Oktacron - Cyber Security RSS Feeds History

Massive Data Leak at Star Health: 31 Million Customers Affected

cyberexpress Oct 10, 2024 Firewall Daily

Claims of an insider threat have emerged from the data breach at Star Health and Allied Insurance Company. An employee reportedly offered direct illegal API access to the company's full customer medical records for $43,000. When the buyer hesitated, the employee escalated the demand to $150,000, claiming that show more ...

"senior management" wanted a cut. The alleged attempt at white-collar crime ultimately backfired, as the buyer chose to blow the whistle instead. In September 2024, the fallout from this insider deal transformed into a massive Star Health cyberattack. A threat actor, using the alias "xenZen," launched self-hosted data leak bots on Telegram announcing a full leak of Star Health's customer data. This claim, made on the platform, asserted that the data was "sponsored" by Star Health, who had allegedly sold the sensitive information directly to the hacker. Key Data Compromised in Star Health Cyberattack According to xenZen, the extent of the data breach is staggering: 7.24 terabytes of information covering over 31 million customers. The data leaked includes comprehensive personal and medical records, insurance claims, and sensitive identifiers like Aadhaar and PAN card photos, detailed medical reports, and more, reported The Hindu. The specifics of the Star Health data breach reveal a concerning level of exposure. The leaked data encompasses an astonishing 31,216,953 customer records and 5,758,425 insurance claims. Alongside these figures, the breach includes a wide array of personal identifiers, such as full names, mobile numbers, email addresses, and residential addresses. Moreover, sensitive medical details have also been compromised, including information about pre-existing conditions and health reports. The sheer volume of information involved raises significant questions about the company's data security measures and its ability to protect customer privacy effectively. The Immediate Aftermath As news of the breach spread, Star Health faced immediate repercussions. Shares of the company fell by 1.7%, trading at ₹568.1, a reflection of the investor panic following the breach. The stock has seen only a 4% rise in 2024 and remains down 37% from its IPO price of ₹900 (10.72 United States Dollar). Star Health issued a statement characterizing itself as a victim of a "targeted malicious cyberattack," and has initiated a comprehensive forensic investigation led by independent cybersecurity experts. The investigation aims to determine the scope of the Star Health data breach and identify responsible parties. In a twist that adds intrigue to the situation, allegations have surfaced that claim Star Health's Chief Information Security Officer (CISO) may have been involved in selling the leaked data. While Star Health maintains that no wrongdoing has been confirmed against the CISO, the company has committed to transparency, stating it is collaborating with government and regulatory authorities throughout the investigation. To mitigate further risks, the Madras High Court has directed relevant parties to disable access to the leaked information, emphasizing the need for immediate remedial action. Conclusion This Star Health cyberattack also draws attention to the role of platforms like Telegram in facilitating the distribution of stolen data. Following criticisms directed at Telegram’s founder, Pavel Durov, regarding the platform's enabling of illegal activities, the Star Health incident highlights the challenges of regulating digital communication tools that can serve as avenues for cybercrime.

Russian SVR Exploiting Unpatched Vulnerabilities in Global Cyber Campaign

cyberexpress Oct 10, 2024 Vulnerabilities

Russian Foreign Intelligence Service (SVR) cyber actors are once again in the spotlight, exploiting widespread vulnerabilities in a global campaign aimed at government, technology, and finance sectors. In a new joint advisory, the UK's National Cyber Security Centre (NCSC) and U.S. agencies warned that SVR cyber show more ...

