Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Global Security. Show all posts
WhatsApp
Cyberhackers Cybersecurity CyberThreat Data Breach Data Loss Global Security Telegram WhatsApp

Data Security Alert as Novel Exfiltration Method Emerges


Global cybersecurity experts are raising serious concerns over the newly identified cyber threat known as Data Splicing Attacks, which poses a significant threat to thousands of businesses worldwide. It seems that even the most advanced Data Loss Prevention (DLP) tools that are currently being used are unable to stop the sophisticated data exfiltration technique.

A user can manipulate sensitive information directly within the browser, enabling the attacker to split, encrypt or encode it into smaller fragments that will remain undetected by conventional security measures because they can manipulate data directly within the browser. By fragmenting the data pieces, they circumvent the detection logic of both Endpoint Protection Platforms (EPP) and network-based tools, only to be reassembled seamlessly outside the network environment in which they were found. 

As a further contributing factor to the threat, malicious actors are using alternatives to standard communication protocols, such as grpc and Webrtc, and commonly used encrypted messaging platforms, such as WhatsApp and Telegram, as a means of exfiltrating data. As a result of these channels, attackers can obscure their activities and evade traditional SSL inspection mechanisms, making it much more difficult to detect and respond to them. 

An important shift in the threat landscape has taken place with the introduction of Data Splicing Attacks, which require immediate attention from both enterprises and cybersecurity professionals. Data exfiltration, a growing concern within the cybersecurity industry, refers to the act of transferring, stealing, or removing a specific amount of data from a computer, server, or mobile phone without authorisation. 

Several methods can be used to perform this type of cyberattack, including a variety of cyberattacks such as data leakage, data theft, and information extrusion. The kind of security breach posed by this type of company poses a serious threat to the company, since it can result in significant financial losses, disruptions to operations, and irreparable damage to their reputation. This lack of adequate safeguarding of sensitive information under such threats emphasises the importance of developing effective data protection strategies. 

There are two primary means by which data can be exfiltrated from an organisation's network: external attacks and insider threats. Cybercriminals infiltrate an organisation's network by deploying malware that targets connected devices, which can be the result of a cybercriminal attack. A compromised device can serve as a gateway to broader network exploitation once compromised. 

Some types of malware are designed to spread across corporate networks in search of and extracting confidential information, while others remain dormant for extended periods, eschewing detection and quietly collecting, exfiltrating, and exchanging data in small, incremental amounts as it grows. As well as insider threats, internal threats can be equally dangerous in stealing data. 

A malicious insider, such as a disgruntled employee, may be responsible for the theft of proprietary data, often transferring it to private email accounts or external cloud storage services for personal gain. Furthermore, employees may inadvertently expose sensitive information to external parties due to negligent behaviour, resulting in the disclosure of sensitive information to outside parties. 

The insider-related incidents that take place at a company underscore the importance of robust monitoring, employee training, and data loss prevention (DLP) to safeguard the company's assets from outside threats. As a rule, there are many ways in which data exfiltration can be executed, usually by exploiting technological vulnerabilities, poor security practices, or human error in order to carry out the exfiltration.

When threat actors attempt to steal sensitive data from corporate environments, they use sophisticated methods without raising suspicion or setting off security alarms, to do so covertly. For organisations that wish to improve their security posture and reduce the risk of data loss, they must understand the most common tactics used in data exfiltration. 

Infiltrating a system using malware is one of the most prevalent methods, as it is malicious software that is intentionally installed to compromise it. When malware is installed, it can scan a device for valuable data like customer records, financial data, or intellectual property, and send that information to an external server controlled by the attacker, which makes the process stealthy, as malware is often designed to mask its activity to evade detection by a company. 

Data exfiltration is often accompanied by trojans, keyloggers, and ransomware, each of which is capable of operating undetected within a corporate network for extended periods. A similar method, phishing, relies on social engineering to trick users into revealing their login information or downloading malicious files. A cybercriminal can trick employees into granting them access to internal systems by craftily crafting convincing emails or creating false login pages.

