ransomware such as Akira and Black Basta in numerous attacks, exploiting this vulnerability to create the “ESX Admins” group and adding themselves to it, thus gaining elevated privileges. [caption id="attachment_84465" align="aligncenter" width="1024"] Storm-0506 attack chain (Source: Microsoft)[/caption] Further analysis revealed multiple methods to exploit this vulnerability. Threat actors could create the “ESX Admins” group, rename existing groups, or manipulate privilege refreshes to maintain control. Even when admins assign different groups for management, the hypervisor may still recognize the “ESX Admins” group, allowing continued exploitation. In one incident, Storm-0506 used this flaw to deploy Black Basta ransomware against a North American engineering firm. The attackers first gained access via a Qakbot infection, then escalated privileges using another Windows vulnerability (CVE-2023-28252). With tools like Cobalt Strike and Pypykatz, they stole domain admin credentials, moved laterally across the network, and created the “ESX Admins” group to control the ESXi hypervisors. This breach resulted in the encryption of the ESXi file system and disruption of hosted virtual machines. Although the attackers also targeted non-ESXi devices with PsExec, Microsoft Defender Antivirus thwarted these attempts on protected devices. How to Mitigate these Attacks Against ESXi Servers Hypervisors have become a preferred choice of target in the past few years for ransomware operators because of the following factors: Many security products have limited visibility and protection for an ESXi hypervisor. Encrypting an ESXi hypervisor file system allows one-click mass encryption, as hosted VMs are impacted. This could provide ransomware operators with more time and complexity in lateral movement and credential theft on each device they access. To mitigate such attacks, Microsoft recommends organizations follow several protective measures. Key steps include: Install Security Updates: Apply VMware’s latest security updates on all domain-joined ESXi hypervisors. If updates are not feasible, validate and harden the “ESX Admins” group, deny access through ESXi settings, or change the admin group. Credential Hygiene: Enforce multifactor authentication (MFA), adopt passwordless methods, and separate privileged accounts from regular productivity accounts. This minimizes the risk of privilege escalation by threat actors. Monitor and Detect: Implement custom detections in extended detection and response (XDR) or security information and event management (SIEM) systems for new group names. Ensure ESXi logs are sent to a SIEM for monitoring suspicious activities. Protect Critical Assets: Regularly update and monitor critical assets like ESXi hypervisors and vCenters. Ensure robust backup and recovery plans are in place to mitigate potential disruptions. Microsoft continues to emphasize the importance of collaboration among researchers, vendors, and the security community. Sharing intelligence and advancing defenses is crucial to protect users and organizations from evolving threats.

U.S. Department of Justice Urges Court to Reject Appeal Challenging TikTok Ban

cyberexpress Jul 30, 2024 Cybersecurity News

The U.S. Department of Justice has asked an appeals court to reject legal challenges to a law requiring ByteDance, TikTok's Chinese parent company, to divest its U.S. assets by January 19 or face a ban. The move by the Department of Justice is the latest development in the ongoing battle over the controversial show more ...

video-sharing app used by 170 million Americans. The government argues that TikTok poses a significant national security threat due to its Chinese ownership, citing concerns about data collection and potential manipulation of content by the Chinese government. To support its case, the Justice Department is submitting a classified document to the court, detailing additional security concerns and including declarations from the FBI, the Office of the Director of National Intelligence, and the DOJ's National Security Division. TikTok Legal Battle and Political Implications The law in question was signed by President Joe Biden in April and gives ByteDance until January 19 to separate from TikTok or face a ban. The White House has made it clear that its goal is to end Chinese ownership of the app on national security grounds, without outright banning the app. TikTok, ByteDance, and a group of TikTok creators have filed lawsuits to block the law, claiming it violates First Amendment rights. However, the DoJ has rejected TikTok's arguments that the law violates First Amendment rights, asserting that the law addresses security concerns rather than restricting free speech. The U.S. Court of Appeals for the District of Columbia will hear oral arguments on Sept. 16, placing the fate of TikTok squarely at the center of the 2024 presidential election. Despite the ongoing controversy, both Republican candidate Donald Trump and Vice President Kamala Harris have recently joined the platform, where they promote their political campaigns. National Security Concerns and Legislative Action The consequences of a ban could be significant, with app stores like Apple and Google's Alphabet prevented from offering TikTok, and internet hosting services barred from supporting it unless ByteDance divests its ownership. The law was passed overwhelmingly in Congress, reflecting growing concerns among U.S. lawmakers about the potential for China to access or exploit data on American users through the app. The government argues that TikTok's efforts to protect U.S. user data are insufficient, and that China could use the platform to manipulate information consumed by Americans. As the deadline approaches, the future of TikTok in the United States remains uncertain, with significant implications for users, creators, influencers and social media usage. TikTok has also faced controversy and government action in other countries, being banned by several states and earlier being fined £12.7 million by the UK's Information Commissioner for misusing children's data and breach of several data protection laws.

Threat Intelligence Visibility for CEOs: A Roadmap to Strategic Defense

cyberexpress Jul 30, 2024 Features

Threat intelligence visibility for CEOs is a top priority and not just a need, why? In today’s complex threat landscape, chief executive officers increasingly recognize the pivotal role of threat intelligence in safeguarding their organizations. However, effectively integrating threat intelligence into the broader show more ...

business strategy remains a challenge for many. This article delves into key approaches CEOs can adopt to enhance threat intelligence visibility and transform it into a strategic asset. Understanding the Importance of Threat Intelligence Visibility for CEOs Before diving into specific strategies, it’s crucial to understand why threat intelligence visibility is paramount for CEOs. Risk mitigation: Comprehensive visibility into potential threats empowers CEOs to make informed decisions about risk management strategies. Decision making: Threat intelligence can provide actionable insights that drive strategic business decisions. Competitive advantage: By proactively addressing threats, organizations can gain a competitive edge. Reputation protection: Early detection and response to threats can safeguard an organization’s reputation. Key Approaches to Integrating Threat Intelligence 1. Establish a Clear Threat Intelligence Framework Define threat landscape: Clearly articulate the organization’s potential threats, including cyber, physical, and reputational risks. Identify key stakeholders: Determine which departments and individuals require threat intelligence to perform their roles effectively. Establish data sharing protocols: Develop a robust system for collecting, analyzing, and sharing threat intelligence across the organization. 2. Foster a Culture of Threat Awareness Executive education: Provide CEOs and senior leadership with regular briefings on the threat landscape and the importance of threat intelligence. Employee training: Implement training programs to enhance threat awareness among employees at all levels. Incident response drills: Conduct simulated attacks to test the organization’s preparedness and identify areas for improvement. 3. Leverage Advanced Analytics and Automation Data-driven insights: Utilize advanced analytics tools to uncover hidden patterns and trends within threat data. Automation: Automate routine threat intelligence tasks to free up analysts for strategic analysis. Real-time monitoring: Implement systems for continuous monitoring of the threat landscape. 4. Build Strong Partnerships Intelligence sharing: Collaborate with industry peers, government agencies, and cybersecurity firms to share threat information. Third-party providers: Leverage commercial threat intelligence services to supplement internal capabilities. Managed security service providers (MSSPs): Consider outsourcing threat intelligence functions to specialized providers. 5. Integrate Threat Intelligence into Business Processes Risk assessment: Incorporate threat intelligence into risk assessment processes to identify vulnerabilities. Decision making: Use threat intelligence to inform strategic decisions, such as market entry, supply chain management, and mergers and acquisitions. Incident response: Leverage threat intelligence to accelerate incident response and minimize damage. Measuring the Impact of Threat Intelligence To demonstrate the value of threat intelligence to the board and stakeholders, it’s essential to measure its impact. Key metrics include: Threat detection rate: This metric measures the percentage of threats successfully identified by your threat intelligence system. To calculate this, divide the number of threats detected by the total number of threats that occurred. A high detection rate indicates effective threat intelligence. Time to detection: This metric measures the average time it takes to identify a threat from the moment it appears in the environment. A shorter time to detection allows for quicker response and mitigation efforts. Tracking this metric can help identify areas where threat intelligence processes can be improved. Mean time to respond (MTTR): This metric measures the average time it takes to contain a threat after it has been detected. A lower MTTR indicates a more efficient incident response process. By analyzing MTTR, organizations can identify bottlenecks and areas for improvement in their response capabilities. Cost avoidance: This metric estimates the financial savings achieved by preventing threats through the use of threat intelligence. While it can be challenging to quantify precisely, calculating the potential impact of a successful attack and comparing it to the cost of threat intelligence implementation can provide a rough estimate of cost avoidance. This metric helps demonstrate the return on investment (ROI) of threat intelligence initiatives. By tracking and analyzing these metrics, organizations can gain insights into the effectiveness of their threat intelligence program, identify areas for improvement, and communicate the value of threat intelligence to stakeholders. Conclusion By following these approaches, CEOs can significantly enhance threat intelligence visibility and transform it into a strategic asset. However, to ease their work cyber threat intelligence services from a reputable cybersecurity firm like Cyble, who not only provide CTI but industry specific solutions that includes finance, healthcare and pharmaceuticals, retail, technology and education. These services typically involve continuous scanning, real-time alerts, and expert analysis of potential threats. Incorporate Cyble’s award-winning AI-Powered cyber threat intelligence platform and leverage threat intelligence feeds to enhance your organization’s cybersecurity posture. Remember, threat intelligence is an ongoing process that requires continuous adaptation to the evolving threat landscape. By investing in this critical capability, organizations can build a stronger security posture and achieve long-term success. Discover more by scheduling a demo today!