operations, known for the SolarWinds attack and targeting COVID-19 vaccine research, have shifted their focus to unpatched software vulnerabilities across a range of sectors. “Russian cyber actors are interested in and highly capable of accessing unpatched systems across a range of sectors, and once they are in, they can exploit this access to meet their objectives.” - Paul Chichester, NCSC Director of Operations SVR’s Tactics: A Persistent Global Threat The SVR, also referred to as APT29 or Cozy Bear, has demonstrated an alarming ability to exploit known vulnerabilities, particularly those left unpatched by organizations. The group is infamous for its persistent and stealthy cyber operations, often targeting government entities, think tanks, and private corporations to collect foreign intelligence. One key aspect of their approach is the two types of targets they pursue. The first includes entities of strategic interest such as governments, financial institutions, and technology companies. These "targets of intent" are carefully selected for their intelligence value. The second group, known as "targets of opportunity," consists of any organization with unpatched systems that can be exploited for malicious purposes. SVR Exploiting Unpatched Vulnerabilities at Scale The advisory includes over 20 publicly disclosed vulnerabilities that SVR actors are actively targeting. Organizations across the globe, including those in the UK, are being urged to rapidly deploy patches and prioritize software updates to minimize exposure to these threats. Once SVR actors gain initial access through unpatched systems, they can escalate privileges and move laterally across networks, often compromising connected systems such as supply chains. This enables them to launch further operations, including espionage, data exfiltration, and network disruption. Following is the complete list of unpatched vulnerabilities that Russian SVR was observed exploiting: CVE Vendor/Product Details CVE-2023-20198 Cisco IOS XE Software web UI feature Privilege escalation vulnerability that allows an attacker to create a local user and password combination CVE-2023-4911 RHSA GNU C Library's dynamic loader ld.so Buffer overflow vulnerability that could allow a local attacker to execute code with elevated privileges CVE-2023-38545 Haxx Libcurl SOCKS5 heap buffer overflow vulnerability CVE-2023-38546 Haxx Libcurl Missing authorization vulnerability that allows an attacker to insert cookies in a running program if certain conditions are met CVE-2023-40289 Supermicro X11SSM-F, X11SAE-F, and X11SSE- F 1.66 Command injection vulnerability that allows an attacker to elevate privileges CVE-2023-24023 Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 through 5.4 Allows certain man-in-the-middle attacks that force a short key length [CWE-326], and might lead to discovery of the encryption key and live injection, aka BLUFFS. CVE-2023-40088 Android Use after free vulnerability that could lead to remote (proximal, adjacent) code execution CVE-2023-40076 Google Android 14.0 Permissions bypass vulnerability that allows an attacker to access credentials and escalate local privileges CVE-2023-40077 Google Android 11-14 Use after free vulnerability that can lead to escalation of privileges CVE-2023-45866 Bluetooth HID Hosts in BlueZ Improper authentication vulnerability that could allow an attacker in close proximity to inject keystrokes and carry out arbitrary commands CVE-2022-40507 Qualcomm Double free vulnerability CVE-2023-36745 Microsoft Exchange Server Remote code execution CVE-2023-4966 Citrix NetScaler ADC, NetScaler Gateway Buffer overflow vulnerability CVE-2023-6345 Google Chrome Integer overflow vulnerability that allows a remote attacker to potentially perform a sandbox escape via a malicious file CVE-2023-37580 Zimbra Cross-site scripting (XSS) vulnerability CVE-2021-27850 Apache Tapestry Critical unauthenticated remote code execution vulnerability CVE-2021-41773 Apache HTTP server 2.4.99 Directory traversal vulnerability CVE-2021-42013 Apache HTTP server 2.4.50 Remote code execution vulnerability CVE-2018-13379 Fortinet FortiGate SSL VPN Path traversal vulnerability CVE-2023-42793 JetBrains TeamCity Authentication bypass vulnerability CVE-2023-29357 SharePoint Server Elevation of privilege vulnerability CVE-2023-24955 SharePoint Server Remote code execution vulnerability CVE-2023-35078 Ivanti Endpoint Manager Mobile versions through 11.10 Authentication bypass vulnerability CVE-2023-5044 Kubernetes Ingress-nginx Code injection vulnerability Not Just a Cybersecurity Threat: Broader Implications The report also sheds light on how SVR actors adapt their techniques to keep pace with evolving technology. The NCSC warns that the group has adjusted its approach in response to the increasing reliance on cloud infrastructure, exploiting cloud misconfigurations and weak security practices. This makes them a formidable adversary for organizations that are migrating or already relying heavily on cloud services. SVR actors have also been linked to recent large-scale attacks, including the supply chain compromise of SolarWinds and a series of spear-phishing campaigns targeting COVID-19 vaccine research. These incidents demonstrate the group's focus on strategic assets and their potential to impact national security and public health. APT29's Arsenal: From Phishing to Supply Chain Attacks The advisory also outlines the tactics, techniques, and procedures (TTPs) employed by SVR cyber actors. Their arsenal includes spear-phishing campaigns, password spraying, supply chain attacks, and the abuse of trusted relationships. These methods allow them to gain initial access and conduct follow-up operations from compromised accounts. For instance, in recent campaigns, SVR actors were found to exploit cloud environments using Microsoft Teams accounts impersonating technical support to trick victims into granting access. By compromising poorly secured small business accounts, they were able to create platforms for targeting high-profile organizations. Infrastructure and Evasion Tactics SVR cyber actors are known for their ability to remain undetected for extended periods. They frequently use The Onion Router (TOR) network and proxy services to obfuscate their activity. In some cases, they lease infrastructure using fake identities and low-reputation email accounts to avoid detection. When SVR suspects that their operations have been uncovered, they move quickly to destroy their infrastructure and any evidence on it. This evasive approach makes it difficult for investigators to trace their operations back to the original source. Recent Exploitations: Zimbra, JetBrains, and More SVR actors have also been involved in exploiting several high-profile vulnerabilities. For example, the advisory mentions the exploitation of Zimbra mail servers using CVE-2022-27924, a command injection vulnerability that allowed attackers to access user credentials without victim interaction. More recently, they exploited JetBrains TeamCity’s CVE-2023-42793 vulnerability, enabling arbitrary code execution. This kind of exploitation highlights SVR’s focus on widely used software systems, allowing them to infiltrate a broad range of sectors and geographies. Mitigations: What Organizations Can Do In light of these ongoing campaigns, the NCSC and U.S. agencies have provided several recommendations to help organizations defend against SVR cyber actors. These include: Rapid deployment of patches and updates: Organizations should prioritize software updates as soon as they become available to close known vulnerabilities. Multi-factor authentication: Implementing multi-factor authentication across networks and systems can reduce the risk of unauthorized access. Auditing cloud accounts: Regularly auditing cloud-based accounts for unusual activity can help detect intrusions before they escalate. Reducing attack surface: Disable unnecessary internet-facing services and remove unused applications to limit points of entry for attackers.

