Search This Blog

Powered by Blogger.

Blog Archive

Labels

Showing posts with label Technology Threats. Show all posts

Controversial Reverse Searches Spark Legal Debate


In a growing trend, U.S. police departments and federal agencies are employing controversial surveillance tactics known as reverse searches. These methods involve compelling big tech companies like Google to surrender extensive user data with the aim of identifying criminal suspects. 

How Reverse Searches Operate 

Under Reverse Searches Enforce Agencies order digital giant companies such as Google to give them vast reservoirs of user data. Under this law, these agencies have the power to demand information related to specific events or queries which include: 

  • Location Data: Requesting data on individuals present in a particular place at a specific time based on their phone's location. 
  • Keyword Searches: Seeking information about individuals who have searched for specific keywords or queries. 
  • YouTube Video Views: A recent court order disclosed that authorities could access identifiable information on individuals who watched particular YouTube videos. 

In the past, when law enforcement needed information for an investigation, they would usually target specific people they suspected were involved in a crime. But now, because big tech companies like Google have so much data about people's activities online, authorities are taking a different approach. Instead of just focusing on individuals, they are asking for massive amounts of data from these tech companies. This includes information on both people who might be relevant to the investigation and those who are not. They hope that by casting a wider net, they will find more clues to help solve cases. 

Following the news, critics argue that these court-approved orders are overly broad and potentially unconstitutional. They raise concerns that such orders could force companies to disclose information about innocent people unrelated to the alleged crime. There are fears that this could lead to prosecutions based on individuals' online activities or locations. 

Also, last year an application filed in a Kentucky federal court disclosed that federal agencies wanted Google to “provide records and information associated with Google accounts or IP addresses accessing YouTube videos for a one-week period, between January 1, 2023, and January 8, 2023.” 

However, it did not end here, the constitutionality of these orders remains uncertain, paving the way for a probable legal challenge before the U.S. Supreme Court. Despite the controversy, federal investigators continue to push the boundaries of this contentious practice.

Decrypting Breach Realities: Beyond Isolation to Collective Progress


Upon discovering that the system has been breached, the initial reaction, marked by a skipped heartbeat, often prompts a common question: What steps should be taken next? 

According to a recent study, over the last two years, more than half of all organizations have experienced a breach from a third party. Regrettably, the predominant response to such incidents is to isolate the affected party. Surprisingly, as many as 83% of consumers confess to halting or discontinuing their transactions with an organization post-incident. 

While it is understandable for people to react to a security incident by distancing themselves from the affected organization, this response overlooks a valuable chance for the entire industry. The opportunity being discussed is the potential for shared learning and progress that arises when the specific details of an incident are made public. To put it differently, rather than merely reacting negatively, there is a prospect for the industry to unite, comprehend the incident, and leverage that understanding to enhance overall security practices and resilience. 

Let’s Understand What Do We Understand by Breach? 

The terms 'cyberattack,' 'data breach,' and 'breach' are sometimes used interchangeably. However, it's important to note that not every cyberattack results in a data breach, and conversely, not all data breaches are a result of cyberattacks. 

A data breach happens when unauthorized individuals infiltrate secure systems, pilfering credential data that encompasses personal details like Social Security numbers, bank account information, and healthcare records. Additionally, corporate data, such as customer records, intellectual property, and financial information, may also be compromised. 

What is More Concerning? 

Despite having a security program deemed commercially reasonable, breaches persist. No entity is impervious. When assessing potential partners and vendors, a crucial factor to consider is their ability to respond effectively and their willingness to be transparent in the event of a security incident. Employees are gaining more understanding when it comes to security incidents. 

There's a shift from immediately blaming individuals for falling victim to phishing attacks. Security experts recognize that phishing is a numbers game, and as attack tactics become more sophisticated, acknowledging the role of human trust and error in our risk landscape is crucial. While businesses often implement successful security policies internally, the same level of scrutiny is not consistently applied to partners and vendors. 

Recognizing that breaches can happen despite precautions, it is crucial for businesses to include an evaluation of security measures in their vetting process. Hasty decisions to sever ties with a reliable partner after an attack can introduce additional risks, including operational challenges. Although distinguishing between an unexpected breach and a pattern of risky behaviour is vital, the availability of compliance frameworks and security assessments facilitates a more informed evaluation of a potential partner's breach readiness. 

Ready and Transparent Future 

Being more understanding about breaches does not mean organizations should skip their checks. Instead, businesses should always confirm if their partners follow the rules. Security questionnaires and reports remain crucial for ensuring organizations handle data carefully.

Group-IB Uncovered Farnetwork's Ransomware-as-a-Service Business Model

 

In recent findings, cybersecurity experts have uncovered a significant player in the world of cyber threats, known as "farnetwork". This individual has been tied to five separate cyber attack programs within the last four years, showcasing a high level of proficiency in the field. 

Singapore-based cybersecurity firm Group-IB embarked on an ambitious mission to gain insight into a secretive cyber attack program utilizing the Nokoyawa ransomware. Their approach involved a unique "job interview" process with the threat actor responsible for the program. This unconventional interaction provided Group-IB with invaluable information about the individual's background and their pivotal role within various cyber attack programs. 

