Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label CyberThreat. Show all posts
NHS
Cyberattacks CyberCrime Cyberhackers CyberThreat Dark Web Data Breach Data Records Galloway Medical Files NHS

Dark Web Nightmare: Scots NHS Patient Data Breach Exposes Medical Files

 


Following a major data breach at NHS Dumfries and Galloway, patients can access their private medical records online with just a few clicks. It has been reported that an extremely large amount of data has been stolen from the NHS by a group known as INC Ransom. 

To keep this vast amount of personal information confidential, the group demanded a ransom and then uploaded a massive amount of information to the dark web. As a result of the cyber attack on NHS Dumfries and Galloway in March, the data of its victims has now been released onto the dark web. NHS Scotland advised potential victims to remain vigilant about cyber attacks. 

Nevertheless, the media reports claim that a search on the dark web resulted in personal information about six patients, including a disabled child aged 10 and an 81-year-old man who was disabled. In addition to providing patients' names and dates of birth, the documents also include their home addresses and even their personal email addresses, details of the patient's life and medical history, test results, and private disclosures about their condition that were made to physicians. 

In response to the Sunday Mail report, NHS Dumfries and Galloway confirmed to the newspaper that patients have been informed, but they don't know what files the hackers have or how many more individuals have been compromised. Using the dark web, cybercriminals released documents that proved they had hacked the NHS system that were easily accessed by the Sunday Mail. 

There are some of the most personal details about six patients, including an 81-year-old man who was disabled at the age of 10 and a disabled 10-year-old girl. Furthermore, the documents reveal the patient's name and date of birth, in addition to their unique numerical identifiers called CHI numbers. It also gives their home addresses, as well as one person's e-mail address.

Furthermore, they contain intimate details regarding people's lives and medical histories, as well as test results, which are disclosed to doctors privately. According to the Sunday Mail, NHS Dumfries and Galloway has informed six patients that their data has been stolen, but they have no idea how many more have been affected or what files they have on hand.

As deputy leader of Labour, Jackie Baillie asked Health Secretary Neil Gray to explain how the breach occurred and what measures are being taken to prevent it in other health boards As a result of the breach, experts warn that the people whose personal information was compromised may be vulnerable to identity theft and other kinds of fraud. Managing director of the Cybersecurity Research Centre at Abertay University, Professor Lynne Coventry, said, "Health records can contain sensitive health information as well as financial information, making them more valuable than financial records." 

As a result of the data breach, thousands of people may potentially be affected, but authorities are not yet sure how significant it will be. There have been several calls for transparency from the NHS regarding the breach, and Patrick McGuire, partner at Thompsons Solicitors, says the NHS needs to provide support to those who were affected by the breach. 

McGuire also claimed that the NHS could be faced with significant legal claims from individuals whose personal information was exposed. This has got to be one of Scotland's biggest data breaches, possibly even the whole of Scotland. McGuire stated that the amount of information is enormous. The Scottish Conservative party's health spokesman, Dr Sandesh Gulhane, has stated that those whose information has been stolen are likely to seek financial compensation and that defending these claims could prove to be a significant challenge. 

During his interview with the press, Mr Gray revealed that he must take responsibility for the mitigation of the damage and prevent future attacks by explaining to the public what actions are being taken to mitigate these damages. As a result of the scale of the attack, it is difficult for NHS Dumfries and Galloway to determine exactly what data the hackers could access or how many individuals might be impacted. Police Scotland has confirmed that an investigation is ongoing. 

According to the health board, the six patients whose information had already been published online have already been contacted. Moreover, the NHS Scotland regional board has reported that no disruptions were reported to patient-facing services due to the cyber incident and that normal operations continued. 

According to the Scottish government, the cyber attack targeted NHS Dumfries and Galloway and no further incidents have been reported across NHS Scotland as a result of the cyber attack. The company has been around since July 2023, when it appeared on the scene. Numerous organizations, including healthcare institutions, have been indiscriminately targeted by ransomware. 

The group obtains access to the enterprise via phishing emails and exploiting vulnerabilities in software resulting in exploitation of Citrix NetScaler vulnerability CVE-20233519. Using TOR, it communicates with its victims over a TOR-based portal and tracks payments using a unique ID code that is at the heart of every payment.
Read more »
Telegram
API Cyberattacks CyberCrime Cyberhackers Cybersecurity CyberThreat Data Breach Information Compromised Real American Voice SiegedSec Telegram

Data Breach at Real America’s Voice: User Information Compromised

 


In the past few weeks, a group of homosexual, furry hackers called SiegedSec has hacked the far-right media outlet Real America’s Voice, and they have taken it down. As well as hosting far-right commentators such as Steve Bannon and Charlie Kirk, the right-wing media outlet owned by Robert Sigg also plays host to conspiracy theories, such as COVID-19 misinformation, 2020 election conspiracy theories, QAnon, and transphobic content, as well as far-right commentators such as Steve Bannon and Charlie Kirk. 

This group announced on Monday that it had hacked the app of Real America's Voice, a right-wing media outlet, founded in 2020 and regularly featuring far-right activists such as Steve Bannon and Charlie Kirk, in an announcement posted to its Telegram channel. As well as spreading conspiracy theories and transphobic rhetoric, Real America's Voice is often attacked by SiegedSec, a hacker furry collective that has wreaked havoc on the outlet. 

As part of their release, they provided data on over 1,000 users of their app, along with information on hosts Charlie Kirk, Steve Bannon, and Ted Nugent, the latter who wrote a song about wanting to fuck a 13-year-old girl. This hacker was known for destroying Minnesota River Valley Church, which used $6,000 of money to buy inflatable sea lions. 

They were also known for destroying nuclear research facilities and demanding that they focus on cat girls to accomplish their goal. It has been reported that SiegedSec has released personal information about more than 1,200 users using the app, including their full names, telephone numbers, and email addresses, as part of its ongoing hacktivism campaign OpTransRights. Additionally, the group said that they removed the user's data from the app's API as well as its cloud storage system, as well as going poof on the files. 

SiegedSec wrote in their Telegram message about the optics of their actions in regards to the Real America's Voice leak as the company shared it with their followers. We have received concerns throughout the attacks that actions had been conducted against transphobic entities and that our attacks would be construed to label the LGBTQ+ community as ‘terrorists’ and ‘criminals,’ as the group stated. 

It’s important to realize that these types of people are always going to blame the LGBTQ+ community, no matter what we do. They’re going to look for ways to hate, they will not listen to reason, and they’re going to spread lies to discredit people who are different. Data reportedly deleted from the Amazon server included information about the network’s top shows, including those hosted by prominent right-wing figures like Charlie Kirk, Steve Bannon, and Ted Nugent, as well as the top shows on the network. 

There is no information available as to whether SiegedSec's actions resulted in any permanent damage to the organization. Initially launched last year after SiegedSec attacked government websites in five states over the policies regarding transgender healthcare, the #OpTransRights campaign has just been relaunched as a part of the group's recently relaunched #OpTransRights campaign. 

As a result of anti-transgender remarks made by the pastor of River Valley Church in Burnsville, Minnesota, SiegedSec hacked the church on April 1 and launched it again on April 1. SiegedSec also used the church's Amazon account to buy inflatable sea lions worth several thousand dollars worth of money using the church's Amazon account after the hack. 