U.S. Court Slashes $78M Lawyers’ Fee in T-Mobile Data Breach Settlement

cyberexpress Jul 30, 2024 Cybersecurity News

A U.S. appeals court has nullified a $78 million legal fee award for plaintiffs’ lawyers who negotiated a $350 million settlement with T-Mobile stemming from a 2021 data breach. T-Mobile agreed to pay $350 million and spend an additional $150 million to upgrade data security to settle litigation over a show more ...

cyberattack that compromised information belonging to an estimated 76.6 million people. On July 29, the court deemed that the award for plaintiff’s lawyers was a “windfall” relative to the attorneys' efforts. What Was the T-Mobile Data Breach? In August 2021, T-Mobile notified its customers that it was the victim of a cyberattack. Investigation revealed that data of more than 76.6 million current and former customers’ information had been compromised during the breach. The leaked information included customers names, addresses, dates of birth, phone numbers, International Mobile Equipment Identity numbers and International Mobile Subscriber Identity numbers. Some customers also had sensitive information compromised, including their social security numbers and drivers license/ID information and T-Mobile account PINs. T-Mobile alerted all those affected and reset the PIN information for the accounts that had been compromised in the attack. To help combat ramifications from the cyberattack, T-Mobile created a dedicated webpage for information about the breach, as well as offering two years of free identity protection services, free scam-blocking protection, and additional best practice guides on what to do in the wake of the breach, including help on resetting passwords and PINs. The telecommunications company still faced a class action lawsuit following the breach for allegedly failing to meet the obligations set out in its privacy policy and protecting its customers’ data. The company agreed to settle, paying $350mn to fund claims submitted by members of the class action lawsuit and agreeing to invest $150mn in its cyber security systems. Court Ruling On Breach Settlement The 8th U.S. Circuit Court of Appeals in St. Louis ruled 3-0 that the legal fee for plaintiffs’ lawyers was excessive considering the hours of work the lawyers invested in the consumer privacy case, which T-Mobile agreed to settle in 2022, Reuters reported. “If we permitted the fee award here to stand, it would mean that counsel could make $7,000 to $9,500 an hour, which we think no reasonable class member would willingly pay to an attorney to help resolve this claim,” Circuit Judge Morris Arnold wrote in the ruling, joined by Chief Circuit Judge Steven Colloton and Circuit Judge Raymond Gruender. One of the plaintiffs' attorneys, Brad Wilders, told Reuters that they “look forward to getting the relief in the hands of class members as soon as possible on remand.” The appeals court acknowledged that the plaintiffs’ lawyers had represented the class well and achieved a significant outcome in a few months. However, the panel noted, “the case had barely gotten off the ground before it settled, and counsel hadn't yet invested the time and effort to yield a return like the one the court awarded.” The panel suggested that reducing the fee amount by half — to about $39 million — would still provide substantial compensation, equating to $3,500 to $4,750 per hour. The court did not mandate a lower percentage fee in all “megafund” cases exceeding $100 million, but emphasized that fee determinations should consider various case-specific factors.

From AI Threats to Strategic Defenses: Singapore’s Cybersecurity Journey in 2023

cyberexpress Jul 30, 2024 Firewall Daily

As we reflect on the Singapore cyber landscape of 2023, it's evident that the year presented both heightened challenges and notable advancements in cybersecurity. Global trends significantly influenced local practices and vulnerabilities, highlighting our increasingly interconnected world and its susceptibility to show more ...

