Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cybersecurity. Show all posts
Telegram
API Cyberattacks CyberCrime Cyberhackers Cybersecurity CyberThreat Data Breach Information Compromised Real American Voice SiegedSec Telegram

Data Breach at Real America’s Voice: User Information Compromised

 


In the past few weeks, a group of homosexual, furry hackers called SiegedSec has hacked the far-right media outlet Real America’s Voice, and they have taken it down. As well as hosting far-right commentators such as Steve Bannon and Charlie Kirk, the right-wing media outlet owned by Robert Sigg also plays host to conspiracy theories, such as COVID-19 misinformation, 2020 election conspiracy theories, QAnon, and transphobic content, as well as far-right commentators such as Steve Bannon and Charlie Kirk. 

This group announced on Monday that it had hacked the app of Real America's Voice, a right-wing media outlet, founded in 2020 and regularly featuring far-right activists such as Steve Bannon and Charlie Kirk, in an announcement posted to its Telegram channel. As well as spreading conspiracy theories and transphobic rhetoric, Real America's Voice is often attacked by SiegedSec, a hacker furry collective that has wreaked havoc on the outlet. 

As part of their release, they provided data on over 1,000 users of their app, along with information on hosts Charlie Kirk, Steve Bannon, and Ted Nugent, the latter who wrote a song about wanting to fuck a 13-year-old girl. This hacker was known for destroying Minnesota River Valley Church, which used $6,000 of money to buy inflatable sea lions. 

They were also known for destroying nuclear research facilities and demanding that they focus on cat girls to accomplish their goal. It has been reported that SiegedSec has released personal information about more than 1,200 users using the app, including their full names, telephone numbers, and email addresses, as part of its ongoing hacktivism campaign OpTransRights. Additionally, the group said that they removed the user's data from the app's API as well as its cloud storage system, as well as going poof on the files. 

SiegedSec wrote in their Telegram message about the optics of their actions in regards to the Real America's Voice leak as the company shared it with their followers. We have received concerns throughout the attacks that actions had been conducted against transphobic entities and that our attacks would be construed to label the LGBTQ+ community as ‘terrorists’ and ‘criminals,’ as the group stated. 

It’s important to realize that these types of people are always going to blame the LGBTQ+ community, no matter what we do. They’re going to look for ways to hate, they will not listen to reason, and they’re going to spread lies to discredit people who are different. Data reportedly deleted from the Amazon server included information about the network’s top shows, including those hosted by prominent right-wing figures like Charlie Kirk, Steve Bannon, and Ted Nugent, as well as the top shows on the network. 

There is no information available as to whether SiegedSec's actions resulted in any permanent damage to the organization. Initially launched last year after SiegedSec attacked government websites in five states over the policies regarding transgender healthcare, the #OpTransRights campaign has just been relaunched as a part of the group's recently relaunched #OpTransRights campaign. 

As a result of anti-transgender remarks made by the pastor of River Valley Church in Burnsville, Minnesota, SiegedSec hacked the church on April 1 and launched it again on April 1. SiegedSec also used the church's Amazon account to buy inflatable sea lions worth several thousand dollars worth of money using the church's Amazon account after the hack. 

This hack exposed private prayer requests from 15,000 users of the church's website. After doing that, SiegedSec went on to dox River Valley Church's pastor Rob Ketterling less than a week later. They also noted that in their statement on Monday, they expressed concern that such attacks would negatively impact the LGBTQ+ community.
Read more »
password managers
Cyber Security Cybersecurity Digital Security Hackers master passwords password managers

Numerous LastPass Users Fall Victim to Highly Convincing Scam, Losing Master Passwords

 

The hackers now have their eyes set on a crucial target: master passwords. These passwords serve as the gateway to password managers, where users store all their login credentials in one secure location. While these managers provide convenience by eliminating the need to remember numerous passwords, they also pose a significant risk. If hackers obtain the master password, they gain access to all associated accounts, potentially wreaking havoc on users' digital lives.

The latest threat, known as CryptoChameleon, has caught the attention of cybersecurity experts. Unlike many cyberattacks, CryptoChameleon doesn't blanket the internet with its malicious activities. Instead, it selectively targets high-value entities like enterprises. David Richardson, vice president of threat intelligence at Lookout, notes that this focused approach makes sense for attackers aiming to extract maximum value from their efforts. For them, gaining access to a password vault is a goldmine of sensitive information ripe for exploitation.

CryptoChameleon's modus operandi involves a series of sophisticated manoeuvres to deceive its victims. Initially, it appeared as just another phishing kit, targeting individuals and organizations with tailored scams. However, its tactics evolved rapidly, culminating in a highly convincing impersonation of legitimate entities like the Federal Communications Commission (FCC). By mimicking trusted sources, CryptoChameleon managed to lure even security-conscious users into its traps.

One of CryptoChameleon's recent campaigns targeted LastPass users. The attack begins with a phone call from a spoofed number, informing the recipient of unauthorized access to their account. To thwart this breach, victims are instructed to press a specified key, which leads to further interaction with a seemingly helpful customer service representative. These agents, equipped with professional communication skills and elaborate scripts, guide users through a series of steps, including visiting a phishing site disguised as a legitimate support page. Unbeknownst to the victims, they end up divulging their master password, giving the attackers unrestricted access to their LastPass account.

Despite LastPass's efforts to mitigate the attack by shutting down suspicious domains, CryptoChameleon persists, adapting to evade detection. While the exact number of victims remains undisclosed, evidence suggests that the scale of the attack could be larger than initially estimated.

Defending against CryptoChameleon and similar threats requires heightened awareness and scepticism. Users must recognize the signs of phishing attempts, such as unsolicited calls or emails requesting sensitive information. Additionally, implementing security measures like multifactor authentication can provide an additional layer of defense against such attacks. However, as demonstrated by the experience of even seasoned IT professionals falling victim to these scams, no defense is foolproof. Therefore, remaining vigilant and promptly reporting suspicious activity is paramount in safeguarding against cyber threats.
Read more »
Security
8Base Cyber Attacks CyberCrime Cyberscoop Cybersecurity CyberThreat Cyberthreats Data Breaches Security

UN Agency Faces Data Crisis: Ransomware Hack Exposes Extensive Data Theft

 


It is reported that the United Nations Development Programme (UNDP) is investigating a cyberattack involving human resources information stolen from its IT systems due to a breach. To eradicate poverty, fight inequality, and eliminate exclusion from society, UNDP, the UN's global development network, works in more than 170 countries and territories.

Donations are received from UN member states, private companies, and multilateral organizations. According to a statement released by the organisation published Tuesday, there was a hack in the local IT infrastructure at UN City, Copenhagen, in late March. In a statement released by the UNDP on Tuesday, the organization said that a “data extortion actor” had stolen human resources and procurement information in UN City, Copenhagen and that the IT infrastructure was targeted.

In the statement, it was not disclosed what kind of data had been stolen from the organization that is the lead agency on international development for the UN. According to notifications shared with affected parties and viewed by CyberScoop, hackers were able to access several servers and steal data that was significant in scope. 

CyberScoop was informed that the notification information included in its notification may include data about former and current employees' family members, as well as information about contractors, including dates of birth, social security numbers, bank account information, passport details, and information about their bank accounts, bank accounts, and passports. 

A UNDP entry on the 8Base ransomware gang's dark web data leak website has been added to its dark web data leak website since March 27, but the UN agency has yet to identify a specific threat group responsible for the attack. In their assertions, the attackers claim their operators were able to exfiltrate large amounts of sensitive information through the documents they were able to acquire during the breach. 

They allegedly leaked a large amount of confidential information via a now-extinct link, including personal information, accounting data, certificates, employment contracts, confidentiality agreements, invoices, receipts, and much more, according to the reports. They emerged in March 2022, and they spiked their activity in June 2023 after they began attacking companies across a greater range of industry verticals and switched to double extortion to increase their revenue. 

