Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label DHS. Show all posts
National Security
Access Controls Cybersecurity Data Breach DHS Information Security Intelligence Sharing National Security

Sensitive Intelligence Exposed in DHS Data Hub Security Lapse


 

There has been a serious concern about the integrity of federal data security in the wake of a critical vulnerability in a central data hub of the Department of Homeland Security (DHS). This vulnerability is thought to have exposed highly sensitive data to a broad range of unauthorized users, raising serious questions about the integrity of federal data security. 

An investigation by Wired revealed that a compromised system, intended to serve as a secure repository to consolidate intelligence and law enforcement data from multiple agencies, was compromised because access controls were incorrect. Instead of restricting access to classified material to properly cleared personnel, the flaw provided unauthorized entities, including adversarial actors, with an open door into classified data. 

Not only does the incident undermine the core purpose of the hub, which was designed to streamline and safeguard the intelligence-sharing process, but it also highlights the increasing risks and vulnerabilities that arise from the growing reliance of the federal government on vast, interconnected computer networks. 

Currently, it is estimated that 5,000 unauthorized individuals may have been able to access restricted data in some form or another. Despite this, officials at DHS have tried to minimize concerns by stressing that only a small number of interactions were flagged as potentially malicious after internal audits. 

However, given the scope of the exposure, the entire national security community is very concerned about the implications, especially since the compromised files contained operational intelligence which had been linked to ongoing investigations. There are many instances where such lapses have occurred before, including the breach that occurred in 2018 in which over 247,000 records pertaining to DHS employees were stolen from a secure database, and the phishing attack that occurred on Oregon DHS in 2019 that exposed 350,000 protected health information. 

Nevertheless, investigators in this case emphasize that the risk does not lie in stolen identities, but in the inadvertent visibility of intelligence information that adversaries might exploit to disrupt or undermine the government's operations, as happened here. The DHS Cyber Safety Review Board, along with federal investigators, have been investigating the incident since the incident. 

In their investigation, federal investigators cited systemic weaknesses within the department's IT infrastructure, particularly the reliance on outdated systems that are not integrated with modern cloud technology. An investigation revealed that the breach had been caused by an identity and access management (IAM) flaw in the DHS data hub framework. 

As a result, the platform used by the DHS data hub relied on a third-party vendor platform that went unpatched for over a year prior to the breach. By exploiting weak session tokens, unauthorized users were able to circumvent authentication protocols and gain read-only access to sensitive information. 

In light of these findings, there has been renewed criticism regarding vendor accountability and the persistent disconnect between federal cybersecurity policies and how they are being implemented on the ground. It has been determined that a DHS internal memorandum, which Wired obtained via a Freedom of Information Act (FOIA) request, indicates that the exposure continued from March to May 2023. 

While this was going on, the Office of Intelligence and Analysis (I&A) at the Department of Homeland Security (DHS) was incorrectly configured of an online platform that was intended to facilitate restricted information exchange as well as investigation leads by DHS. It was found that the system that serves as part of the Homeland Security Information Network’s intelligence section, called HSIN-Intel, was incorrectly configured to allow access to “everyone” rather than just authorized members of the intelligence community. 

Due to this, hundreds of thousands of people with HSIN accounts across the country, including some without a connection to intelligence or law enforcement, were inadvertently granted access to restricted information, even if they were not connected to intelligence or law enforcement. There were unintentional accesses of federal employees who were working in unrelated fields like disaster response, private contractors, and even foreign government representatives who were allowed to use the HSIN platform for other purposes. 

In light of the revelations, civil liberties advocates have been sharply critical, with Spencer Reynolds, a lawyer at the Brennan Center for Justice, who obtained the internal memo through a Freedom of Information Act request and shared it with Wired, stating that it raises serious concerns over the department’s commitment to safeguarding the department’s most confidential information. According to Reynolds, DHS advertises HSIN as secure and claims the information it contains is highly sensitive, crucial to national security. 

However, this incident raises serious concerns about the company's dedication to information security. Thousands and thousands of users have had access to information that they weren't supposed to receive. In addition to the trove of classified documents that were compromised, HSIN-Intel's holdings include investigative leads and investigative tips that range from reports on foreign hacking campaigns, disinformation operations, and analyses of domestic protest movements as well as snippets of articles from international publications.