When attackers gain access to a network, they can easily move across the network laterally and gain access to sensitive information. Phishing attacks are particularly dangerous because they rely heavily on human error to exploit human error, bypassing even the most sophisticated technological safeguards. The insider threat represents a challenging aspect of an organisation. 

It can involve malicious insiders, such as employees or contractors, who deliberately leak or sell confidential information for monetary, strategic, or personal gain. As an example, insiders can also compromise data security unintentionally by mishandling sensitive data, sending information to incorrect recipients, or using insecure devices, without realising it. No matter what the intent of an insider threat is, it can be very difficult to detect and prevent it, especially when organisations do not have comprehensive monitoring and security controls in place. 

Lastly, network misconfigurations are a great source of entry for attackers that requires little effort. When an internal system is compromised, it can be exploited by an attacker to gain unauthorised access by exploiting vulnerabilities such as poorly configured firewalls, exposed ports, and unsecured APIS. Once the attacker is inside, he or she can navigate the network by bypassing the traditional security mechanisms to locate and steal valuable information. 

Often, these misconfigurations don't become apparent until a breach has already occurred, so it is very important to conduct continuous security audits and vulnerability assessments. In order to safeguard critical information assets better, organizations must understand these methods so that they may be able to anticipate threats and implement targeted countermeasures. Increasingly, web browsers have become an integral part of workplace productivity, creating a significant threat surface for data leaks. 

As more than 60% of enterprise data is now stored on cloud-based platforms and is accessed primarily through browsers, ensuring browser-level security has become an extremely important concern. However, many existing security solutions have fallen short in addressing this challenge as recent research has revealed. It is very hard for proxy-based protections incorporated into enterprise browsers to identify sophisticated threats because they lack visibility. 

Nevertheless, these solutions are not capable of understanding user interactions, monitoring changes to the Document Object Model (DOM), or accessing deeper browser context, which makes them easily exploitable to attackers. The traditional Data Loss Prevention (DLP) systems on endpoints are also not without limitations. As a result of their dependence on browser-exposed APIs, they are unable to determine the identity of the user, track browser extensions, or control the flow of encrypted content in the browser. 

The constraints are creating a blind spot, which is increasingly being exploited by insider threats and advanced persistent attacks as a result of these constraints. It is especially problematic that these attacks are so adaptable; adversaries can develop new variants with very little coding effort, which will further widen the gap between modern threats and outdated security infrastructure, as well as allowing adversaries to build new variants that bypass existing defences. 

A new toolkit developed specifically for reproducing the mechanics of these emerging data splicing attacks has been developed by researchers to address this growing concern. The tool has been developed to respond to this growing concern. It is designed for security teams, red teams, and vendors to test and evaluate their current defences in a realistic threat environment rigorously to determine whether their current defences are adequate. 

It is the objective of Angry Magpie to help companies discover hidden vulnerabilities by simulating advanced browser-based attack vectors in order to evaluate how resilient their DLP strategies are. It is becoming increasingly apparent that enterprises need a paradigm shift in their approach to browser security, emphasizing proactive assessment and continuous adaptation in order to deal with rapidly changing cyber threats in the future. 

As data splicing attacks have become increasingly prevalent and current security solutions have become increasingly limited, enterprise cybersecurity is at a critical inflexion point. As browser-based work environments become the norm and cloud dependency becomes more prevalent, traditional Data Loss Prevention strategies need to evolve both in scope and sophistication, as well as in scale. As organisations, we need to move away from legacy solutions that do not offer visibility, context, or adaptability that are necessary for detecting and mitigating modern data exfiltration techniques. 

For cybersecurity professionals to remain competitive in the future, they must adopt a proactive and threat-informed defence strategy that includes continuous monitoring, advanced browser security controls, and regular stress testing of their systems through tools such as Angry Magpie. By taking this approach, organisations can identify and close vulnerabilities before they become exploitable, as well as ensure that there is a culture of security awareness throughout the workforce to minimise human error and insider threats. 