Data leaks were a major issue for the extortion group in May of 2023 when they claimed to be "honest and simple" pen testers that targeted "companies that neglected employees' and customers' privacy and the importance of their data." There have been over 350 victims listed on the site of this ransomware group so far, with some days announcing up to six victims at the same time. 

In 8Base, a custom version of Phobos ransomware has been used, a malicious program that emerged in 2019 and has many code similarities to the Dharma ransomware family. Additionally, in January 2021, the United Nations Environmental Programme (UNEP) announced that over 100,000 employee records containing personally identifiable information (PII) were made available online after a data breach. 

In July 2019, there was also a breach of UN networks in Geneva and Vienna, where a Sharepoint vulnerability allowed access to personnel records, health insurance data, and commercial contract data in an event, that a UN official described as a "major meltdown."
Read more »
Middle East
CR4T backdoor Cyber Attacks Cyberattack Cybersecurity evasive governments Hackers Middle East

Cyberattackers Employ Elusive "CR4T" Backdoor to Target Middle Eastern Governments

 

A recent revelation by Russian cybersecurity firm Kaspersky sheds light on a covert cyber campaign dubbed DuneQuixote, which has been clandestinely targeting government bodies in the Middle East. This campaign involves the deployment of a newly identified backdoor called CR4T.

Kaspersky's investigation, initiated in February 2024, suggests that the operation might have been underway for at least a year prior. The perpetrators have taken sophisticated measures to evade detection, employing intricate methods to shield their implants from scrutiny and analysis.

The attack commences with a dropper, available in two versions: a standard executable or a DLL file, and a manipulated installer for a legitimate software tool called Total Commander. Regardless of the variant, the dropper's main task is to extract a concealed command-and-control (C2) address, utilizing a unique decryption technique to obfuscate the server's location and thwart automated malware analysis tools.

The decryption process involves combining the dropper's filename with snippets of Spanish poetry embedded in its code, followed by calculating an MD5 hash to decode the C2 server address. Upon successful decryption, the dropper establishes connections with the C2 server and fetches a subsequent payload, employing a hardcoded ID as the User-Agent string in HTTP requests.

Kaspersky notes that the payload remains inaccessible unless the correct user agent is provided, indicating a deliberate effort to restrict access. Additionally, the payload may only be downloaded once per victim or for a limited time following the malware's release.

Meanwhile, the trojanized Total Commander installer exhibits some variations while retaining the core functionality of the original dropper. It omits the Spanish poem strings and incorporates additional anti-analysis checks to detect debugging or monitoring tools, monitor cursor activity, check system RAM and disk capacity, among other measures.

CR4T, the central component of the campaign, is a memory-only implant written in C/C++, facilitating command-line execution, file operations, and data transfers between the infected system and the C2 server. Kaspersky also identified a Golang version of CR4T with similar capabilities, including executing arbitrary commands and creating scheduled tasks using the Go-ole library. The Golang variant employs COM objects hijacking for persistence and utilizes the Telegram API for C2 communication, indicating a cross-platform approach by the threat actors.

The presence of the Golang variant underscores the threat actors' ongoing efforts to refine their techniques and develop more resilient malware. Kaspersky emphasizes that the DuneQuixote campaign poses a significant threat to entities in the Middle East, showcasing advanced evasion tactics and persistence mechanisms through the use of memory-only implants and disguised droppers masquerading as legitimate software.
Read more »
Spyware
Cyber Attacks CyberCrime cybercriminals Cybersecurity CyberThreat iPhone LightSpy Spyware

LightSpy Spyware: A Chinese Affair Targeting iPhone Users in South Asia

 


The LightSpy spyware has been used by cyberespionage groups to spy on users of iPhones, iPads, and other mobile devices in the South Asian region in a recent cyberespionage campaign. According to reports, the cybercriminals behind this cybercriminal campaign are China-based hackers that have been planning surveillance attacks against a specific area. 

As a bonus, this latest version of LightSpy, codenamed 'F_Warehouse,' features a modular structure which significantly enhances the spying abilities of the program. As a result of some of the most alleged infected individuals who are coming from India, initial investigations suggest a possible focus on the country. 

Researchers found that Apple iOS spyware, known as LightSpy, is being used in cyber espionage campaigns targeting South Asia. This sophisticated mobile spyware has resurfaced after a period of inactivity that dates back several months. In a report published by the Blackberry Threat Research and Intelligence Team, cyber security researchers have stated that the most recent version of the LightSpy campaign uses an extremely sophisticated spying framework in combination with a modular framework. 

To protect its command and control servers from being interception and detected, LightSpy employs a certificate-pinning strategy. It is believed that the campaign primarily targets iPhone users in India, although there have been reports of incidents taking place in Bangladesh, Sri Lanka, Afghanistan, Pakistan, Bhutan, the Maldives, and Iran in recent times as well. Hackers have been suspected of exploiting hacker websites to facilitate the deployment of LightSpy spyware, as previously observed in previous campaigns, by using hacked news websites that had Hong Kong-related stories, as they did in previous campaigns. 

In a BlackBerry report, the company uncovered that the loader enables the delivery of the core implant along with several plugins that enhance the capabilities of the primary backdoor. It is considered that LightSpy is an iOS backdoor attack that spreads via watering hole attacks, in which popular websites are infected and then targeted by attackers who attack them when they visit these infected websites and gain access to their systems or mobiles. 

According to the BlackBerry security agency, it has been discovered that the latest spyware attacks may have been coordinated by news websites that were infected and visited by targeted individuals who then installed LightSpy on their computers. A spyware program such as this usually gathers information such as phone numbers, SMS messages, exact location and voicemail from your computer, among other things. 

The report suggests that the attack was carried out by Chinese hackers, as its infrastructure and functionality were very similar to that of DragonEgg spyware, a Chinese nation-state hacker group which has been linked to the attack. Accordingly, Chinese hackers are suspected of conducting the attack. Specifically, the report claims that LightSpy is capable of analyzing location data, sound recordings, contacts, SMS messages, and data from apps such as WeChat and Telegram to extract sensitive information from your phone. 

There is a growing threat of mobile espionage threat campaigns that is highlighted by the re-emergence of the LightSpy spyware implants. Apple’s security updates are all the more important after the recent mercenary spyware attacks that affected iPhone users in 92 countries. The campaign is in line with the recent mercenary spyware attack that had impacted iPhone users all over the world. 

As the agency points out, the most recent version of LightSpy discovered this month is also capable of retrieving files and data from popular apps like Telegram, WeChat, and iCloud Keychain data as well as the history of your web browsers in Safari and Chrome. There is indication that state-sponsored involvement may have been involved in the development of LightSpy in the form of permission pinning which prevents communication interception with its C2 server, as well as the presence of Chinese language artefacts in the implant's source code. 

According to Apple's recent threat notifications, which have been sent to users in 92 countries, including India, the situation has become more severe. It is unsurprising that LightSpy, a mobile spy tool with attractive new capabilities, has made a resurgence and is now posing an alarming threat to individuals and organisations throughout Southern Asia, indicating an alarming escalation in mobile spying attacks.
Read more »
Vulnerabilities and Exploits
CVE-2024-3400 Cyber Cybersecurity Palo Alto Networks PAN-OS firewall Remote Code Execution Threat actors Volexity Vulnerabilities and Exploits

Zero-Day Exploitation of Palo Alto Networks Firewall Allows Backdoor Installation

 

Suspected state-sponsored hackers have exploited a zero-day vulnerability in Palo Alto Networks firewalls, identified as CVE-2024-3400, since March 26. These hackers have utilized the compromised devices to breach internal networks, pilfer data, and hijack credentials.