A media report related to demonstrations against the Atlanta Public Safety Training Center, commonly referred to as the "Stop Cop City" protests, cited one example in which media coverage was positive toward confrontational police tactics. In addition to the 1,525 improper access to 439 intelligence products, the DHS inquiry also found that 518 people from the private sector and 46 foreigners had improperly accessed the products. 

There were nearly 40 percent of compromised materials that were associated with cybersecurity threats such as state-sponsored hacking groups targeting government IT infrastructure and cyber security threats. According to officials, some of the unauthorized US users who viewed the data had qualified for access through formal channels but never got the proper approval. In light of the incident, technology professionals in both government and industry should take heed of the warnings that precede rapid digital transformation when safeguards are often lagging behind in keeping up with the process. 

It has already been stated that there are similarities between this incident and the Johnson Controls malware attack of 2023, which, it is reported by SecurityAffairs, may have exposed DHS data through supply-chain vulnerabilities, highlighting similar systemic weaknesses as the misconfigurations that have been at the core of this incident. 

DHS has responded to this problem by engaging external cybersecurity firms to audit its platforms in an effort to make sure that a comprehensive review is being conducted. In addition, the DHS has been monitoring its platforms continuously in order to detect irregular access patterns in real time. In spite of this, Wired noted that long-term consequences may not be visible for years to come, underscoring the delicate balance federal agencies must strike between allowing data access for operational efficiency while safeguarding intelligence vital to national security at the same time. 

It is not only a single security lapse that has been committed by the Department of Homeland Security, but it is a reflection of a broader issue confronting modern governance as it becomes increasingly dependent on technology. The growing dependence on interconnected networks among federal agencies to coordinate intelligence operations and streamline operations has made even minor oversights in configurations or vendor management more likely to create national security vulnerabilities as the interconnected world continues to expand. 

There has been a consensus that to address such risks, more than just technological solutions, such as stronger encryption, automated monitoring and patch management, but cultural shifts within federal agencies will also be required, which should make cybersecurity a priority rather than just a compliance issue within the organization. 

In order to strengthen resilience and rebuild public trust in systems designed to safeguard national interests, better disclosure of breach information, tighter oversight of third-party vendors, and improved training for federal employees could all help strengthen public confidence and build resilience. At the same time, governments, companies, and international partners should collaborate more closely, as adversaries increasingly exploit cross-border digital ecosystems with greater sophistication as they work together to combat future threats. 

As the ten-year anniversary of the DHS breach draws closer, it may be seen as one of those moments of historical significance-an occasion when we should remember that secure information-sharing is a frontline defense for democratic institutions, not simply an administrative function.
Read more »
ware
ALPHV Blackcat Ransomware BlackSuit Cisco Talos Cyberhackers CyberThreat DHS ICE Ransomware ransomware-as-a-service (RaaS) Royal Ranso ware

BlackSuit Ransomware Capabilities Undermined by Targeted Server Takedown

 


With the help of U.S Immigration and Customs Enforcement's Homeland Security Investigations (HSI), as well as domestic and international law enforcement agencies, U.S Immigration and Customs Enforcement's Homeland Security Investigations has dismantled the backbone of the BlackSuit ransomware group, a decisive blow taken against transnational cybercrime. 

As a result of the coordinated action taken against the gang, servers, domains, and other digital assets vital to the gang's illicit activities were seized. There is widespread evidence that BlackSuit is the successor to the notorious Royal ransomware. It has been implicated in numerous high-impact attacks on critical sectors such as healthcare and education, public safety organisations, energy infrastructure, and government agencies, which have threatened the availability of essential services and public safety. 

Currently, the U.S. Department of Homeland Security (DHS) is examining allegations that the BlackSuit ransomware group—the successor to the Royal gang—was responsible for compromising 450 organisations across the country and extorting $370 million in ransom payments before its federal authorities took action to take the group down. 