Data Breaches Exposed in Hyundai’s IPO: A Look at Their Cybersecurity Posture

cyberexpress Oct 10, 2024 Firewall Daily

Hyundai's recent IPO documents shed light on the company's cybersecurity posture, revealing the challenges it has faced in protecting customer data. The red herring prospectus for Hyundai Motor India Ltd (HMIL) not only outlines the automaker's financial health but also highlights cybersecurity incidents, show more ...

providing a transparent view of its risk management strategies. The IPO of Hyundai comes at a time when cybersecurity is a crucial concern for businesses worldwide, particularly in the automotive industry, which increasingly relies on connected technology. The documents specifically mention two notable breaches of customer data: one in December 2022 and another in February 2023. Both incidents involved hackers posting customer information on the dark web. Hyundai IPO: Major Cybersecurity Insights In December 2022, we experienced a customer data leak where sensitive information was posted online. After this incident, we conducted thorough penetration testing and successfully removed the compromised data from the dark web," reported Autocar Professional. In response to the second incident in February 2023, Hyundai took immediate action by identifying and disabling the vulnerable application programming interfaces (APIs) that hackers had exploited. The Hyundai IPO prospectus emphasizes the ongoing challenge of securing data from cyberattacks. While we have implemented measures to address these vulnerabilities, there is no guarantee that such actions will prevent future incidents. Hackers may still attempt unauthorized access to our networks and systems, potentially compromising vehicle functionality and customer data," the document warns. This acknowledgment of vulnerability is crucial for potential investors, especially considering that a failure to safeguard data could expose Hyundai to legal liabilities. The company has been proactive in outlining its cybersecurity initiatives, highlighting that protecting customer data is a top priority for companies. Next Set of Steps for Hyundai Cybersecurity Posture Hyundai’s approach to cybersecurity involves a comprehensive strategy, including the operation of its own data center, complete with a disaster recovery site designed to protect critical business information. This infrastructure is overseen by dedicated IT personnel, ensuring that data security is consistently maintained. The automaker has also implemented several technical measures, including multi-level authentication protocols to control access, regular software updates to patch vulnerabilities, and malware protection systems. Moreover, Hyundai has established a dedicated team responsible for managing vulnerabilities and monitoring cyber threats around the clock. This proactive stance is essential in an era where cyberattacks are increasingly sophisticated and prevalent, particularly given the rise of connected vehicles and the Internet of Things (IoT). Hyundai also adheres to national and international security standards, continuously updating its policies and procedures to keep pace with the evolving nature of cyber risks. This commitment to cybersecurity is not just about protecting data; it reflects a broader recognition that consumer trust is paramount in maintaining brand integrity, especially as the company embarks on its IPO journey. In the context of the Hyundai cyberattack incidents, it becomes evident that the automotive sector must remain vigilant in protecting sensitive information. As companies like Hyundai store vast amounts of customer data, the potential for exploitation becomes a pressing concern.