"Throughout the threat actor's cybercriminal career, which began in 2019, far network has been involved in several connected ransomware projects, including JSWORM, Nefilim, Karma, and Nemty, as part of which they helped develop ransomware and manage the RaaS programs before launching their own RaaS program based on Nokoyawa ransomware," Nikolay Kichatov, cyber security intelligence said at Group-IB. 

About half a year after successfully infiltrating the Qilin Ransomware-as-a-Service (RaaS) syndicate, the cybersecurity firm has shared comprehensive information on how affiliates are paid and the inner workings of the RaaS program. Farnetwork is recognized by many names such as farnetworkit, farnetworkl, jingo, jsworm, piparkuka, and razvrat, depending on the underground forum. Initially, Farnetwork promoted a remote access trojan named RazvRAT as a vendor. 

In 2022, the person who speaks Russian and is involved in cyber activities, aside from concentrating on Nokoyawa, reportedly initiated their own botnet service. This service enables associates to gain entry to compromised business networks. Since the start of this year, farnetwork has been actively recruiting individuals for the Nokoyawa Ransomware-as-a-Service (RaaS) program. 

They task potential candidates with using stolen corporate account information to elevate their access privileges. These recruits are then directed to employ the ransomware to encrypt a victim's files and subsequently demand a ransom in exchange for the decryption key. Information-stealing software logs, containing login details, are sourced from underground markets. 

In certain scenarios, cyber threat actors utilize pre-made stealing tools like RedLine to gain initial access to their target devices. These tools are then distributed through tactics such as deceptive phishing emails and malicious advertising campaigns. 

Under the Ransomware-as-a-Service (RaaS) model, affiliates get 65% of the ransom money, while the botnet owner gets 20%. Meanwhile, the ransomware developer initially gets 15% of the overall share, which may decrease to 10% in certain cases. 

As of October 2023, Nokoyawa has officially halted its operations. However, Group-IB has pointed out a strong likelihood that farnetwork might reemerge, adopting a different identity and introducing a new Ransomware-as-a-Service (RaaS) program.

North Korean Threat Actors Stole $41 Million in Online Casino Heist

 

This week, cyber attackers set their sights on Stake.com, an online casino game and sports betting platform. They successfully made away with around $41 million in cryptocurrencies. The FBI has pinpointed North Korea and its infamous state-supported hacking group, the Lazarus Group, as the responsible parties. 

According to Edward Craven, co-founder of Stake.com, the incident was characterized as a "sophisticated breach." It exploited a specific service employed by the casino for authorizing cryptocurrency transactions. Despite the significant amount stolen by the state-affiliated hackers, particularly given the ongoing downturn in cryptocurrency prices, Craven affirmed that Stake.com would persevere in its operations. 

“The FBI has confirmed that this theft took place on or about September 4, 2023, and attributes it to the Lazarus Group (also known as APT38) which is comprised of DPRK cyber actors,” the agency said in a press release. 

The group has been active since 2010 and its primary interest lies in South Korean entities, The group engages in activities ranging from espionage to disruption and even outright destruction. Additionally, they have a track record of pursuing financial gains through cyber operations, which includes targeting cryptocurrency exchanges. 

In 2019, North Korea's Lazarus Group gained infamy and was sanctioned by the U.S. government. This hacking collective also recognized as APT38, has been responsible for a series of high-profile cyber intrusions, amassing well over a billion dollars in ill-gotten gains over the years. 

Just this year alone, the FBI reports that Lazarus Group has purloined more than $200 million in cryptocurrencies. Given the traceable nature of blockchain, authorities possess information on the destination addresses of these funds. The FBI is strongly advising individuals to exercise caution when engaging in transactions linked directly or indirectly to these flagged addresses. 

Speculations from experts suggest that North Korea may be channeling the acquired cryptocurrencies into its nuclear weapons program. This month, Kim Jong-un is scheduled to visit Russia, where discussions are anticipated to revolve around the potential supply of weapons to support Vladimir Putin's ongoing invasion of Ukraine. U.S. officials have cautioned that such actions will come with consequences for the nation.

Critical TootRoot Bug Hijack Mastodon Servers

 

Mastodon, the decentralized social networking platform that emphasizes freedom and open-source principles, has recently addressed several vulnerabilities, including a critical one with potentially severe consequences. This particular vulnerability enabled hackers to exploit specially designed media files, allowing them to generate arbitrary files on the server. However, the Mastodon team has taken prompt action to patch these vulnerabilities and enhance the platform's security. 

Mastodon is a software that facilitates the operation of self-hosted social networking services, and it is freely available and open-source. The platform encompasses microblogging functionalities, similar to those found on Twitter. Notably, Mastodon operates through numerous independent nodes, referred to as instances, each possessing its distinct set of guidelines, regulations, privacy preferences, and content moderation policies. 

Instances contribute to a diverse ecosystem of interconnected social networks, providing users with a range of choices and experiences. With a user base of approximately 8.8 million, Mastodon thrives on a network of 13,000 individual servers, also known as instances. These servers are hosted by dedicated volunteers who foster a sense of community while maintaining their unique identities. 