An official at Immigration and Customs Enforcement (ICE) confirmed today that Homeland Security Investigations (HSI), in collaboration with U.S. and international law enforcement partners, had successfully dismantled the critical infrastructure supporting the organisation's operations, as part of a statement issued by the agency. 

In a coordinated action initiated by the FBI, servers, domains, and digital assets used to deliver ransomware were seized, along with the proceeds that were laundered from the extortion of victims and the deployment of ransomware on victims. This marks a significant disruption of one of the most damaging cybercriminal enterprises in recent memory. 

A multinational law enforcement effort, coordinated by U.S. and Europol officials and spanning nine countries, has struck a significant blow against the BlackSuit ransomware gang, seizing its darknet leak site and disassembling portions of its digital infrastructure, in accordance with a joint announcement on July 24, 2025. A company with roots dating back to the spring of 2023, BlackSuit stands out from the crowd due to the fact that the firm has been able to avoid the common ransomware-as-a-service model, preferring instead to keep full control of the malicious tools and infrastructure instead of licensing them out to affiliates. 

A joint advisory released in 2024 by the FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified this group as a continuation and evolution of the Royal ransomware, which itself was associated with Conti, a notorious Russian-speaking syndicate that disbanded in the year 2022-23. There has been a calculated campaign by the BlackSuit ransomware group against organisations that range in scope from education, government, healthcare, information technology, manufacturing, and retail. 

The group used a double extortion model for extorting victims by stealing data before it was encrypted to maximise their leverage. With respect to Windows and Linux environments, the gang exploited VMware ESXi servers, encrypting files over a wide area within accessible drives, hindering recovery efforts, and issuing ransom notes that direct victims to the Tor network for communication. As part of its operations, the group targeted small and medium-sized businesses, as well as large enterprises.

According to the US authorities, they had demanded at least $500 million in ransom payments by August 2024, ranging from $1 million to $60 million for individual demands. Approximately the same time as the leak site of the Cisco Talos network was seized, cybersecurity researchers from Cisco Talos released an analysis of Chaos ransomware - the first to be observed in early 2025. This ransomware is likely to be a successor to BlackSuit, according to Cisco Talos researchers. 

A string of high-profile ransomware attacks, including those perpetrated by BlackSuit and its predecessor, Royal, caused extensive disruptions as well as financial losses. A crippling attack on the city of Dallas led to heightened law enforcement interest in this group. The attack disrupted emergency services, court operations, and municipal systems in the city. Several U.S. schools, colleges, major corporations, and local governments were the victims of this attack, including Japan's publishing giant Kadokawa and the Tampa Bay Zoo. 

During April 2024, the gang claimed responsibility for an attack on Octapharma, a blood plasma collection company that caused the temporary closure of nearly 200 collection centres across the country, according to the American Hospital Association. In an effort led by Europol to target Royal and BlackSuit, Operation Checkmate was a key component of the effort, which Bitdefender called a milestone in the fight against organised cybercrime by marking the group's dismantling as one of the largest achievements to date. 

Even though the takedown has been described as a “critical blow” to the group’s infrastructure, U.S. Secret Service Special Agent in Charge William Mancino said that the group has re-surfaced under the Chaos ransomware name, displaying striking similarities in the encryption methods, ransom note formatting, and attack tools. However, Cisco Talos analysts reported resurfacing with elements of the gang under the Chaos ransomware name after the operation.

In addition, the Department of Justice announced that $2.4 million in cryptocurrency has been confiscated from an address allegedly linked to a Chaos member known as Hors, who has been implicated in ransomware attacks in Texas and other countries. BlackSuit's servers have been effectively disabled by the operation, effectively stopping it from functioning, according to experts confirmed by the operation. 

There were 184 victims of the group worldwide, including several Germans, whose data was published on a dark web leak site to pressure victims into paying ransoms, which the group claimed to have killed. At the time that this report was written, the site was no longer accessible, instead showing a seizure notice stating that the site had been taken down following an international law enforcement investigation coordinated by the organisation. It has been confirmed by German authorities that the effort was carried out with the support of ICE's Homeland Security Investigations unit as well as Europol, although ICE representatives declined to comment on this matter. 