This hack exposed private prayer requests from 15,000 users of the church's website. After doing that, SiegedSec went on to dox River Valley Church's pastor Rob Ketterling less than a week later. They also noted that in their statement on Monday, they expressed concern that such attacks would negatively impact the LGBTQ+ community.
Read more »
Security
8Base Cyber Attacks CyberCrime Cyberscoop Cybersecurity CyberThreat Cyberthreats Data Breaches Security

UN Agency Faces Data Crisis: Ransomware Hack Exposes Extensive Data Theft

 


It is reported that the United Nations Development Programme (UNDP) is investigating a cyberattack involving human resources information stolen from its IT systems due to a breach. To eradicate poverty, fight inequality, and eliminate exclusion from society, UNDP, the UN's global development network, works in more than 170 countries and territories.

Donations are received from UN member states, private companies, and multilateral organizations. According to a statement released by the organisation published Tuesday, there was a hack in the local IT infrastructure at UN City, Copenhagen, in late March. In a statement released by the UNDP on Tuesday, the organization said that a “data extortion actor” had stolen human resources and procurement information in UN City, Copenhagen and that the IT infrastructure was targeted.

In the statement, it was not disclosed what kind of data had been stolen from the organization that is the lead agency on international development for the UN. According to notifications shared with affected parties and viewed by CyberScoop, hackers were able to access several servers and steal data that was significant in scope. 

CyberScoop was informed that the notification information included in its notification may include data about former and current employees' family members, as well as information about contractors, including dates of birth, social security numbers, bank account information, passport details, and information about their bank accounts, bank accounts, and passports. 

A UNDP entry on the 8Base ransomware gang's dark web data leak website has been added to its dark web data leak website since March 27, but the UN agency has yet to identify a specific threat group responsible for the attack. In their assertions, the attackers claim their operators were able to exfiltrate large amounts of sensitive information through the documents they were able to acquire during the breach. 

They allegedly leaked a large amount of confidential information via a now-extinct link, including personal information, accounting data, certificates, employment contracts, confidentiality agreements, invoices, receipts, and much more, according to the reports. They emerged in March 2022, and they spiked their activity in June 2023 after they began attacking companies across a greater range of industry verticals and switched to double extortion to increase their revenue. 

Data leaks were a major issue for the extortion group in May of 2023 when they claimed to be "honest and simple" pen testers that targeted "companies that neglected employees' and customers' privacy and the importance of their data." There have been over 350 victims listed on the site of this ransomware group so far, with some days announcing up to six victims at the same time. 

In 8Base, a custom version of Phobos ransomware has been used, a malicious program that emerged in 2019 and has many code similarities to the Dharma ransomware family. Additionally, in January 2021, the United Nations Environmental Programme (UNEP) announced that over 100,000 employee records containing personally identifiable information (PII) were made available online after a data breach. 

In July 2019, there was also a breach of UN networks in Geneva and Vienna, where a Sharepoint vulnerability allowed access to personnel records, health insurance data, and commercial contract data in an event, that a UN official described as a "major meltdown."
Read more »
Microsoft
CSRB Cyber Security Cyberattacks CyberCrime Cyberhackerss CyberThreat Microsoft

Unveiling the Threat: Microsoft's Executive Speaks Out on State-Backed Hacking

 


The executive vice president of security at Microsoft, Charlie Bell, recently proposed that the company is the neighbourhood of foreign state-sponsored hackers in an interview with Bloomberg. It has certainly been true over the years that they are particularly good at collecting data over time, gathering momentum over time, and being able to leverage that momentum into more successes over time,' Bell speaks at length about their abilities. 

Microsoft announced the Secure Future Initiative last November, following a series of cybersecurity breaches, associated with foreign governments, which resulted in Microsoft launching the initiative to protect its users' data. A notable example of these breaches was the intrusion of Chinese hackers who gained access to customer email addresses in May by breaking into systems through a malware program. 

Approximately 30 million customer's data were compromised as a result of hacking by a Russian-allied group known as Anonymous Sudan in the summer of 2023. Even though Microsoft has implemented several security initiatives over the past few years, there are still breaches that occur. 

There have been several incidents involving hackers that have hacked into the email accounts of Microsoft employees, including those of executives, and exposed vulnerabilities even further. The hackers have been named Midnight Blizzard, a group supported by Russia. 

It was subsequently determined that Microsoft's security systems were compromised due to a series of failures found within the software as a result of the breach, according to a report from the US Cyber Safety Review Board (CSRB). 

There is no doubt that Microsoft's security culture is insufficient to safeguard its customers' information and business operations, according to the CSRB report, which calls for a significant overhaul of the corporate culture, given the company's pivotal role in the technology ecosystem and the massive trust that customers place in it. 

The company has taken steps to strengthen its security framework as well as removing over 700,000 obsolete applications from its database, as well as 1.7 million outdated accounts. The company has stepped up efforts to implement multi-factor authentication across more than one million accounts as well as enhance its security protections to prevent the theft of employee identities by hackers by increasing its efforts to achieve multi-factor authentication in more than one million accounts. 

As a result, critics of Microsoft's security infrastructure argue that these actions are not sufficient to correct Microsoft's fundamental security flaws and do not go far enough in addressing them. It has been more than a month since Microsoft has responded to criticisms. A report released by Microsoft recently shows that Chinese state-sponsored hackers are using artificial intelligence (AI) to spread misinformation in advance of the upcoming presidential election, adding another layer of concern to the cybersecurity landscape. 

It will make it imperative to keep developing robust defensive strategies to counter the ever-evolving tactics of cyber adversaries and protect democratic processes as well as national security in times when they are vulnerable to cyber-attacks.
Read more »
Spyware
Cyber Attacks CyberCrime cybercriminals Cybersecurity CyberThreat iPhone LightSpy Spyware

LightSpy Spyware: A Chinese Affair Targeting iPhone Users in South Asia

 


The LightSpy spyware has been used by cyberespionage groups to spy on users of iPhones, iPads, and other mobile devices in the South Asian region in a recent cyberespionage campaign. According to reports, the cybercriminals behind this cybercriminal campaign are China-based hackers that have been planning surveillance attacks against a specific area. 

As a bonus, this latest version of LightSpy, codenamed 'F_Warehouse,' features a modular structure which significantly enhances the spying abilities of the program. As a result of some of the most alleged infected individuals who are coming from India, initial investigations suggest a possible focus on the country. 

Researchers found that Apple iOS spyware, known as LightSpy, is being used in cyber espionage campaigns targeting South Asia. This sophisticated mobile spyware has resurfaced after a period of inactivity that dates back several months. In a report published by the Blackberry Threat Research and Intelligence Team, cyber security researchers have stated that the most recent version of the LightSpy campaign uses an extremely sophisticated spying framework in combination with a modular framework. 

To protect its command and control servers from being interception and detected, LightSpy employs a certificate-pinning strategy. It is believed that the campaign primarily targets iPhone users in India, although there have been reports of incidents taking place in Bangladesh, Sri Lanka, Afghanistan, Pakistan, Bhutan, the Maldives, and Iran in recent times as well. Hackers have been suspected of exploiting hacker websites to facilitate the deployment of LightSpy spyware, as previously observed in previous campaigns, by using hacked news websites that had Hong Kong-related stories, as they did in previous campaigns. 

In a BlackBerry report, the company uncovered that the loader enables the delivery of the core implant along with several plugins that enhance the capabilities of the primary backdoor. It is considered that LightSpy is an iOS backdoor attack that spreads via watering hole attacks, in which popular websites are infected and then targeted by attackers who attack them when they visit these infected websites and gain access to their systems or mobiles. 