digital threats. The year 2023 was tumultuous for cybersecurity worldwide. Cybercriminals and Advanced Persistent Threat (APT) groups exploited vulnerabilities in supply chains and third-party services. High-profile incidents, including the Cl0p ransomware campaign and breaches impacting Barracuda Networks and Citrix devices, highlighted the escalating sophistication of cyber threats. These attacks demonstrated how threat actors are increasingly leveraging Generative AI to enhance their cyber and misinformation campaigns. This article explores the significant shifts in the cybersecurity domain, particularly focusing on hacktivism, AI advancements, and their impact on Singapore. The Singapore Cyber Landscape in 2023 According to Cyber Security Agency of Singapore's latest report, hacktivism has also evolved, with groups employing more sophisticated tactics and targeting a broader array of systems. Pro-Ukrainian factions have conducted spear-phishing campaigns, while pro-Palestinian and pro-Iranian hacktivists have caused disruptions through various means. Distributed Denial of Service (DDoS) attacks have become more advanced, and coordination among hacktivist groups via platforms like Telegram has increased. Organizations are now compelled to adopt a multi-layered approach to cybersecurity. Regular software updates, strong access controls, and robust incident response plans have become essential. Enhanced cybersecurity hygiene and preparedness are critical for mitigating risks from both cybercriminals and hacktivists. In 2023, AI technology has made headlines, especially with the rapid adoption of advanced AI tools. ChatGPT, for example, reached 100 million monthly active users within just two months of its launch, illustrating the widespread enthusiasm for AI. Nearly 70% of organizations reported having at least one AI project underway, reflecting the technology's growing integration into various processes. However, this rapid adoption of AI has also attracted malicious actors. The emergence of WormGPT in July 2023, a tool designed to bypass security measures like those in ChatGPT, has raised significant concerns. WormGPT, available on underground forums, facilitates the creation of phishing emails and malware. Another tool, FraudGPT, aids in hacking and phishing activities. These developments suggest that AI is increasingly lowering the barriers to conducting cyber-attacks and scams. Deepfake technology has also seen a rise in malicious applications. Scammers now use deepfakes to bypass biometric authentication and execute sophisticated fraud schemes. For instance, deepfake videos have been used to impersonate executives and fraudulently acquire millions of dollars. The growing accessibility of deepfake tools has led to a surge in fraudulent activities. AI's role in cybersecurity is double-edged. On the one hand, it enhances productivity for malicious actors by aiding in target research, vulnerability discovery, and password cracking. Tools like PassGAN and advanced fuzzing techniques expedite these processes. On the other hand, AI offers promising advancements in cybersecurity defense. AI systems can process and analyze vast amounts of data more effectively than traditional rule-based systems, identifying anomalies and detecting malicious activities with greater precision. Despite these advantages, AI in cybersecurity faces challenges. Managing false positives and negatives is crucial to avoid overwhelming security teams with unnecessary alerts while ensuring no threats are missed. As cybercriminals develop new evasion techniques, the arms race between AI defenses and attackers continues. Ongoing improvement of AI models is essential, alongside public awareness campaigns and robust internal processes like multi-factor authentication. Key Takeaways from Singapore Cyber Landscape in 2023 In 2023, the Singapore cyber landscape has demonstrated significant improvements compared to the previous year, though challenges persist. Key trends reveal a notable decrease in phishing attempts, with 4,100 cases reported compared to over 8,000 in 2022. Despite this reduction, phishing remains a significant threat, exacerbated by the increasing use of AI-generated phishing emails. The use of HTTPS and more credible top-level domains in phishing scams highlights their growing sophistication. Ransomware incidents in Singapore remained steady at 132 cases, primarily affecting the manufacturing and construction sectors. This stability contrasts with the global surge in ransomware attacks. Additionally, there was a 14% decline in infected systems, reflecting improved cyber hygiene, though vulnerabilities persist. Website defacements dropped by 68% to 108 cases, aligning with a global trend of reduced defacements as hacktivists shift their focus. Infected systems decreased to 70,200, but this number still indicates ongoing vulnerabilities. A new concern has emerged with malware-enabled scams, which saw nearly 1,900 cases and significant financial losses. In response, enhanced security measures and public awareness campaigns have been implemented. The growing role of AI in refining phishing tactics emphasizes the need for vigilance and comprehensive cybersecurity practices. The Cyber Security Agency (CSA) conducted a national Cybersecurity Public Awareness Survey in 2022, revealing increased public concern about cyber threats. Published in September 2023, the survey showed that 60% of respondents felt they were likely to fall victim to cyber incidents, up from 43% in 2020. Similarly, 43% believed they might be targeted by online scams, compared to 32% in 2020. Despite heightened awareness, the actual incidence of falling victim to cyber incidents slightly decreased, with 29% of respondents reporting such experiences in 2022, down from 32% in 2020. Younger respondents aged 15 to 39 experienced higher victimization rates, while those aged 55 and above reported lower rates. Awareness of phishing remained steady, with about 70% of respondents able to identify at least one phishing email or SMS. However, there was a decline in the frequency of immediate software updates, with 27% of respondents updating their devices promptly in 2022, compared to 30% in 2020. On a positive note, adopting two-factor authentication (2FA) increased from 22% in 2020 to 35% in 2022, and half of the respondents installed cybersecurity apps. The survey also highlighted a gap in IoT security awareness. However, 84% of respondents used IoT devices, less than 20% knew how to secure them. Strong password practices and changing default passwords were noted, but overall IoT security awareness remains limited. In response to these findings, the CSA launched its fifth National Cybersecurity Campaign, "The Unseen Enemy," in September 2023. This campaign emphasizes the importance of 2FA, recognizing phishing scams, updating software, and using cybersecurity apps. Strategic Initiatives and International Collaboration The Singapore cyber landscape of 2023 outlines a strategic approach to enhancing cybersecurity through three key pillars: building resilient infrastructure, enabling a safer cyberspace, and enhancing international cyber cooperation. The CSA has focused on several initiatives, including strengthening digital infrastructure through the OTCEP Forum, conducting nationwide cyber crisis management exercises, and improving information sharing with critical sectors. Noteworthy initiatives include the development of the Safe App Standard for mobile app security, the launch of the Cybersecurity Labelling Scheme for IoT devices, and collaboration on international IoT security standards. CSA has also emphasized cloud security and AI safety, producing companion guides for cloud security and contributing to international AI security standards. Efforts to enhance public and organizational cybersecurity have included the SG Cyber Safe Seniors Programme and the SG Cyber Safe Students Programme. These initiatives aim to educate seniors and students on digital safety. Additionally, CSA’s collaboration with industry leaders, such as Microsoft, Google, and Dragos, highlights the importance of public-private partnerships in strengthening cyber resilience. In 2022, CSA developed the Internet Hygiene Programme (IHP) to address the widespread lack of awareness and adoption of internet security practices in Singapore. The IHP offers a free tool for assessing website security and promoting better cyber hygiene. For example, Nucleo Consulting Pte Ltd improved its operations and reputation through enhanced security protocols provided by the IHP. Singapore has also made strides in international cyber cooperation. As a founding member of the Counter Ransomware Initiative (CRI), Singapore and other members have worked against ransomware, urging governments not to pay ransom demands. Singapore also chairs the UN Open-Ended Working Group (OEWG) on ICT security, contributing to discussions and establishing a Global Points-of-Contact directory. Bilateral and ASEAN engagements in 2023 included high-level dialogues with the UK and US and hosting the 18th ASEAN CERT Incident Drill (ACID) to test and enhance regional cybersecurity response. The Cyber TIG Plan was introduced to advance Singapore's cybersecurity industry, supported by initiatives like the CyberSG TIG Collaboration Centre. Efforts to build a skilled cybersecurity workforce have included programs like SG Cyber Associates, SG Cyber Olympians, and the Cybersecurity Development Programme (CSDP). These initiatives aim to develop and sustain a skilled workforce for the digital economy. Addressing AI Risks and Opportunities Singapore is investing heavily in AI security and developing guidelines to ensure responsible AI use. The Infocomm Media Development Authority (IMDA) has launched the AI Verify Foundation and the Model AI Governance Framework for Generative AI (MGF-GenAI) to improve AI testing and management. Concurrently, the CSA is developing guidelines and standards to secure AI systems and foster industry collaboration. GovTech's initiatives, such as the Pair Chat application for drafting reports, demonstrate Singapore's commitment to technological innovation. The focus on mitigating Adversarial AI threats through projects like automated red teaming and proof-of-concept experiments addresses risks such as backdoor injections and evasion attacks in AI systems. In the financial sector, the Financial Services Information Sharing and Analysis Center (FS-ISAC) enhances cyber resilience through regular exercises, information sharing, and community building. Initiatives like the CAPS and CERES exercises test responses to ransomware attacks and develop proactive strategies for third-party risk management. FS-ISAC’s collaboration with CSA and focus on emerging technologies like AI further strengthens Singapore’s financial cybersecurity framework. The Sentinel Programme, launched nationwide on January 20, 2024, is a significant initiative by Singapore's Digital and Intelligence Service (DIS) in collaboration with the Ministry of Education (MOE), CSA, and the Defence Technology Community (DTC). This program aims to cultivate cybersecurity talent among youths by providing comprehensive training and development opportunities. Open to Year 1 students from secondary schools, junior colleges, polytechnics, and Institutes of Technical Education (ITEs), the Sentinel Programme offers a four-year secondary and two-year post-secondary curriculum. It includes programming, network forensics, and penetration testing, complemented by visits to defense agencies and mentorship from cybersecurity professionals. Students can also participate in national competitions like the Sentinel Challenge and Cyberthon. The program builds on a successful two-year pilot, demonstrating positive outcomes and strong student enthusiasm. Former pilot participants like Mr. Koh Le On and Mr. Enzo Yap have reported significant skill development and passion for cybersecurity, with Mr. Yap advancing to a diploma in Cybersecurity and Digital Forensics. Summing Up The Singapore cyber landscape in 2023 reflects both progress and ongoing challenges in the realm of cybersecurity. As global trends influence local practices, Singapore has made strides in addressing vulnerabilities, enhancing public awareness, and leveraging AI for both defense and threat. The country's commitment to building a resilient digital infrastructure, fostering international cooperation, and nurturing the next generation of cyber defenders positions it well to navigate the complexities of the cyber landscape. As threats continue to advance, continuous adaptation and vigilance will be crucial for maintaining cybersecurity in an increasingly interconnected world.

Researchers Study Evolution of Ransomware Gang UNC4393’s Campaigns After QAKBOT Takedown

cyberexpress Jul 30, 2024 Cybersecurity News

The threat actor group UNC4393, known for deploying BASTA ransomware, has undergone continuous changes in its tactics since mid-2022. Researchers have tracked over 40 UNC4393 intrusions across 20 industries and about 500 victims on its data leak site to study the group's operations and changes. While the group show more ...