The seizure of the drugs was reported earlier in the week by officials, but no arrests have yet been confirmed as a result. As of late, BlackSuit has emerged as one of the largest ransomware operations in the United States, having struck major U.S. cities like Dallas and targeting organisations from several industries, including manufacturing, communications, and healthcare. 

Cisco Talos cybersecurity researchers have discovered that after blackSuit's infrastructure was dismantled, it was found that the ransomware group likely rebranded itself as Chaos ransomware after dismantling its infrastructure. Several cases of newly emerging ransomware-as-a-service (RaaS) operations have been associated with distinct double-extortion strategies, combining voice-based social engineering to gain access to targets, followed by deploying an encryptor to target both local and remote storage to create maximum impact.

In a report by the Talos security group, the current Chaos ransomware is not related to earlier Chaos variants, and there are rumours that the group adopted the name to create confusion among victims. Several researchers have analysed the operation and assessed it as either a direct rebranding of BlackSuit (formerly Royal ransomware) or as run by former members of the organisation with moderate confidence. 

According to their findings, there are similarities between tactics, techniques, and procedures, from encrypted commands and ransom notes to the use of LOLbins and remote monitoring and management tools. It is believed that BlackSuit's origins can be traced back to the Conti ransomware group, which was fractured in 2022 after its internal communications were leaked. 

After the Russian-speaking syndicate splintered into three factions, the first was Zeon, the second was Black Basta, the third was Quantum, but by 2024, they had adopted the BlackSuit name after rebranding themselves as Royal. Among the most significant developments in the Russian-language ransomware ecosystem is the rise of the INC collective, which has been dubbed the "granddaddy of ransomware" by cybersecurity researcher Boguslavskiy. There is concern that BlackSuit will increase its dependency on INC's infrastructure as a result of INC's growth. 

According to reports, the syndicate has about 40 members and is led by a person who is referred to as "Stern", who has forged extensive alliances, creating a decentralised network with operational ties to groups such as Akira, ALPHV, REvil, and Hive, among others. In terms of Russian-speaking ransomware collectives, LockBit Inc. is presently ranked as the second biggest, only being surpassed by DragonForce. 

There is no doubt that the takedown of BlackSuit marks a decisive moment in the fight against ransomware syndicates as it represents the disruption of a prolific and financially destructive cybercrime operation. Although analysts warn that the seizure of infrastructure, cryptocurrency, and dark web platforms might have been a tangible setback for these groups, they have historically shown they can reorganise, rebrand, and adapt their tactics when they are under pressure from law enforcement. 

It is evident that Chaos ransomware, which employs sophisticated extortion techniques as well as targeted exploitation of both local and remote systems, has demonstrated the persistence of this threat, as well as the adaptability of its operators. Experts point out that the operation's success is a reflection of unprecedented international coordination, which combines investigative expertise, intelligence sharing, and cyber forensics across multiple jurisdictions to achieve unprecedented success. 

In today's world, a collaborative model has become increasingly crucial for dismantling decentralised ransomware networks that span borders, rely on anonymising technologies to avoid detection, and use decentralised methods of evading detection. Cybersecurity researchers note that the BlackSuit case highlights how deeply connected Russian-speaking ransomware groups are, with many of them sharing tools, infrastructure, and operational methods, making them more resilient and also making them easier to trace when global enforcement efforts are aligned. 

There is no doubt that the BlackSuit takedown serves as both a victory and a warning for governments, industries, and cybersecurity professionals alike—demonstrating how effective sustained, multinational countermeasures are, but also demonstrating the importance of maintaining vigilance against the rapid reemergence of threat actors in new identities that can happen any time. 

