Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Critical Infrastructure. Show all posts
User Privacy
Critical Infrastructure Cyber Security Healthcare Sector Patient Data User Privacy

Here's Why Cyber Security is Critical For Healthcare Sector

 

Healthcare organisations provide an essential service that, if disrupted by a cyber attack, could jeopardise patient safety, disrupt care delivery, and even result in death. In the case of a security incident, the implications could impact not only the victim organisation, but also their patients and national security. 

What makes medical device cybersecurity critical?

Unlike traditional computers, medical devices often lack adequate security protections, making them more vulnerable to hacking. These devices frequently rely on hard-coded and typically known passwords, and thus may not be easily patched or updated. 

Complicating matters further, the variety of manufacturers and distribution channels leads to a lack of conventional security controls like passwords, encryption, and device monitoring. The primary security risk is the possible exposure of both data and device control, resulting in a delicate balance between safety and security that necessitates stakeholder collaboration, particularly in implementation and maintenance methods. 

Given that older medical devices were not initially created with cyber security in mind and are difficult to secure properly, healthcare institutions must prioritise and invest in securing these devices. In order to minimise operational disruptions and protect patient safety and privacy, it is imperative to safeguard medical equipment, as the proliferation of newly linked devices exacerbates pre-existing vulnerabilities. 

Mitigation tips

Based on their experience working in healthcare the sector, researchers suggested  safety guidelines for healthcare organisations aiming to strengthen their cyber security:

  • Adopt a proactive strategy to cyber security, addressing people, processes, and technology. 
  • Define clear roles and responsibilities for network and information system security so that employees can take ownership of essential cybersecurity practices. 
  • Conduct regular cyber risk assessments to uncover flaws, evaluate potential threats, and prioritise remedial activities based on the risk to critical systems and patient data.
  • Conduct training programs to raise awareness and prepare for cyber threats. 
  • Establish well-defined policies and procedures as part of your security management system, together with conveniently available documentation to guide your security personnel. 
  • Use defence-in-depth technical controls to effectively guard, detect, respond to, and recover from incidents.
  • Backup and disaster recovery plans are used to ensure the availability and integrity of essential data in the case of a cyberattack, system failure, or data breach. 
  • Medical device security should be addressed explicitly throughout the product/system lifetime.

By implementing these best practices, healthcare companies can fortify their defences, mitigate cyber risks, and safeguard patient data and critical infrastructure from emerging cyber threats.
Read more »
edge computing
Cloud Computing CloudFlare Cloudflare outage Computing Critical Infrastructure Cyber Security Data Safety data security Disruption edge computing

Cloudflare Explains Major Service Outage: Not a Security Breach, No Data Lost

 

Cloudflare has clarified that a widespread outage affecting its global services was not the result of a cyberattack or data breach. The company confirmed that no customer data was compromised during the disruption, which significantly impacted numerous platforms, including major edge computing services and some Google Cloud infrastructure. 

The issue began at approximately 17:52 UTC and was primarily caused by a complete failure of Workers KV, Cloudflare’s globally distributed key-value storage system. As a backbone for its serverless computing platform, Workers KV plays a crucial role in supporting configuration, identity management, and content delivery across many of Cloudflare’s offerings. When it went offline, critical functions across the ecosystem were immediately affected. 

In a post-incident analysis, Cloudflare revealed that the root cause was a malfunction in the storage infrastructure that underpins Workers KV. This backend is partially hosted by a third-party cloud service, which experienced its own outage—directly leading to the failure of the KV system. The ripple effects were far-reaching, disrupting Cloudflare services for nearly two and a half hours. 

Key services impacted included authentication platforms like Access and Gateway, which saw major breakdowns in login systems, session handling, and policy enforcement. Cloudflare’s WARP service was unable to register new devices, while Gateway experienced failures in DNS-over-HTTPS queries. CAPTCHA and login tools such as Turnstile and Challenges also malfunctioned, with a temporary kill switch introducing token reuse risks.  
Media services like Stream and Images were hit particularly hard, with all live streaming and media uploads failing during the incident. Other offerings such as Workers AI, Pages, and the AutoRAG AI system were rendered entirely unavailable. Even backend systems like Durable Objects, D1 databases, and Queues registered elevated error rates or became completely unresponsive.  

