Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label Cyber Security Ransomware Attacks. Show all posts

Akira Ransomware Bypasses MFA in Ongoing Attacks on SonicWall SSL VPN Devices

 

The Akira ransomware group continues to evolve its attacks on SonicWall SSL VPN devices, with researchers warning that the threat actors are managing to log into accounts even when one-time password (OTP) multi-factor authentication (MFA) is enabled. Cybersecurity firm Arctic Wolf reported that attackers appear to be exploiting previously stolen OTP seeds or a similar method to bypass MFA, though the exact technique remains unclear. 

Earlier this year, Akira was observed exploiting SonicWall SSL VPN devices to breach corporate networks. Initially, researchers suspected a zero-day vulnerability was involved. However, SonicWall later attributed the incidents to an improper access control flaw identified as CVE-2024-40766, disclosed in September 2024. The flaw had been patched in August 2024, but attackers continued to exploit stolen credentials from compromised devices even after updates were applied. SonicWall advised administrators to reset all VPN credentials and update to the latest SonicOS firmware.  

The latest Arctic Wolf findings reveal a persistent campaign in which multiple OTP challenges were triggered before successful logins, implying that attackers may be generating valid OTP tokens using previously harvested OTP seeds. The company confirmed that these logins were linked to devices affected by CVE-2024-40766, suggesting that stolen credentials remain a key entry point.

In a related investigation, Google’s Threat Intelligence Group (GTIG) observed a similar campaign in July, where a financially motivated group known as UNC6148 deployed the OVERSTEP rootkit on SonicWall SMA 100 series appliances. GTIG assessed that the attackers were using stolen one-time password seeds from earlier zero-day intrusions, allowing continued access even after organizations patched their systems. 

Once Akira gained access to networks, the attackers moved rapidly, often initiating internal scans within minutes. According to Arctic Wolf, they used Impacket SMB session requests, Remote Desktop Protocol (RDP) logins, and Active Directory enumeration tools like dsquery, SharpShares, and BloodHound to expand their reach. A major focus was on Veeam Backup & Replication servers, where a custom PowerShell script extracted and decrypted stored MSSQL and PostgreSQL credentials. 

To disable endpoint protection, Akira affiliates executed a Bring-Your-Own-Vulnerable-Driver (BYOVD) attack, using Microsoft’s legitimate consent.exe executable to sideload malicious DLLs that deployed vulnerable drivers such as rwdrv.sys and churchill_driver.sys. These drivers were then used to terminate security processes, enabling the ransomware to encrypt systems undetected. 

The report notes that some compromised systems were running SonicOS 7.3.0, the very version recommended by SonicWall to mitigate such attacks. Security experts urge all administrators to reset VPN credentials and review access logs on any devices that previously used vulnerable firmware, as threat actors may still exploit stolen data to infiltrate networks.

Retail Cyberattacks Surge as Service Desks Become Prime Targets

 

In recent months, reports of retail data breaches have surfaced with alarming frequency, showing that both luxury and high-street retailers are under relentless attack. During the second quarter of 2025, ransomware incidents publicly disclosed in the global retail sector rose by 58 percent compared with the first quarter, with businesses in the United Kingdom facing the worst consequences. The outcomes of such breaches vary, but the risks are consistently severe, ranging from loss of revenue and service disruptions to long-term reputational damage. 

One recent example that highlights this growing threat is the cyberattack on Marks & Spencer (M&S), one of Britain’s most recognized retailers. Employing over 64,000 people across more than 1,000 stores, M&S reportedly fell victim to hackers believed to be part of the group Scattered Spider. The attackers infiltrated the company’s systems in February, deploying ransomware that encrypted vital infrastructure and severely disrupted operations. By impersonating employees, the cybercriminals manipulated IT help desk staff into resetting passwords and turning off multi-factor authentication. This gave them access to internal systems, where they stole a file containing password hashes from Active Directory. The fallout was severe, including a five-day suspension of online sales that cost an estimated £3.8 million per day, along with a drop of more than £500 million in market value. 

The method used against M&S was not unique. Similar techniques were applied in attacks on other UK retailers, including Co-op and Harrods. In the case of Co-op, attackers also pretended to be employees to trick IT staff into granting them access. Although Co-op managed to prevent the full deployment of ransomware by shutting down parts of its infrastructure, the company still faced major operational disruption, proving that even partial breaches can have wide-reaching effects. 

The common thread in these cases is the vulnerability of service desks. These teams often have privileged access to systems, including the ability to manage user accounts, reset credentials, and disable authentication tools. Their focus on quick support and customer service can leave them more exposed to sophisticated social engineering tactics. Because they are frequently overlooked in broader cybersecurity strategies, service desks represent a weak point that attackers are increasingly exploiting. 