initially relied on the QAKBOT botnet infection for access, the UNC4393 group adapted its methods following the internal crackdown on the QAKBOT network. The group has now switched to using custom-deployed malware and diverse initial access techniques. UNC4393 Attribution, Targeting and Malware UNC4393 is a financially motivated threat cluster, and the primary user of the BASTA ransomware. The group has primarily made use of initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware in its campaigns. [caption id="attachment_84476" align="alignnone" width="720"] Source: cloud.google.com[/caption] Now researchers from Mandiant in a new study suspect BASTA operators maintain a private or small closed-invitation affiliate model, whereby only trusted third-party actors are provided with access to the BASTA encryptor. The group has claimed hundreds of victims on its dark leak site within short intervals of time, proving its quick reconnaissance, data exfiltration and ransomware encryption objectives within a median time of approximately 42 hours. UNC4393 has transitioned from readily available tools to custom malware development. Their arsenal includes: BASTA: A C++ ransomware that encrypts files using ChaCha20 or XChaCha20. SYSTEMBC: A tunneler that retrieves proxy-related commands from a command-and-control server. KNOTWRAP: A memory-only dropper that executes additional payloads. DAWNCRY: A dropper that decrypts embedded resources, including DAVESHELL and PORTYARD. PORTYARD: A tunneler establishing connections to command-and-control servers. Researchers note that while the group traditionally avoided attacks on healthcare institutions, recent breaches of the sector may suggest an expansion of attack interests. Shifting Access Methods and Partnerships Following the QAKBOT infrastructure takedown, UNC4393 diversified its initial access methods: DARKGATE: Briefly used for access via phishing campaigns. SILENTNIGHT: A C/C++ backdoor delivered through malvertising, marking a shift from phishing-only tactics. For internal reconnaissance, the group employs open-source tools like BLOODHOUND and ADFIND, along with custom tools such as COGSCAN, a .NET-based reconnaissance assembly. After gaining access, UNC4393 combines living-off-the-land techniques with custom malware. They frequently use DNS BEACON with unique domain-naming conventions for establishing and maintaining footholds in target environments. UNC4393 has demonstrated willingness to cooperate with multiple distribution clusters and affiliates to achieve its goals. [caption id="attachment_84478" align="alignnone" width="1444"] Recent decline of listed victims on dark leak site (Source: cloud.google.com)[/caption] The group has shown a keen willingness to diversify and optimize its operations, through its change in the kind of malware deployed to various strategic partnerships with initial access brokers. However, the researchers note that while the group's dark leak site has been among the most active in the ones they track, the number of victims that had been claimed on the site had declined over recent months, and conclude that with less than a week remaining in the month, any significant change to this decline is unlikely. The researchers still stress the group's quick operational tempo and multi-faceted extortion techniques as a challenge for defenders, and a list of potential indicators of compromise (IOCs) has been uploaded to VirusTotal to help organizations mitigate against the threat.

New Variant of Mandrake Spyware Found in Google Play Apps

cyberexpress Jul 30, 2024 Firewall Daily

The Android spyware known as Mandrake has made a significant resurgence with a new variant. This Mandrake spyware has been discovered hidden in five seemingly innocuous applications on Google Play. These apps, which were downloaded a combined total of over 32,000 times, remained undetected by most security vendors for show more ...

nearly two years. Mandrake spyware first emerged in 2016, with its sophisticated spying capabilities making headlines in 2020. Bitdefender's detailed analysis revealed that Mandrake was a potent piece of Android spyware, capable of extensive espionage. The latest reports, however, highlight that Mandrake has evolved, employing more advanced evasion techniques to avoid detection. Overview of the Mandrake Spyware Campaign The new Mandrake Android spyware variant, uncovered by Kaspersky, exhibits enhanced obfuscation and evasion methods. These include moving malicious functionalities to obfuscated native libraries and using certificate pinning for command-and-control (C2) communications. This updated version of Mandrake was embedded in five apps submitted to Google Play in 2022 and stayed hidden until early 2024. The infiltration of Mandrake spyware into Google Play has been traced to five specific applications. Among them is AirFS, a file-sharing app developed by it9042, which saw a significant number of downloads—30,305—between April 28, 2022, and March 15, 2024. Another app, Astro Explorer, was developed by shevabad and recorded 718 downloads from May 30, 2022, to June 6, 2023. Amber, created by kodaslda, had a more modest reach with 19 downloads between February 27, 2022, and August 19, 2023. Similarly, CryptoPulsing, also developed by shevabad, was downloaded 790 times from November 2, 2022, to June 6, 2023. Lastly, Brain Matrix, another app by kodaslda, accumulated 259 downloads between April 27, 2022, and June 6, 2023. The spread of these infected apps was notably global, with the majority of infections occurring in countries such as Canada, Germany, Italy, Mexico, Spain, Peru, and the UK. Evolution of Mandrake Spyware The latest version of Mandrake spyware represents a significant advancement in evasion techniques compared to its predecessors. Unlike earlier iterations that relied on relatively straightforward malware deployment methods, this new variant incorporates several sophisticated tactics. One of the most notable improvements is its advanced obfuscation methods. The current Mandrake variant employs heavily obfuscated native libraries, such as libopencv_dnn.so and libopencv_java3.so, to conceal its malicious operations. These libraries play a crucial role in managing and decrypting subsequent stages of the malware. In addition to advanced obfuscation, Mandrake now utilizes certificate pinning to secure its communications with command-and-control (C2) servers. This technique prevents the interception of SSL traffic, making it harder for security analysts to monitor or analyze the data being transmitted. The spyware has also improved its sandbox evasion techniques, which now include checks for debugging tools and emulator environments. These enhancements make it increasingly difficult for analysts to detect and analyze the spyware. Mandrake operates through a multi-stage infection process. The initial stage, known as the dropper, is embedded within the native libraries and is responsible for decrypting and loading subsequent stages. The second stage, the loader, handles further decryption and prepares the environment for the core component. The core stage contains the primary malicious functionalities of Mandrake, including data theft and surveillance. Among the various malicious activities that Mandrake can perform are screen recording and automated actions. The spyware is capable of capturing screenshots and recording screens, which are then sent to the C2 servers. It can also automate actions such as swiping and clicking on web pages. Additionally, Mandrake collects sensitive information, including user credentials, device details, and a list of installed applications. Impact and Response The infiltration of Mandrake spyware into Google Play highlights a significant issue in-app marketplace security. Despite Google's efforts to thoroughly vet applications, sophisticated threats like Mandrake have still managed to bypass these defenses. The extended period during which these malicious apps went undetected highlights the pressing need for continual vigilance and enhanced security measures to protect users. As Mandrake Android spyware advances in its concealment and evasion techniques, it poses a considerable challenge to both users and security professionals. This recent discovery of Mandrake's improved methods of hiding and operating within official app stores further emphasizes the critical need for robust security practices and ongoing monitoring. The ability of Mandrake to evade detection and persist within app marketplaces highlights the necessity for more stringent security protocols. To effectively combat such sophisticated threats, it is essential to implement and enforce more rigorous security measures and maintain heightened vigilance in monitoring app stores.

Data Breach Cost Nears $5 Million, But AI and Automation Help: IBM

cyberexpress Jul 30, 2024 Cybersecurity News

IBM’s annual Cost of a Data Breach Report released today found that the global average cost of a data breach grew by 10% to $4.88 million in 2024, as breaches have become more disruptive and often overwhelmed security teams. One bright note: The IBM-Ponemon report – now in its 19th year – found that show more ...

organizations that extensively use AI and automation across prevention workflows saved $2.2 million on average data breach cost over organizations that aren’t using those technologies. In the U.S., the average data breach cost actually declined – from $9.48 million in 2023 to $9.36 million in 2024 – yet remains the highest in the world, followed by the Middle East region, which saw the average breach cost increase from $8.07 million to $8.75 million. If current trends continue, the Middle East could overtake the top spot from the U.S. as early as 2025. Mega breaches – defined as a million or more records compromised – were excluded from the calculations because of their huge cost, starting around $42 million per breach. Healthcare, Breach Containment Time Improve Among industries, healthcare took the top spot again, even as the cost per breach dropped substantially, from $10.93 million to $9.77 million. Financial firms were a distant second at $6.08 million, up slightly over 2023. Here's the data broken down by industry: [caption id="attachment_84668" align="aligncenter" width="500"] Data breach cost by industry: IBM[/caption] The average time to identify and contain a breach fell to a 7-year-low of 258 days. Compromised credential and insider breaches took even longer to contain (chart below). [caption id="attachment_84617" align="aligncenter" width="523"] Data breach containment time by attack vector: IBM[/caption] The most common initial attack vectors were: Stolen or compromised credentials (16%) Phishing (15%) Cloud misconfiguration (12%) Unknown zero-day vulnerability (11%) Business email compromise (10%) Malicious insider (7%) Social engineering, known unpatched vulnerabilities, accidental data loss and stolen devices, physical security compromise, and system errors all came in at around 6% each. Factors Contributing to Data Breach Cost Factors contributing to higher breach costs included understaffed security teams, shadow data, and data spread across multiple environments. AI tools, along with detection by internal tools and teams (as opposed to hearing from third parties or attackers), were positive factors, and bringing in law enforcement in ransomware cases saved nearly $1 million per incident, and 63% of ransomware victims who involved law enforcement were able to avoid paying a ransom. Interestingly, any investment in AI and automation saved on breach costs (chart below). [caption id="attachment_84612" align="aligncenter" width="523"] Cost of a breach for AI security users (Source: IBM)[/caption] Also noteworthy, the IBM report includes an extensive look at the security tools and factors that decreased breach costs, in descending order: [caption id="attachment_84624" align="aligncenter" width="250"] Security tools and factors that reduced breach costs (IBM)[/caption] Data Breach Recovery Takes Time Only 12% of the organizations queried in the report said they had fully recovered from the breach. In the context of the study, full recovery from a breach means: Business operations back to normal in areas affected by the breach. Compliance obligations met, including paying fines. Customer confidence and employee trust restored. Controls, technologies and expertise in place to avoid future breaches. That third point - customer confidence - is the toughest to restore, and a reason to invest in effective cybersecurity controls in the first place.