Security infrastructures must keep up with the rapidly growing threats and innovations in cyberspace as well to maintain a competitive advantage. Businesses need to acknowledge and commit to modern, dynamic defence mechanisms to increase their resilience and ensure the integrity of their most valuable digital assets is better protected as a result of emerging threats.

Read more »
Triada
Android devices Android Smartphone counterfeit Cyberattacks CyberCrime Cybersecurity CyberThreat Global Security malware Malware Trojan Remote Access Trojan Triada

Triada Malware Embedded in Counterfeit Android Devices Poses Global Security Risk

 


There has been a significant increase in counterfeit Android smartphones in recent years. Recently, cybersecurity investigations have revealed a concern about counterfeit Android smartphones. These unauthorized replicas of popular mobile devices, which are being widely circulated and are pre-loaded with Triada, a sophisticated Android-based malware, are being offered at attractively low prices, causing widespread confusion and widespread fear. 

As a Remote Access Trojan (RAT) that was originally discovered during campaigns targeting financial and communication applications, Triada can be used to gain covert access to infected devices through covert means. Triada is designed to steal sensitive data from users, such as login information, personal messages, and financial information, which is then discreetly harvested. 

The cybersecurity experts at Darktrace claim that Triada employs evasion techniques to avoid detection by the threat intelligence community. In some cases, data can be exfiltrated through command-and-control servers using algorithmically generated domain names, which is an approach that renders conventional threat monitoring and prevention tools ineffective because of this approach. 

In the wake of a recent discovery, it has been highlighted that malicious software embedded on the firmware of mobile devices, particularly those sourced from vendors that are unknown or unreliable, poses a growing cybersecurity threat. As a consequence of the presence of malware prior to user activation, the threat becomes much more serious. Experts recommend that consumers and businesses exercise greater caution when procuring mobile hardware, especially in markets where devices are distributed without any government regulation. 

Additionally, it has become more important for mobile threat defense systems to be more sophisticated, capable of detecting deeply embedded malware as well as ensuring their effectiveness. There is a strong need for robust supply chain verification methods, effective endpoint security strategies, and an increased awareness of counterfeit electronics risks as a result of these findings. Kaspersky Security experts have warned consumers against purchasing significant discounts on Android smartphones from unverified online platforms that are deemed untrustworthy. 

There have been reports that more than 2,600 compromised devices have been delivered to unsuspecting users, most of whom are already infected with a sophisticated form of mobile malware known as Triada, which has been found to be prevalent in Russia. According to Kaspersky's research, the latest variant of Trojan is not merely installed as a malicious application, but is incorporated into the firmware of the device as well. 

Android's system framework layer is where this malware is situated, which makes it possible for it to infiltrate every single process running within the system. Because of this deep-level integration, the malware is able to access the entire system, while evading traditional detection tools, resulting in a particular difficulty in identifying or removing it using conventional techniques. This Trojan, which was first identified in 2016, has gained notoriety due to its ability to operate mainly in the volatile memory of an Android device, making it extremely difficult to detect. Its modular nature allows it to operate on a variety of Android devices. 

It has become more complex and stealthy over the years, and multiple instances have been documented in which the malware has been integrated into the firmware of budget Android smartphones that are sold through unreliable retailers that have been unauthorized. Triada is a highly persistent threat because its firmware-level embedding makes it impossible to remove it using conventional removal techniques, and it requires a full ROM reset to eradicate. 

According to Kaspersky's latest analysis, the most recent strain of Triada continues to possess sophisticated evasion capabilities. To maintain continuous control and access, the malware burrows into the Android system framework and replicates itself across all active processes. When the malware is activated, it executes a variety of malicious functions on compromised devices. It is possible for hackers to hijack the credentials of users from social media networks, manipulate WhatsApp and Telegram to send or delete messages under the guise of the user, intercept or reroute calls by using spoofing phone numbers, and more. 