According to the BlackBerry security agency, it has been discovered that the latest spyware attacks may have been coordinated by news websites that were infected and visited by targeted individuals who then installed LightSpy on their computers. A spyware program such as this usually gathers information such as phone numbers, SMS messages, exact location and voicemail from your computer, among other things. 

The report suggests that the attack was carried out by Chinese hackers, as its infrastructure and functionality were very similar to that of DragonEgg spyware, a Chinese nation-state hacker group which has been linked to the attack. Accordingly, Chinese hackers are suspected of conducting the attack. Specifically, the report claims that LightSpy is capable of analyzing location data, sound recordings, contacts, SMS messages, and data from apps such as WeChat and Telegram to extract sensitive information from your phone. 

There is a growing threat of mobile espionage threat campaigns that is highlighted by the re-emergence of the LightSpy spyware implants. Apple’s security updates are all the more important after the recent mercenary spyware attacks that affected iPhone users in 92 countries. The campaign is in line with the recent mercenary spyware attack that had impacted iPhone users all over the world. 

As the agency points out, the most recent version of LightSpy discovered this month is also capable of retrieving files and data from popular apps like Telegram, WeChat, and iCloud Keychain data as well as the history of your web browsers in Safari and Chrome. There is indication that state-sponsored involvement may have been involved in the development of LightSpy in the form of permission pinning which prevents communication interception with its C2 server, as well as the presence of Chinese language artefacts in the implant's source code. 

According to Apple's recent threat notifications, which have been sent to users in 92 countries, including India, the situation has become more severe. It is unsurprising that LightSpy, a mobile spy tool with attractive new capabilities, has made a resurgence and is now posing an alarming threat to individuals and organisations throughout Southern Asia, indicating an alarming escalation in mobile spying attacks.
Read more »
malware
Cyberattacks CyberCrime Cyberhacks Cybersecurity CyberThreat GDP Mac malware

Counting the Cost: $9.2 Trillion Annual Impact of Cybercrime Looms

 


According to a new Statista Market Insights report, cybercrime is rising at an unprecedented pace. Approximately one-third of the United States' GDP or about 24 times Apple's annual revenue in 2023 will be incurred as a result of cyberattacks, according to a new survey from Statista Market Insights. A similar study from Statista Market Insights found that cybercrime costs have risen by 245% between 2018 and 2020, increasing from $860 billion to $2.95 trillion. 

With the spread of the pandemic, the cost of health care has more than doubled to $5.49 trillion in 2021 and is expected to increase by $1 trillion annually in 2023 to $8.15 trillion. In addition to impacting businesses and governments, cybercrime has become one of the world's largest illegal economies, as well as the everyday people of the world. Cyberattacks are known for causing financial losses such as ransom payments, loss of productivity, system downtime and data theft, among others. 

Contributing factors In terms of attack surfaces, IoT devices are providing cybercriminals with an increasingly large attack surface, increasing the number of potential victims and supplying them with a more relevant attack surface over time. There is no reason for Mac users to be excluded from this. There was an increase of 50% in new Mac malware families in 2023 in Jamf's report. 

The number of instances of malware that can be found within each of these families could be hundreds. With the growing number of users of Macs, cybercriminals are more and more interested in targeting it as an easy target. It is important to keep in mind that geopolitics plays a significant role in cyberattacks as many countries use them for strategic advantage, disruption of critical infrastructure, and intelligence gathering.

A heightened escalation in the number of state-sponsored attacks is taking place as a result of the conflict between Ukraine and Israel. A significant number of cybersecurity jobs have gone unfilled as a result of the skills shortage we're going through today. Due to this shortage, many cybersecurity positions have gone unfilled. It will therefore be more difficult to monitor and defend against specific threats as there will be fewer professionals. 

Moreover, the shortage of skilled professionals can also increase the workload for employees who are already working, so that productivity can be negatively impacted. Further to this, employees are burned out as a result of their jobs. Threat actors count on this. In the world of ransomware-as-a-service (RaaS), there are very few barriers to entry, and this has made it very popular thanks to a combination of tough economic factors, swift financial gains, and little technical knowledge. 

Operators develop the software under this model and affiliates pay to use pre-built tools and packages to launch attacks on the network. Each affiliate pays a fee for each attack they launch. A ransomware attack can be carried out by non-programmers lacking the skills to develop and deploy their ransomware. 

There is no shortage of RaaS kits available on the dark web, but they aren't always the best. Due to a simple lack of awareness, the risks and consequences associated with cyberattacks remain undetected by many individuals and organizations, making them vulnerable to cybercrime. It was found that 40% of Jamf's mobile users and 39% of the organizations in their annual trends report are running on a device that is known to have vulnerabilities, according to the report.

In light of recent incidents regarding a popular Apple device management platform, it has become evident that there remains a notable lack of awareness concerning the security measures necessary to protect Mac devices. Ensuring the security of the Mac is imperative in safeguarding against potential threats such as malware and phishing attacks. Here are some essential steps to bolster the security of the Mac: 

1. Keep the device up-to-date: It is crucial to regularly update the Mac's operating system to incorporate the latest security patches. By staying current with updates, users can effectively address known vulnerabilities that may be exploited by malware.

2. Utilize antivirus software: Despite common misconceptions, Macs are not impervious to malware. Therefore, employing reputable antivirus software is highly recommended. Tools such as Malwarebytes offer free applications for individual users, capable of detecting and removing potential threats. Additionally, MacPaw’s CleanMyMac X now features a malware removal tool powered by MoonLock, enhancing protection against malicious software. 

3. Exercise caution when clicking: Email remains a primary vector for malware distribution, with phishing attacks experiencing a significant rise in success rates. According to recent reports, phishing success rates increased from 1% in 2022 to 9% in 2023. Hence, exercising caution and scepticism when interacting with email links and attachments is essential to mitigate the risk of falling victim to such attacks. 

4. Enable a firewall: Enabling the built-in firewall on the Mac is an effective measure to prevent the acceptance of unauthorized connections and services. By managing both incoming and outgoing connections, the firewall helps fortify the device's defences against potential threats. 

5. Use strong, unique passwords: Employing robust and distinctive passwords is imperative for bolstering the security of the Mac. Avoid using easily guessable passwords, such as common phrases or pet names followed by predictable characters. Instead, opt for complex combinations of letters, numbers, and symbols to enhance password strength and resilience against unauthorized access. 

6. Enable disk encryption: Leveraging features such as FileVault, which encrypts all user data stored on the disk in real-time, enhances the security of sensitive information on the Mac. In the event of device loss or theft, disk encryption ensures that the data remains inaccessible to unauthorized individuals, thereby safeguarding privacy and confidentiality. 

7. Limit user privileges: Restricting user privileges is crucial in preventing unauthorized software installations and minimizing the potential impact of malware infections. By limiting user permissions, users can effectively mitigate the risks associated with malicious activities and enhance overall device security. 

In summary, prioritizing the implementation of robust security measures is paramount in safeguarding the Mac against evolving threats. By adopting proactive strategies such as keeping the device updated, utilizing antivirus software, exercising caution when interacting with emails, enabling firewalls, employing strong passwords, enabling disk encryption, and limiting user privileges, users can significantly enhance the security posture of the Mac and protect against potential vulnerabilities and cyber threats.
Read more »
Payments
Artificial Intelligence Cyber Security Cyberattacks CyberCrime CyberThreat Generative Artificial Intelligence Moody's Investors Payments

Cybersecurity Crisis: Small Firms Rank Attacks as the Greatest Business Risk

 


As a result of the rapid development of generative artificial intelligence, cyberattackers will likely have the upper hand in the short to medium term, compounding the long-term increase in cybersecurity risks for businesses, according to a report published by Moody's Investors Service. Based on University of Maryland data, the rating firm said cyberattacks rose by 26% per year between 2017 and 2023. 