Meta Will Pay Record $1.4 Billion to Settle Texas Facial Recognition Lawsuit

cyberexpress Jul 30, 2024 Business News

Meta Platforms Inc. has reached a record $1.4 billion settlement with the state of Texas to resolve a privacy lawsuit that alleged the tech giant misused facial biometric data without user consent. The Meta facial recognition lawsuit settlement, the largest secured by a single state, comes after years of scrutiny over show more ...

Meta’s data practices. In 2021, the company, formerly known as Facebook, agreed to pay $650 million to settle a similar case brought by Illinois residents. Meta Facial Recognition Lawsuit Settlement Sets Record “After vigorously pursuing justice for our citizens whose privacy rights were violated by Meta’s use of facial recognition software, I’m proud to announce that we have reached the largest settlement ever obtained from an action brought by a single State,” said state Attorney General Ken Paxton. “This historic settlement demonstrates our commitment to standing up to the world’s biggest technology companies and holding them accountable for breaking the law and violating Texans’ privacy rights. Any abuse of Texans’ sensitive data will be met with the full force of the law.” Meta said it was pleased to resolve the matter and looks forward to expanding its business in Texas. However, the company's stock price, which opened the day at $467, fell to a low of $457 after the lawsuit deal announcement before rebounding. The record $1.4 billion settlement is unlikely to weigh a lot on Meta’s business since the California-based tech giant made a profit of $12.37 billion in the first three months of this year on revenue of $36.46 billion, an increase of 27% from a year earlier. Meta is scheduled to report its second-quarter earnings results on Wednesday. The Texas lawsuit, filed in 2022, accused Meta of violating a state law prohibiting the collection and sale of biometric information, such as facial and fingerprint data, without explicit user permission. In 2020 - when the company was known as Facebook - Meta settled a similar lawsuit with the state of Illinois for $650 million where the tech giant allegedly used photo face-tagging and other biometric data without the permission of its users. U.S. district judge James Donato approved the deal at the time in a class-action lawsuit that was filed in Illinois in 2015. Facebook Face Recognition System and Data Deleted in 2021 In response to growing privacy concerns, Meta discontinued its face recognition system in 2021 and deleted billions of facial templates. However, the company faced criticism for previously enabling the feature by default. Paxton has also filed a similar lawsuit against Google, alleging the company collected biometric data through its products and services. That case is ongoing.

Analyzing ‘EchoSpoofing’: How Cybercriminals Exploited Proofpoint to Send Millions of Phishing Emails

cyberexpress Jul 30, 2024 Firewall Daily

A new vulnerability has been discovered within Proofpoint's email security systems, leading to a phishing campaign that has affected millions. This exploit, dubbed "EchoSpoofing," demonstrated how even the most trusted email security providers could be exploited to execute large-scale phishing attacks. show more ...

Proofpoint, renowned for securing the email communications of 87 out of the Fortune 100 companies, including household names like Disney, IBM, Nike, Best Buy, and Coca-Cola, has recently been found to have a major security flaw in its email protection systems. The Rise of EchoSpoofing Campaign The EchoSpoofing exploit allowed cybercriminals to send millions of phishing emails that appeared to originate from multiple trusted brands. These emails, fully authenticated with SPF and DKIM signatures, bypassed many traditional security measures, leading recipients to fraudulent sites designed to steal sensitive information such as credit card details. This vulnerability was uncovered by Guardio Labs, a team specializing in identifying, monitoring, and mitigating new security threats across the web. [caption id="attachment_84571" align="alignnone" width="828"] Exploiting Proofpoint to send spoofed emails in customers' names (Source: Guardio)[/caption] The EchoSpoofing exploit leveraged the Proofpoint email relay infrastructure to send out spoofed emails. By using Proofpoint's email relays, attackers were able to craft emails that appeared to be sent from legitimate, trusted domains. For instance, an email spoofed to look like it came from Disney+ would carry the real Disney logo and domain information, making it seem authentic. To understand the technicalities, let's break down how this was achieved. Initially, attackers created phishing emails with spoofed "FROM" headers, indicating they were from well-known brands. These emails were then routed through various servers, including Microsoft’s Office365 accounts, and ultimately passed through Proofpoint's relays. The key to this exploit was Proofpoint’s relay servers, which accepted these spoofed emails because they were sent through an approved Office365 connector. How Proofpoint Was Abused Proofpoint’s email security solution functions like a firewall for emails, intercepting and inspecting messages before they reach the recipient. Typically, Proofpoint’s system ensures emails comply with SPF and DKIM standards. However, the attackers exploited a misconfiguration within Proofpoint’s system. Here’s how it worked: Attackers set up their own Office365 accounts to send emails with spoofed headers. These emails, although malicious, were relayed through Proofpoint's servers, which were configured to accept any emails sent from approved Office365 connectors. This setup allowed the attackers to bypass Proofpoint's email security, as the emails appeared legitimate due to their SPF and DKIM validations. One of the notable examples was an email that appeared to be from Disney+. The email contained a phishing link disguised as a promotional offer or a customer survey. Clicking on this link would direct the user to a fraudulent page designed to capture personal and financial information. The email headers showed that the message had been authenticated as coming from Disney's domain, even though it was part of the attack. The EchoSpoofing campaign began in January 2024, and over the following months, the volume of spoofed emails surged dramatically. By April 2024, attackers were sending up to 14 million spoofed emails per day. The scale of the operation was facilitated by PowerMTA, a high-performance email delivery software used to manage large volumes of emails efficiently. The use of such robust infrastructure allowed the attackers to maintain the campaign's effectiveness and evade detection. Response from Proofpoint and Cybersecurity Community Upon discovering the EchoSpoofing exploit, Guardio Labs immediately alerted Proofpoint. Proofpoint responded swiftly, collaborating with Guardio Labs to address the issue. They began by notifying affected customers and working to tighten their email security configurations. One key response involved implementing a new security measure: the X-OriginatorOrg header. This unique header, automatically appended by Microsoft Exchange servers, helped verify the true source of emails. By filtering out emails that did not contain a valid X-OriginatorOrg header, Proofpoint aimed to block unauthorized spoofing attempts. The EchoSpoofing incident highlighted several critical lessons for email security. The misconfiguration in Proofpoint’s system, which allowed any Office365 account to relay emails through its servers, highlighted the need for more secure setup practices. Organizations must ensure that only authorized services and accounts are allowed to use their email security providers. While SPF and DKIM are essential for email authentication, they are not foolproof. The use of additional verification methods, like the X-OriginatorOrg header, can provide an extra layer of security. The rapid evolution of phishing techniques necessitates continuous monitoring and updating of security measures. Cybersecurity professionals must remain vigilant and proactive in addressing emerging threats. The swift and collaborative response between Guardio Labs and Proofpoint demonstrated the effectiveness of joint efforts in tackling cybersecurity threats. Coordination between security researchers, service providers, and affected organizations is crucial in mitigating and addressing security breaches.

DigiCert Revokes Thousands of SSL Certificates Over Validation Error

cyberexpress Jul 30, 2024 Cybersecurity News

In a move that could cause some serious headaches for website administrators, DigiCert, a major digital certificate provider, is revoking thousands of SSL certificates due to a technical error in the company's domain validation process. DigiCert made the decision after discovering a critical issue in its Domain show more ...