Further, this malware allows users to make premium SMS payments and monitor web activity, alter hyperlinks, replace cryptocurrency wallet addresses during transactions, and monitor web activity. This malware is also capable of installing other programs remotely and disrupting network connectivity to bypass security measures or hinder forensic investigations, thus resulting in unauthorized financial losses.

According to Kaspersky's telemetry, this Triada variant has already been diverted approximately $270,000 worth of cryptocurrency, even though the full extent of the theft remains unclear due to the fact that privacy-centric cryptocurrencies such as Monero are being used in the operation. Although it is still unclear what the exact vector of infection was, researchers strongly believe that an infection could have occurred during the manufacturing or distribution stages of the device.

It is increasingly becoming clear that modified variants of Triada are being found in devices other than smartphones, including tablets, TV boxes, and digital projectors, that are based on Android, as well as smartphones. A broader fraudulent campaign known as BADBOX has been associated with these infections, which are often the result of compromised hardware supply chains and unregulated third-party marketplaces that have allowed the malware to gain initial access to the user's system. 

Triada developed into a backdoor that was built into the Android framework backdoor in 2017. This backdoor allows threat actors to remotely install more malware on the affected devices and exploit the devices for malicious purposes using various malicious operations. Google's 2019 disclosure revealed that, as a general rule, infection typically occurs during the production stage when original equipment manufacturers (OEMs) outsource custom features, such as facial recognition, to third parties. 

In such cases, these external developers may modify entire system images, and they have been implicated in injecting malware such as Triada into the operating system. Google's identification as Yehuo or Blazefire led to one of these vendors being cited as a potential contributor to the spread of the malware. 

Kaspersky confirmed in its analysis of samples that the Trojan is integrated into the system framework, which facilitates its replication across all processes on the device and allows unauthorized actions such as credential thefts, covert communications, manipulation of calls and SMS, substitution of links, activation of premium services, and disruption of network connectivity to occur. There's no doubt that Triada is not an isolated example of supply chain malware, as Avast revealed in 2018 that several Android devices made by manufacturers like ZTE and Archos are also preloaded with an adware called Cosiloon that is preloaded on them. 

According to Kaspersky's ongoing investigation, the latest strain of Triada has been found to be embedded directly within the firmware of compromised Android devices, primarily in their system framework. With this strategic placement, the malware is able to integrate itself into all the active processes on the device, giving the attacker complete control over the entire system. 

In a recent article published by Kaspersky Security, cybersecurity specialist Dmitry Kalinin highlighted the persistant threat posed by the Triada malware family, describing it as one of the most intricate and persistent malware families that targets Android devices. This was due to the fact that malware can often be introduced to devices before they even reach the end user, probably because of a compromised point along the way in the manufacturing or supply chain process, leaving retailers unaware that the devices they are distributing are already infected. 

The malware can perform a wide variety of harmful activities once it becomes active, including taking control of email accounts and social media accounts, sending fraudulent messages, stealing digital assets such as cryptocurrency, spying on users, and remotely installing malicious software to further harm their system. 

A growing number of experts advise consumers and vendors to be extremely cautious when sourcing devices, especially from unofficial or heavily discounted marketplaces, as this system is deeply integrated and has the potential to lead to large-scale data compromises, particularly when the devices are purchased online. For users to be safe from deeply embedded, persistent threats like Triada, it is imperative that the supply chain be audited more stringently, as well as robust mobile threat defense solutions are implemented.
Read more »
Ransomware
ALPHV Blackcat Ransomware Black Basta Cyber Security CyberCrime CyberThreat Global Security Ransomware

Persistent Increase in Ransomware Attacks Raises Global Security Concerns

 


It was concluded that in the first five weeks of 2025, there was a significant increase in ransomware attacks targeted at the United States, marking a nearly 150% increase compared to the first five weeks of 2024. Based on a series of high-profile incidents in which certain organisations decided to pay ransoms to avoid detection, cybercriminals have inadvertently increased their interest in the U.S. and made the country a more attractive target for cybercriminals. 