Palo Alto Networks issued a warning on the active exploitation of an unauthenticated remote code execution flaw in its PAN-OS firewall software. Patch updates are slated for release on April 14. Given the ongoing exploitation, Palo Alto Networks opted to disclose the vulnerability and provide interim mitigations for customers until patches are fully deployed.

Further insights into the zero-day exploitation emerged from a subsequent report by Volexity, the entity that discovered the flaw. According to Volexity, hackers have been exploiting the vulnerability since March, employing a custom backdoor dubbed 'Upstyle' to infiltrate target networks and execute data theft. The activity, tracked under the designation UTA0218, is strongly suspected to be orchestrated by state-sponsored threat actors.

Volexity's investigation traced the zero-day exploitation to April 10, primarily targeting the GlobalProtect feature of Palo Alto Networks PAN-OS. The subsequent deployment of identical exploitation methods at another customer site underscored the severity of the situation. Despite the exploitation period starting as early as March 26, payloads were not deployed until April 10.

The 'Upstyle' backdoor, facilitated by a Python script, enables remote command execution on compromised devices. The backdoor leverages a path configuration file to execute commands, allowing threat actors to operate stealthily within compromised environments.

In addition to the 'Upstyle' backdoor, Volexity observed the deployment of additional payloads, including reverse shells, PAN-OS configuration data exfiltration tools, and the Golang tunneling tool 'GOST.' In some instances, threat actors pivoted to internal networks to steal sensitive files, such as Active Directory databases and browser data from specific targets.

Volexity recommends two methods for detecting compromised Palo Alto Networks firewalls: generating Tech Support Files to analyze forensic artifacts and monitoring network activity for specific indicators of compromise.

This incident underscores the increasing targeting of network devices by threat actors, as demonstrated by previous campaigns exploiting vulnerabilities in Fortinet, SonicWall, Cisco, TP-Link, and Barracuda devices.
Read more »
malware
Cyberattacks CyberCrime Cyberhacks Cybersecurity CyberThreat GDP Mac malware

Counting the Cost: $9.2 Trillion Annual Impact of Cybercrime Looms

 


According to a new Statista Market Insights report, cybercrime is rising at an unprecedented pace. Approximately one-third of the United States' GDP or about 24 times Apple's annual revenue in 2023 will be incurred as a result of cyberattacks, according to a new survey from Statista Market Insights. A similar study from Statista Market Insights found that cybercrime costs have risen by 245% between 2018 and 2020, increasing from $860 billion to $2.95 trillion. 

With the spread of the pandemic, the cost of health care has more than doubled to $5.49 trillion in 2021 and is expected to increase by $1 trillion annually in 2023 to $8.15 trillion. In addition to impacting businesses and governments, cybercrime has become one of the world's largest illegal economies, as well as the everyday people of the world. Cyberattacks are known for causing financial losses such as ransom payments, loss of productivity, system downtime and data theft, among others. 

Contributing factors In terms of attack surfaces, IoT devices are providing cybercriminals with an increasingly large attack surface, increasing the number of potential victims and supplying them with a more relevant attack surface over time. There is no reason for Mac users to be excluded from this. There was an increase of 50% in new Mac malware families in 2023 in Jamf's report. 

The number of instances of malware that can be found within each of these families could be hundreds. With the growing number of users of Macs, cybercriminals are more and more interested in targeting it as an easy target. It is important to keep in mind that geopolitics plays a significant role in cyberattacks as many countries use them for strategic advantage, disruption of critical infrastructure, and intelligence gathering.

A heightened escalation in the number of state-sponsored attacks is taking place as a result of the conflict between Ukraine and Israel. A significant number of cybersecurity jobs have gone unfilled as a result of the skills shortage we're going through today. Due to this shortage, many cybersecurity positions have gone unfilled. It will therefore be more difficult to monitor and defend against specific threats as there will be fewer professionals. 

Moreover, the shortage of skilled professionals can also increase the workload for employees who are already working, so that productivity can be negatively impacted. Further to this, employees are burned out as a result of their jobs. Threat actors count on this. In the world of ransomware-as-a-service (RaaS), there are very few barriers to entry, and this has made it very popular thanks to a combination of tough economic factors, swift financial gains, and little technical knowledge. 

Operators develop the software under this model and affiliates pay to use pre-built tools and packages to launch attacks on the network. Each affiliate pays a fee for each attack they launch. A ransomware attack can be carried out by non-programmers lacking the skills to develop and deploy their ransomware. 

There is no shortage of RaaS kits available on the dark web, but they aren't always the best. Due to a simple lack of awareness, the risks and consequences associated with cyberattacks remain undetected by many individuals and organizations, making them vulnerable to cybercrime. It was found that 40% of Jamf's mobile users and 39% of the organizations in their annual trends report are running on a device that is known to have vulnerabilities, according to the report.

In light of recent incidents regarding a popular Apple device management platform, it has become evident that there remains a notable lack of awareness concerning the security measures necessary to protect Mac devices. Ensuring the security of the Mac is imperative in safeguarding against potential threats such as malware and phishing attacks. Here are some essential steps to bolster the security of the Mac: 

1. Keep the device up-to-date: It is crucial to regularly update the Mac's operating system to incorporate the latest security patches. By staying current with updates, users can effectively address known vulnerabilities that may be exploited by malware.

2. Utilize antivirus software: Despite common misconceptions, Macs are not impervious to malware. Therefore, employing reputable antivirus software is highly recommended. Tools such as Malwarebytes offer free applications for individual users, capable of detecting and removing potential threats. Additionally, MacPaw’s CleanMyMac X now features a malware removal tool powered by MoonLock, enhancing protection against malicious software. 

3. Exercise caution when clicking: Email remains a primary vector for malware distribution, with phishing attacks experiencing a significant rise in success rates. According to recent reports, phishing success rates increased from 1% in 2022 to 9% in 2023. Hence, exercising caution and scepticism when interacting with email links and attachments is essential to mitigate the risk of falling victim to such attacks. 

4. Enable a firewall: Enabling the built-in firewall on the Mac is an effective measure to prevent the acceptance of unauthorized connections and services. By managing both incoming and outgoing connections, the firewall helps fortify the device's defences against potential threats. 

5. Use strong, unique passwords: Employing robust and distinctive passwords is imperative for bolstering the security of the Mac. Avoid using easily guessable passwords, such as common phrases or pet names followed by predictable characters. Instead, opt for complex combinations of letters, numbers, and symbols to enhance password strength and resilience against unauthorized access. 

6. Enable disk encryption: Leveraging features such as FileVault, which encrypts all user data stored on the disk in real-time, enhances the security of sensitive information on the Mac. In the event of device loss or theft, disk encryption ensures that the data remains inaccessible to unauthorized individuals, thereby safeguarding privacy and confidentiality. 

7. Limit user privileges: Restricting user privileges is crucial in preventing unauthorized software installations and minimizing the potential impact of malware infections. By limiting user permissions, users can effectively mitigate the risks associated with malicious activities and enhance overall device security. 

In summary, prioritizing the implementation of robust security measures is paramount in safeguarding the Mac against evolving threats. By adopting proactive strategies such as keeping the device updated, utilizing antivirus software, exercising caution when interacting with emails, enabling firewalls, employing strong passwords, enabling disk encryption, and limiting user privileges, users can significantly enhance the security posture of the Mac and protect against potential vulnerabilities and cyber threats.
Read more »
Washington DC
conservative think tank cyber attack Cyber Attacks cyber espionage Cybersecurity donor information Heritage Foundation Investigation nation-state hackers Politico Republican politics Washington DC

US Think Tank Struck by Cyberattack

 

The Heritage Foundation, a prominent conservative think tank based in Washington, DC, revealed on Friday that it had fallen victim to a cyberattack earlier in the week. The attack, which occurred amid ongoing efforts to mitigate its effects, left the organization grappling with uncertainties regarding potential data breaches. 