The instances, although separate, are interconnected through federation, enabling diverse communities to coexist and interact with one another. This decentralized approach empowers users to choose the instance that aligns with their interests, fostering a vibrant and interconnected ecosystem within the Mastodon platform. 

Independent auditors from Cure53 discovered and helped fix four vulnerabilities in Mastodon, as a result of their thorough assessments. Engaged by Mozilla to inspect Mastodon's code, Cure53 specializes in penetration testing for online services. The most critical vulnerability, known as TootRoot (CVE-2023-36460), allowed attackers an easy way to compromise servers. 

Mastodon promptly addressed these vulnerabilities, highlighting their commitment to platform security and integrity. The four vulnerabilities that Mastodon resolved included two critical-severity flaws. One of them, identified as CVE-2023-36459, involves a cross-site scripting (XSS) issue in oEmbed preview cards. This vulnerability allows bypassing HTML sanitization in the target browser, potentially leading to account hijacking, user impersonation, or unauthorized access to sensitive data. 

The other critical-severity flaw, CVE-2023-36461, relates to a Denial of Service (DoS) vulnerability caused by slow HTTP responses. Additionally, CVE-2023-36462, also rated as high-severity, enables attackers to format a deceptive verified profile link for phishing purposes. These four vulnerabilities impact Mastodon versions 3.5.0 onwards and have been addressed in the subsequent versions: 3.5.9, 4.0.5, and 4.1.3. Mastodon's timely patches demonstrate their commitment to ensuring the security of their platform.

Ransomware Affiliates, Triple Extortion, and the Dark Web Ecosystem

 

While the dark web is often associated with drugs, crime, and leaked information, there has been a rise in a sophisticated cybercrime ecosystem that operates through platforms like Tor and illicit channels on Telegram. One aspect of this trend is the emergence of ransomware groups and their affiliates, who are employing increasingly intricate methods to extort money from companies. 

According to a recent report from Unit42, ransomware attacks surged by 518% in 2021 compared to the previous year. Another report by KnowBe4 reveals that 83% of successful attacks involved Double and Triple Extortion tactics. Triple extortion is an advanced variation of double extortion, where cybercriminals threaten to expose a company's sensitive data unless a ransom is paid. 

Recently, we have noticed that groups involved in extortion are using more advanced methods. It is now uncommon for a group to only lock a company's data with encryption. Instead, some groups are completely bypassing encryption and concentrating on stealing data and blackmailing employees. 

What are single, double, and triple extortion attacks? 

Single extortion attack refers to a traditional ransomware approach where a group encrypts a company's data and demands payment to unlock it. 

Double extortion attack involves a ransomware group encrypting a company's data and also stealing it. They then threaten to publish the stolen data on ransomware blogs unless the victim pays the ransom.

Triple extortion attack is an advanced version of double extortion. In addition to encrypting and stealing data, the cybercriminals also threaten to expose the stolen information, launch DDoS attacks, or target the company with other harmful activities unless the ransom is paid. 

What are ransomware affiliates? 

A ransomware affiliate is someone or a group that rents access to Ransomware-as-a-Service (RaaS) platforms. They use this access to break into company networks, encrypt files using the rented ransomware, and earn a commission when their extortion attempts are successful. 

What are the challenges? 

In the first half of 2023, there have already been over 2,000 instances of data leaks on ransomware blogs. This indicates that 2023 is likely to set a new record for ransomware data disclosure. The emergence of triple extortion ransomware aligns with another significant change in the threat landscape: the increasing prevalence of infostealer malware. 

There has been a notable rise in "initial access brokers" who work on exclusive dark web forums. These brokers specialize in acquiring initial access to companies and then sell it through auction-style platforms, where interested buyers can either bid or choose to purchase immediately at a fixed price. 

What cybersecurity team can do? 

As the cybercrime ecosystem becomes more complex, even less experienced threat actors can now launch sophisticated attacks on businesses. At Flare, we firmly believe that setting up a continuous threat exposure monitoring process (CTEM) is vital for strong cybersecurity. 

Gartner predicts that companies adopting CTEM practices can decrease the likelihood of a data breach by 66% by 2026. Infostealer malware, such as Vidar, Redline, and Raccoon, infects individual computers and extracts important information. This includes browser fingerprints, host data, and most critically, all the saved credentials stored in the browser.

How the FBI Hacked Hive and Saved Victims

Earlier this year, the FBI achieved a significant milestone by dismantling Hive, a notorious cybercrime group, employing an unconventional approach. Instead of apprehending individuals, the agency focused on outsmarting and disrupting the hackers remotely. This marks a notable shift in the FBI's strategy to combat cybercrime, recognizing the challenges posed by international borders where many cybercriminals operate beyond the jurisdiction of U.S. law enforcement. 

In the past, Hive gained infamy as a highly active criminal syndicate, renowned for its acts of disrupting American schools, businesses, and healthcare institutions by disabling their networks and subsequently demanding ransoms for restoration. However, FBI field agents based in Florida successfully dismantled the group using their cyber expertise. 