According to Moody's, ransomware payments worldwide for the past year exceeded $1 billion, according to Chainanalysis, a cybersecurity firm. It has been reported that 23 per cent of small businesses are very prepared for cyberattacks, while half are considered somewhat prepared, according to a survey conducted by the U.S. Chamber and MetLife from Jan. 26 to Feb. 12, citing 750 small business owners. 

Even though small businesses in professional services are significantly more concerned about cyber security threats than those in manufacturing and services, the Chamber of Commerce and MetLife report that the industry is also better prepared to deal with these threats than those in manufacturing and services. 

As a result, the U.S. Chamber and MetLife survey found that small businesses in manufacturing and retail are most concerned about a supply chain breakdown, even though only about three out of five are prepared to handle one, according to the survey. A survey by the U.S. Chamber and MetLife stated that more than half of small businesses (52%), reported persistent price pressure to be their primary concern, noting inflation remains a stubborn concern.

A report by the National Federation of Independent Businesses indicates that 25% of small businesses view inflation as their largest operational problem, an increase of 2 percentage points since February according to the study and that inflation is one of the biggest operational problems that small businesses face. “Inflation has once again been cited by the NFIB Chief Economist Bill Dunkelberg as the top economic issue facing Main Street,” Dunkelberg stated. 

A third straight month of higher consumer prices was reported in March, prompting futures traders to predict that the Federal Reserve will not be cutting borrowing costs in 2024 as much as it should. According to the Bureau of Labor Statistics, the CPI was 0.4% higher in March and 3.5% higher over the past twelve months, well above the Fed's 2% target, thanks to the sharp rise in transportation and shelter prices.

Additionally, the core CPI, which excludes volatile food and energy prices, also surpassed expectations for the month, rising by 0.4% and up 3.8% over the same period last year in addition to the 0.4% increase for the month.
Read more »
Spyware Alert
Apple Cyber Security Cyberattacks CyberCrime CyberThreat Mercenary Social Media Spyware Alert

Apple Steps Up Spyware Alerts Amid Rising Mercenary Threats

 


It has been reported that Apple sent notifications on April 10 to its Indian and 91 other users letting them know they might have been a victim of a possible mercenary spyware attack. As stated in the company's notification to the affected users, these spyware attacks were intended to 'remotely compromise the iPhone associated with the users' Apple IDs,' suggesting the attackers might have targeted them specifically as a result of who they are or what they do, and that they were most likely to be a target. 

A threat notification has been issued to users worldwide after fears were raised that sophisticated spyware attacks could be targeting high-profile Apple customers. There had been a similar warning sent out to Indian Apple users back in October last year, in which members of the Indian Parliament and journalists were alerted about potential ‘state-sponsored attacks'. 

People who had been alerted last year were able to use social media in response to the alerts, but this time around, the same has not been the case. After the Pegasus surveillance issue, Apple introduced this feature in 2021. When these alerts are received, they will be sent to users when they see activity that is consistent with a state-sponsored attack. 

It has recently released an alert highlighting the dangers and rarities of mercenary spyware, like the famous Pegasus from NSO Group, highlighting how complex and rare these types of viruses can be. According to the company's warning email, the spyware was designed to secretly infiltrate iPhones associated with particular Apple IDs. 

There has been a lot of speculation surrounding this issue, with Apple indicating that attackers may select their targets depending on their identity or profession to gain access to their systems. Mercenary spyware refers to sophisticated malware that has been developed and deployed primarily by private entities that may be guided by national authorities. 

In a message issued by the company, users were warned that advanced spyware may attempt to remotely access their iPhones, indicating that they may be at risk. The attacks, according to Apple, are both “exceptionally rare” and “vastly more sophisticated” than the usual cybercrime activities or consumer malware. 

In addition to stressing the unique characteristics of threats such as Pegasus spyware from NSO Group, the company also pointed out that such attacks are individually tailored and cost millions of dollars to launch, and only a very small percentage of customers are affected by such attacks. Moreover, as evidenced by the fact that a coalition of countries, including the United States, is currently working to create safeguards against the misuse of commercial spy software, these efforts are in line with global efforts to combat the misuse of commercial spyware. 

Furthermore, a recent report released by Google's Threat Analysis Group (TAG) and Mandiant shed light on the exploitation of zero-day vulnerabilities in the year 2023, revealing a significant portion of these exploits would be attributed to commercial surveillance vendors. It is widely known that web browser vulnerabilities and mobile device vulnerabilities are a major source of threat actors' evasion and persistence strategies, an indication of how reliant they are on zero-day exploits. 

Among the most concerning issues was that, in India, opposition politicians had raised concerns about possible government involvement in attacks against mobile phones in October, citing Apple's earlier alert about state-sponsored attacks from October that appeared to indicate such an involvement. There has been a high-risk warning issued by CERT-In, India's national cybersecurity watchdog, about vulnerabilities in Apple products that are affecting the entire Apple ecosystem. 

There may be vulnerabilities in these systems which will enable attackers to access sensitive information, execute unauthorized code, bypass security measures, and spoof systems to perform identity theft and other attacks against them. Several Apple devices and software are the subject of this advisory, including iOS, iPadOS, macOS, tvOS, watchOS, and Safari, as well as a wide range of Apple devices and computer software.

Apple also recommends that users remain vigilant regarding suspicious links and attachments, as some attacks might be exploiting the power of social engineering to mislead users into clicking on malicious links. When users suspect that they are being targeted, even in the absence of a threat notification, precautions should be taken to avoid exposing themselves to security threats. 

These precautions include changing passwords and speaking with experts in the field of digital security. As a result of these evolving threats, Apple emphasizes that to mitigate the risks effectively, users must work together with security professionals. Proactive measures and an increased awareness of cyber threats must become increasingly important in helping combat malicious cyber activity in the era of growing digital privacy concerns. 

There may be vulnerabilities in these systems which will enable attackers to access sensitive information, execute unauthorized code, bypass security measures, and spoof systems to perform identity theft and other attacks against them. Several Apple devices and software are the subject of this advisory, including iOS, iPadOS, macOS, tvOS, watchOS, and Safari, as well as a wide range of Apple devices and computer software. 

Apple also recommends that users remain vigilant regarding suspicious links and attachments, as some attacks might be exploiting the power of social engineering to mislead users into clicking on malicious links. When users suspect that they are being targeted, even in the absence of a threat notification, precautions should be taken to avoid exposing themselves to security threats. These precautions include changing passwords and speaking with experts in the field of digital security. 

As a result of these evolving threats, Apple emphasizes that to mitigate the risks effectively, users must work together with security professionals. Proactive measures and an increased awareness of cyber threats must become increasingly important in helping combat malicious cyber activity in the era of growing digital privacy concerns. It is recommended that users when clicking on links or opening attachments from unknown sources, be cautious. 

Since they feared the spyware might help attackers plan for a stealth attack, they decided not to share any more details about it. Additionally, Apple incorporated new advice for users who might be impacted by mercenary spyware attacks into its support page for those who might have been affected. The page explained how these threats are tailored to each individual and their particular device, which means they are difficult to detect and hard to eliminate.
Read more »
Tarrant County
Cyber Attacks CyberCrime Cybersecurity CyberThreat Medusa Leak TAD Tarrant County

300 Strikes: Fort Worth's Battle Against the Medusa Gang

 


In the wake of a cyberattack on Tarrant County Appraisal District in March, the Medusa ransomware gang has claimed responsibility for the hack and has threatened the public with the threat of leaking 218 GB of the stolen data unless the ransom of $100,000 is paid within six days. 