Control Validation (DCV) process, which affected approximately 0.4 per cent of their certificates issued. According to a statement issued by DigiCert, the issue stems from a missing underscore character that's supposed to be included with a random value used during verification. How Domain Validation Works Before issuing an SSL certificate, DigiCert needs to confirm that the applicant actually owns the domain name they're requesting a certificate for. They achieve this through a process called Domain Control Verification (DCV). One method used for DCV involves adding a specific record to the domain's DNS settings, which contains a random value provided by DigiCert. By verifying the presence of this random value, DigiCert can confirm the applicant's control over the domain. There are a few ways to add this record, but one approach requires the random value to be prefixed with an underscore character. This seemingly minor detail ensures the random value can't accidentally clash with an actual subdomain name. While the odds of such a collision are slim, the lack of an underscore is still considered a security risk under the guidelines set by the CA/Browser Forum (CABF). DigiCert recently discovered that their system wasn't consistently adding the underscore prefix to the random value in all CNAME-based DCV scenarios. This means some certificates were issued based on an incomplete validation process, violating the CABF requirements. As a result, DigiCert is forced to revoke all affected certificates within 24 hours to maintain trust and compliance. DigiCert's rapid response stands in contrast to compliance failures noted by Google in its decision to distrust certificates issued by Entrust. What Caused the DigiCert Error? According to DigiCert, the issue arose during a system upgrade they implemented in August 2019. The new system streamlined the validation process but, in the shuffle, the code responsible for adding the underscore prefix got left behind in the legacy system. This resulted in a situation where some validation paths included the underscore, while others didn't. Certificate Fixes for Customers DigiCert estimates that roughly 0.4% of their active domain validations are affected by this error. Impacted customers have been notified and have a tight window of 24 hours to replace their revoked certificates. Here's what you need to do if you're a DigiCert customer: Check Your Notification: DigiCert should have sent you an email or notification within your account dashboard if any of your certificates are affected. Identify Revoked Certificates: Log in to your DigiCert account and locate the impacted certificates. Reissue Your Certificates: You'll need to generate a new Certificate Signing Request (CSR) and reissue your certificates. DigiCert provides instructions on how to do this within their CertCentral platform. Install the New Certificates: Once reissued, install the new SSL certificates on your web server to restore secure communication. Looking Ahead: Preventing Future Certificate Incidents DigiCert has acknowledged the inconvenience this incident caused and is taking steps to prevent similar issues in the future. These measures include: Consolidating and Reviewing Random Value Generators: They're streamlining their system to ensure consistent underscore prefix addition across all DCV methods. Simplified User Experience: Customers won't need to worry about the specific format of the random value based on their chosen DCV method. Enhanced Compliance: Compliance teams will be embedded within DigiCert's development teams to ensure all changes adhere to relevant regulations. Increased Test Coverage: DigiCert plans to expand their testing procedures beyond basic functionality to include automated compliance checks. Open-Sourcing DCV: They're committed to making their DCV process open-source for broader community review and potential improvements. Focus on Safety While the chances of a security breach directly resulting from this missing underscore are minimal, DigiCert's swift action highlights the importance of maintaining strict domain validation procedures. This incident serves as a reminder for website owners to stay updated on any security alerts from their certificate authorities and to act promptly when certificate revocation notices are received. By keeping your SSL certificates current and following best practices, you can ensure a secure and trustworthy online experience for your website visitors.

Critical Sectors at Risk: India Reports 593 Attacks in the First Half of 2024

cyberexpress Jul 30, 2024 Cybersecurity News

Cyberattacks in India have reached alarming levels, with a staggering 593 incidents reported in the first half of 2024. The education, government, and technology sectors emerged as the most vulnerable targets, according to a recent report. This surge in cyberattacks underscores the critical need for robust show more ...

cybersecurity measures across all sectors of the Indian economy. The report mentioned that the potential for cyberattacks will only grow, making it imperative for businesses and government entities to stay ahead of the evolving threat landscape. Cyberattacks in India Report in Detail The report titled ‘India Breach Report’ by FalconFeeds, highlighted that India witnessed 388 data breaches (65.4%), 107 data leaks (18.0%), 59 cases of access sales or leaks (9.9%) and 39 ransomware group activities (6.6%), in the first half of 2024. Apart from education, government and technology, healthcare, banking, manufacturing and consumer services sectors witnessed severe cyberattacks from January to June this year. “This evolving cyber threat landscape in the nation, particularly within critical sectors like government and education, is a stark reminder that it is high time we created a protocol to address the issue. No sector is immune,” said Nandakishore Harikumar to The Hindu newspaper, who runs FalconFeeds.io. [caption id="attachment_84534" align="alignnone" width="1357"] Source: FalconFeeds.io Report[/caption] “Data breaches are the most common type of cyberattack, indicating that many organizations lack robust data protection measures. Sensitive information remains highly vulnerable to unauthorized access and exposure. Data leaks follow closely behind data breaches, further highlighting the need for improved data security practices,” the report said. “The thriving underground market for unauthorized access to corporate and government networks underscores the importance of strong access control measures, regular monitoring, and swift response to unauthorized access attempts,” it added. The report identified a disturbing correlation between increase in cyberattacks in India and the country’s Parliament elections which was held from April 19 to June 1. “From March to April, there was a marked increase in cyber incidents, peaking in May, followed by a slight decrease in June and a more notable drop in July. This highlights the opportunistic behaviour of threat actors who exploit periods of heightened national activity,” the report said. Government and public sector entities were disproportionately affected, with New Delhi and the Central government bearing the brunt of attacks during this period. Most Active Platforms for Cyberattacks in India An analysis of the platforms which were facilitating most of the cyberattacks included dark web portal BreachForums (35 victims) followed by social media app Telegram (32 victims). Among threat actors, Lockbit 3.0 executed the highest number of attacks standing at 18 followed by Darkvault (6), BianLian (4) and, Kill Security and RansomHub (3 each). [caption id="attachment_84536" align="alignnone" width="1087"] Source: FalconFeeds.io Report[/caption] Some of the major organizations impacted due to cyberattacks in India this year includes Eicher Motors Limited, Telangana Police, Tamil Nadu Labour Department and the National Disaster Management Authority, the report said. Mitigations and Recommendations of Report The report called for regular security audits to identify and address vulnerabilities, educate employees about phishing, social engineering, and other common attack vectors and encryption of sensitive data both at rest and in transit. It also suggested implementing Multi-Factor Authentication (MFA) to add an extra layer of security for accessing systems and data, developing and regularly update an incident response plan to quickly address any breaches or leaks, participating in threat intelligence sharing communities to stay informed about the latest threats, implementing network segmentation to limit the spread of malware and restrict unauthorized access to sensitive data. Among other recommendations include regularly backing up critical data and ensuring that backup systems are secure and tested and implementing advanced monitoring and detection tools to identify and respond to suspicious activities in real time. “The cyberattacks in India from January to July 2024 underscore the urgent need for enhanced cybersecurity measures across all sectors. By understanding the trends, impacts, and mitigation strategies outlined in this report, organizations can better prepare to defend against future threats,” the report concluded.