Cloudflare’s response plan now includes a significant architectural shift. The company will begin migrating Workers KV from its current third-party dependency to its in-house R2 object storage solution. This move is designed to reduce reliance on external providers and improve the overall resilience of Cloudflare’s services. 

In addition, Cloudflare will implement a series of safeguards to mitigate cascading failures in future outages. This includes new cross-service protections and controlled service restoration tools that will help stabilize systems more gradually and prevent sudden traffic overloads. 

While the outage was severe, Cloudflare’s transparency and swift action to redesign its infrastructure aim to minimize similar disruptions in the future and reinforce trust in its platform.
Read more »
Ransomware
Critical Infrastructure data security malware Play PlayCrypt Playgroup Ransomware

FBI Alert: Play Ransomware Attacks 900 Organizations

FBI Alert: Play Ransomware Attacks 900 Victims

In a recent joint cybersecurity advisory released with its Australian partners, the FBI announced that the Play ransomware group has attacked over 900 organizations since May 2025. “As of May 2025, FBI was aware of approximately 900 affected entities allegedly exploited by the ransomware actors,” the FBI said. 

Triple growth in three years

The number has tripled; in 2023, the figure was 300. This highlights the group’s rapid growth of attacking capabilities and compromise of new flaws.

Since 2022, the Playgroup, aka Playcrypt, has launched attacks across Europe, North America, and South America. The victims are diverse, ranging from MNCs to public sector agencies to areas of critical infrastructure. 

The Play ransomware differs due to its strategic use of manual-coded malware for each compromise. The constant configuration of attacks and retooling increases the group’s efficiency by helping it avoid getting caught. 

In a few cases, the group has strengthened attack tactics by contacting victims directly and asking for ransom for not leaking their data. 

Members of the infamous cybercrime syndicate have also compromised various newly found flaws (CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728) in remote monitoring and management software, deploying them as entry points for deeper penetration to compromise systems. In one incident, threat actors backdoored systems and used Sliver beacons, building the foundation for future ransomware attacks. 

Play follows a unique approach

Differing from other gangs, Play uses direct email communication instead of the Dark Web negotiation. 

Play extracts sensitive data and uses it for extortion, and also uses a proprietary tool to escape shadow copy protections in data thefts. Some high-profile targets include the City of Oakland, Dallas County, and Krispy Kreme. 

How to stay safe?

A sound understanding of ransomware groups and good cyber hygiene is a must to prevent ransomware attacks, specialized tools, however, can boost your defenses. 

The joint advisory recommends security teams to keep their systems updates to prevent exploit of unpatched vulnerabilities. They are also advised to use two-factor authentication (2FA) throughout all services. Organizations should keep offline data backups and make and test a recovery drill as part of their security practices. 


Read more »
GitHub Advanced Security
AWS Cloud Security Critical Infrastructure Customer Data Cyberattack Data Breach Data Safety User Data data security GitHub GitHub Advanced Security

Massive Cyberattack Disrupts KiranaPro’s Operations, Erases Servers and User Data


KiranaPro, a voice-powered quick commerce startup connected with India’s Open Network for Digital Commerce (ONDC), has been hit by a devastating cyberattack that completely crippled its backend infrastructure. The breach, which occurred over the span of May 24–25, led to the deletion of key servers and customer data, effectively halting all order processing on the platform. Despite the app still being live, it is currently non-functional, unable to serve users or fulfill orders. 


Company CEO Deepak Ravindran confirmed the attack, revealing that both their Amazon Web Services (AWS) and GitHub systems had been compromised. As a result, all cloud-based virtual machines were erased, along with personally identifiable information such as customer names, payment details, and delivery addresses. The breach was only discovered on May 26, when the team found themselves locked out of AWS’s root account. Chief Technology Officer Saurav Kumar explained that while they retained access through IAM (Identity and Access Management), the primary cloud environment had already been dismantled. 