According to the Tarrant County Appraisal District, approximately 300 individuals' personal information was stolen in a recent update. As of this original report (April 9th), the county organization was still about four days away from publishing the alleged data stolen in the attack after the gang forewarned it to do so on April 6th. 

TAD appeared on the Medusa leak blog on April 6th. It is recommended to report any suspicious activity as soon as possible to the authorities, but affected individuals will be contacted to ensure that their personal information remains safe. Even though the county has not yet responded to whether the ransom will be paid, it is understood that the attack has been reported to the FBI, and plans are underway to restore operations. 

Additionally, the Medusa gang recently attacked an Illinois county on the border with Iowa in addition to the Tarrant County incident. As of 2023, the group began to work its way onto the scene. It soon became involved with a large number of victims, including a company in Italy that supplies drinking water to close to half a million people, a large school district in Minnesota, Sartrouville, a French village, the state-owned telecommunications company of Tonga, and most recently, the government organization in charge of the Philippines' universal healthcare program. 

It is no secret that Medusa made headlines in the fall of last year when it attacked Toyota and a technology company created by two of the biggest banks in Canada. A ransomware gang known as Medusa first appeared on the scene in late 2022 and has been consistently active ever since. In January, they attempted to extort Water for People, a nonprofit that works to improve water access for all. 

As recently as December 2017, Medusa became the target of three separate school districts within less than a week and compromised the personal information of thousands of students and teachers across three districts. It was reported in December of that year that Medusa's leak blog revealed that the group published the files from the school districts from all three districts in December as well. 

Two other school districts in Pennsylvania appeared to have been hit at that time; while Minneapolis Public Schools had been hit earlier in the year. Moreover, in November, the threat actors attacked Toyota Financial Services and took down systems in the region, forcing Toyota to take some systems offline for days. In addition, the threat actors also attacked Moneris, a Canadian fintech company that processes payments for Starbucks and IKEA. 

Medusa is regarded as operating under a ransomware-as-a-service (RaaS) model, whereby the company sells its trademark ransomware variant to other ‘criminal affiliates’ for a cut of the profits generated from sales of their ransomware variant. TAD did not disclose how much data the ransomware group took or precisely what information had been compromised. 

However, Medusa has now threatened to leak the supposed stolen information unless a $100,000 ransom is paid to them. The gang has posted a sample cache of around 40 documents said to have been exfiltrated during the recent attack by the group. According to Cybernews, the purported samples are a collection of financial documents, commercial and residential property databases, property owners' information, records of properties, judgments obtained by the courts, details about board members, tax information, records of employees, and the like. 

The recent ransomware attack that hit the Tarrant County Appraisal District in Tarrant County, Texas, has highlighted the critical need for organizations to adopt a proactive approach to cyber defence and consider it a continuous process rather than reactive. There is a history of international cyberattacks conducted by the Medusa cybercrime gang that is well known, he said. 

There has been an increasing realization by the intelligence community that traditional, reactive measures are no longer effective when faced with adversaries like Medusa, which are using advanced tactics. According to him, empowering ourselves to navigate the evolving digital landscape requires more than just technological upgrades; it requires us to change the way we perceive and prepare for cyber threats, move from a reactive posture to a proactive, anticipatory position, and adopt proactive measures that get us ahead of the game. 

There are 73 jurisdictions in the county served by the Tax Assessment Division, which is the division of local property tax assessments. It has been estimated that there are approximately 2.1 million inhabitants in Tarrant County, with the government offices situated in the city of Fort Worth, one of the largest cities in the state. 

There is no state or local government in Texas that levy or collect taxes from its residents because it is one of the few states where taxes are not imposed. The government delegated that responsibility to city and county governments, so TAD has an extremely important role to play there. The Tax Assessor's Department, or TAD, is a government agency responsible for property appraisal and the determination of eligibility for property tax exemptions for homeowners, the elderly, disabled adults, disabled veterans, and nonprofit organizations and charitable organizations. 

The latter are not necessarily charitable. A ransomware gang could be easily convinced to take advantage of the amount of sensitive personal information stored and processed within TAD's network if it were to think it had a chance to profit from those stolen files. It is also worth noting that even though TAD claims that only a small amount of individual data was exposed in the attack, it is oftentimes not known in the immediate aftermath of such a breach what the true effects of the breach will be. Tarrant Appraisal District was recently found to have suffered a breach of its data, which is not the first time this has happened.
Read more »
SVG
Cyber Campaigns Cyber Fraud Cyberattacks CyberCrime Cybersecurity CyberThreat Email Attacks Malware Campaigns Phising SVG

Cybercriminals Employ Obfuscation in Invoice Phishing Malware Campaigns

 


An array of cunning cyberattack campaigns utilizing seemingly innocuous invoices to deliver malware attacks have been uncovered by cybersecurity researchers. In this deceptive campaign, malicious Scalable Vector Graphics (SVG) file attachments are embedded in phishing emails that have been crafted to pose as malicious content. 

There is a risk that an intricate infection sequence will unfold once the victim opens the attachment, potentially releasing the victim's computer with various types of malware strains. Using this invoice-themed phishing scheme, FortiGuard Labs at Fortinet, a leading cybersecurity research team, identified a variety of malware. 

The malicious payloads included RATs such as Venom RAT, Remcos RAT, NanoCore RAT, and XWorm, as well as other Remote Access Trojans (RATs) that are known to have been exploited by hackers. Furthermore, the attack arsenal has incorporated a cryptocurrency wallet stealer that allows attackers to steal digital currencies from users without their knowledge of it. 

In a technical report published by Fortinet FortiGuard Labs, a technical report said that the emails include Scalable Vector Graphics files (SVG) that activate infection sequences when clicked. It is of particular note that the modus operandi uses BatCloak's malware obfuscation engine and ScrubCrypt to deliver malware as obfuscated batch scripts via the BatCloak malware obfuscation engine. 

A tool known as BatCloak, which was offered for sale to other threat actors in late 2022, has its roots in Jlaive, a tool that was developed by the organization. Essentially, it serves to load a next-stage payload by circumventing traditional detection mechanisms by loading it in a layered manner. The complexity of the attack lies in its multilayered approach. 

It is the SVG attachments that serve as triggers, initiating the infection process once the target opens them up. The BatCloak malware obfuscation engine is also extensively used to perform obfuscation techniques. In late 2022, cybercriminals were able to purchase a tool called Jlaive, a descendant of another obfuscation tool known as Jlaive, which has been available since then. 

In addition to masking the subsequent stages of malware, BatCloak's main function is to make it difficult for security software to detect the subsequent stages of malware. This variant of the Quasar RAT gives attackers the ability to seize control of compromised systems, collect sensitive data, and execute commands from command and control (C2) servers once they have taken control of a compromised system. 

In addition, it allows a multitude of plugins to be deployed for different kinds of malicious activities, including Remcos RAT, which is distributed via obfuscated VBS scripts, ScrubCrypt, and Guloader PowerShell scripts. The plugin system also allows a stealer module to be deployed to collect information from crypto wallets and applications like Atomic Wallet, Electrum, Ethereum, and others and send that stolen information to a remote server via the plugin system. 