Financial Stability: CFOs Leveraging Threat Intelligence

cyberexpress Jul 30, 2024 Cybersecurity News

In an era of increasing cyber threats and financial volatility, threat intelligence solutions can help chief financial officers (CFOs) bolster financial stability in their organizations by staying ahead of scams, fraud, impersonation and other financial risks. By harnessing the advanced data analysis and risk show more ...

assessment tools that threat intelligence offers, CFOs can be better equipped to navigate the complex landscape of financial risks and compliance and cybersecurity challenges. CFOs Leveraging Threat Intelligence for Financial Stability Threat intelligence, once the domain of IT departments, has become a crucial asset for financial leaders. It provides real-time insights into potential threats, enabling CFOs to make informed decisions about risk management and resource allocation. CFOs are increasingly adopting a proactive stance on risk management, leveraging threat intelligence to identify and mitigate potential financial risks before they materialize. This approach involves: Continuous monitoring: Implementing systems that track financial markets, regulatory changes, and industry trends in real-time. Scenario planning: Using data-driven models to simulate various risk scenarios and develop contingency plans. Supply chain resilience: Analyzing supplier and partner networks to identify vulnerabilities and diversify risks. By integrating threat intelligence into their financial planning processes, CFOs can create more robust and adaptable financial strategies. This proactive approach not only protects against potential losses but also positions companies to capitalize on opportunities that may arise from market shifts. Embracing AI and ML in Finance The days of AI being a luxury for large corporations are behind us. According to Deloitte's State of AI in the Enterprise report, the 'early adopter' phase is ending, and about half of respondents (47%) are 'skilled' in their AI efforts, while 26% are categorized as 'seasoned.' CFOs recognize the potential of AI to boost productivity, accuracy, and growth, and are eager to explore its capabilities. In Deloitte's North American CFO Signals survey, titled "Accelerated business digitization," including AI was one of the top strategic shifts CFOs said their companies were making in response to the turbulent economic environment. AI's value extends beyond back-office applications, where it can automate tasks, improve accuracy, and eliminate human bias. By partnering with the commercial side of the business, AI and ML can produce insights and boost predictability, providing increasingly accurate predictions about customer behavior and supplier performance that can help CFOs manage financial risk. However, AI's capacity for learning depends on the volume and quality of data it receives, in addition to how well it is aligned with the problem. To implement AI and ML for threat intelligence and financial risk management, CFOs must address several key considerations: Data Governance: CFOs must assess and mitigate any quality issues involving data, undertaking data-cleansing initiatives to boost integrity and accuracy. This includes addressing data governance issues and internal wrangling over data access. Identifying Early Use Cases: CFOs should identify specific problems and define desired outcomes to measure the technology's impact early on. Streamlining back-office activities, such as transaction processing, may yield a financial return in the short term, but high-impact risk reduction may require more careful consideration. Developing In-House Expertise: CFOs can outsource technical expertise to managed AI services providers, enabling finance to focus on excavating data from functional silos. Developing in-house expertise can begin with prioritizing AI-related skills in recruitment and training. Choosing Between Building and Buying: CFOs should collaborate with their technology counterparts to determine whether to partner with third-party AI providers, develop solutions internally, or pursue a hybrid approach. Uses of Threat Intelligence in Financial Risk Management Threat intelligence plays a crucial role in strengthening an organization's financial operations: Targeted investments: CFOs can allocate resources more effectively by focusing on the most pressing cybersecurity threats identified through intelligence gathering. Fraud prevention: Advanced analytics help detect patterns indicative of financial fraud, cyber attacks, compromised card detection, suspicious domains, and other threats. Regulatory compliance: Staying ahead of evolving cybersecurity regulations and industry standards, as well as identifying vulnerabilities and the necessary controls to meet those requirements. Dark Web Monitoring: Dark Web Monitoring provides additional benefits to CFOs in the form of early threat detection, real-time alerts and data exposure reports. Brand intelligence: Stay on top of impersonation, phishing and fraudulent domains, and some threat intelligence services like Cyble offer takedown services. By taking a cross-functional, integrated approach to threat intelligence, CFOs can unlock its full potential and drive financial security. Cyble's financial threat intelligence services, powered by artificial intelligence and human expertise to monitor vast amounts of data and risks, can help CFOs in these activities as an ideal solution to combat threats to financial operations.

Fake leaks of passwords and seed phrases are scammers' new weapons | Kaspersky official blog

kaspersky Jul 30, 2024 Threats

We spent several months researching a new and very smart crypto scam, where the victims were slowly, craftily encouraged to install a malicious crypto management app. However, the ones who got scammed were only nominally victims, because the operators, like some digital Robin Hoods, targeted… other pilferers. Take show more ...

an in-depth look at this scam with us and learn how to protect your cryptocurrency. The initial bait It all started with my receiving a fairly trivial forwarded Telegram message about cryptocurrency. Others might have ignored it, but being the web content analysts team lead at Kaspersky, I smelled a rat and decided to look into it. To evade detection, the message was presented as a five-second-long video clip, which contained a screenshot showing a hasty, heavily discounted sale of two lucrative crypto projects with respective links thereto. Likely designed to give the recipient a false sense of security, the first link led to a real second-tier crypto exchange — albeit a small one. The real bait was hiding behind the other link. The screenshot of the crypto project sale announcement is wrapped into a five-second-long video clip. Thats a red flag! A convenient server malfunction Contrary to what could be expected, following the other link didnt bring up any malicious content. Things were far more interesting: if you entered the address expecting to see a home page, the browser displayed a root directory listing with some enticing file names in it. It appeared as if the server had been misconfigured, or the home page accidentally had been deleted, revealing all of the unsuspecting domain owners data. You could click any file in the list and view its contents right in the browser, because, conveniently, all of them had common, easy-to-handle formats, such as TXT, PDF, PNG or JPG. A visitor sees a list of files in the root folder. There isnt a single HTML file This made a visitor feel like theyd landed inside the personal data folder of a rich but dimwitted owner of some crypto project. The text files contained wallet details complete with seed phrases, and the images were screenshots showing proof of a large amount in cryptocurrency being successfully sent, substantial wallet balances, and the owners lavish lifestyle. The text file contains carefully collected addresses, logins, passwords, seed phrases, recovery keys, PINs and private keys One of the screenshots had a YouTube video in the background, explaining how to buy yachts and Ferraris with Bitcoin. A PDF catalog of these yachts could easily be found in the same directory. In a nutshell, this was seriously juicy bait. The screen shows a snapshot from the life of a rich slacker. So, what is the CORRECT WAY to buy the Ferrari and Yacht with Bitcoin? Real wallets and cash Whats smart about this scam is that the wallet details are real, and one indeed can access the wallets and view, say, the Exodus transaction history or the assets in the other wallets, worth nearly 150,000 US dollars, according to DeBank. The Exodus wallet is empty, but its real, and someone used it quite recently You wouldnt be able to withdraw anything, though, as the funds are staked — that is, basically tied up in the account. Nonetheless, this makes the visitor far less skeptical: the whole thing seems to be someones carelessly leaked real data, not spam or phishing. Besides, there are no external links or malicious files to be seen anywhere — nothing to be suspicious about! The amounts in the other wallets are hefty. Too bad the funds are staked (locked) We monitored the site for two months, seeing no changes whatsoever. The scammers seemed to be waiting for a critical mass of interested users to build up while tracking their behavior with web server analytics. It was only after this lengthy warm-up period that they proceeded to the next stage of the attack. A new hope The dramatic two-month pause was at last ended with an update: a fresh Telegram screenshot purportedly showing a successful Monero payout. If one took a closer look at the screenshot, one would notice an Electrum-XMR wallet app with a transaction log and a sizable balance of almost 6000 Monero tokens (XMR), worth about a million dollars at the time of publishing this. The active phase kicks off: a wallet seemingly containing about a million dollars By a lucky coincidence, a new text file with the seed phrase for the wallet popped up right next to the screenshot. The seed phrase for the wallet was the bait At this point, anyone dishonest enough rushed to download an Electrum wallet to log in to the careless dupes account and grab the remaining money. Tough luck: Electrum only supports Bitcoin, not Monero, and it takes a private key (and not a seed phrase) to regain access to an account. When attempting to restore the key from the seed phrase, every legitimate converter said the seed phrase format was invalid. Yet greed was clouding the users judgment: after all, there was a million dollars at stake, and they needed to hurry before someone else stole it. The fast-buck artists went googling Electrum XMR or simply Electrum Monero. Whichever it was, the top result was a website ostensibly about an Electrum fork that supported Monero. The right version of the wallet appears at the top of the search results Its design resembled that of the original Electrum website, and, in typical open-source fashion, it featured all kinds of descriptions, links to GitHub (the original Electrum repository, though — not Electrum-XMR), a note that explicitly said this was a fork to support Monero, and handy direct links to macOS, Windows and Linux installers. The website for the fake wallet app is very well made Which is when the hunter unwittingly becomes the prey. Downloading and installing Electrum-XMR infects the computer with malware identified by Kaspersky as Backdoor.OLE2.RA-Based.a, which provides attackers with covert remote access. What they do next is probably scanning the contents of the machine and stealing crypto wallet data and any other valuable information. Our security solution would have blocked the malicious website, let alone an attempt to the install the Trojan, but crypto hunters eager to lay their hands on other peoples money are hardly among our users. Our security blocks the malicious site, let alone an attempt to the install the Trojan All of a sudden, a second iteration Some time later, when we were done investigating this feat of social engineering, we received another bit of bait, which was hardly a surprise. This time around, the scammers switched from slow steaming to searing. The screenshot showed a fake wallet with a large balance next to an open text file containing a wealth of personal information and a thoughtfully added link to a malicious site. It looks like this scam has apparently proved to work well, and were in for lots of similar attacks. Version two saw the scammers get right down to it by collecting all relevant information in one screenshot Recognizing the attack Victims of the scam we discussed above evoke no sympathy at all, seeing how they took the bait by trying to steal other peoples money. However, the scammers keep coming up with new tricks, and next time, you might be offered an ostensibly ethical way of making money. For example, you might accidentally get a screenshot advertising a lucrative airdrop, with the link right in the address bar… So, stay alert, and take any information with a large pinch of salt. Each stage in the attack was suspicious in its own way. The website sale ad was presented in the form of a video clip with a screenshot, obviously to get around anti-spam algorithms. A website that contains nothing but unencrypted text files with crypto wallet data in these looks too good to be true. The domain purportedly hosting the crypto wallet fork had been registered just two months before the attack. Most importantly, however, the scam-filled crypto landscape makes using little-known wallet apps an unacceptable risk. Thus, follow these steps: Use only major, tried-and-true crypto wallet apps and exchange websites. Carefully check that youre signing in only through official sites and downloading apps from the right sources. Read our tips for spotting online scammers. Use comprehensive computer and smartphone protection thatll keep you from going to phishing sites or running malware. Subscribe to our blog and/or Telegram channel to be the first to learn about new threats.

