Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label ransomware attacks. Show all posts
ransomware attacks
911 service Cyber Security DHS Pennsylvania Personal Information ransomware attacks

Are Emergency Services Vulnerable to Cyber Threats?




In recent warnings issued by the Department of Homeland Security (DHS), a concerning trend has emerged: emergency services are increasingly vulnerable to cyber-attacks, particularly ransomware incidents. These attacks pose significant risks not only to operational efficiency but also to public safety and the security of personal information.

Ransomware attacks, for those unfamiliar, involve hackers infiltrating computer systems and encrypting data, demanding payment for its release. Emergency services, including police departments and 911 call centres, have become prime targets for these attacks, leading to severe disruptions in critical operations. Picture a scenario where accessing emergency services during a crisis becomes impossible due to system outages—it's a frightening reality that stresses upon the urgency of addressing cybersecurity vulnerabilities.

The repercussions extend beyond mere operational disruptions. Cybercriminals gain access to highly sensitive personal information and police records, which can be exploited for various illicit activities, including identity theft and extortion. Such breaches not only compromise individuals' privacy but also undermine law enforcement's ability to effectively respond to emergencies, posing a significant threat to public safety.

One of the primary challenges in combating these cyber threats lies in the lack of resources and expertise at the local level. Many state and local governments, responsible for managing emergency service networks, struggle to keep pace with the rapidly expanding aspects of cybersecurity. Outdated technology systems and a shortage of cybersecurity personnel exacerbate the problem, leaving critical infrastructure vulnerable to exploitation by malicious actors.

Recent incidents in Bucks County, Pennsylvania, and Fulton County, Georgia, serve as stark reminders of the vulnerabilities within emergency services. In Bucks County, dispatchers were compelled to resort to manual processes after a cyberattack paralysed the 911 system, while Fulton County endured widespread disruption to government services following a cyber intrusion.

To address these challenges effectively, collaboration and preparedness are the key. Communities must prioritise cybersecurity measures, investing in modern technology systems, and providing comprehensive training for personnel to identify and respond to cyber threats promptly.

As society continues to rely increasingly on digital foundation, safeguarding critical services, particularly emergency response systems, becomes imperative. By remaining vigilant and proactive, we can fortify our communities against cyber threats, ensuring that emergency assistance remains readily accessible, even in the face of malicious cyber activity.


Read more »
ransomware attacks
CDR CISA Cyber Attacks Cyber Defenses cybercriminals EDR endpoint detection and response LockBit Malicious Software Open Source Software ransomware attacks

The Rise of Weaponized Software: How Cyber Attackers Outsmart Traditional Defenses

 

As businesses navigate the digital landscape, the threat of ransomware looms larger than ever before. Each day brings new innovations in cybercriminal techniques, challenging traditional defense strategies and posing significant risks to organizations worldwide. Ransomware attacks have become increasingly pervasive, with 66% of companies falling victim in 2023 alone, and this number is expected to rise. In response, it has become imperative for businesses to reassess their security measures, particularly in the realm of identity security, to effectively combat attackers' evolving tactics.
 
Ransomware has evolved beyond merely infecting computers with sophisticated malicious software. Cybercriminals have now begun exploiting legitimate software used by organizations to conduct malicious activities and steal identities, all without creating custom malware. One prevalent method involves capitalizing on vulnerabilities in Open Source Software (OSS), seamlessly integrating malicious elements into OSS frameworks. 

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about this growing trend, citing examples like the Lockbit operation, where cyber attackers leverage legitimate, free software for nefarious purposes. Conventional endpoint security solutions often lack the necessary behavior analytics capabilities to detect subtle indicators of compromise. 

As a result, attackers can exploit tools already employed by organizations to acquire admin privileges more easily while evading detection. This underscores the need for organizations to stay abreast of evolving techniques and adapt their defense strategies accordingly. Throughout the ransomware attack lifecycle, cybercriminals employ a variety of tactics to advance their missions. 