In addition to obfuscating the malware, ScrubCrypt is one more layer that adds to this elaborate attack. It encrypts the malicious code, making it even more difficult to detect and prevent infection from security systems. A malware payload typically arrives in the form of encoded batch scripts as soon as the layers are peeled back. Once the scripts have been downloaded and executed onto the compromised system, the malware payload will be able to be detected. 

According to the cybersecurity firm that analyzed the latest campaign, the SVG file served as a conduit for dropping a ZIP archive which contained a batch script that probably was created using BatCloak. After the ScrubCrypt batch file has been unpacked, the Venom RAT is eventually executed, but not before establishing persistence on the host, bypassing ETW and AMSI protections, and setting up persistence on the host. 

The evolution of the tactics employed by cybercriminals has demonstrated the importance of the evolving threat landscape. A very important aspect of the sophistication of these online threats is the fact that attackers are strategically using readily available obfuscation tools, alongside malware that targets cryptocurrency. 

Researchers have stressed to users the importance of remaining vigilant, especially when it comes to unsolicited email attachments, even when they seem to be invoices or other documents that seem to come from a legitimate source. Several security measures should also be implemented by businesses, including comprehensive email filtering systems in addition to employee training programs targeted at recognizing warning signs of phishing attempts, which are recommended as part of these measures.
Read more »
Latvia Lead
Bengal Schools Bombs Cyber Attacks Cyber Phishing CyberCrime Cybersecurity CyberThreat Emails Latvia Lead

Threatening Emails Rattle Bengal Schools: Police Pursue Latvia Lead

 


In a statement announced Tuesday, the Kolkata Police said that more than 20 schools across the city have been threatened with bombs, which have been later revealed as hoaxes. According to the sender, bombs had been placed in numerous classrooms across a variety of schools in the city, and the bombs would explode in the morning hours following the placement. 

After receiving a hoax bomb threat mail on Monday, Kolkata Police took the initiative to spread an online message on Tuesday to reassure all parents that they would be there to ensure their children's safety and security, clarifying that it was a hoax mail and that they would be on hand to help. It has been revealed that police have traced the IP address to the Netherlands where the threat mail which was sent to 200-odd schools in the city, suburbs, and Siliguri, was sent from.

On the intervening night between Sunday and Monday (April 8, 2024), a user known as "doll" sent an email at 12.28 am on Monday with the email address 'happyhotdog101' threatening to have bombs placed in schools. The user threatened to make it happen with the help of the U.S. Government.   An email screenshot has been shared by over 90 schools and the screenshots have been shared on more than a dozen websites. 

The message itself has not been shared yet, but the fact that it has gone viral has contributed to its success. The sender, it is thought, had threatened the students that bombs would be detonated when they arrived at school that morning and that this was the reason for the mail. 

There had been no official announcement regarding this case from either the Calcutta Police or the West Bengal Police until late that evening. There is also the possibility that none of the schools in either of the cities will publicize the threat. The email reads, “This is a message for everyone. There are bombs planted inside "of the" classrooms. The bombs are set to go off tomorrow morning when there are kids inside "of the" schools. Our mission is to leave as many as people in a pool of blood." 

his attack was caused by 2 terrorists named Ching and Doll." According to the Latvian police, the email had been generated by an account linked to an email service provider founded in 2018 and set up its operations in 2022, but it was conceived in 2018 and started operating in 2022. 

Around 68 educational institutions in Bengaluru received a threat email last January, which came from one of the email addresses that were created by the same company that provides email services to these institutions. Initially, Bengaluru police speculated that the email was coming from either the Czech Republic or Slovakia, but they have since removed that suspicion. 

In the course of the investigation, it was found that the encryption service provider in question was the same as the one used in the Calcutta school case, though the location was in Cyprus instead of India. It was reported that the email sender said that he used a Switzerland-based Virtual Private Network, which is also well-known for the security and privacy of end-to-end encryption and focus on privacy, to send the email according to reports from the Bengaluru Police. 

There is an announcement that, in June 2022, the Narendra Modi government will ask all VPN operators to store for five years data related to its subscribers, such as names, email addresses, contact numbers, and IP addresses to tighten cybersecurity rules. Also, the Indian government requested the use of the data at its discretion as and when it deemed necessary. As a result of the order, most VPN companies have declared themselves uncooperative and have removed their servers from India as a result.

The Calcutta Police and the Bengal Police are yet to discover whether the email service provider has been contacted by either the Calcutta Police or the Bengal Police to review Monday's threat emails as yet. Amidst a flurry of concerning emails inundating over 90 schools across Bengal, authorities promptly alerted law enforcement, triggering a swift response from the cyber crime cell. Their immediate objective: pinpoint the sender's identity through meticulous analysis of the email's IP address. Offering insights into the unfolding situation, a senior police official asserted that the dissemination of such emails was a deliberate ploy aimed at stoking tensions in the lead-up to the elections, underscoring the malicious intent behind the communication. 

In a bid to assuage public concerns, the city police took to social media to affirm that the purported threats were indeed unfounded, branding them as mere 'hoaxes' intended to sow panic and unrest. Further action was swiftly undertaken by authorities, with the registration of a formal case against the individual responsible for the email transmission, signalling the commencement of a thorough investigation into the matter. 

This incident is but the latest in a string of similar occurrences, with the Delhi Police, just last March, apprehending a 29-year-old Bangladeshi national residing in Kolkata for orchestrating a hoax bomb threat targeting a SpiceJet flight en route from Delhi to Kolkata. Delving into the motives behind the elaborate ruse, law enforcement disclosed that the perpetrator, upon interrogation, confessed to concocting the threat in a bid to derail the flight and thus prevent the imminent arrival of his brother-in-law in Kolkata. This calculated manoeuvre, as elucidated by police officials, stemmed from the individual's desire to conceal a web of deceit, as he had falsely claimed to be pursuing a PhD in the United States—a fabrication that facilitated his marriage to his spouse.
Read more »
FS-ISAC
Cyber Attacks CyberCrime CyberThreat data security FS-ISAC

Despite Mounting Cyberattacks, Analysts Uncover The Primary Challenge

 


Data security has become a necessity since the world is completely dependent on the Internet for everything, including the most basic things. Security challenges have become increasingly important with the amount of sensitive data the Internet carries, including users' names, addresses, and credit card numbers. 

As a result of Check Point Research's analysis of global cyberattacks, it has been estimated that the number of cyberattacks will increase by 38% in 2022. As a result of the increase in remote work, the growing use of cloud computing, and the increasing sophistication of cybercriminals, the rise in these numbers was driven by several factors. 

It has become increasingly common for businesses of all sizes to use computerized systems to streamline their day-to-day operations, whether it is corporate entities, organizations, governments, or even small and medium-sized companies. It has, therefore, become imperative to ensure that users' data is protected from unauthorized intrusions and many online threats since it is becoming increasingly important. 

With the evolution of technology, there has been an increase in the prevalence of data breaches, ransomware attacks, and hacks as a result of technology. Take a comprehensive security course from an industry expert to enhance users' security knowledge and skills, empowering users with the skills and knowledge they need to protect users' data comprehensively. 

There is a rise in the number of cybersecurity attacks in Asia-Pacific, despite the lack of knowledge and experience of organizations in markets like Singapore in implementing proper security measures.  As a result of increased cyberattacks in 2023, the region saw an increase of 15%. The region had 1,963 attacks on average every week, with ransomware being the leading threat. Based on data analyzed by the FS-ISAC (Financial Services Information Sharing and Analysis Center), the financial industry was the fourth most targeted sector in Asia-Pacific for ransomware attacks. 