Despite law enforcement agencies' attempts to track the remnants of BlackSuit through the lens of Chaos ransomware and beyond, the case serves as a reminder that, when it comes to cybercrime, it is quite common for one operation to end, only for another to begin some weeks later.
Read more »
protecting sensitive data
Chinese Hackers Cyber Attacks cyber espionage cybercriminal group Cyberthreatm Salt Typhoon Hacks data security Data Theft DHS Hacker attack Hacker group protecting sensitive data

Chinese Hacker Group Salt Typhoon Breaches U.S. National Guard Network for Nine Months

 

An elite Chinese cyber-espionage group known as Salt Typhoon infiltrated a U.S. state’s Army National Guard network for nearly nine months, according to a classified Pentagon report revealed in a June Department of Homeland Security (DHS) memo. The memo, obtained by the nonprofit Property of the People through a freedom of information request, indicates the hackers had deep access between March and December 2024, raising alarms about compromised military or law enforcement data. 

Salt Typhoon has previously been linked to some of the most expansive cyber-intrusions into American infrastructure. This latest revelation suggests their reach was even broader than earlier believed. Authorities are still investigating the full extent of data accessed, including sensitive internal documents, personal information of service members, and network architecture diagrams. The affected state’s identity remains undisclosed. 

The Department of Defense declined to comment on the matter, while a spokesperson from the National Guard Bureau confirmed the breach but assured that the incident did not hinder any ongoing state or federal missions. Investigations are ongoing to determine the scope and potential long-term impact of the breach. 

China’s embassy in Washington did not directly deny the allegations but claimed the U.S. had not provided concrete evidence linking Salt Typhoon to the Chinese government. They reiterated that cyberattacks are a global threat and that China also faces similar risks. 

Salt Typhoon is particularly notorious for its ability to infiltrate and pivot across different networks. In a prior campaign, the group was linked to breaches at major telecom companies, including AT&T and Verizon, where hackers allegedly monitored text messages and calls tied to U.S. political figures, including both Trump and Harris campaigns and Senate Majority Leader Chuck Schumer’s office.

The hybrid structure of the National Guard — functioning under both federal and state authority — may have provided a wider attack surface. According to the DHS memo, the group may have obtained intelligence that could be used to compromise other states’ National Guard units and their local cybersecurity partners. Fourteen state National Guard units reportedly share intelligence with local fusion centers, potentially magnifying the risk. 

In January 2025, the U.S. Treasury Department sanctioned a company in Sichuan believed to be facilitating Salt Typhoon operations for China’s Ministry of State Security. Past incidents have shown that Salt Typhoon can maintain access for years, making complete removal and defense particularly challenging.
Read more »
SIEM
CISO Cyber Security Cybersecurity regulation data security DHS Digital Privacy EDR SIEM

The Indispensable Role of the CISO in Navigating Cybersecurity Regulations

 

With evolving cyber threats and stringent regulatory requirements, CISOs are tasked with ensuring the confidentiality, integrity, and availability of an organization’s digital systems and data. This article examines the regulatory landscape surrounding cybersecurity and explores effective strategies for CISOs to navigate these requirements. CISOs must stay updated on regulations and implement robust security practices to protect their organizations from legal consequences. 

The SEC has introduced rules to standardize cybersecurity risk management, strategy, governance, and incident disclosures. These rules apply to public companies under the Securities Exchange Act of 1934 and include both domestic and foreign private issuers. Companies are required to promptly disclose material cybersecurity incidents, detailing the cause, scope, impact, and materiality. Public companies must quickly disclose cybersecurity incidents to investors, regulators, and the public to prevent further damage and allow stakeholders to take necessary actions. 

Detailed disclosures must explain the incident's root cause, the affected systems or data, and the impact, whether it resulted in a data breach, financial loss, operational disruption, or reputational harm. Organizations need to assess whether the incident is substantial enough to influence investors’ decisions. Failure to meet SEC disclosure requirements can lead to investigations and penalties. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCA) mandates that companies report significant cyber incidents to the Department of Homeland Security (DHS) within 24 hours of discovery. 

CISOs must ensure their teams can effectively identify, evaluate, validate, prioritize, and mitigate vulnerabilities and exposures, and that security breaches are promptly reported. Reducing the organization’s exposure to cybersecurity and compliance risks is essential to avoid legal implications from inadequate or misleading disclosures. Several strategies can strengthen an organization's security posture and compliance. Regular security tests and assessments proactively identify and address vulnerabilities, ensuring a strong defense against potential threats. Effective risk mitigation strategies and consistent governance practices enhance compliance and reduce legal risks. Employing a combination of skilled personnel, efficient processes, and advanced technologies bolsters an organization's security. Multi-layered technology solutions such as endpoint detection and response (EDR), continuous threat exposure management (CTEM), and security information and event management (SIEM) can be particularly effective. 