They initially gained unauthorized access to Hive's network in July 2022 and subsequently countered the syndicate's extortion activities by aiding the targeted organizations in independently regaining access to their systems. 

According to Adam Hickey, a former Deputy Assistant Attorney General in the Justice Department's national security division during the Hive operation, the FBI's method proved effective and saved victims worldwide approximately $130 million. After conducting thorough investigations, the FBI discovered that Hive had rented its primary attack servers from a Los Angeles data center. 

Acting swiftly, the FBI seized the servers within two weeks and subsequently announced the takedown. This rapid action was motivated by the agency's recognition of an opportunity to halt Hive's activities, which had previously been difficult to preempt. However, while the announcement marked a significant milestone, Special Agent Smith and Director Crenshaw emphasized that the case is far from over. 

Hickey, who is now a partner at Mayer Brown law firm, stated that relying solely on arrests to combat cyber threats would be an oversimplified approach. He emphasized the need for a broader perspective and alternative strategies to address the evolving cyber threat landscape. 

The FBI initially became aware of Hive in July 2021 when the group, which was still relatively unknown at the time, targeted and encrypted the computer network of an undisclosed organization in Florida. This occurred during a period when prominent ransomware groups were carrying out severe attacks on gas pipelines and meat processors in the United States. 

In the following 18 months, Hive conducted more than 1,500 attacks worldwide, resulting in the collection of approximately $100 million in cryptocurrency from the victims, as estimated by U.S. law enforcement. The group's rapid expansion can be attributed, in part, to its strategic utilization of ruthlessness as a catalyst for growth. 

They targeted organizations, including hospitals and healthcare providers, that other cybercriminals had refrained from attacking. Data gathered by researcher Allan Liska, reveals that despite the FBI's covert presence within Hive, the group continued to carry out attacks at a consistent rate. 

On a hidden website where Hive disclosed the identities and sensitive details of victims who refused to pay, they listed seven victims in August, eight in September, seven in October, nine in November, and 14 in December. These numbers remained similar to the group's attack patterns before the FBI's infiltration. 

Hive members are still at large, and the seized servers could potentially aid in exposing the network of affiliates who collaborated with Hive during the 18-month period. As a result, the takedown has the potential to lead to additional arrests in the future.

Federal Report Highlights Steps for Enhancing Software Code Pipeline Security Amid App Attacks

 

In a recent update, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) collaborated on an advisory memorandum with the aim of strengthening security measures within application development software supply chains. 
The memo, titled "Defending Continuous Integration/Continuous Delivery (CI/CD) Pipelines," delves into the vulnerabilities associated with deployment processes and sheds light on potential methods that attackers can employ to exploit these pipelines. 

These tactics range from the theft of login credentials and encryption keys to injecting malware into or assuming control over source code projects. To address these concerns, the advisory memo draws heavily upon the MITRE ATT&CK threat framework, utilizing its threat classification system to offer recommended strategies and countermeasures. The publication underscores the substantial scope for improvement in this area and serves as a valuable resource for enhancing defense mechanisms. 

According to the recent State of Software Security report by Veracode Inc., a significant majority of the 130,000 applications tested exhibited at least one security flaw, accounting for 76% of the total. Furthermore, the report highlighted that approximately 24% of all applications assessed contained high-severity flaws. These findings indicate a substantial scope for improvement and ample opportunity to develop more secure applications. 

Software code pipeline security encompasses the following measures and practices: 

Source Code Management: Implement secure version control systems with proper access controls and monitoring to protect code repositories. 

Build Process Security: Ensure secure build environments and tools to prevent tampering or injection of malicious code. Validate dependencies and use approved components. 

Code Testing and Analysis: Conduct comprehensive security testing and code analysis at different stages of the pipeline. Utilize static code analysis, dynamic testing, and vulnerability scanning. 

Secure Artifact Storage: Safeguard artifacts generated during the build process, such as binaries or container images. Maintain secure storage and apply appropriate access controls. 

Deployment Security: Establish secure deployment practices to deploy authorized and validated artifacts to production environments. Verify code integrity and detect unauthorized changes. 

Continuous Monitoring: Implement continuous monitoring and logging mechanisms to identify security incidents, unauthorized access attempts, anomalies, or code tampering. 

Access Control and Authentication: Enforce proper access controls and authentication mechanisms for code repositories, build servers, and deployment environments. Utilize strong authentication, role-based access control, and least privilege principles. 

By implementing these security measures throughout the code pipeline, organizations can enhance protection against code tampering, unauthorized access, and vulnerabilities, ensuring the overall security and integrity of the software development process. 


Know Quantum Threats Before Using AI Language Models Like ChatGPT

 

By this point, ChatGPT has become a household name as the pioneering example of a novel form of artificial intelligence known as generative AI, or large language models (LLMs). Since its launch in November 2022, ChatGPT has experienced exceptional growth, amassing a staggering 1 million users in just five days. 

Today, with over 100 million users, ChatGPT has become a widely adopted AI model, and Openai.com, the platform behind its creation, receives approximately 1 billion monthly visits. As our reliance on LLMs continues to grow, our digital footprints expand exponentially. 