Although the exact extent of the breach remained unclear, the foundation took proactive measures by temporarily shutting down its network to prevent further infiltration while launching an investigation into the incident.

Initial reports of the cyberattack surfaced through Politico, citing a Heritage official who speculated that the perpetrators behind the attack could be nation-state hackers. However, no concrete evidence was provided to substantiate this claim. Despite inquiries, Heritage spokesperson Noah Weinrich refrained from offering comments, both on Thursday via email and when approached by TechCrunch on Friday.

Founded in 1973, the Heritage Foundation has emerged as a significant force in conservative advocacy and policymaking, exerting considerable influence within Republican circles. Yet, its prominence also renders it a prime target for cyber threats, with think tanks often serving as lucrative targets for cyber espionage due to their close ties to government entities and policymaking processes. 

This incident marks another instance in which Heritage has faced cyber adversity, reminiscent of a 2015 attack that resulted in the unauthorized access and theft of internal emails and sensitive donor information.
Read more »
IMF warning
bank runs Cyber Security Cyber Threats Cybersecurity economic impact financial stability IMF warning

IMF Warns of Potential Bank Runs Triggered by Cyber Attacks

 

The International Monetary Fund (IMF) has raised concerns about the increasing frequency and severity of cyber attacks, warning that they could potentially lead to bank runs. According to the IMF, these cyber threats pose significant risks to financial stability and could even push companies into insolvency. This warning comes in the wake of research showing that the number of malicious cyber attacks has doubled since the onset of the pandemic.

In its latest Financial Stability Report, the IMF emphasized the potential impact of cyber incidents on eroding confidence in the financial system, disrupting critical services, and causing spillovers to other institutions. The report highlighted the possibility of market sell-offs or runs on banks in extreme cases, emphasizing the need for robust cybersecurity measures.

Recent cyber attacks have targeted the UK's financial system, with the Bank of England conducting its own cyber stress test as a response to these threats. The UK Government has attributed some of these attacks to Chinese hackers, further underscoring the seriousness of the issue.

A survey conducted by the Bank of England revealed that 80% of firms view cyber attacks as the second biggest threat to the UK financial system, following closely behind geopolitical risks. The IMF noted a significant increase in the risk of financial losses due to cyber incidents, with potential funding problems for companies and heightened solvency risks.

While not attributing attacks to specific countries, the IMF observed a surge in cyber attacks following geopolitical events, such as Russia's invasion of Ukraine in February 2022. Financial firms have become prime targets for cyber criminals, with attacks on commercial banks comprising nearly a fifth of all attempted hacks.

Major financial institutions, such as JPMorgan, have invested heavily in cybersecurity measures, with billions of dollars allocated to technology and tens of thousands of personnel dedicated to strengthening defenses. Despite these efforts, the IMF highlighted the persistent threat of cyber attacks, citing instances of modest deposit outflows at smaller US banks following cyber incidents.

Over the past two decades, the financial system has experienced over 20,000 successful cyber attacks, resulting in significant losses. The IMF stressed the potential impact of cyber incidents on critical services like payment networks, which could severely disrupt economic activity.

To address these challenges, the IMF called for greater international cooperation and the adoption of national cybersecurity strategies. Collaborative efforts are needed to mitigate the risks posed by cyber threats and safeguard financial stability on a global scale.
Read more »
mitigate risks
agencies CISA Cyber Security Cybersecurity emergency directive Microsoft hack mitigate risks

CISA Directs Affected Agencies to Mitigate Risks Arising from Microsoft Breach

 

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a new emergency directive aimed at U.S. federal agencies in response to the breach of multiple Microsoft corporate email accounts by the Russian APT29 hacking group.

The directive, known as Emergency Directive 24-02, was issued on April 2 to Federal Civilian Executive Branch (FCEB) agencies. It mandates these agencies to conduct investigations into potentially affected emails, reset any compromised credentials, and implement measures to secure privileged Microsoft Azure accounts.

According to CISA, operatives from the Russian Foreign Intelligence Service (SVR) are now utilizing information pilfered from Microsoft's corporate email systems to gain unauthorized access to certain customer systems. CISA Director Jen Easterly emphasized the urgent need for action to mitigate risks to federal systems, highlighting the longstanding pattern of malicious cyber activity associated with Russia.

Microsoft, in conjunction with the U.S. cybersecurity agency, has notified all federal agencies whose email correspondence with Microsoft was identified as exfiltrated by the Russian hackers.

This emergency directive marks the first official confirmation by the U.S. government that federal agency emails were compromised in the January Microsoft Exchange breaches. Affected agencies are instructed to assess the entirety of their correspondence with compromised Microsoft accounts and conduct a cybersecurity impact analysis by April 30, 2024.

Agencies detecting signs of authentication compromises are required to take immediate remedial action, including resetting compromised credentials and reviewing account activity logs for potential malicious activity.

While the requirements of Emergency Directive 24-02 specifically target FCEB agencies, the implications of the exfiltration of Microsoft corporate accounts extend to other organizations. These organizations are encouraged to seek guidance from their respective Microsoft account teams and bolster their security measures, including the use of strong passwords, multifactor authentication, and secure communication practices.

The APT29 hacking group, also known as Midnight Blizzard and NOBELIUM, gained access to Microsoft's corporate email servers in January through a password spray attack targeting a legacy non-production test tenant account lacking multifactor authentication. Subsequently, the attackers exploited an OAuth application with elevated access to steal data from corporate mailboxes belonging to Microsoft leadership and personnel in cybersecurity and legal departments.

APT29 previously made headlines for its involvement in the 2020 SolarWinds supply chain attack, which compromised several U.S. federal agencies and numerous companies, including Microsoft. In June 2021, the group breached another Microsoft corporate account, granting access to customer support tools.
Read more »
Tarrant County
Cyber Attacks CyberCrime Cybersecurity CyberThreat Medusa Leak TAD Tarrant County

300 Strikes: Fort Worth's Battle Against the Medusa Gang

 


In the wake of a cyberattack on Tarrant County Appraisal District in March, the Medusa ransomware gang has claimed responsibility for the hack and has threatened the public with the threat of leaking 218 GB of the stolen data unless the ransom of $100,000 is paid within six days. 

According to the Tarrant County Appraisal District, approximately 300 individuals' personal information was stolen in a recent update. As of this original report (April 9th), the county organization was still about four days away from publishing the alleged data stolen in the attack after the gang forewarned it to do so on April 6th. 

TAD appeared on the Medusa leak blog on April 6th. It is recommended to report any suspicious activity as soon as possible to the authorities, but affected individuals will be contacted to ensure that their personal information remains safe. Even though the county has not yet responded to whether the ransom will be paid, it is understood that the attack has been reported to the FBI, and plans are underway to restore operations. 

Additionally, the Medusa gang recently attacked an Illinois county on the border with Iowa in addition to the Tarrant County incident. As of 2023, the group began to work its way onto the scene. It soon became involved with a large number of victims, including a company in Italy that supplies drinking water to close to half a million people, a large school district in Minnesota, Sartrouville, a French village, the state-owned telecommunications company of Tonga, and most recently, the government organization in charge of the Philippines' universal healthcare program. 

It is no secret that Medusa made headlines in the fall of last year when it attacked Toyota and a technology company created by two of the biggest banks in Canada. A ransomware gang known as Medusa first appeared on the scene in late 2022 and has been consistently active ever since. In January, they attempted to extort Water for People, a nonprofit that works to improve water access for all. 

As recently as December 2017, Medusa became the target of three separate school districts within less than a week and compromised the personal information of thousands of students and teachers across three districts. It was reported in December of that year that Medusa's leak blog revealed that the group published the files from the school districts from all three districts in December as well. 