Consulting with legal experts specializing in cybersecurity regulations can guide compliance and risk mitigation efforts. Maintaining open and transparent communication with stakeholders, including investors, regulators, and the board, is critical. Clearly articulating cybersecurity efforts and challenges fosters trust and demonstrates a proactive approach to security. CISOs and their security teams lead the battle against cyber threats and must prepare their organizations for greater security transparency. The goal is to ensure effective risk management and incident response, not to evade requirements. 

By prioritizing risk management, governance, and technology adoption while maintaining regulatory compliance, CISOs can protect their organizations from legal consequences. Steadfast adherence to regulations, fostering transparency, and fortifying defenses with robust security tools and best practices are essential for navigating the complexities of cybersecurity compliance. By diligently upholding security standards and regulatory compliance, CISOs can steer their organizations toward a future where cybersecurity resilience and legal compliance go hand in hand, providing protection and peace of mind for all stakeholders.
Read more »
ransomware attacks
911 service Cyber Security DHS Pennsylvania Personal Information ransomware attacks

Are Emergency Services Vulnerable to Cyber Threats?




In recent warnings issued by the Department of Homeland Security (DHS), a concerning trend has emerged: emergency services are increasingly vulnerable to cyber-attacks, particularly ransomware incidents. These attacks pose significant risks not only to operational efficiency but also to public safety and the security of personal information.

Ransomware attacks, for those unfamiliar, involve hackers infiltrating computer systems and encrypting data, demanding payment for its release. Emergency services, including police departments and 911 call centres, have become prime targets for these attacks, leading to severe disruptions in critical operations. Picture a scenario where accessing emergency services during a crisis becomes impossible due to system outages—it's a frightening reality that stresses upon the urgency of addressing cybersecurity vulnerabilities.

The repercussions extend beyond mere operational disruptions. Cybercriminals gain access to highly sensitive personal information and police records, which can be exploited for various illicit activities, including identity theft and extortion. Such breaches not only compromise individuals' privacy but also undermine law enforcement's ability to effectively respond to emergencies, posing a significant threat to public safety.

One of the primary challenges in combating these cyber threats lies in the lack of resources and expertise at the local level. Many state and local governments, responsible for managing emergency service networks, struggle to keep pace with the rapidly expanding aspects of cybersecurity. Outdated technology systems and a shortage of cybersecurity personnel exacerbate the problem, leaving critical infrastructure vulnerable to exploitation by malicious actors.

Recent incidents in Bucks County, Pennsylvania, and Fulton County, Georgia, serve as stark reminders of the vulnerabilities within emergency services. In Bucks County, dispatchers were compelled to resort to manual processes after a cyberattack paralysed the 911 system, while Fulton County endured widespread disruption to government services following a cyber intrusion.

To address these challenges effectively, collaboration and preparedness are the key. Communities must prioritise cybersecurity measures, investing in modern technology systems, and providing comprehensive training for personnel to identify and respond to cyber threats promptly.

As society continues to rely increasingly on digital foundation, safeguarding critical services, particularly emergency response systems, becomes imperative. By remaining vigilant and proactive, we can fortify our communities against cyber threats, ensuring that emergency assistance remains readily accessible, even in the face of malicious cyber activity.


Read more »
U.S. national security
Chinese-manufactured drones critical infrastructure risk Cyber Security Data Safety DHS FBI warning U.S. national security

DHS and FBI: Chinese Drones Pose Major Threat to U.S. Security

 

The cybersecurity arm of the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have jointly issued a public service announcement cautioning about the potential risks posed by Chinese-manufactured drones to critical infrastructure and U.S. national security. The advisory, released on Wednesday, emphasizes the likelihood of Chinese drones being used to pilfer American data, citing Chinese laws permitting government access to data held by private entities as a cause for concern.