Consequently, this factor is largely responsible for the increase in ransomware activity in the last few months, as successful ransom payments have likely incentivized other ransomware attacks. In the past year, despite fluctuations in the most active ransomware groups and specific timeframes, the frequency of ransomware incidents in the United States has substantially increased. There has been a significant rise in ransomware incidents since the fall of 2024, and a steady increase has continued into the new year. Security firm NCC Group reports 590 new ransomware victims in January, a 3% increase from the previous month, which already set a record for that period. 

The threat intelligence company Cyble has also identified 518 new victims in January, and this number has increased to 599 within the past 27 days. Approximately two-thirds of the attacks were conducted against organizations located in the United States. Additionally, other cybersecurity monitoring organizations have noted a rise in ransomware incidents over the past two months. The difference in victim counts between cybersecurity firms may be attributed to the difference in methodologies, in particular whether victims of previously compromised cybersecurity systems who have just been revealed should be classified as new victims. 

However, despite these discrepancies, industry experts all agree that ransomware activity has increased in recent months. There are several notable ransomware groups responsible for driving this increase, among which RansomHub, Play, and Akira stand out as prominent threat actors. As a result of their increased activity, organizations across the globe are facing increasing cybersecurity challenges as a result of their increased activities. There is still a persistent threat of ransomware, however, individual ransomware groups emerge and dissipate frequently. 

Some of these groups, such as Black Basta, are now in decline or are nearing obsolescence, while others are suffering disruption due to law enforcement intervention, as LockBit appears to be the case. Groups that suffer from internal conflict, often driven by financial disputes, are prone to collapse. For instance, Alphv, also known as BlackCat, was notorious for conducting an exit scam 12 months ago, retaining the entire $22 million ransom paid by UnitedHealth Group following the Change Healthcare hack, rather than sharing it with the affiliate that carried out the scam. 

Although some ransomware groups have disbanded at the end of last year, the landscape of ransomware continues to be highly dynamic, with new actors continuously emerging. In many instances, these "new" actors are not merely rebranded entities, but individuals already entrenched in the cybercrime ecosystem himself. A significant percentage of these attacks are the result of affiliates, threat actors who work with several ransomware operations. Regardless of which specific group name they operate under, affiliations are responsible for a significant portion of these attacks, according to cybersecurity firm BlackFog. In 2024, 48 new ransomware groups surfaced. 

There are four victims mentioned publicly on RunSomeWare's data leak sites, whereas Linkc only has one victim posted on its data leak site, as reported by threat intelligence firm Cyble. It is unclear how long these emerging groups will survive in this business. In December 2024, Anubis, a Russian-speaking ransomware group that first became active, appears to be the work of former ransomware affiliates, as indicated by the sophistication of its tactics. 

Kela reports that Anubis maintains a presence on cybercrime forums like RAMP and XSS, which reinforces its network within the cybercriminal underground by ensuring it maintains its visibility on these forums. In addition to offering a range of illicit services, this group also operates a traditional ransomware-as-a-service model, where affiliates are rewarded with 80% of the ransom money collected from victims they infect. 

As well as targeting Windows, Linux, network-attached storage (NAS), and ESXi environments, Anubis' ransomware can also be used to spread the virus. In addition, the group maintains a data leak blog based on Tor, where so far only a few people have been listed. The Anubis ransomware operation offers two distinct services in addition to conventional ransomware. In the first case, participants receive 60% of the revenue extorted from victims using stolen data, based on the data-ransom-as-a-service model. If the stolen data are unpublished, have been obtained within the past six months, and considered valuable enough for public exposure, they are eligible for this program. By releasing a press release and notifying local data privacy regulators about the breach, Anubis claims to amplify pressure on victims. 