To address this issue, organizations must shift their approach from reactive to proactive defense. Service desks, while designed to solve problems efficiently, need to be supported with advanced training, strong verification procedures, and layered defenses that reduce the likelihood of manipulation. Investing in security awareness, modern authentication practices, and continuous monitoring of unusual account activity is now essential. 

The rise in attacks on retailers like M&S, Co-op, and Harrods demonstrates that hackers are targeting service desks with growing precision, causing significant financial and operational harm. These incidents show the urgent need for companies to reassess their cybersecurity strategies, placing greater emphasis on the human element within IT support functions. While organizations cannot control who attackers choose to target, they can strengthen their defenses to ensure resilience when confronted with such threats.

Building Trust Through Secure Financial Dealings


 

Unlike in the past, where money existed as physical objects rather than electronic data, today's financial market is about to be transformed into an increasingly digital one. The ability to protect digital financial assets has become a key priority for those working in the finance industry. 

There is an increasing likelihood that banks, investment houses, and insurance firms will be placed on the frontlines of a cyber-warfare that is rapidly deteriorating, targeted by criminals that are becoming more sophisticated by the day. 

It is especially crucial to note that the financial and insurance sectors are suffering the greatest losses from data breaches in 2023, averaging $5.17 million per incident, according to a report released by IBM in 2023. The digital transformation that has revolutionised the financial services industry has undoubtedly reduced friction, improved operational efficiency, and enhanced customer interactions. 

At the same time, it has increased vulnerabilities, exposing institutions and their clients to unprecedented risks. With the convergence of opportunity and threat, the need for rigorous cybersecurity measures has become an essential part of ensuring the survival and trust of the financial industry, not just as a necessity but as a defining necessity. 

There is a growing sense of importance to safeguarding financial institutions from cyber threats, commonly referred to as financial cybersecurity, and it has become one of the most important pillars of financial resilience for the financial industry. 

In addition to covering a wide range of protective measures, it also helps banks, credit unions, insurance firms, and investment companies to protect vast amounts of sensitive data and high-value transactions that they conduct daily. 

In spite of the fact that these organisations are entrusted with their clients' most sensitive financial details, cybercriminals remain prime targets for those seeking financial gain as well as ideological disruption. There are numerous threats to be aware of, and they range from sophisticated phishing attacks to increasingly complex ransomware strains such as Maze and Ryuk, to the more recent double extortion techniques designed to maximise the leverage of their victims. 

There have been numerous incidents recently that show how attackers can easily exfiltrate and publicly release millions of customer records in one single attack, with the effect of ripple effects across the global economy. In addition to these challenges, institutions are facing the rapid adoption of cloud technologies and managing sprawling supply chains that are inadvertently expanding their attack surface as a result of rapid digital transformation. 

In the context of this vulnerability, the 2020 SolarWinds compromise is an important reminder that stealthy intrusions are possible and that they can persist undetected for months while infiltrating critical financial systems, revealing the extent of these vulnerabilities. As customers increasingly trust digital platforms to handle their banking and investment needs, financial organisations are under tremendous pressure to deploy advanced security measures that can keep up with the evolving innovation of attackers. 

In addition to the immediate costs associated with ransom requests or stolen data, the stakes go much deeper than that. They threaten the very foundations of the financial system itself, and they threaten its stability and trust. A significant increase in remote work was sparked by the COVID-19 pandemic in 2024, leading to an unprecedented surge of cyberattacks, which not only persisted but also intensified.

In response to advancements in defence technology, cybercriminals have developed equally innovative offensive tactics as well, creating a constantly shifting battleground as a result. Among the most disruptive developments has been the rise of Malware-as-a-Service (MaaS), a service that makes sophisticated hacking tools accessible to a wider range of attackers, effectively lowering the barrier to entry.

In the same vein, artificial intelligence has been incorporated into criminal arsenals to make hyper-personalised attacks, which can include everything from deep-fake videos to cloned voices to highly convincing phishing campaigns tailored to individual targets. As far as financial institutions and accounting firms are concerned, the consequences are extremely severe. 

Global estimates indicate that data breaches will cost an average of $4.45 million per incident by 2023, which represents a 15 per cent increase over the past three years. Despite the financial toll of data breaches, reputational damage is also an existential concern, as firms face erosion of client trust and, in some cases, the necessity to close down their doors altogether due to reputational damage. 

In light of these convergences of risks, modern cybersecurity is not just a static protection, but a constant struggle to stay ahead of the game in terms of innovation and resilience. Financial institutions must understand the numerous layers of cybersecurity to be able to build resilient defences against a constantly changing threat environment. 

Across each layer, different roles are performed in safeguarding sensitive information, critical systems, and the trust of millions of customers. Network security, which is at the foundation of all computer networks and data communications, is one of the most important elements, ranging from firewalls and intrusion detection systems to secure virtual private networks to secure computer networks and data communications. 