This is due to our usage of LLMs, like other websites and applications, through internet and satellite communications that are safeguarded by public key infrastructure (PKI). 

How quantum computers are a threat to Langauge Models? 

In recent times, quantum computers have gained significant attention for their immense computational power. These machines have the potential to break PKI and decrypt vast amounts of our existing communications, encompassing almost everything we engage in on the internet. Consequently, the data we generate, including LLM data, becomes vulnerable to exploitation by adversaries equipped with quantum computers. 

Quantum threats arise due to the development and potential utilization of quantum computers, which possess the ability to perform certain calculations at a much faster pace than classical computers. These highly capable machines pose a significant risk to the security of current cryptographic algorithms used for safeguarding data. 

A primary concern is the susceptibility of traditional asymmetric encryption algorithms, such as RSA and elliptic curve cryptography (ECC), to quantum computers. These algorithms rely on complex mathematical problems, like factoring large numbers or solving discrete logarithms, to ensure the integrity of encryption. However, quantum computers can efficiently solve these problems using algorithms like Shor's algorithm, potentially compromising the security of encrypted data. 

Why it is very challenging to protect a system from quantum threats?

 As we increasingly engage with technology in our daily lives, such as using mobile phones, making online purchases, or utilizing AI-powered systems like LLMs, our digital presence expands. This accumulation of data creates a digital twin or shadow that grows alongside our activities. 

With the advancement of LLMs and AI, it becomes increasingly challenging to differentiate between our real selves and our digital counterparts. The integration of LLM data into our digital shadows means that every aspect of our lives becomes part of a permanent and accessible database. This poses a potential risk as adversaries equipped with quantum tools could gain unauthorized access to this data. 

Consequently, not only individuals but also businesses and government organizations that rely on these technologies expose themselves to the same threats. 

Consider the gravity of sensitive information such as government or nuclear secrets, personal healthcare records, bank account details, and identification numbers like Social Security and driver's license numbers. It is imperative that these data remain confidential and secure for extended periods, ranging from 25 to 75 years. 

However, if a highly capable quantum computer becomes operational within the next five years, the potential consequences become evident. The exposure of our most valuable and sensitive information would persist for decades, compromising privacy and security on an unprecedented scale. 

What you can do to protect your data privacy in the era of LLMs and AI technology? 

  • Understand the implications: Recognize that the use of LLMs and AI exposes data during communication and storage processes. Be aware of the potential risks associated with these technologies. 
  • Avoid sensitive data exposure: Refrain from using LLMs or AI platforms where there is a possibility of sensitive or confidential information being exposed or stored. Exercise caution and prioritize data privacy. 
  • Review privacy policies: Take the time to read and understand the privacy policies of LLM websites or AI service providers. Being aware of how your data will be used can help you make informed decisions about sharing information.

What is the future against quantum threats? 

In response to this challenge, researchers are actively engaged in the development of post-quantum cryptography, also known as quantum-resistant cryptography. This field focuses on creating new cryptographic algorithms that can withstand attacks from both classical and quantum computers. 

The ultimate objective is to establish long-term security for sensitive data and communications, considering the increasing power and accessibility of quantum computers. Ongoing efforts are underway to standardize quantum-resistant cryptographic algorithms and establish a new generation of encryption methods. 

These endeavors involve collaboration among experts to define and promote secure algorithms capable of countering quantum threats. Furthermore, organizations may need to adopt hybrid approaches that combine classical and post-quantum cryptography to ensure the secure transmission and storage of data in the face of evolving quantum threats.

How the Economy is Impacting Cybersecurity Teams

A recent study conducted by HackerOne, the world's largest ethical hacker community, revealed that half of the surveyed organizations experienced a surge in cybersecurity vulnerabilities in the last year. This alarming trend has been attributed to security budget cuts and layoffs. At a HackerOne event, researchers, along with ethical hackers and leaders from Sumo Logic and GitLab, discussed the economic impacts of this issue. 

The experts emphasized the critical role of DevSecOps, machine learning, and artificial intelligence in mitigating security risks during an economic downturn, particularly in light of the current vulnerable state of organizations. They also highlighted how some companies are achieving more with less in the face of these challenges. 

The survey reveals that 75% of the surveyed companies are experiencing difficulties in managing cybersecurity effectively due to economic reductions like budget cuts, hiring freezes, and layoffs. While these cost-saving measures may seem beneficial in the short term, cutting back on cybersecurity investments can lead to severe consequences for companies in the long run. 

In addition to this, the FBI's report in 2008 and the recent pandemic, it is evident that cybercrime tends to surge during times of economic recession and crises. According to Acronis, the average cost of a data breach is now at an unprecedented high of over $5 million, which is expected to increase by 2023. 
Furthermore, with the continuous changes in the regulatory framework, compliance risks are also on the rise. It is becoming difficult for companies to manage this. 