Two other school districts in Pennsylvania appeared to have been hit at that time; while Minneapolis Public Schools had been hit earlier in the year. Moreover, in November, the threat actors attacked Toyota Financial Services and took down systems in the region, forcing Toyota to take some systems offline for days. In addition, the threat actors also attacked Moneris, a Canadian fintech company that processes payments for Starbucks and IKEA. 

Medusa is regarded as operating under a ransomware-as-a-service (RaaS) model, whereby the company sells its trademark ransomware variant to other ‘criminal affiliates’ for a cut of the profits generated from sales of their ransomware variant. TAD did not disclose how much data the ransomware group took or precisely what information had been compromised. 

However, Medusa has now threatened to leak the supposed stolen information unless a $100,000 ransom is paid to them. The gang has posted a sample cache of around 40 documents said to have been exfiltrated during the recent attack by the group. According to Cybernews, the purported samples are a collection of financial documents, commercial and residential property databases, property owners' information, records of properties, judgments obtained by the courts, details about board members, tax information, records of employees, and the like. 

The recent ransomware attack that hit the Tarrant County Appraisal District in Tarrant County, Texas, has highlighted the critical need for organizations to adopt a proactive approach to cyber defence and consider it a continuous process rather than reactive. There is a history of international cyberattacks conducted by the Medusa cybercrime gang that is well known, he said. 

There has been an increasing realization by the intelligence community that traditional, reactive measures are no longer effective when faced with adversaries like Medusa, which are using advanced tactics. According to him, empowering ourselves to navigate the evolving digital landscape requires more than just technological upgrades; it requires us to change the way we perceive and prepare for cyber threats, move from a reactive posture to a proactive, anticipatory position, and adopt proactive measures that get us ahead of the game. 

There are 73 jurisdictions in the county served by the Tax Assessment Division, which is the division of local property tax assessments. It has been estimated that there are approximately 2.1 million inhabitants in Tarrant County, with the government offices situated in the city of Fort Worth, one of the largest cities in the state. 

There is no state or local government in Texas that levy or collect taxes from its residents because it is one of the few states where taxes are not imposed. The government delegated that responsibility to city and county governments, so TAD has an extremely important role to play there. The Tax Assessor's Department, or TAD, is a government agency responsible for property appraisal and the determination of eligibility for property tax exemptions for homeowners, the elderly, disabled adults, disabled veterans, and nonprofit organizations and charitable organizations. 

The latter are not necessarily charitable. A ransomware gang could be easily convinced to take advantage of the amount of sensitive personal information stored and processed within TAD's network if it were to think it had a chance to profit from those stolen files. It is also worth noting that even though TAD claims that only a small amount of individual data was exposed in the attack, it is oftentimes not known in the immediate aftermath of such a breach what the true effects of the breach will be. Tarrant Appraisal District was recently found to have suffered a breach of its data, which is not the first time this has happened.
Read more »
SVG
Cyber Campaigns Cyber Fraud Cyberattacks CyberCrime Cybersecurity CyberThreat Email Attacks Malware Campaigns Phising SVG

Cybercriminals Employ Obfuscation in Invoice Phishing Malware Campaigns

 


An array of cunning cyberattack campaigns utilizing seemingly innocuous invoices to deliver malware attacks have been uncovered by cybersecurity researchers. In this deceptive campaign, malicious Scalable Vector Graphics (SVG) file attachments are embedded in phishing emails that have been crafted to pose as malicious content. 

There is a risk that an intricate infection sequence will unfold once the victim opens the attachment, potentially releasing the victim's computer with various types of malware strains. Using this invoice-themed phishing scheme, FortiGuard Labs at Fortinet, a leading cybersecurity research team, identified a variety of malware. 

The malicious payloads included RATs such as Venom RAT, Remcos RAT, NanoCore RAT, and XWorm, as well as other Remote Access Trojans (RATs) that are known to have been exploited by hackers. Furthermore, the attack arsenal has incorporated a cryptocurrency wallet stealer that allows attackers to steal digital currencies from users without their knowledge of it. 

In a technical report published by Fortinet FortiGuard Labs, a technical report said that the emails include Scalable Vector Graphics files (SVG) that activate infection sequences when clicked. It is of particular note that the modus operandi uses BatCloak's malware obfuscation engine and ScrubCrypt to deliver malware as obfuscated batch scripts via the BatCloak malware obfuscation engine. 

A tool known as BatCloak, which was offered for sale to other threat actors in late 2022, has its roots in Jlaive, a tool that was developed by the organization. Essentially, it serves to load a next-stage payload by circumventing traditional detection mechanisms by loading it in a layered manner. The complexity of the attack lies in its multilayered approach. 

It is the SVG attachments that serve as triggers, initiating the infection process once the target opens them up. The BatCloak malware obfuscation engine is also extensively used to perform obfuscation techniques. In late 2022, cybercriminals were able to purchase a tool called Jlaive, a descendant of another obfuscation tool known as Jlaive, which has been available since then. 

In addition to masking the subsequent stages of malware, BatCloak's main function is to make it difficult for security software to detect the subsequent stages of malware. This variant of the Quasar RAT gives attackers the ability to seize control of compromised systems, collect sensitive data, and execute commands from command and control (C2) servers once they have taken control of a compromised system. 

In addition, it allows a multitude of plugins to be deployed for different kinds of malicious activities, including Remcos RAT, which is distributed via obfuscated VBS scripts, ScrubCrypt, and Guloader PowerShell scripts. The plugin system also allows a stealer module to be deployed to collect information from crypto wallets and applications like Atomic Wallet, Electrum, Ethereum, and others and send that stolen information to a remote server via the plugin system. 

In addition to obfuscating the malware, ScrubCrypt is one more layer that adds to this elaborate attack. It encrypts the malicious code, making it even more difficult to detect and prevent infection from security systems. A malware payload typically arrives in the form of encoded batch scripts as soon as the layers are peeled back. Once the scripts have been downloaded and executed onto the compromised system, the malware payload will be able to be detected. 

According to the cybersecurity firm that analyzed the latest campaign, the SVG file served as a conduit for dropping a ZIP archive which contained a batch script that probably was created using BatCloak. After the ScrubCrypt batch file has been unpacked, the Venom RAT is eventually executed, but not before establishing persistence on the host, bypassing ETW and AMSI protections, and setting up persistence on the host. 

The evolution of the tactics employed by cybercriminals has demonstrated the importance of the evolving threat landscape. A very important aspect of the sophistication of these online threats is the fact that attackers are strategically using readily available obfuscation tools, alongside malware that targets cryptocurrency. 

Researchers have stressed to users the importance of remaining vigilant, especially when it comes to unsolicited email attachments, even when they seem to be invoices or other documents that seem to come from a legitimate source. Several security measures should also be implemented by businesses, including comprehensive email filtering systems in addition to employee training programs targeted at recognizing warning signs of phishing attempts, which are recommended as part of these measures.
Read more »
Latvia Lead
Bengal Schools Bombs Cyber Attacks Cyber Phishing CyberCrime Cybersecurity CyberThreat Emails Latvia Lead

Threatening Emails Rattle Bengal Schools: Police Pursue Latvia Lead

 


In a statement announced Tuesday, the Kolkata Police said that more than 20 schools across the city have been threatened with bombs, which have been later revealed as hoaxes. According to the sender, bombs had been placed in numerous classrooms across a variety of schools in the city, and the bombs would explode in the morning hours following the placement. 

After receiving a hoax bomb threat mail on Monday, Kolkata Police took the initiative to spread an online message on Tuesday to reassure all parents that they would be there to ensure their children's safety and security, clarifying that it was a hoax mail and that they would be on hand to help. It has been revealed that police have traced the IP address to the Netherlands where the threat mail which was sent to 200-odd schools in the city, suburbs, and Siliguri, was sent from.