Investigations suggest that the initial access may have been gained through an account associated with a former team member, although the company has yet to confirm the source of the breach. To complicate matters, the team’s multi-factor authentication (MFA), powered by Google Authenticator, failed during recovery attempts—raising questions about whether the attackers had also tampered with MFA settings. 

Founded in late 2024, KiranaPro operates across 50 Indian cities and allows customers to order groceries from local kirana shops using voice commands in multiple languages including Hindi, Tamil, Malayalam, and English. Before the cyberattack, the platform served approximately 2,000 orders daily from a user base of over 55,000 and was preparing for a major rollout to double its footprint across 100 cities. 

Following the breach, KiranaPro has contacted GitHub for assistance in identifying IP addresses linked to the intrusion and has initiated legal action against ex-employees accused of withholding account credentials. However, no final evidence has been released to the public about the precise origin or nature of the attack. 

The startup, backed by notable investors such as Blume Ventures, Snow Leopard Ventures, and TurboStart, had recently made headlines for acquiring AR startup Likeo in a $1 million stock-based deal. High-profile individual investors include Olympic medalist P.V. Sindhu and Boston Consulting Group’s Vikas Taneja. 

Speaking recently to The Indian Dream Magazine, Ravindran had laid out ambitious plans to turn India’s millions of kirana stores into a tech-enabled delivery network powered by voice AI and ONDC. International expansion, starting with Dubai, was also on the horizon—plans now put on hold due to this security incident. 

This breach underscores how even tech-forward startups are vulnerable when cybersecurity governance doesn’t keep pace with scale. As KiranaPro works to recover, the incident serves as a wake-up call for cloud-native businesses managing sensitive data.
Read more »
Public Sector
Critical Infrastructure Cyber Attacks Cyber Warfare DDoS Hacker attack Hackers Indian Cyber Security Malware Attack Military Data Public Sector

India Faces Cyber Onslaught After Operation Sindoor Military Strikes

 

In the aftermath of India’s military action under Operation Sindoor, Pakistan responded not only with conventional threats but also with a wave of coordinated cyberattacks. While India’s defense systems effectively intercepted aerial threats like drones and missiles, a simultaneous digital assault unfolded, targeting the nation’s critical infrastructure and strategic systems. 

Reports from The Times of India indicate that the cyberattacks were focused on key defense public sector units (PSUs), their supporting MSMEs, and essential infrastructure including airports, ports, the Indian Railways, power grids, and major telecom providers such as BSNL. Additionally, digital financial platforms—ranging from UPI services to stock exchanges and mobile wallets—were also in the crosshairs. 

Sources suggest these cyber intrusions aimed to steal classified military data, disrupt daily life, and damage India’s global standing. Allegedly, the attackers sought intelligence on missile defense systems and military readiness. In retaliation, India reportedly struck back at Pakistani military infrastructure, although the cyber battlefield remains active. 

Cybersecurity expert and Interpol trainer Pendyala Krishna Shastry confirmed the attacks involved a range of methods: malware deployment, denial-of-service (DoS) strikes, phishing schemes, and website defacements. These tactics targeted multiple sectors, including finance, telecom, and public services, aiming to breach systems and sow confusion. 

Website tracking portal Zone-H recorded several government domain breaches. Notable targets included the websites of the National Institute of Water Sports (niws.nic.in) and nationaltrust.nic.in, both of which were defaced before being restored. The Central Coalfields Ltd (CCL) website also experienced a breach, displaying a message from a group calling itself “Mr Habib 404 – Pakistani Cyber Force,” declaring, “You thought you were safe, but we are here.” 

Although CCL’s Public Relations Officer Alok Gupta dismissed the breach as a technical issue with no data loss, cybersecurity experts warn that downplaying such incidents could weaken national digital defense. 

This escalation underscores how cyber warfare is now being integrated into broader military strategies. Experts argue that India must urgently strengthen its cyber defenses to address the growing threat. Priorities include deploying AI-based threat detection, reinforcing CERT-In and sector-specific Security Operation Centres (SOCs), enforcing strong cybersecurity practices across public systems, and expanding collaboration on global cyber intelligence. 