Iran-Affiliated Hackers CyberAv3ngers Use ChatGPT to Plan Industrial Attacks

cyberexpress Oct 10, 2024 Cyber Warfare

Iran's state-linked hackers have become tech-savvy prompt engineers. What started as a reconnaissance exercise using AI models quickly escalated into something more sinister, as the threat actors used AI tools to improve and refine their tools and techniques. The Iranian Islamic Revolutionary Guard Corps show more ...

(IRGC)-linked group "CyberAv3ngers" has been using AI models like ChatGPT to fuel a fresh wave of cyberattacks against industrial control systems (ICS) and programmable logic controllers (PLCs). OpenAI's latest findings suggest that as these attackers push the boundaries of cyber warfare, their activities reflect the growing convergence of artificial intelligence and nation-state hacking. According to OpenAI, CyberAv3ngers accessed AI tools to assist with their reconnaissance, coding efforts, and vulnerability research. The AI-powered models were not simply a passive source of information. Instead, the group actively sought guidance on debugging scripts and gathering intelligence on known ICS vulnerabilities. CyberAv3ngers Targets Critical Infrastructure CyberAv3ngers’ operations have recently known to be focused on high-value targets in Israel, the U.S., and Ireland, leveraging open-source tools to exploit weaknesses in water systems, energy grids, and manufacturing facilities. In late 2023, they disrupted water services in County Mayo, Ireland, and infiltrated the Municipal Water Authority of Aliquippa in Pennsylvania. The U.S. State Department also identified six Iranian hackers linked to this threat group who were involved in a series of cyberattacks on U.S. water utilities. The department has kept a substantial reward for any information on these hackers. These breaches show the threat group's ability to exploit poorly secured industrial networks using default passwords and known vulnerabilities in PLCs. CyberAv3ngers specialize in disrupting critical infrastructure, targeting weak spots within ICS, which often manage key operations in water, energy, and manufacturing sectors. Their actions pose a direct threat to national security, leveraging a blend of AI-powered insights and traditional attack methods. Reconnaissance and Scripting via AI The hackers’ reliance on large language models (LLMs) reflects a growing trend among cyber actors to automate parts of the attack lifecycle. Through these AI tools like ChatGPT, CyberAv3ngers sought default password combinations for various industrial devices, explored industrial routers used in regions like Jordan, and refined scripts designed to probe network vulnerabilities. Each request represented a calculated effort to enhance their toolkit for executing ICS-specific attacks. "While previous public reporting on this threat actor focused on their targeting of ICS and PLCs, from these prompts we were able to identify additional technologies and software that they may seek to exploit," OpenAI said. For example, the group used AI to assist in writing bash and Python scripts, refining existing public tools, and obfuscating malicious code. By leveraging these capabilities, CyberAv3ngers boosted their ability to evade detection and further expand their arsenal for targeting industrial networks. AI-Driven Exploits: A Limited Yet Dangerous Utility While CyberAv3ngers exploited LLMs to aid their campaigns, the information they retrieved was not groundbreaking. Much of the knowledge they accessed could have been found through traditional methods like search engines or publicly available cybersecurity resources. The AI’s role, in this case, was incremental, helping them automate tedious tasks rather than providing entirely novel exploits. That said, their reliance on AI showcases the potential perils of using machine learning to support nation-state hacking. Even limited incremental gains can have significant ramifications when deployed against critical infrastructure. What Lies Ahead? The use of AI tools for hacking ICS reveals the next step in cyber warfare, which now seems to be shifting from information warfare to strategizing full blown cyberattacks. Nation-state actors like CyberAv3ngers are turning to AI to expedite attack preparation, probing industrial systems with efficiency and scale that was previously unimaginable. This emerging trend challenges traditional security measures and demands that security professionals, particularly in sectors like energy and water, adopt new defenses against AI-assisted attacks. As AI models grow more sophisticated, the risks increase. What’s crucial now is how organizations can anticipate and mitigate these AI-driven threats. Proactive measures, such as strengthening passwords, closing well-known vulnerabilities, and continuously monitoring ICS networks, can help organizations stay ahead of attackers. In an era where cyberattacks can disrupt entire cities' water supplies or cause significant damage to energy grids, the stakes have never been higher. Security professionals need to view AI as both a tool for defenders and a weapon for attackers. CyberAv3ngers’ recent activities prove that AI, while a powerful tool for innovation, also opens new doors for malicious actors seeking to compromise critical infrastructure. It's time for the cybersecurity community to close those doors before it's too late.