On the intervening night between Sunday and Monday (April 8, 2024), a user known as "doll" sent an email at 12.28 am on Monday with the email address 'happyhotdog101' threatening to have bombs placed in schools. The user threatened to make it happen with the help of the U.S. Government.   An email screenshot has been shared by over 90 schools and the screenshots have been shared on more than a dozen websites. 

The message itself has not been shared yet, but the fact that it has gone viral has contributed to its success. The sender, it is thought, had threatened the students that bombs would be detonated when they arrived at school that morning and that this was the reason for the mail. 

There had been no official announcement regarding this case from either the Calcutta Police or the West Bengal Police until late that evening. There is also the possibility that none of the schools in either of the cities will publicize the threat. The email reads, “This is a message for everyone. There are bombs planted inside "of the" classrooms. The bombs are set to go off tomorrow morning when there are kids inside "of the" schools. Our mission is to leave as many as people in a pool of blood." 

his attack was caused by 2 terrorists named Ching and Doll." According to the Latvian police, the email had been generated by an account linked to an email service provider founded in 2018 and set up its operations in 2022, but it was conceived in 2018 and started operating in 2022. 

Around 68 educational institutions in Bengaluru received a threat email last January, which came from one of the email addresses that were created by the same company that provides email services to these institutions. Initially, Bengaluru police speculated that the email was coming from either the Czech Republic or Slovakia, but they have since removed that suspicion. 

In the course of the investigation, it was found that the encryption service provider in question was the same as the one used in the Calcutta school case, though the location was in Cyprus instead of India. It was reported that the email sender said that he used a Switzerland-based Virtual Private Network, which is also well-known for the security and privacy of end-to-end encryption and focus on privacy, to send the email according to reports from the Bengaluru Police. 

There is an announcement that, in June 2022, the Narendra Modi government will ask all VPN operators to store for five years data related to its subscribers, such as names, email addresses, contact numbers, and IP addresses to tighten cybersecurity rules. Also, the Indian government requested the use of the data at its discretion as and when it deemed necessary. As a result of the order, most VPN companies have declared themselves uncooperative and have removed their servers from India as a result.

The Calcutta Police and the Bengal Police are yet to discover whether the email service provider has been contacted by either the Calcutta Police or the Bengal Police to review Monday's threat emails as yet. Amidst a flurry of concerning emails inundating over 90 schools across Bengal, authorities promptly alerted law enforcement, triggering a swift response from the cyber crime cell. Their immediate objective: pinpoint the sender's identity through meticulous analysis of the email's IP address. Offering insights into the unfolding situation, a senior police official asserted that the dissemination of such emails was a deliberate ploy aimed at stoking tensions in the lead-up to the elections, underscoring the malicious intent behind the communication. 

In a bid to assuage public concerns, the city police took to social media to affirm that the purported threats were indeed unfounded, branding them as mere 'hoaxes' intended to sow panic and unrest. Further action was swiftly undertaken by authorities, with the registration of a formal case against the individual responsible for the email transmission, signalling the commencement of a thorough investigation into the matter. 

This incident is but the latest in a string of similar occurrences, with the Delhi Police, just last March, apprehending a 29-year-old Bangladeshi national residing in Kolkata for orchestrating a hoax bomb threat targeting a SpiceJet flight en route from Delhi to Kolkata. Delving into the motives behind the elaborate ruse, law enforcement disclosed that the perpetrator, upon interrogation, confessed to concocting the threat in a bid to derail the flight and thus prevent the imminent arrival of his brother-in-law in Kolkata. This calculated manoeuvre, as elucidated by police officials, stemmed from the individual's desire to conceal a web of deceit, as he had falsely claimed to be pursuing a PhD in the United States—a fabrication that facilitated his marriage to his spouse.
Read more »
Ukrainian Hackers
Cyber Attacks Cyber Warriors CyberCrime Cybersecurity Cyberthreats Data Center Internet Services Russian Military Telecom Ukrainian Hackers

Under Siege: Ukrainian Cyber Warriors Erase Vital Russian Military Data Center

 


On April 8 of this year, sources in the Ukrainian Security Service of Ukraine (SBU) told the Kyiv Independent that Ukrainian hackers, possibly linked to the SBU, destroyed a data centre used by Russian military, energy, and telecommunications companies. In a recent attack, Ukrainian hackers connected to the SSU cyber department destroyed a data centre belonging to a Russian industrial giant. 

They included Gazprom, Lukoil, Telecom and some of the leading military companies in the country. Sources have stated that more than 10,000 entities involved in the Russian military industry have stored their data in OwenCloud.ru cloud services, which the hackers targeted. 

A number of these companies, including Ural Works of Civil Aviation, Rubin, Ural Plant Spectechniks, Gazprom, Transgaz, Lukoil, Rosneft, Nornickel, Rostelecom, or MegaFon, reportedly make up this group: the oil and gas industry, the metallurgical and aerospace industry, as well as major telecommunication giants. 

A source stated that over 300 TB of data were taken out of circulation on 400 virtual and 42 physical servers. This operation involved the Ukrainian hacking group BLACKJACK and the cyber division of the Ukrainian Security Service. In addition to internal documents and backups, these servers had software used to manage production processes remotely, according to a source. 

The OwenCloud.ru website, at the moment of publication, displays what is alleged to be a message left by a group called Blackjack, stating that the centre's "information technology infrastructure has been destroyed." The Ukrinform news service reports nearly 4,500 cyberattacks on Ukraine are carried out by Russian hackers every year. Kyivstar was attacked by a powerful hacker on December 12, 2023, which caused the company to experience a technical breakdown.

Communication and internet services stopped working. It is estimated that around 16,000 Russian companies are affected by the strike, such as Lukoil, Rosneft, The Ural Works of Civil Aviation (which is part of the Roselectronika holding), Ural Special Equipment Plant, Gazprom, Transgaz, Norilsk Nickel, Rostelecom, Telecom, and Megafon. As a result, the source asserted that OwenCloud.ru is hosting over 10,000 legal entities, including the military-industrial sector, oil and gas industry, metallurgical and aerospace companies, and telecommunication giants. 

It was reported that the hack affected various organizations, such as companies in the oil and gas and telecommunications sectors and the country's military. In the Kyiv Independent report, there was a list of victims that included Ural Works of Civil Aviation, Rubin, Ural Plant Spectechniks, Gazprom, Transgaz, Lukoil, Rosneft, Nornickel, Rostelecom, and MegaFon, among others. 

The source of NV's report revealed on March 18 that Ukrainian hackers were able to access correspondence between Russian CEC member Nikolai Levichev and Boris Nadezhdin, a candidate in the so-called presidential election. As a result of being denied registration as a presidential candidate, Nadezhdin actively contacted representatives of the Russian Central Election Commission and resolved personal and political issues, including addressing the refusal of the Russian Central Election Commission. 

According to the hacker group, this suggests that a "fake presidential candidate" is at play. Ukrainian hackers are known for regularly stealing information about Russian websites, payment systems, and state-owned companies. Thousands of Russian organizations were accessed by Ukrainian hackers in January, and 200 gigabytes of data was obtained. 

A Russian state-owned company that builds military facilities across the entire Russian territory has also been crashed by the BLACKJACK hacker group. They have also stolen documentation for 500 military facilities maintained by the Russian Ministry of Defense. On the servers of the Russian Ministry of Defense, a DDoS attack was launched by hackers from the Defense Intelligence Department.
Read more »
training
Awareness Cyber Security Cybersecurity employee engagement proactive culture Threat Detection training

Fostering Cybersecurity Culture: From Awareness to Action

 

The recent film "The Beekeeper" opens with a portrayal of a cyberattack targeting an unsuspecting victim, highlighting the modern challenges posed by technology-driven crimes. The protagonist, Adam Clay, portrayed by Jason Statham, embarks on a mission to track down the perpetrators and thwart their ability to exploit others through cybercrimes.