The document underscores the necessity for careful consideration and potential mitigation when employing Chinese-manufactured Unmanned Aircraft Systems (UAS), as their use may expose sensitive information to Chinese authorities, thereby endangering national security, economic security, and public health and safety. The White House has identified China as the most formidable cyber threat, attributing this to their adept exploitation of data utilized by American consumers.

A 2021 law, according to the agencies, has expanded China's authority over companies and data within its borders, imposing strict penalties for non-compliance. The data collected by these companies is deemed crucial to China's Military-Civil Fusion strategy, aimed at gaining a strategic advantage over the United States by accessing advanced technologies and expertise.

As critical infrastructure sectors increasingly rely on UAS for cost-effective operations, the agencies express concern about the potential exposure of sensitive information due to the use of Chinese-manufactured drones. Chinese drones are noted as capable of receiving and transmitting data, and the potential avenues for exploitation include data transfer, collection through software updates, and the use of docking stations as data collectors.

The consequences of data harvesting by Chinese drones could be severe, including exposing intellectual property, divulging critical infrastructure operations details, compromising cybersecurity and physical security controls, and facilitating easier access for Chinese hackers into systems. To address these risks, CISA and the FBI recommend isolating Chinese-made drones from networks and implementing regular maintenance to uphold adequate security measures.
Read more »
URL Shortener
CERT Critical Flaw cyber security agency DHS DNS attacks Domain Malicious actor Phising Attacks unauthorised access URL URL Shortener

PUMA Network: Unmasking a Cybercrime Empire

A massive cybercrime URL shortening service known as "Prolific Puma" has been uncovered by security researchers at Infoblox. The service has been used to deliver phishing attacks, scams, and malware for at least four years, and has registered thousands of domains in the U.S. top-level domain (usTLD) to facilitate its activities.

Prolific Puma works by shortening malicious URLs into shorter, more memorable links that are easier to click on. These shortened links are then distributed via email, social media, and other channels to unsuspecting victims. When a victim clicks on a shortened link, they are redirected to the malicious website.

Security researchers were able to track Prolific Puma's activity by analyzing DNS data. DNS is a system that translates domain names into IP addresses, which are the numerical addresses of websites and other devices on the internet. By analyzing DNS data, researchers were able to identify the thousands of domains that Prolific Puma was using to deliver its malicious links.

Prolific Puma's use of the usTLD is particularly noteworthy. The usTLD is one of the most trusted TLDs in the world, and many people do not suspect that a link with a usTLD domain could be malicious. This makes Prolific Puma's shortened links particularly effective at deceiving victims.

The discovery of Prolific Puma is a reminder of the importance of being vigilant when clicking on links, even if they come from seemingly trusted sources. It is also a reminder that cybercriminals are constantly developing new and sophisticated ways to attack their victims.

Here are some tips for staying safe from Prolific Puma and other malicious URL shortening services:

  • Be wary of clicking on links in emails, social media posts, and other messages from unknown senders.
  • If you are unsure whether a link is safe, hover over it with your mouse to see the full URL. If the URL looks suspicious, do not click on it.
  • Use a security solution that can detect and block malicious links.
  • Keep your web browser and operating system up to date with the latest security patches.

The security researchers who discovered Prolific Puma have contacted the United States Computer Emergency Readiness Team (US-CERT) and the Department of Homeland Security (DHS) about the service. Both agencies are working to take down Prolific Puma's infrastructure and prevent it from being used to launch further attacks.

Prolific Puma is not the first malicious URL-shortening service to be discovered. In recent years, there have been a number of other high-profile cases of cybercriminals using URL shortening services to deliver malware and phishing attacks.

The discovery of Prolific Puma is a reminder that URL shortening services can be abused for malicious purposes. Users should be cautious when clicking on shortened links, and should take steps to protect themselves from malware and phishing attacks.

Read more »
User Privacy
Data Breach DHS Homeland Security Johnson Controls Server Hack User Privacy

Johnson Controls Breach Allegedly Leaked Sensitive DHS Data

 

A king-sized ransomware attack that targeted Johnson Controls forced certain parts of its IT systems to go offline and disrupted some of its operations. The attack on the renowned manufacturer of industrial control systems is reportedly the work of the Dark Angels hacker group. 