It is also worth mentioning that adversarial tactics, techniques, and procedures are becoming increasingly sophisticated, such as SEO poisoning and QR code phishing, are now encompassing these tactics, techniques, and procedures. It is also likely that threat actors will use generative artificial intelligence (AI) as a means of scaling up and automating attacks, including "poisoning" and manipulating the tools created by generative artificial intelligence. 

The increasing sophistication of cyberattacks has become one of the most significant trends in the digital threat landscape. A variety of attack vectors have been developed by attackers to breach security systems, steal sensitive data, or disrupt critical systems. Several factors are responsible for this evolution, including the proliferation of cybercrime forums, the availability of powerful hacking tools, and the rise of nation-state-sponsored hacking groups. 

The digital threat landscape today encompasses a variety of attack vectors, including malware, ransomware, and denial-of-service attacks. Many attack vectors can be used to achieve a target's goal. Many methods can be used, so attackers have become more versatile. The use of phishing emails can be the starting point of a ransomware attack; however, it can progress to installing malware that encrypts data as a result of the deployment of malware. 

Example of Cybersecurity Challenges the Industry is Facing in 2024: 

There are many security threats that we face in the digital world, but ransomware is one of the most significant ones. There has been an unprecedented number of ransomware attacks over the years 2021-2022, and it is still expected that this trend will continue into the year 2024. Basically what it means is that a hacker will hack into the user's sensitive information and deny them access until they are reimbursed for a ransom sum that has been paid to the hacker. 

In today's world, data security threats are becoming more and more prevalent with the implementation of the Internet of Things. In a recent report on cybersecurity, the government agency that oversees the country urged businesses to adopt all necessary security measures so that they do not expose themselves to unnecessary risks. 

The survey was conducted between May and August 2023, with 2,036 large enterprises and 2,036 small and midsize companies (SMBs) participating. Cyber Essentials and Cyber Trust are two of CSA's cybersecurity certification schemes, which outline national security standards for companies to follow.  Within the past year, more than eight out of ten companies acknowledge that a cybersecurity incident has occurred within their organization, including 49% that have experienced such an incident more than once within the year. 

The most common examples of these types of attacks are ransomware, social engineering scams, and exploiting misconfigurations of the cloud environments deployed by the company. Security incidents have been experienced by 99% of organizations, 48% of businesses have experienced business disruptions, and 46% are suffering data loss. All of these organizations have experienced business impact as a result of the incident. 

The incident response measures used by 27% of companies resulted in financial losses of their own, followed by another 31% of businesses that sustained financial losses. As 2024 is going to be a power-up version of 2022, defenders will still need to keep an eye out for it. Even though there are ways for businesses to protect their data from data security threats if they have the right strategies – existing strategies are not always sufficient – fortunately, there are ways to protect data security by still doing so. Google has provided a tutorial in which users can learn how to protect their Gmail account from phishing attacks and other malware attacks, just as they did here.
Read more »
USSD
Call Forward criminals Cyber Security Cyberattacks CyberCrime Cyberfraud CyberThreat Mobile USSD

USSD Call Forwarding Deactivation: India's Move to Safeguard Against Cyber Fraud

 


The Department of Telecommunications (DoT) has recently taken a step to tackle the surge in online fraud cases across the country. To counter various incidents of fraud resulting from illegal call forwarding, the authorities have required all telecom operators in the country to allow their USSD-based call forwarding services to be deactivated from April 15, 2024.  

In other words, USSD (Unstructured Supplementary Service Data) is a technology that makes it possible for mobile users to gain access to a wide variety of services provided by phone networks by dialling shortcodes such as *401#. Criminals impersonate customer support to trick users into dialing this code followed by their number and into being tricked by them. 

As a result, the fraudster will usually be able to receive all phone calls and forward them to him. The USSD (Unstructured Supplementary Service Data) is commonly used by users to check balances, block numbers, and other information with the option of dialling simple codes. As a result, such social engineering attacks are vulnerable to this particular system by the DoT. 

Several services can assist users with this, including call forwarding, as well as phone number rerouting. In addition to checking mobile phone balances and IMEI numbers, the service is also commonly used to check the health of mobile phones. An order has been issued as a result of an ongoing investigation into frauds involving mobile phones and online crimes that have been committed. 

In making this decision, they do so in response to a rising number of concerns about fraud, and misuse, as well as the increasing number of online scams occurring in the wake of the call forwarding feature. Once users suspend the service for their number, users will need to reactivate any call forwarding that has been set up on it. If they already have it enabled, they will have to reactivate it. 

There have been rumours, however, that users may have to use alternative methods of activating call forwarding, which has yet to be specified, to perform this functionality. The traditional ways for users to manage the forwarding of their calls will now need to be replaced by alternative ways for providers to do so. The suspension of USSD-based call forwarding services comes amid concerns about the susceptibility of such services to fraudulent activities within the telecommunications sector. 

While the request does not imply a permanent removal of the service, there are speculations that it may be reintroduced in the future with enhanced security measures to prevent misuse and fraud. Telecommunications fraud often involves cybercriminals exploiting vulnerabilities within call forwarding systems to unlawfully access sensitive information. 

One prevalent tactic utilized by fraudsters involves persuading unsuspecting users to enable call forwarding to alternative phone numbers via USSD commands. Once activated, these diverted calls serve as a conduit for intercepting confidential data, such as one-time passwords (OTPs), intended for authentication purposes. 

The USSD service, accessed by inputting specific codes on mobile keypads, offers various functionalities including prepaid balance checks and IMEI retrieval. Among these functions is the activation of unconditional call forwarding, a feature now under scrutiny due to reported instances of misuse. 

The DoT's directive to deactivate USSD-based call forwarding represents a proactive measure aimed at disrupting fraudulent schemes. By eliminating this option, telecom operators can thwart fraudsters from exploiting the feature for illicit activities. This action not only protects mobile phone users but also bolsters the integrity of the telecommunications infrastructure.

In summary, the mandated suspension of USSD-based call forwarding services marks a significant stride in combating fraudulent practices in the telecommunications realm. By depriving fraudsters of a crucial tool, the DoT's initiative contributes to the advancement of cybersecurity and fosters a safer digital landscape for both consumers and businesses.
Read more »
Ransomware
AlphaV Cyber Security Cyber Victim Cyberattacks CyberCrime Cybersecurity CyberThreat LockBit Ransomware

Behind the LockBit Takedown: Strategies and Significance

 


It was widely hailed as a major victory for law enforcement to take down LockBit in the sprawling war against ransomware and was considered one of the most important victories for law enforcement. However, after law enforcement takes down ransomware groups, they usually reemerge, albeit with less power to continue their criminal activity. 

There was a back-and-forth tussle between law enforcement and the AlphV ransomware group in December when the group resurfaced on the dark web hours after being taken down by the police. As of today, AlphaV has been active for over ten years and lists new victims on its data leak site. 

Over the past decade, ransomware has become an increasingly prevalent problem worldwide, with modern ransomware gangs running complex businesses, and governments and private companies working together to stop these gangs have been working together for the past year. As a part of Operation Cronos, LockBit's infrastructure was used by the coordinating organizations involved with the operation to publish information about the gang's activities. 

There is no doubt that this activity against LockBit is an important victory, but ransomware continues to be a major threat, even from LockBit. To combat ransomware better, cybersecurity communities need to reflect on some lessons learned to improve the fight against ransomware. There have been instances where a victim has paid LockBit but has yet to receive the data that they promised was deleted from their servers, according to the UK's National Crime Agency (NCA). 