Furthermore, application security is equally vital, as it ensures that banks and insurers are protected against vulnerabilities by testing their software and digital tools on a regular basis and by updating them regularly. 

The purpose of data security is to ensure that sensitive financial details remain safe and secure, whether they are in transit or at rest, by encrypting, masking, and implementing access controls to ensure that sensitive financial information does not fall into the hands of unauthorised users. 

Providing operational security in addition to these layers ensures that financial transactions remain accurate and confidential for the client. This is done through governing user permissions and data handling procedures, which safeguard data integrity and confidentiality. 

Finally, disaster recovery and business continuity planning ensure that, even if an institution suffers a breach or system failure, they have backups, redundant systems, and comprehensive recovery protocols in place to ensure it can quickly restore operations. 

It is important to note that despite the implementation of these frameworks, the finance industry continues to be threatened by sophisticated cyber threats, despite the fact that they have been in place for quite some time. Phishing campaigns remain among the most common and effective attacks, and fraudsters continue to pose as trusted financial organisations to trick users into disclosing sensitive data. 

There are many kinds of malware attacks, but the most devastating ones are ransomware attacks. They encrypt critical data and demand ransom payments from institutions that need to return to normal operations. 

A DDoS attack can also pose a significant challenge for online banks and trading platforms, overwhelming systems, often causing both financial and reputational damage in the process. Moreover, insider threats are particularly dangerous, whether they occur by negligence or by malice, given employees' privilege to access sensitive systems. 

Man-in-the-middle attacks, which intercept communications between clients and financial institutions, highlight the risk of digital financial interactions, with attackers intercepting data or hijacking transactions between clients and institutions. 

It can be argued that these threats collectively demonstrate the breadth and sophistication of the modern cyber threat and underline the importance of deploying multi-layered, adaptive security strategies in financial services. It is no longer just the U.S. government that is betting on Intel's growth. A new partnership between Intel and Nvidia has been formed to accelerate the development of artificial intelligence. 

In a deal designed to accelerate the development of artificial intelligence, Nvidia has acquired $5 billion worth of Intel shares as part of a new partnership. This agreement requires Intel to build personal computer chips incorporating Nvidia's GPUs, as well as custom CPUs, which will be embedded in Nvidia's AI infrastructure platforms.

Since Intel has been struggling to retain its previous position in computing in spite of fierce competition and rapidly advancing technology, this collaboration is an important one for the company. The company has, under Lip-Bu Tan's leadership, been going through a difficult restructuring process since he assumed the position of chief executive in March. This has involved hiring fewer employees, delayed construction of new facilities, and a renewed focus on securing long-term customers before expanding manufacturing capabilities. 

The Washington support has also played a critical role in Intel's revival efforts, although controversy has been associated with this as well. As the Biden administration pledged more than $11 billion in subsidies to Intel under the CHIPS Act, the Trump administration reversed course by arranging a deal in which the federal government would take a 10 per cent stake in Intel, thereby strengthening Intel's manufacturing base.

With this backdrop in mind, the partnership between Intel and Nvidia brings together two of the biggest players in the industry. By combining Intel’s established x86 ecosystem with Nvidia’s advanced artificial intelligence and accelerated computing technologies, it brings together the industry’s two most influential players. 

The market responded quickly to Intel's announcement: shares soared by more than 2 per cent on Thursday morning after the announcement, as analysts argued that the momentum could boost the S&P 500 to another record level. It is a significant achievement in the technology sector that Intel and Nvidia have come to an agreement that signals a transformational shift in the way innovation is being driven in an era of rapid digital transformation. 

Intel and NVIDIA have formed an alliance to combine Intel's x86 architecture and manufacturing capabilities with Nvidia's advanced artificial intelligence and accelerated computing capabilities. The alliance is expected to boost artificial intelligence infrastructure and improve processing efficiency, as well as unlock the next generation of computing solutions. 

Investors and stakeholders have many reasons to get excited about this collaboration, since it offers substantial opportunities for investors and stakeholders in the form of enhanced market confidence and an enhanced environment for the development of robust AI ecosystems for enterprise-level and consumer applications. 

The partnership not only provides financial and technological benefits, but it also illustrates the value of proactive adaptation to technological changes, showing how partnerships with government agencies and government-sponsored initiatives can enable businesses to maintain competitiveness. 

Furthermore, as cyber threats continue to rise alongside the digital transformation, integrating advanced artificial intelligence into computing platforms will strengthen security analytics, threat detection, and operational resilience at the same time. 

The Intel and Nvidia collaborations are creating a benchmark for industry leadership, sustainable growth, and market stability through aligning innovation with strategic foresight and risk-aware practices, demonstrating how forward-looking collaboration will shape the future of AI-driven computing and digital financial ecosystems.