According to BleepingComputer, which broke the story first, the ransomware group is demanding $51 million in exchange for a decryptor and a complete wipeout of stolen data. 

As part of the hack, the company's ESXi servers were allegedly encrypted and some 27 terabytes of data were stolen by the digital hijackers. 

Theft of DHS data? 

The data hoard's potential exposure of private Department of Homeland Security (DHS) information, including physical floor plans of some agency buildings and security details on contracts with third parties, is of particular concern, CNN reported.

According to an internal DHS email reviewed by CNN, uncertainty exists around whether the Dark Angels or other digital hackers have taken control of Johnson Controls' private information. 

“Until further notice, we should assume that [the contractor] stores DHS floor plans and security information tied to contracts on their servers,” the memo stated. “We do not currently know the full extent of the impact on DHS systems or facilities.” 

Researchers believe that the ransomware employed in the attack is essentially an identical RagnarLocker Linux ransomware designed in 2021. In an 8K regulatory filing with the Securities and Exchange Commission (SEC), Johnson Controls stated that while some of its systems had been attacked by ransomware, many of its applications "remain operational." 

In the repair process, Johnson Controls' insurers are collaborating with external cybersecurity experts, perhaps managed security service providers (MSSPs), and possibly forensics experts. The attack commenced at the company's Asia offices and then extended to its subsidiaries. The cyber attackers reportedly launched the infiltration last weekend.

Statement from Johnson Controls 

Johnson Control reported in an 8K filing that the incident is expected to continue to hinder certain parts of the company's business operations: 

"Johnson Controls International plc (the “Company”) has experienced disruptions in portions of its internal information technology infrastructure and applications resulting from a cybersecurity incident. Promptly after detecting the issue, the Company began an investigation with assistance from leading external cybersecurity experts and is also coordinating with its insurers. 

The Company continues to assess what information was impacted and is executing its incident management and protection plan, including implementing remediation measures to mitigate the impact of the incident, and will continue taking additional steps as appropriate. " 

At this time, it's unclear whether Johnson Controls will be able to announce fourth-quarter and full-year fiscal year results, as well as the financial impact of the attack.
Read more »
Vulnerabilities and Exploits
DHS EAS FEMA Vulnerabilities and Exploits

Emergency Alert System Bugs Can Help Actors Distribute Fraud Messages

 


The U.S Department of Homeland Security (DHS) has issued a warning of critical vulnerability in the Emergency Alert System (EAS) encoding/decoding devices. If not fixed, the bugs will allow threat actors to send out fraud emergency alerts on cable networks, TV, and radio. 

The advisory came on August 1 from DHS' Federal Emergency Alert Agency (FEMA). Cybersecurity experts Ken Pyle found out about the vulnerabilities. 

FEMA said the EAS national test in 2021 was very similar to regular monthly tests typically originated by state authorities. 

During the test, radios and televisions across the country interrupted normal programming to play the EAS test message in English or Spanish. 

"The EAS national test in 2021 was very similar to regular monthly tests typically originated by state authorities. During the test, radios and televisions across the country interrupted normal programming to play the EAS test message in English or Spanish," reports FEMA.

EAS is a U.S. national public warning system that allows state authorities to send out information in less than 10 minutes if there's an emergency. These warnings can interrupt TV and radio to show emergency alert information. 

Information about the bugs has not been disclosed to prevent threat actors from exploiting them, but we can expect the details publicly soon as a proof-of-concept at the DEF CON conference going to take place in Las Vegas next week. 

Basically, the flaws are public knowledge and will be shown to a large audience in the following weeks. 

To control the vulnerability, users are advised to update the EAS devices to the latest software versions, use a firewall to secure them, and keep an eye on audit and review logs for signs of any suspicious access (unauthorised). 

"The testing process is designed to evaluate the effectiveness of the IPAWS Open Platform for Emergency Networks and assess the operational readiness of the infrastructure for distribution of a national message and determine whether technological improvements are needed," reports FEMA.


Read more »
Subscribe to: Posts (Atom)