SEC Charges Companies and Individuals in Major Crypto Asset Fraud

cyberexpress Oct 10, 2024 Firewall Daily

The U.S. Securities and Exchange Commission (SEC) has announced fraud charges against three companies and nine individuals involved in crypto market manipulation schemes. This scheme was to manipulate the markets for various crypto assets offered and sold as securities to retail investors. The defendants allegedly show more ...

deceived investors by creating the false appearance of active trading markets for these assets, luring them into making purchases based on manipulated trading volumes and prices. Fraudulent Crypto Market Manipulation Schemes The SEC's complaints outline that the crypto asset promoters — Russell Armand, Maxwell Hernandez, Manpreet Singh Kohli, Nam Tran, and Vy Pham — collaborated with three entities, ZM Quant, Gotbit, and CLS Global, which claimed to be market makers, to manipulate the trading activity of crypto assets. These companies allegedly provided "market-manipulation-as-a-service" to artificially inflate the trading volume and price of the crypto assets that the promoters offered to retail investors in unregistered transactions. As described in the SEC’s filings, ZM Quant and Gotbit, under the employ of the promoters, manipulated the markets by generating artificial trading volume through self-trading, or wash trading, which involves buying and selling the same asset to create the illusion of market activity. The SEC also alleged that CLS Global carried out a similar scheme in relation to another crypto asset created under the direction of the Federal Bureau of Investigation (FBI) as part of a separate probe into crypto asset market manipulation. According to the SEC, these fraudulent activities misled retail investors by fostering the belief that the crypto assets were being actively traded and had strong market demand, when in reality, the trading activity was fabricated and served no economic purpose. In some instances, the defendants employed algorithms, or trading bots, that generated vast numbers of transactions, producing up to quadrillions of transactions and billions of dollars in artificial trading volume per day on popular crypto trading platforms. SEC Enforcement and Statements The SEC's actions aim to hold the perpetrators accountable for their fraudulent schemes, which the agency claims victimized retail investors by enticing them with false promises of profitability in the volatile crypto markets. Sanjay Wadhwa, Deputy Director of the SEC’s Division of Enforcement, emphasized the significance of the charges, stating: “Today’s enforcement actions demonstrate, once more, that retail investors are being victimized by fraudulent activity by institutional actors in the markets for crypto assets. With purported promoters and self-anointed market makers teaming up to target the investing public with false promises of profits in the crypto markets, investors should be mindful that the deck may be stacked against them.” The SEC highlighted the growing concern over the ease with which the crypto asset market can be manipulated, especially as crypto assets continue to be offered and sold to the public as securities. Jorge G. Tenreiro, Acting Chief of the Division of Enforcement’s Crypto Asset and Cyber Unit (CACU), expressed concerns over the scale of the deception: “The wrongdoers behind these schemes are profiting handsomely at the expense of investors that have been deceptively lured into these markets and lost their hard-earned savings. We remain committed to rooting out instances of such misconduct when it involves securities.” Legal Action and Charges The SEC’s five complaints were filed in the United States District Court for the District of Massachusetts. The complaints charge all defendants with violating the antifraud and market manipulation provisions of U.S. securities laws, and some defendants are further accused of violating registration requirements. The SEC is seeking various forms of relief in these cases, including: Permanent injunctions to prevent the defendants from continuing to violate securities laws. Conduct-based injunctions to prohibit specific behaviors related to market manipulation. Disgorgement of ill-gotten gains, with interest, to recoup the profits made through illegal activities. Civil penalties to deter future violations. Officer and director bars against certain defendants to prevent them from serving in leadership positions in any companies subject to SEC regulation. In a significant development, three of the key defendants — Armand, Hernandez, and Pham — have agreed to settle the charges under bifurcated settlements. This settlement, which is pending court approval, would permanently enjoin them from further violations of federal securities laws and subject them to conduct-based injunctions. Additionally, they would be barred from serving as officers or directors of any public companies. The court will later determine the final amounts for disgorgement, prejudgment interest, and civil penalties for these defendants. FBI and Parallel Criminal Actions In a parallel criminal investigation, the Federal Bureau of Investigation (FBI) and the United States Attorney’s Office for the District of Massachusetts have also taken action against the individuals involved in these fraudulent schemes. The SEC has praised the cooperation between agencies, which has enabled both civil and criminal proceedings to be brought against the perpetrators. These cases represent a broader strategy by regulatory and law enforcement agencies to clamp down on market manipulation in the increasingly popular and, at times, volatile world of crypto assets. As the SEC continues to monitor and investigate fraudulent activity in the crypto space, these enforcement actions serve as a warning to would-be manipulators that their actions will not go unnoticed or unpunished. Investors, meanwhile, are encouraged to remain cautious and thoroughly research crypto markets offerings before committing their funds.