While security teams may aspire to emulate Clay's proactive approach, physical prowess and combat skills are not within their realm. Instead, prioritizing awareness becomes paramount. Educating the workforce proves to be a formidable task but stands as the most effective defense against individual-targeted threats. New training methodologies integrate traditional techniques, emphasizing adaptability over repetition.

In cybersecurity, the technology operates predictably, unlike humans. Recognizing this distinction underscores the necessity for personalized training during onboarding processes. Interactive training acknowledges the complexity of human behavior, emphasizing adaptability to address evolving threats and individual learning preferences. Unlike automated methods, personalized approaches can swiftly adjust to cater to unique challenges and learner needs, fostering a deeper understanding of security practices.

Organizations must evaluate their readiness to combat AI-based threats, considering that human error contributes to the majority of data breaches. Prioritizing education and resource allocation towards cultivating an informed workforce emerges as a critical strategy. Utilizing security champions and fostering collaboration among teams are advocated over solely relying on automation.

Establishing a robust cybersecurity culture involves encouraging employees to share their personal experiences with security incidents openly. Storytelling proves to be a powerful tool in imparting valuable security lessons, promoting a sense of community, and normalizing discussions around cybersecurity.

Testing and monitoring employee responses are crucial aspects of assessing the effectiveness of security programs. Conducting simulated phishing or smishing attacks allows organizations to gauge employee awareness and readiness to detect and report potential threats. Active engagement and communication among staff members indicate the success of the security program in fostering a proactive security culture.

Moreover, while we may not engage in the direct confrontation depicted in "The Beekeeper," building a resilient security culture through awareness remains our primary defense against cybercrime. Encouraging employee participation, personalized training, and proactive testing are pivotal in equipping individuals to identify and mitigate potential threats effectively. The benefits of these strategies extend beyond the workplace, empowering individuals to navigate the digital landscape safely in both personal and professional spheres, and contributing to a safer online environment for all.
Read more »
Vulnerabilities and Exploits
Cyber Breach Cyberattacks CyberCrime Cybersecurity Cyberthreats Security Breach Software update UAE Vulnerabilities and Exploits

Security Advisory: Protecting Mobile Devices for UAE Residents

 


In a security update released by Microsoft on Thursday, 61 high-risk vulnerabilities, including critical ones, were addressed. The cyber threat actor may be able to exploit some of these vulnerabilities to gain control of a computer that has been affected. To prevent the breach or leak of information or personal data, UAE Cyber Security Wednesday advised users to implement Microsoft updates. 

The UAE authorities have emphasized the importance of heightened awareness of the vulnerability of their devices and the need for proactive measures to combat it. As the digital world is increasing, it has become increasingly important to secure users' mobile devices to ensure that they are protected against potential risks.

By taking proactive steps, residents can mitigate these threats and protect their data. The Cyber Security Council has provided a real-life example to educate residents regarding the dangers posed by online disrupters. A report issued by the UAE Cyber Security Council and CPX Holding jointly published in 2024 on UAE's cybersecurity highlights a worrying reality. 

There are currently 155,000 cyber assets in the UAE that are vulnerable, with over 40 per cent of them over the age of five. In light of the escalating cyber threats, including sophisticated attacks such as ransomware, the need for advanced cybersecurity measures is urgent, particularly now that the nation has faced an increase in cyberattacks. 

In general, software updates are not thought to be solely relevant to smartphones. However, they play an important role in ensuring security across all types of devices and applications - computers, tablets, smart appliances and even wearables - as well as ensuring security and protecting the user's data. It is imperative to keep devices up to date to ensure security and safeguard them, particularly when they are intertwined with a variety of aspects of life for users.

Users who prefer to update their devices and apps via Wi-Fi might want to set a reminder for when they need to update their apps so they don't have to consume their data plan while doing so. Tips for making updating software a more secure decision: 

To ensure that the data is protected, it is important to periodically update your device's operating system and applications. Ensure that you are up-to-date on software updates from the appropriate source to avoid cyber attacks. Back up important files to prevent losing updates. Ensure that automatic updates are enabled on the device so that manual intervention is minimized. It is important to consider updates for all devices, including smartphones, laptops, wearables, and tablets, when updating software and apps.
Read more »
Threat actor
Commonwealth of Independent States Cybersecurity Dark Web Exfiltration Lazy Koala malware password stealer malware Phishing Attacks PT ESC Telegram Threat actor

Lazy Koala: New Cyber Threat Emerges in CIS Region

 

Cybersecurity researchers at Positive Technologies Expert Security Center (PT ESC) recently uncovered a new threat actor they've named Lazy Koala. Despite lacking sophistication, this group has managed to achieve significant results.

The report reveals that Lazy Koala is targeting enterprises primarily in Russia and six other Commonwealth of Independent States countries: Belarus, Kazakhstan, Uzbekistan, Kyrgyzstan, Tajikistan, and Armenia. Their victims belong to government agencies, financial institutions, and educational establishments. Their primary aim is to acquire login credentials for various services.

According to the researchers, nearly 900 accounts have been compromised so far. The purpose behind the stolen information remains unclear, but it's suspected that it may either be sold on the dark web or utilized in more severe subsequent attacks.

The modus operandi of Lazy Koala involves simple yet effective tactics. They employ convincing phishing attacks, often using native languages to lure victims into downloading and executing attachments. These attachments contain a basic password-stealing malware. The stolen files are then exfiltrated through Telegram bots, with the individual managing these bots being dubbed Koala, hence the group's name.

Denis Kuvshinov, Head of Threat Analysis at PT ESC, describes Lazy Koala's approach as "harder doesn't mean better." Despite their avoidance of complex tools and tactics, they manage to accomplish their objectives. Once the malware establishes itself on a device, it utilizes Telegram, a preferred tool among attackers, to exfiltrate stolen data.

PT ESC has notified the victims of these attacks, warning that the stolen information is likely to be sold on the dark web.
Read more »
Policy
Cyber Crime Cyber Safety Cyberattacks Cybersecurity Cyberthreats Data Safety Europol Policy

Cracking Down on Crime: Europol Shares Data on Europe's Top Threats

 


There has been a considerable increase in serious organized crime over the past few years, and it continues to pose a significant threat to the EU's internal security. The most threatening criminal networks operating in and affecting the EU need to be clearly understood by law enforcement and policymakers if they are to effectively prioritise resources and guide policy action. 

Certain traits make successful companies agile and resilient, able to anticipate trends and pivot to new environments rapidly while maintaining their operations at the same time. Europol released a report on Friday that indicated that the most threatening criminal networks across the EU are also equipped with these skills. 

Europol has presented a report today (April 5) detailing the state of crime in Europe, highlighting 821 criminal networks that exist within the EU territory, flagged as the most dangerous criminal networks within the EU. Making the invisible visible so that we can know, fight, and defeat it. To produce the report, we consulted with law enforcement agencies from 27 of the member countries, as well as 17 other states, who provided information and participation. 

As Europol pointed out, some key characteristics distinguish the 821 most threatening criminal networks: they are agile as they can adopt business processes in a short time, which is characteristic of economies of scale, overcoming challenges that law enforcement agents may face as well. 

Despite their activities remaining concentrated in a single country, criminal networks are borderless: they can operate within EU and non-EU countries without any significant difficulty. Controlling: They can perform excellent surveillance over everything within the organization, and they generally specialize in a specific criminal activity. In addition to corrupt activities, the 821 networks also engage in significant damage to internal security due to corruption. 