George Gerchow, chief security officer and senior vice president of IT at Sumo Logic said that “Whenever there are times of high anxiety, such as an economic downturn coming off of a pandemic, bad actors are at their best. I’ve seen a few companies impacted by the tightening of the budget strings, but I can tell you that at Sumo, it hasn’t happened. We’re probably investing more heavily than we ever have. I think it’s a real mistake when companies start cutting back on their budget around cybersecurity, especially during these times.” 

Despite 84% of companies expressing concern about the financial and reputational harm that could arise from cybersecurity breaches, the HackerOne report shows that many of them have implemented or plan to implement cost-cutting measures that impact their security teams. The report reveals that over the past year, 39% of companies have already made cuts to their security teams, and 40% plan to make similar cuts in the coming year. Such actions, according to Gerchow, have direct and indirect consequences that are often disregarded.

Kimsuky Spear-Phishing Campaign Goes Global Using New Malware

On Thursday, security researchers from SentinelOne reported that the North Korean state-sponsored APT group, Kimsuky, has been observed utilizing a brand new malware component called ReconShark. The malware is disseminated through spear-phishing emails that are specifically targeted, containing OneDrive links that, when clicked, trigger the download of documents that subsequently activate malicious macros.  

Tom Hegel and Aleksandar Milenkoski from SentinelOne revealed that the spear-phishing emails used to distribute ReconShark are tailored to specific individuals, with a high level of design quality that increases the likelihood of the target opening them. These emails appear legitimate, using proper formatting, grammar, and visual clues that can deceive unsuspecting users. 

Moreover, the malicious documents and the links in the emails are disguised with the names of real individuals whose knowledge or expertise is relevant to the subject of the lure, for instance, political scientists. 

Furthermore, the researcher added that “The ability of ReconShark to exfiltrate valuable information, such as deployed detection mechanisms and hardware information, indicates that ReconShark is part of a Kimsuky-orchestrated reconnaissance operation that enables subsequent precision attacks, possibly involving malware specifically tailored to evade defenses and exploit platform weaknesses”.

The state-sponsored APT group Kimsuky, which has been operating since 2012, is also identified by other names such as APT43, ARCHIPELAGO, Black Banshee, Emerald Sleet (previously Thallium), Nickel Kimball, and Velvet Chollima. This notorious threat actor group has been involved in targeted attacks on numerous entities, including non-governmental organizations (NGOs), diplomatic agencies, military organizations, think tanks, research entities, and economic groups across Asia, North America, and Europe. 

In new developments, Kimsuky differs from its predecessors. It avoids storing collected data on the file system. Instead, the malware stores the information in string variables and transmits it to a command-and-control (C2) server via HTTP POST requests. Additionally, ReconShark can install supplementary payloads, such as DLL files or scripts, by examining the detection mechanisms present on the infected systems. 

Furthermore, the security researchers noted that Kimsuky's recent activities are designed to hit global issues. “For example, the latest Kimsuky campaigns have focused on nuclear agendas between China and North Korea, relevant to the ongoing war between Russia and Ukraine,” reads the report. 

The discovery of ReconShark highlights the growing proof that Kimsuky is changing its techniques to secretly access and control computer systems, stay undetected, and collect information for prolonged periods.

Crypto Platform 3Commas Attacked

 

Cryptocurrency trading platform 3Commas reported that they suffered a data breach in which API data were stolen. Following the incident, an FBI investigation has been called in. 

However, the investigation comes after weeks of criticism from users of the Estonia-based crypto trading platform. As per the statement released by the platform, an unknown hacker posted 3Commas’ API database to Pastebin, on 28 December. 

Also, users reported that its CEO repeatedly ignored the warning signs that the platform had been targeted. 

The cyber threat security team of the company has confirmed the attack’s authenticity after analyzing it, saying “at this point, 3Commas can, unfortunately, confirm that some of 3Commas’ users’ API data (API keys, secrets and passphrases) have been disclosed by a third party.”

Further, it added that “Currently and to the best of our knowledge only API data have been disclosed as part of this incident. As a likely consequence, the hacker(s) may use or may have used the API data to connect your exchange accounts to his/their account and/or initiate unauthorized trades”. 

The threat actor has managed to leak a set of 10,000 API keys, which was just 10% of the 100,000-big database, as per the report. These keys are used by 3Commas bots to automatically interact with crypto exchange platforms, make trades and generate profit, without user interaction. 

The company sent notice to its users via email and a blog post, in which it assures its users that their data and funds will be protected as the company has taken precautionary measures already. The attack has also been reported to the relevant law enforcement agencies, including the FBI. 

However, the damage has already been done. The malicious actor has been abusing stolen API keys since November, he also managed to steal some $6 million worth of cryptocurrencies so far as per the report. 

Furthermore, the company added, “Only a small number of technical employees had access to the infrastructure, and we have taken steps since November 19 to remove their access. Since then, we have implemented new security measures, and we will not stop there; we are launching a full investigation in which law enforcement will be involved”.

Hackers Leaked Stolen Data of 5.7M Gemini Users

Gemini crypto exchange recently made an announcement this week that its customers have been victimized in a phishing campaign after a group of malicious actors collected their personal credentials by breaching a third-party vendor. 