It is the second offering of Anubis that targets initial access brokers, who facilitate cyber intrusions by selling credentials to compromised networks to gain access to them. Under Anubis' model, the IABs become eligible for 50% of all ransoms demanded by victims whose credentials they have supplied. A specific set of eligibility criteria applies, including being a citizen of the United States, Canada, Europe, or Australia, not having been targeted by another ransomware group within the last 12 months, and not being employed by the government, the educational system, or any non-profit organization. 

Ransomware groups are long collaborating with initial access brokers and have often paid a premium for exclusive access to compromised networks, but the healthcare industry remains a viable target. Cybercrime brokers are increasingly becoming increasingly reliant on each other, and this indicates that their role is growing within the cybercrime economy. According to a recent report by CrowdStrike, access broker activity is expected to grow by almost 50% in 2024, as cybercriminals continue to look for ways of infiltrating high-value targets in an increasingly swift and stealthy manner. 

Despite the persistence of ransomware, it is important to remember that individual ransomware groups emerge and dissipate regularly. Several groups, such as Black Basta, appear to have declined over the years or are on the verge of obsolescence, whereas others, such as LockBit, seem to be facing disruptions because of law enforcement interventions. As it seems with LockBit, these groups collapse in the face of internal conflicts, often caused by financial disagreements. Alphv, also known as BlackCat, is one example that exemplifies an exit scam that was carried out 12 months ago. 

According to reports, Alphv kept the entire $22 million ransom paid by UnitedHealth Group to resolve the Change Healthcare breach, instead of sharing it with the affiliate that perpetrated the attack. It is important to note that while some groups have disbanded, the ransomware landscape still remains a highly dynamic place, with new actors constantly emerging on the scene. The so-called "new" groups are usually nothing more than rebranded entities that already have a place in the cybercrime ecosystem. 

These so-called "new" groups include individuals already well versed in the criminality ecosystem. Affiliates - threats actors who collaborate with multiple ransomware operations - are responsible for a significant portion of these attacks, regardless of who they use as their operating name. In 2024, 48 new ransomware groups were discovered, according to cybersecurity firm BlackFog. RunSomeWares claims to have identified four victims on their data leak site which has been compiled by Linkc, while only one victim has been identified by RunSomeWares, according to threat intelligence firm Cyble. However, the long term viability of these emerging groups is uncertain. 

As indicated by the sophistication of the attacks of Anubis, a Russian-speaking ransomware group that became active by December 2024, its tactics were likely developed by former ransomware affiliates. Anubis maintained a visible presence, according to threat intelligence firm Kela, on cybercrime forums such as RAMP and XSS, thereby enhancing its connections within the black market for cybercrime. The group offers a range of illicit services to its customers. There are two main models of ransomware-as-a-service (RaaS) that the organization uses, in which affiliates receive 80% of any ransom payments that are collected from victims that are infected by the group. 

The ransomware of Anubis is capable of attacking Windows, Linux, network-attached storage (NAS), and ESXi environments, as well. Furthermore, the group maintains a Tor-based blog that leaks data, but so far, it has only listed a few victims that have been affected. It advertises two distinctive services in addition to conventional ransomware. The first is a model called data-ransom-as-a-service (DraaS), in which participants receive 60% of all the revenue extorted from victims by using stolen data. 

To qualify, the stolen data must not have been published, must have been obtained within the last six months, and should be considered valuable enough to be published. In its second offering, Anubis claims that publicizing the data breach and notifying local data privacy regulators will increase pressure on victims. The offering targets initial access brokers (IABs) who facilitate cyber intrusions by selling access credentials to compromised networks. Under Anubis' model, it will award half of the ransom obtained from victims who provide their access credentials to the IAB, which will be used to secure a ransom. 

It is important to note, however, that there are some eligibility requirements for this program. The victim must reside in the United States, Canada, Europe, or Australia, and not have been targeted by another ransomware group in the past 12 months. The victim must also not be a government or educational employee. It is, however, still very possible to target the healthcare industry. 