The CrowdStrike Meltdown: A Wake-up Call for Cybersecurity

darkreading Jul 30, 2024 Feed

The incident serves as a stark reminder of the fragility of our digital infrastructure. By adopting a diversified, resilient approach to cybersecurity, we can mitigate the risks and build a more secure digital future.

Criminal Hackers Add GenAI Credentials to Underground Markets

darkreading Jul 30, 2024 Feed

According to the study, around 400 stolen GenAI credentials are being sold by threat actors per day.

Cyberattackers Accessed HealthEquity Customer Info via Third Party

darkreading Jul 30, 2024 Feed

Data thieves heisted the HSA provider's data repository for 4.5 million people's HR information, including employer and dependents intel.

Ransomware Gangs Exploit ESXi Bug for Instant, Mass Encryption of VMs

darkreading Jul 30, 2024 Feed

With sufficient privileges in Active Directory, attackers only have to create an "ESX Admins" group in the targeted domain and add a user to it.

Clutch Security Launches With NHI Platform

darkreading Jul 30, 2024 Feed

Clutch Security is the latest cybersecurity startup looking to secure and manage non-human identity.

Microsoft 365 Users Targeted by Phishers Abusing Microsoft Forms

cyware Jul 30, 2024 Identity Theft, Fraud, Scams

The phishing campaigns involve sending fake emails that appear to be from Microsoft, leading recipients to malicious Microsoft Forms impersonating Microsoft 365 or Adobe login pages.

Malware Campaign Lures Users With Fake W2 Form

cyware Jul 30, 2024 Malware and Vulnerabilities

A malicious campaign targeting users searching for W2 forms began on June 21, 2024, with a JavaScript file dropping a Brute Ratel Badger DLL into the user's AppData. This initiated the installation of a Latrodectus backdoor.

RaspAP Flaw Let Hackers Escalate Privileges with Raspberry Pi Devices

cyware Jul 30, 2024 Malware and Vulnerabilities

The flaw, identified as CVE-2024-41637, affects RaspAP versions before 3.1.5 and has a severity score of 9.9. The vulnerability stems from improper access controls, enabling attackers to escalate privileges from www-data to root.

Microsoft Warns of Ransomware Gangs Abusing VMware ESXi Authentication Bypass in Attacks

cyware Jul 30, 2024 Malware and Vulnerabilities

Ransomware operators like Black Basta and Akira have already used this vulnerability in attacks, with Storm-0506 deploying Black Basta ransomware on the ESXi hypervisors of a North American engineering firm.

Hotjar, Business Insider Vulnerabilities Expose OAuth Data Risks

cyware Jul 30, 2024 Malware and Vulnerabilities

Critical vulnerabilities within Hotjar and Business Insider have been uncovered by security researchers, posing risks for enterprises. These vulnerabilities highlight a broader issue with XSS flaws reintroduced by new technologies, increasing risks.

Attackers Bypassed Google’s Email Verification to Create Workspace Accounts, Access Third-Party Services

cyware Jul 30, 2024 Malware and Vulnerabilities

The issue, which began in late June, affected a few thousand Workspace accounts that were created without domain verification. Google has since fixed the problem and added more security measures to prevent similar bypasses in the future.

Meta's AI Safety System Manipulated by Space Bar Characters to Enable Prompt Injection

cyware Jul 30, 2024 Innovation and Research

A bug hunter discovered a bypass in Meta's Prompt-Guard-86M model by inserting character-wise spaces between English alphabet characters, rendering the classifier ineffective in detecting harmful content.

US State Department Says UN Cybercrime Treaty Must Include Human Rights Protections

cyware Jul 30, 2024 Geopolitical, Terrorism

The U.S. State Department emphasized the importance of including human rights protections in the upcoming United Nations cybercrime treaty. The final round of negotiations for the treaty, which began on Monday and will conclude on August 9, 2024.

SideWinder Utilizes New Infrastructure to Target Ports and Maritime Facilities in the Mediterranean Sea

cyware Jul 30, 2024 Threat Actors

The recent attacks by the SideWinder APT group use phishing lures related to emotional topics like sexual harassment and salary cuts to trick victims into opening booby-trapped Microsoft Word documents.

Change Healthcare Begins to Notify Millions Affected by Hack

cyware Jul 30, 2024 Incident Response, Learnings

Change Healthcare has started the process of notifying millions of Americans affected by a massive cyberattack and data theft that occurred more than five months ago. The company is sending individual breach notification letters on a rolling basis.

New PowerShell Backdoor Linked to Zloader Malware

cyware Jul 30, 2024 Malware and Vulnerabilities

The newly discovered backdoor has limited samples available on VirusTotal, making detection more difficult. It operates by collecting system information and sending it to a command and control server, awaiting further instructions.

Cowbell Secures $60 Million Series C Funding From Zurich Insurance Group

cyware Jul 30, 2024 Companies to Watch

This investment will allow Cowbell to expand its operations, enter key global markets, enhance cyber resilience services, introduce innovative products, and strengthen partnerships.

European Central Bank Concludes Banking Cyber Stress Test

cyware Jul 30, 2024 Govt., Critical Infrastructure

The European Central Bank has completed a cyber stress test for the banking sector, finding that while banks have strong response frameworks, there is still room for improvement in recovery capabilities.

Crafty ClickFix-Style Phishing Campaign Targets Microsoft OneDrive Users

cyware Jul 30, 2024 Identity Theft, Fraud, Scams

The attackers use social engineering tactics to get users to run a PowerShell script, compromising their systems. The scam starts with an email containing an HTML file that tricks the recipient into clicking on a button to fix a fake DNS issue.

Massive Phishing Campaign Exploiting Proofpoint’s Email Protection to Dispatch Millions of Perfectly Spoofed Emails

cyware Jul 30, 2024 Identity Theft, Fraud, Scams

The campaign began in January 2024 and peaked at 14 million emails in June. The emails were designed to steal sensitive information and included authentic-looking signatures to bypass security measures.

Hackers Exploit VMware Vulnerability That Gives Them Hypervisor Admin

packetstormsecurity Jul 30, 2024 headline,hacker,flaw

Malaysia Is Working On An Internet Kill Switch

packetstormsecurity Jul 30, 2024 headline,government,denial of service,so

40 Million UK Voters Hacked Due To Security Lapses

packetstormsecurity Jul 30, 2024 headline,government,privacy,britain,data

NIST Releases Open Source Platform For AI Security Testing

packetstormsecurity Jul 30, 2024 headline,government,usa