The notification of the attack came to light after multiple posts on hacker forums observed by BleepingComputer offered to sell a database reportedly from the Gemini crypto exchange containing email addresses and phone numbers of 5.7 million customers. 

 “Some Gemini customers have recently been the target of phishing campaigns that we believe are the result of an incident at a third-party vendor. This incident led to the collection of Gemini customer email addresses and partial phone numbers...,” reads the advisory published by the crypto exchange. “…No Gemini account information or systems were impacted as a result of this third-party incident, and all funds and customer accounts remain secure.” 

The Gemini security team released a short notice in which it described the attack but did not disclose the name of a third-party vendor who suffered an "incident" that allowed unauthorized access to malicious actors. Because of the breach, customers of the company received phishing emails. 

However, as per the analysis of the attack, it has been observed that the mission of the threat actors is unknown. In the short report, the company wrote that the account information and its systems are safe from the attack and that fund and customer accounts "remain secure." 

After the attack, the company came back online after seven hours due to scheduled maintenance. "The Gemini Spaceship will undergo scheduled Exchange maintenance on Thursday, December 15th from approximately 10:00 p.m. until Friday, December 16th at 12:30 a.m. ET, and all user interfaces and trading will be unavailable during that time”, a notice on the exchange's status page read. 

Gemini advised its customers to use strong authentication methods and two-factor authentication (2FA) and/ or the hardware security keys to protect their networks and systems.

North Korean Hackers Target CryptoJob Seekers To Evade Western Countries Against Sections

North Korean state sponsors hackers are victimizing cryptocurrency workers with a new phishing campaign on LinkedIn and Indeed to plagiarize resumes and other people’s profiles to land remote work at crypto firms, security researchers at Mandiant said. 

Malwarebytes cyber security researcher, Hossein Jazi, published details of the attack on Twitter. Research analysis shows that the hackers leveraged a PDF containing information about the non-existent role of “engineering manager, product security” at crypto giant Coinbase. 

The objective behind this campaign is to get access to these firms’ internal operations, and projects and gather data about upcoming trends, including Ethereum network development, potential security lapses, and non-fungible tokens (NFTs). 

This information reportedly serves North Korean threat actors to launder cryptocurrencies that can later be used by the Pyongyang government to answer Western sanctions. 

Joe Dobson, a principal analyst at Mandiant, told the press that “It comes down to insider threats If someone gets hired onto a crypto project, and they become a core developer, that allows them to influence things, whether for good or not.” 

This phishing campaign also shares similarities with Operation In(ter)caption, in which hackers used LinkedIn phishing messages that were containing job offers for target working audiences in relevant sectors. Malicious files and data were sent either via email or LinkedIn in a OneDrive link, it was first exposed by ESET in June 2020. 

“Once the recipient opened the file, a seemingly innocent PDF document with salary information related to the fake job offer was displayed. Meanwhile, the malware was silently deployed on the victim’s computer. In this way, the attackers established an initial foothold and reached a solid persistence on the system,” ESET reported. 

Although, the government of North Korea denied its involvement in any cyber-related theft, however, the U.S. government federal agencies, such as the Department of State and the FBI, earlier this year released warnings to the organizations against randomly hiring freelancers from North Korea, as they were potentially misleading businesses with their true identities and state's (DPRK) backing in their activities. 

GwisinLocker Ransomware Targets Linux Systems in South Korea

ReversingLabs cyber intelligence group discovered a brand ransomware family called 'GwisinLocker'. As per the analysis, this ransomware mainly victimizes South Korea’s infrastructures such as healthcare, pharmaceutical companies, and industries with Windows and Linux encryptors, including support for encrypting VMware ESXi servers and virtual machines. 

Dubbed as GwisinLocker, the malware was first detected on July 19 by ReversingLabs cyber intelligence group. GwisinLocker is an upgraded and advanced malware variant that was created by a previously lesser-known threat actor (TA) called “Gwisin” which translates in Korean as 'ghost' or 'spirit'. Also, the hacker’s origin is unknown but as per the technical data, it appears that the hacker has a good command of the Korean language. 

“In those incidents, it often launched attacks on public holidays and during the early morning hours (Korean time) – looking to take advantage of periods in which staffing and monitoring within target environments were relaxed,” ReversingLabs wrote in an advisory published on Thursday. 

“In communications with its victims, the Gwisin group claims to have deep knowledge of their network and claim that they exfiltrated data with which to extort the company.”

“In communications with its victims, the Gwisin group claim to have deep knowledge of their network and claim that they exfiltrated data with which to extort the company. Ransom notes associated with GwisinLocker.Linux contains detailed internal information from the compromised environment. Encrypted files use file extensions customized to use the name of the victim company”, the report reads.

Regarding the information on the payment system behind the ransomware, researchers said that GwisinLocker.Linux victims called for logging into the portal run by the group and creating private communications channels for completing ransom payments. “As a result, little is known about the payment method used and/or cryptocurrency wallets associated with the group,” the researchers further added.

Google Docs Comment Flaw Exploited by Hackers

 

A flaw has been deducted in the comment feature of Google Docs which is allowing cybercriminals to compromise users with phishing emails. 