As a result of this, a victim trusts that the criminal will keep their end of the bargain after paying the ransom. This is one of the top risks associated with paying a ransom. The disclosure that LockBit failed to delete the data as promised severely tarnished its reputation. If a ransomware group appears trustworthy, its victims will not be willing to pay. 

Organizations need to be prepared for such eventualities and have plans in place in case of such an event. When a company's data is compromised, it needs to prioritize the creation of a thorough disaster recovery plan and procedure in case of data loss or damage, rather than relying on decryption for the sake of recovery. In response to a law enforcement takedown last week, which resulted in police seizing both LockBit's cyber extortion operations and its darknet site, as well as receiving significant intelligence, the criminals are attempting to relaunch their cyber extortion operation. 

The group's administrator, LockbitSupp, launched a new extortion site on Saturday that contains the names and contact information of five victim companies they are threatening to leak stolen documents. Even so, the site is no longer showing any of the old listings from before the law enforcement operation occurred.

Since its launch four years ago, this prolific ransomware-as-a-service outfit has hosted more than 2,000 documents that have been stolen from its victims. Last Monday, police posted a splash page to the dark web that said that they were in control, the most of any of the several extortion gangs operating on it. A week after LockBit's .onion website was hijacked by the U.K. National Crime Agency (NCA), the gang parodied LockBit's infrastructure in a series of posts about how the police had possessed “unprecedented technological access” to the company's infrastructure. 

To downplay the extent of the access, the ransomware service attempted to downplay it. The arrests of alleged affiliates as well as the shutting down of 14,000 accounts on third-party services have come as a result of the ransomware gang's failure to destroy the data of victims, even after it promised to. In an attempt to minimize the reputational damage caused by police action, a new LockBit post attempts to minimize the damage caused by the action. 

The criminals repeat what they claim in the beginning that police had compromised outdated PHP servers. To counter ransomware-as-a-service (RaaS), agencies will resort to a two-fold attack: first, to disrupt the administrative staff of the gang, and then to disrupt its affiliates. It is generally the task of the administrative staff to manage the data leak site, and the task of the affiliates to deploy the ransomware and encrypt networks is the task of the affiliates. 

There is a significant part of the administration staff that enables criminals, and without them being removed, there will be many more criminals assisting them. A disruption of the administration staff will result in the affiliates of the ransomware gangs working for other ransomware gangs. Infrastructure is used by affiliates themselves, either by purchasing it or by illegally accessing it. 

The tools, network connections, and behaviours of this infrastructure provide a considerable amount of information about this infrastructure. The ransom process exposes some details about the administrators: For the ransom process to proceed, the administrator must provide a method of communication and a method of payment for the ransom to be paid. 

The significance of these details may not seem useful to an organization immediately, but law enforcement and researchers will be able to leverage these details to uncover more about the individuals who committed these crimes. Using details from past incidents, law enforcement was able to disrupt LockBit's infrastructure as well as some affiliates of the group by using information from past incidents. 

Likely, Operation Cronos could not have been undertaken without that information, which was gathered with the assistance of attack victims and the allied agencies of the governmental organizations. The fact that an organization does not need to be a victim to help is an important thing to remember. Private organizations are eager to work with governments and are eager to collaborate with them. 

By partnering with CISA, the US government division that formed the Joint Cyber Defense Collaborative (JCDC) to create a global partnership platform to share critical and timely information to fight ransomware, organizations in the US can contribute to the effort to fight ransomware. Government agencies and public organizations can share information through the JCDC in a bidirectional manner. 

To stay on top of emerging trends as well as identify the infrastructure being used by attackers, CISA and organizations work together. There are several ways in which law enforcement can take advantage of collaboration and information sharing to gain a critical advantage against even the most powerful attacker groups, as the LockBit takedown demonstrated.
Read more »
Server Breach
Cyberattacks CyberCrime Cybersecurity CyberThreat Data Breach Ray Framework Security Failure Server Breach

Security Failure in Ray Framework Leads to Server Breach

 


There has been a hacking attack on a widely used open-source AI framework called Ray, which hackers have exploited to gain unauthorized access to servers and hijack their resources, as a result of an unpatched vulnerability. It has been documented that the hacking campaign dubbed ShadowRay has been active since September 5, 2023, and is affecting sectors such as education, crypto-currency, and biotechnology. 

This is one of the most free and open-source solutions for AI and Python applications that have been developed by Anyscale which helps them scale across a cluster of computers for distributed computing tasks using Ray. With over 30,500 stars on GitHub, it has been used by organizations like Amazon, Spotify, LinkedIn, Instacart, Netflix, Uber, and OpenAI to train ChatGPT globally. 

According to security researchers, threat actors actively exploit an unpatched vulnerability in an open-source artificial intelligence (AI) platform named Anyscale Ray to steal computing power and mine illicit cryptocurrencies. Threat actors have reportedly exploited this vulnerability for quite some time. 


The report of application security firm Oligo says that these attacks have been occurring since at least September 5, 2023, and have targeted industries such as education, cryptocurrency, biotechnology, and others. According to Anyscale, Ray is an open-source framework that enables distributed computation workloads to be scaled across a cluster of machines using artificial intelligence and Python. 

A cybersecurity researcher has warned that hackers may have breached hundreds of companies by attacking open-source software known as Ray, which can scale artificial intelligence models. This framework has been used by several organizations around the world, including Amazon, Spotify, LinkedIn, Instacart, Netflix, Uber, and OpenAI, who have used it to train ChatGPT in the past. It has accumulated more than 30,500 stars on GitHub, and it is used by several organizations. 

Active exploitation is underway As of November 2023, Anyscale published five Ray vulnerabilities, of which four were fixed, namely, CVE-2023-6019, CVE-2023-6020, CVE-2023-6021, and CVE-2023-48023. They failed to fix the fifth bug even though it was a critical remote code execution flaw, tracked as CVE-2023-48022. According to them, this was due to a long-standing design decision which did not allow authentication to work.

A specific description of the flaw is provided by Anyscale, who stated that the flaw could only be exploited in deployments which did not follow the recommendations provided in the project's documentation, which specified that the use of Ray must be restricted to a strictly controlled network environment. 

In addition, Anyscale believes that these flaws are not vulnerabilities, but rather bugs since the Anyscale platform is designed to execute code in a distributed manner. Even though the CVE-2023-48022 flaw was not classified as a critical one, the lack of authentication provided hackers with an opportunity to exploit it in insecure environments, which has made the vulnerability more vulnerable.

It was found by Oligo that CVE-2023-48022 was used to compromise hundreds of exposed Ray servers, which allowed attackers to gain access to sensitive information such as AI models, environment variables, database credentials, and access tokens for cloud environments. Cryptocurrency mining operations were sometimes carried out using the powerful graphics cards, which were installed on such compromised systems. 

The other attack vectors used reverse shells to establish persistence in the compromised environments, and this was carried out using pseudo-terminals that are based on Python to execute arbitrary code. Oligo provided remediation assistance to many companies after those findings were made and alerted them of the breach. 

To ensure Ray deployments are secure, it is essential to enforce firewall rules in a manner that prevents unauthorized access, add authorization to the Ray Dashboard port, and monitor for anomalies continuously. Furthermore, default settings such as bind to 0.0.0.0 should also be avoided, and tools should be utilized to enhance cluster security to achieve these goals.
Read more »
Subscribe to: Posts (Atom)