As a result of Europol's report on terrorism, 50 per cent of the most dangerous criminal networks are involved in drug trafficking. For 36 per cent of those networks, drug trafficking is their sole business. A total of 15 percent of the organizations deal with fraud exclusively while the remaining 6 percent deal with human trafficking. 

Regarding drugs, aside from heroin, cannabis, and cocaine, there is also the concern that there is the arrival of new substances on the European market such as Fentanyl, which has already caused thousands of deaths in the United States and has already reached a critical point. Recent months have seen massive shipments of drugs hidden in bananas that have been shipped throughout Europe. 

A shipment of bananas in the British Isles contained a shipment of more than 12,500 pounds of cocaine, which was found in February, breaking the record of the most drugs seized in a single seizure in British history. In August of last year, customs agents in the Netherlands discovered that 17,600 pounds of cocaine had been hidden inside banana crates inside Rotterdam's port. 

In the Italian port of Gioia Tauro, a police dog sniffed out 3 tons of cocaine hidden in a case of bananas three months earlier. As part of the top ten criminal groups identified, nine of them specialize in cyber crimes and are actively operating in France, Germany, Switzerland and the U.S. These organizations, mainly run by Russians and Ukrainians, are active in France, Germany, Switzerland and the U.S. 

They have up to 100 members, but have a core of criminals who are responsible for distributing ransomware to affiliates so that they can conduct cyber attacks. A core group of individuals are responsible for managing the negotiation and payment of ransoms, often in cryptocurrency, and usually pay affiliates 80% of their fee for carrying out an attack. 

As a result of their involvement in fraud schemes and providing cyber services and technology solutions, service providers provide crucial support to criminal networks. The methods used in these campaigns include mass mailings and phishing campaigns, creating fake websites, creating fake advertisements and creating social media accounts. 

According to Europol, the firm has also been supporting online fraud schemes and advising on the movements of cryptocurrencies online. Law enforcement personnel sometimes use countermeasures, such as encrypted telephones to avoid detection by criminal networks, to avoid being detected by them. The other group of people avoid the use of electronic devices in all forms of communication and meet in person instead to avoid leaving any digital footprint on their activities.  

A report released by the European Commission stated that drug trafficking continues to stand out as the most significant activity in the EU countries and is witnessing record seizures of cocaine in Europe, as well as an increase in violent crimes linked to drugs, such as in Belgium and France.  

Half of the most dangerous networks in the criminal world are involved in drug trafficking in some form or another, whether on their own or as part of their overall portfolio. According to the report, more than 70% of networks engage in corruption “to facilitate criminal activity or obstruct law enforcement or judicial processes. 68% of networks use violence as an inherent element of their approach to conduct business,” which is consistent with their criminal or nefarious activities.

It has been reported that gang violence has been rife in Antwerp for decades as the city serves as the main entry point for Latin American cocaine cartels into the European continent. Federal authorities say that drug trafficking is rapidly affecting society as a result of an increase in drug use throughout the whole country. 

In Ylva Johansson, EU Commissioner for Home Affairs, the threat of organised crime is one of the biggest threats facing the society of today, a threat which threatens it with corruption and extreme violence. During a press conference, Europol explained the data it collected would be shared with law enforcement agencies in countries of the EU, which should help better target criminals.
Read more »
WordPress
Cyberattacks Cybersecurity Cyberthreats LayerSlider Plugin Vulnerabilities and Exploits WordPress

LayerSlider Plugin Imperils 1 Million WordPress Sites, Urgent Fixes Mandated!

 


The LayerSlider WordPress slider plugin has been installed by more than one million people and offers a full package of features for editing web content, creating digital visual effects, and designing graphic content in a single application. 

Considering that WordPress is the most popular website builder in the world, as well as used by roughly half of all websites on the planet, it makes it an ideal target for cybercriminals all over the world. Despite that, hackers have turned their attention and focus to third-party themes and plugins, which are seldom as secure as the platform itself, because most people consider this platform to be relatively secure. 

In addition, Defiant’s Wordfence team stated that unauthenticated attackers can append SQL queries to existing queries to extract information such as password hashes due to the lack of sufficient escape of the parameter supplied by the user, as well as the lack of sufficient preparation of the existing SQL query. 

There is a vulnerability of over 1 million WordPress sites attributed to a premium plugin referred to as LayerSlider, requiring administrators to prioritize applying security updates to that plugin. In addition to being a visual web content editor, LayerSlider also offers graphic design software, as well as digital visual effects that enable users to create animations and rich content for their websites. It is noted by its website that there are millions of people using it globally. 

During the week of March 25, 2024, a researcher named AmrAwad found a critical vulnerability (CVSS score: 9.8) affecting WordPress security firm Wordfence through their bug bounty program. He received $5,500 for his responsible reporting. AmrAwad was recognized for his responsible reporting. 

If an attacker has access to sensitive data from the site's database, such as password hashes, from versions 7.9.11 through 7.10.0 of the plugin, the website could be put at risk of a complete takeover or data breach in the future. In LayerSlider, SQL injection is possible as well as the function that queries slider pop-up markups is done by the “ls_get_popup_markup” function. 

If the “id” parameter of this function is not a number, it is not sanitized before it is passed to “find”. Moreover, even though the plugin escapes $args values with the “esc_sql” function, the “where” key is not included in this function, so attacker-controlled inputs within “where” can be used to query the victim's database by the attacker-controlled inputs. 

 By manipulating “id” and “where”, an attacker can craft a request in such a way that sensitive data from the database, such as password hashes, can be extracted by manipulating those variables. As the structure of possible queries limits the attack to a time-based blind SQL injection, attackers must observe the database's response times to determine the data from the database. There are several ways in which threat actors can enter WordPress sites through vulnerable WordPress plugins to steal data or compromise a website. 

It has been shown that, in January, more than 6,700 WordPress sites were exploited by Balada Injector malware triggered by a cross-site scripting flaw in the Popup Builder plugin logged under CVE-2023-6000. In addition to the thousands of sites that were exposed to the TagDiv Composer plugin flaw tracked as CVE-2023-3169 in October, Balada Injector was installed on over 9,000 sites. In the past six years, over a million WordPress sites have been compromised by the Balada Injector campaign. 

According to Sucuri, the Balada Injector has been responsible for more than a million WordPress sites that have been compromised in this campaign. It is important to note that CVE-2024-2879 still allows malicious actors to access sensitive user information and password hashes from a compromised website's database, despite this limitation. Malicious actors can do this without having any authentication on the website. 

There is a further complication because the queries are not prepared using WordPress' '$wpdb->prepare()' function, which ensures that usernames and passwords are sanitized before a query is sent to the database. This prevents SQL injection because the input is therefore sanitized before it is submitted to the database. It was quickly acknowledged by the Kreatura Team of the plugin's creators that the plugin had been prone to the flaw and it was immediately addressed. 

It has been less than 48 hours since the developers contacted me about the release of a security update. There are critical vulnerabilities in LayerSlider, which are addressed in version 7.10.1, but it is strongly recommended that all users upgrade to version 7.10.1. A WordPress site admin should in general make sure that all their plugins are up-to-date, remove any plugins that are not required, use strong passwords for their accounts, and deactivate any dormant accounts that could be hacked. 

In the world of WordPress, there are thousands of themes and plugins available, each of which builds upon the WordPress experience for the user and makes it better. Some of these are free programs, but the commercial ones tend to have a dedicated team who work on improving them as well as maintaining the security of the program. This happens mainly because hackers choose to target free-to-use themes and plugins.

Many of these are used by millions of people today, but their developers have abandoned them and they are prone to vulnerabilities that have never been addressed (or rarely) by the developers. A safe and secure installation process involves administrators installing themes and plugins that they intend to use, and ensuring that they are always updated to the most recent version of those themes and plugins.
Read more »
Subscribe to: Posts (Atom)