As state-sponsored attacks become more sophisticated and frequent, India’s ability to defend its digital frontier will be just as crucial as its military strength.
Read more »
Threat Landscape
Critical Infrastructure Cyber Attacks Iran Nation-State Attack Threat Landscape

Iran Claims it Thwarted Sophisticated Cyberattack on its Infrastructure

 

Iran thwarted a “widespread and complex” cyberattack on Sunday that targeted the nation’s infrastructure, a senior official told Tasnim News Agency, which is affiliated with the Islamic Revolutionary Guard Corps. 

Behzad Akbari, the head of the government's Telecommunications Infrastructure Company (TIC), revealed the occurrence, which was not explained in detail. "One of the most widespread and complex cyber attacks against the country's infrastructure was identified and preventive measures were taken," Akbari noted. 

The cyber incident occurred a day after a huge explosion at Shahid Rajaei, the country's busiest commercial port, which killed at least 28 people and injured 800 more, according to police. The cause has not been determined. There is no indication that it was related to any cyber activity. 

Ambrey Intelligence, a maritime risk consultant, claims the explosion was caused by "improper handling of a shipment of solid fuel intended for use in Iranian ballistic missiles" imported from China, while Iran's defence ministry denies this. 

It comes amid ongoing talks between Iran and the United States over the Islamic Republic's contentious nuclear program, amid concerns that the nation will aim to enrich uranium to the point where it could build a nuclear bomb. Iran has had many noteworthy cyberattacks in recent years, including those against the country's fuel system in 2021 and a steel mill in June 2022, both claimed by a group calling itself Predatory Sparrow, which stated that its attacks were "carried out carefully to protect innocent individuals.” 

While the Predatory Sparrow group claims to be made up of dissidents, the attack on the steel mill appeared to be carried out with sophisticated operational planning to avoid casualties, raising the possibility that it was sponsored by a foreign state agency with a risk management process. Iranian officials blamed the United States and Israel for the 2021 cyberattack on Iran's gasoline systems, but provided no evidence. 

At the time, Gholamreza Jalali, the country's civil defence chief, told state television: "We are still unable to say forensically, but analytically, I believe it was carried out by the Zionist Regime, the Americans, and their agents.” 

Jalili claimed that the United States and Israel were responsible for a cyberattack on the Shahid Rajaei port authority's technological infrastructure in 2020, but he did not provide any evidence. The United States and Israel are thought to have worked on the Stuxnet worm, which was discovered in 2010 and was aimed to destroy Iran's nuclear program.
Read more »
Ransomwares
Backdoor Backdoor Attacks Critical Infrastructure Cyber Attacks Healthcare Malware Attack RansomHub Ransomware attack Ransomwares

Symantec Links Betruger Backdoor Malware to RansomHub Ransomware Attacks

 

A sophisticated custom backdoor malware called Betruger has been discovered in recent ransomware campaigns, with Symantec researchers linking its use to affiliates of the RansomHub ransomware-as-a-service (RaaS) group. The new malware is considered a rare and powerful tool designed to streamline ransomware deployment by minimizing the use of multiple hacking tools during attacks. 

Identified by Symantec’s Threat Hunter Team, Betruger is described as a “multi-function backdoor” built specifically to aid ransomware operations. Its functions go far beyond traditional malware. It is capable of keylogging, network scanning, privilege escalation, credential theft, taking screenshots, and uploading data to a command-and-control (C2) server—all typical actions carried out before a ransomware payload is executed. Symantec notes that while ransomware actors often rely on open-source or legitimate software like Mimikatz or Cobalt Strike to navigate compromised systems, Betruger marks a departure from this norm. 

The tool’s development suggests an effort to reduce detection risks by limiting the number of separate malicious components introduced during an attack. “The use of custom malware other than encrypting payloads is relatively unusual in ransomware attacks,” Symantec stated. “Betruger may have been developed to reduce the number of tools dropped on a network during the pre-encryption phase.” Threat actors are disguising the malware under file names like ‘mailer.exe’ and ‘turbomailer.exe’ to pose as legitimate mailing applications and evade suspicion. While custom malware isn’t new in ransomware operations, most existing tools focus on data exfiltration. 