A unit of cyber threats has reported that the hackers are using the “Comments” feature of Google Docs to send malicious links in a phishing campaign. Researchers also unveiled in their findings that the group primarily targeted Outlook users. 

Researchers from email collaboration and security firm Avanan, a CheckPoint company have discovered what they call “a new, massive wave of hackers’’ leveraging the comment feature in Google Docs during December 2021 to execute attacks, Avanan Cybersecurity Researcher/Analyst Jeremy Fuchs mentioned in a report that has been published on Thursday. 

The team said that the hackers mentioned the target with an @ in the comment box of the users and by doing so an email was automatically sent to that person's inbox. The email includes malicious links and texts. Furthermore, researchers said that the email address of the commenter was not shown, just the name of the attacker. 

The attackers who have already hit more than 500 users across 30 different locations, employing more than 100 different Gmail accounts, are difficult to be caught as of now, according to the researchers at Avanan.

"In this attack, hackers are adding a comment to a Google Doc. The comment mentions the target with an @. By doing so, an email is automatically sent to that person’s inbox. In that email, which comes from Google, the full comment, including the bad links and text, is included. Further, the email address isn’t shown, just the attackers’ name, making this ripe for impersonators," reinstates Jeremy Fuchs, cybersecurity researcher/analyst at Avanan.

Following the incident, Jeremy Fuchs shared an example in which he explained the whole incident, "let’s say the intended target has a work address of vic.tim@company.com. The end-user will have no idea whether the comment came from bad.actor@gmail.com or bad.actor@company.com. It will just say 'Bad Actor' mentioned you in a comment in the following document," Fuchs says. "If Bad Actor is a colleague, it will appear trusted. Further, the email contains the full comment, along with links and text."

Why Cyber Due Diligence is Essential to the M&A Process

 

As per the latest findings, many organizations have experienced a big surge in ransomware attacks in recent years. Upon comparing the data with the past reports, we see a 437% increment in ransomware attacks, with many of those breaches occurring after a merger or acquisition announcement. In corporate finance, mergers and acquisitions are transactions in which the ownership of companies, other business firms, or their operating units are transferred or consolidated with other bodies. 

Cyber Criminals are targeting these organizations to rob banks. If you sold a business to a large private firm, then the firm has the ability to pay the Ransome demands compared to the smaller stand-alone organization which does not possess a stronghold. M&A also creates a period of transition, where new entities and management teams come into or out of their roles. This transitional process gives a perfect opportunity for cybercriminals to breach. 

Advance ransomware attacks cost millions of dollars for a larger organization due to ransom demands, legal fees, loss of revenue, incident response costs, hardware/software replacement, and increased cyber insurance premiums. Alongside, company owners and their members are also now being held personally liable for a lack of security checks. 

With reference to the past incidents, malicious actors use various methods to get into the system, and conducting a phishing attack via email is a common and effective approach of the attackers. Once the attackers get access to the systems, they can control the networks and applications to determine where the most sensitive data is stored. 

The larger question that arises is 'how a company can prevent such attacks from happening?' Researchers said that the companies should evaluate cyber-risk as part of their due diligence process, create an incident response plan, and should not present the acquisition as a soft target.

'The Community' Has Been Sentenced For a Multimillion-dollar SIM Swapping Conspiracy

 

The U.S. Department of Justice (DoJ) has sentenced a sixth member of the international hacking group known as ‘The Community’ in association with a multimillion-dollar SIM swapping conspiracy. 

Garrett Endicott, 22 years old from Warrensburg, Missouri, is the last of the six accused that has been sent to prison in connection with a multi-million-dollar SIM-swapping conspiracy that targeted victims across the country, including in California, Michigan, Missouri, Utah, New York, Texas, and Illinois. He has been sentenced to 10 months and pronounced to pay $121,549.37 amount in reparation. 

Before delving into more details, first, we must understand what exactly went down? Let’s go over what SIM swapping is and how it usually plays out. 

SIM swapping or SIM hijacking, is a type of identity theft fraud wherein the perpetrator persuades phone carriers into porting their victims' cell services to SIM cards under their control. 

This usually happens by stealing the data of victims from numerous sources including data breach leaks, social media profiles, phishing, and other types of social engineering. Once this is done, the group of hackers gets access to the victim’s accounts that are linked to their phone number including email account, cloud storage, and cryptocurrency exchange accounts, etc. 

The main reason why cybercriminals do this is to intercept two-factor authentication (2FA) texts that give access to secure services such as banks and crypto-wallets. 

"Members of The Community engaged in Sim Hijacking to steal cryptocurrency from victims across the country, including California, Missouri, Michigan, Utah, Texas, New York, and Illinois, resulting in the theft of cryptocurrency valued, at the time of the theft, ranging anywhere between $2,000 to more than $5 million, from different affected parties,” the justice department said. 

"The actions of these defendants resulted in the loss of millions of dollars to the victims, some of whom lost their entire retirement savings. This case should serve as a reminder to all of us to protect our personal and financial information from those who seek to steal it said Acting U.S. Attorney Saima Mohsin for the Eastern District of Michigan”.