A long history of ransomware groups collaborating with initial access brokers has shown that these brokers often pay a premium for exclusive access to compromised networks. Their increasing dependence on these brokers indicates that their role within the cybercrime economy is growing. According to a recent report published by CrowdStrike, access broker activity increased by nearly 50% in 2024 compared to the previous year, as cybercriminals continued to search for faster and stealthier methods of infiltrating high-value targets as they continued to grow.
Read more »
Technology
AI Development Artificial Intelligence Cyberattacks CyberCrime CyberThreat Global Security Technology

AI Development Needs Global Oversight, UN Experts State


 

In a time of increasing popularity for artificial intelligence (AI), the United Nations has warned that market forces should not be the sole determining factor as the technology becomes more widely used. United Nations experts called for creating tools for global cooperation as the technology becomes increasingly popular and raises concerns about its misuse. 

A high-level United Nations body that advises the government said Thursday that developing a global framework for artificial intelligence is an "imperative". In a statement released by The World Bank last week, the bank called on the United Nations to establish the first comprehensive global organizations to regulate the fast-growing technology market. 

An analysis published by the group in a 100-page report on AI concluded that the technology "is changing our world," holding an abundance of incredible potential for good, such as opening new fields of science and accelerating economic growth as well as improving public health and agriculture, as well as optimizing energy systems. 

A report by the World Economic Forum stated that if AI is left unregulated, it would provide benefits only to a small number of countries, companies, and individuals, while it warned that even more powerful systems than those in existence today "could upend the world of work," develop autonomous weapons, and threaten peace and stability worldwide. 

There are approximately 40 experts from the fields of technology, law, and data protection on the panel, which was established by United Nations High Representative Antonio Guterres in October last year as part of his Global Agenda Council. There is a need to raise awareness about the lack of global governance of artificial intelligence such as the exclusion of developing countries from discussions concerning AI's future and its regulatory framework within the context of high-profile "Summit of the Future" events. 

Only seven of the U.N.'s 193 members belong to one of the seven major AI initiatives, while 118 others are absent from all of them -- mostly countries from the South of the globe. Recent years have seen impressive achievements in the areas of large language models and chatbots, and this has sparked high hopes for a revolution in economic productivity, but some experts have also warned that AI technology may be developing too rapidly, which may lead to problems in creating control over it in the future. 

In less than a month after ChatGPT appeared, several scientists and entrepreneurs came together and signed a letter asking for a temporary pause of the technology's development for six months to assess the risks associated with it. Among the more immediate concerns, there are the ones relating to disinformation automated through artificial intelligence, the generation of deepfake audio and video, the mass replacement of workers, and the worsening of societal algorithmic bias on an industrial scale. 

As Nelson says, "There is a sense of urgency about the situation, and people feel that we need to come together to find a solution.". The UN proposals reflect a strong commitment by government officials worldwide to regulate AI to minimize these risks to the environment. This research comes at a time when the world's major powers, including the United States and China, are frantically competing to lead the way in the development and use of technology that offers enormous economic, scientific, and military benefits, and as these countries stake out their visions for how they should be used and managed. 

As a result, differences are already beginning to appear between the sexes. It is important to remember that whole parts of the world have been left out of international discussions regarding AI governance; that is the lack of representation. It should be pointed out that seven countries (Canada, France, Germany, Italy, Japan, the UK, and the United States) are parties to seven prominent non-UN initiatives on artificial intelligence, whereas only 118 countries, predominantly in the Global South, are parties to none of these initiatives. 

"The risks caused by artificial intelligence might become more severe and might become more concentrated, leading to Member States considering the need for a more robust international institution that has authority over monitoring, reporting, verification, and enforcement. Because of the remarkable speed with which AI is advancing, the authors accept that it would be useless to compose a detailed list of the dangers, that AI poses, to demonstrate the impact of AI on society.

However, they focused on the dangers posed by disinformation, deep fakes, particularly pornographic deep fakes, as well as the continued development of autonomous weapons and the use of artificial intelligence (AI) by terrorist and criminal groups. A more immediate response, given the speed, autonomy, and opacity of artificial intelligence systems, may not prove to be feasible if people wait for a threat to emerge before finding out what is happening, according to the report. 