Notable examples include BlackMatter’s Exmatter and BlackByte’s Exbyte, both created to steal data and upload it to cloud platforms like Mega.co.nz. However, Betruger represents a more all-in-one solution tailored for streamlined attack execution. The RansomHub RaaS operation, previously known as Cyclops and Knight, surfaced in early 2024 and has quickly become a major threat actor in the cybercrime world. Unlike traditional ransomware gangs, RansomHub has focused more on data theft and extortion rather than just data encryption. Since its emergence, RansomHub has claimed several high-profile victims including Halliburton, Christie’s auction house, Frontier Communications, Rite Aid, Kawasaki’s EU division, Planned Parenthood, and Bologna Football Club. 

The group also leaked Change Healthcare’s stolen data after the BlackCat/ALPHV ransomware group’s infamous $22 million exit scam. More recently, the gang claimed responsibility for breaching BayMark Health Services, North America’s largest addiction treatment provider. BayMark serves over 75,000 patients daily across more than 400 locations in the US and Canada. According to the FBI, as of August 2024, RansomHub affiliates have compromised over 200 organizations, many of which are part of critical infrastructure sectors such as government, healthcare, and energy. 

As ransomware groups evolve and adopt more custom-built malware like Betruger, cybersecurity experts warn that defenses must adapt to meet increasingly sophisticated threats.
Read more »
Security Service of Ukraine(SBU)
Critical Infrastructure critical infrastructure cybersecurity Cyber Attacks Cybersecurity E-ticketing Online Services Russia-Ukraine War SBU Security Service of Ukraine(SBU)

Ukrzaliznytsia Cyberattack Disrupts Online Ticket Sales but Train Services Remain Unaffected

 

Ukraine’s national railway operator, Ukrzaliznytsia, has fallen victim to a large-scale cyberattack, severely disrupting its online ticket sales and forcing passengers to rely on physical ticket booths. The attack, which began on March 23, has caused significant delays, long queues, and overcrowding at train stations as people struggle to secure their travel arrangements. Despite the disruption to digital services, train schedules have remained unaffected, ensuring that rail transportation across the country continues without major interruptions.

In response to the attack, Ukrzaliznytsia has taken steps to mitigate the inconvenience by deploying additional staff at ticket offices to accommodate the surge in demand. However, the company acknowledged that waiting times remain long and urged passengers not to overcrowd sales points unnecessarily. To ensure that military personnel are not affected by the disruption, they have been granted the option to purchase tickets directly from train conductors. Meanwhile, civilians who had bought their tickets online before the cyberattack are advised to use the PDF copies sent to their email or arrive at the station early to seek assistance from railway officials. 

Ukrzaliznytsia confirmed the cyberattack in an official statement across multiple communication platforms, apologizing for the inconvenience caused to passengers. The company emphasized that, despite the challenges, train operations were running smoothly and schedules had not been impacted. Officials noted that prior experience with cyberattacks had helped strengthen the railway’s response mechanisms, allowing it to implement backup protocols that ensured continuity of service. 

However, online ticket sales remain unavailable as efforts continue to restore affected systems. Describing the attack as highly systematic and multi-layered, Ukrzaliznytsia stated that it was working closely with cybersecurity specialists from Ukraine’s Security Service (SBU) and the Government Computer Emergency Response Team (CERT-UA) to identify vulnerabilities and strengthen its defenses. While the company did not specify the origin of the attack, cyber threats targeting Ukrainian infrastructure have been a persistent issue since the start of Russia’s full-scale invasion. Both state agencies and private companies have faced frequent cyber incidents, highlighting the growing challenges in securing critical infrastructure. 

Despite the cyberattack, Ukrzaliznytsia remains committed to maintaining uninterrupted rail service. The company reassured passengers that its backup systems were in place to handle such incidents, ensuring that transportation across Ukraine and beyond continues without disruption. However, no specific timeline has been given for when online ticketing services will be fully restored, leaving passengers to rely on in-person ticket purchases for the foreseeable future.
Read more »
Subscribe to: Posts (Atom)