Walking the Tightrope Between Innovation & Risk

darkreading Oct 10, 2024 Feed

When employees and leaders engage with CISOs early in innovation projects, security concerns are addressed proactively, building trust and ensuring innovation and security coexist.

Vulnerability Prioritization & the Magic 8 Ball

darkreading Oct 10, 2024 Feed

Vulnerability prioritization has evolved over the years. Several frameworks exist to help organizations make the right decisions when it comes to deciding which patches to apply and when. But are these better than a Magic 8 Ball?

Microsoft: BYOD, QR Codes Lead Rampant Education Attacks

darkreading Oct 10, 2024 Feed

The average higher education institution is getting hit once a week now, and as one University of Oregon attack shows, the sector often lacks the resources to keep pace.

AI-Powered Cybercrime Cartels on the Rise in Asia

darkreading Oct 10, 2024 Feed

All across the Asia-Pacific region, large and diverse marketplaces for AI cybercrime tools have developed, with deepfakes proving most popular.

Google Launches Data-Sharing Initiative to Fight Fraud

darkreading Oct 10, 2024 Feed

Global Signal Exchange will act as a global clearing house for online scams and fraud signals.

Microsoft Previews New Windows Feature to Limit Admin Privileges

darkreading Oct 10, 2024 Feed

In its latest Windows preview, Microsoft adds a feature — Administrator Protection — designed to prevent threat actors from easily escalating privileges and restrict lateral movement.

Fidelity Notifies 77K Customers of Data Breach

darkreading Oct 10, 2024 Feed

The third-party actor had access for two days, in the financial services company's second major breach of the year.

EU Plans Sanctions for Cyberattackers Acting on Behalf of Russia

darkreading Oct 10, 2024 Feed

The European Union's new sanctions framework will target individuals and organizations engaging in pro-Russian activities such as cyberattacks and information manipulation to undermine EU support for Ukraine.

Critical Mozilla Firefox Zero-Day Allows Code Execution

darkreading Oct 10, 2024 Feed

The bug is already being exploited in the wild, but Firefox has provided patches for those who may be vulnerable.

Internet Archive Leaks User Info And Succumbs To DDoS

packetstormsecurity Oct 10, 2024 headline,hacker,privacy,denial of servic

Siemens Device PIN Susceptible To Remote Brute Force In Older Model

packetstormsecurity Oct 10, 2024 headline,flaw

Doctor Web Refutes Hackers' Claim Of User Data Theft

packetstormsecurity Oct 10, 2024 headline,hacker,privacy,data loss

CISA Adds Fresh Ivanti Vuln, Critical Fortinet Bug To Hall Of Shame

packetstormsecurity Oct 10, 2024 headline,government,usa,flaw

US Charges 3 Companies, 15 People With Cryptocurrency Fraud

packetstormsecurity Oct 10, 2024 headline,government,usa,fraud,fbi,crypto