Continual assessments and policy dialogue will help to ensure that the world will not be surprised by the events of the future. As the authors acknowledge, owing to the breakneck speed of change in the field of artificial intelligence, it would not be possible to put together a comprehensive list of the potential dangers associated with the fast-evolving technology no matter how hard they tried. 

There were 3 key points they emphasized in their report: the threat of disinformation for democracy, the rise of more realistic deep fakes - especially those associated with pornography - as well as the evolution of autonomous weapons and the use of AI for criminals and terrorists.
Read more »
Threat Intelligence
Cyber Attacks ESET Global Security North Korea Threat Intelligence

Defending Digital Frontiers: Strategies for Organizations in an Unstable World

Global Stability Issues Alter Cyber Threat Landscape

An overview

  • Geopolitical Tensions: Regional stability issues, such as political conflicts and economic tensions, have a direct impact on cyber threats. As geopolitical events unfold, threat actors adapt their strategies to exploit vulnerabilities.
  • Attack Trends: While no groundbreaking attack methods have emerged, existing techniques continue to evolve. Advanced Persistent Threat (APT) groups remain active, targeting government entities, critical infrastructure, and private organizations.
  • Leading Actors: ESET’s research identifies Russia-aligned APT groups as the most prolific attackers. Their sophisticated campaigns target various sectors, including energy, finance, and defense. China-aligned actors follow closely, focusing on espionage and intellectual property theft.

The current landscape

A recent analysis from threat intelligence analysts ESET claims that threat actors are increasing their attacks worldwide, with geographic events determining which locations are most heavily targeted. The principal author of the research recommends that CISOs to intensify their protection plans in light of the activity, even if he claims that no new attack techniques have been discovered.

The director of threat research at ESET, Jean-Ian Boutin said  that current attack methods "still work well." Thus, attackers don't always need to use innovative vectors. According to Boutin, CISOs are defending against these attacks properly; they only need to fortify themselves even more.

Impact on regional stability

The researchers claim that because the primary worldwide assault trends that ESET has identified have been directly impacted by regional stability difficulties, these challenges are also affecting the cyber sphere. The report focuses on activities of specific advanced persistent threat (APT) groups from October 2023 to March 2024, the experts said in the report.

Researchers from ESET also observed that organizations connected with Russia were concentrating on espionage activities throughout the European Union in addition to assaults against Ukraine.

Along with operations against Ukraine, ESET researchers also saw that entities connected with Russia were concentrating on espionage across the European Union. However, the researchers noted that several threat actors with ties to China took use of flaws in software and public-facing hardware, including firewalls and VPNs, as well as Confluence and Microsoft Exchange Server, to gain first access to targets across a variety of sectors.

Analysis of attacks

Using emotions to keep the assault from being disclosed is one of the more recent strategies ESET is witnessing in North Korea; this will probably increase the tactic's usefulness and duration. According to Boutin, the method has been used for years, but North Korean APT organizations are making a small adjustment.

Under the guise of a job application, the hack targets programmers and other technical talent at numerous significant US corporations. The victim is exposed to the malware and the trap is set when the attacker poses as a recruiter for such companies and requests that the victims complete an online test to demonstrate their technical proficiency.

Implications for CISOs

  • Defense Strategies: Organizations must strengthen their defense mechanisms. Proactive threat intelligence, robust network security, and employee training are essential. Zero-day vulnerabilities and supply chain attacks require constant vigilance.
  • Threat Attribution: Understanding threat actors’ motivations and affiliations is crucial. Attribution helps tailor defenses and prioritize resources effectively. Collaboration among security professionals and law enforcement agencies is vital.
  • Risk Assessment: Organizations should assess their risk exposure based on geopolitical events. Consider the impact of regional instability on critical assets and operations. Regular risk assessments inform decision-making.

Read more »
Subscribe to: Posts (Atom)