From initial infection to data exfiltration, each stage presents unique challenges and opportunities for attackers. For example, attackers may exploit vulnerabilities, manipulate cookies, or employ phishing emails to gain initial access. Once inside a network, they utilize legitimate software for persistence, privilege escalation, lateral movement, encryption, and data exfiltration. 

One critical aspect of mitigating the risk posed by ransomware is embracing an identity-centric defense-in-depth approach. This approach places emphasis on important security controls such as endpoint detection and response (EDR), anti-virus (AV)/next-generation antivirus (NGAV), content disarm and reconstruction (CDR), email security, and patch management. By prioritizing least privilege and behavior analytics, organizations can strengthen their defenses and mitigate the risk of falling victim to ransomware attacks. 

As ransomware attacks continue to evolve and proliferate, organizations must prioritize identity security and adopt a proactive approach to defense. By recognizing and addressing the tactics employed throughout the ransomware attack lifecycle, businesses can bolster their defenses, enhance identity security, and safeguard against the ever-evolving threat of ransomware.
Read more »
ransomware attacks
Identity Protection LOCKBIT Cybergang Personal Data Breach Privacy ransomware attacks

Russian Cybergang Responsible for Cybertheft in Jacksonville Beach: What You Need to Know


In late January, the city of Jacksonville Beach, Florida, fell victim to a cybertheft incident that potentially impacted up to 50,000 residents. The responsible party? A Russian-based cybergang known as LOCKBIT. In this blog post, we delve into the details of the attack, the aftermath, and what citizens need to be aware of moving forward.

The LOCKBIT Cybergang

LOCKBIT is not a new player in the cybercrime world. Known for its sophisticated tactics, this group specializes in ransomware attacks. Their modus operandi involves infiltrating systems, encrypting data, and demanding hefty ransoms in exchange for decryption keys. In the case of Jacksonville Beach, LOCKBIT targeted the city’s information system, potentially compromising sensitive data.

The Jacksonville Beach Incident

On February 12, LOCKBIT escalated the situation by listing local residents’ personal information on their website. Social security numbers, addresses, and other private details were suddenly exposed. Panic ensued as citizens grappled with the realization that their identities were at risk. The city’s response was swift: they refused to pay the ransom demanded by LOCKBIT, adhering to Florida’s laws prohibiting such payments.

The International Police Operation

Fortunately, an international police operation intervened, dismantling the criminal empire. LOCKBIT’s reign of terror was cut short, but the damage had already been done. The question remained: where did the stolen data end up? Forensic experts began their painstaking work, attempting to trace the digital breadcrumbs left by the cybergang. Months of investigation lay ahead, and even then, a complete picture might never emerge.

The Fallout

The fallout from the Jacksonville Beach incident is multifaceted. First and foremost, citizens face the uncertainty of whether their personal information is circulating on the dark web. LOCKBIT’s exposure of social security numbers and addresses could have severe consequences, from identity theft to financial fraud. The hotline set up by the city (844-709-0703) aims to address citizens’ concerns, but the road ahead remains murky.

Lessons Learned

As we reflect on this cybertheft, several crucial lessons emerge:

Vigilance is Key: Cyber threats are real and ever-evolving. Citizens must remain vigilant, practicing good cybersecurity hygiene. Regularly update passwords, avoid suspicious emails, and be cautious when sharing personal information online.

Backup Your Data: Ransomware attacks can cripple organizations and individuals. Regularly back up your data to secure locations. If your files are encrypted, having backups ensures you don’t have to pay a ransom to regain access.

No Ransom Payments: Jacksonville Beach’s refusal to pay the ransom was commendable. By adhering to this stance, they not only followed the law but also sent a message to cybercriminals that their tactics won’t work.

Collaboration Matters: International cooperation played a crucial role in dismantling LOCKBIT. Cybercrime knows no borders, and joint efforts are essential to combating it effectively.

Read more »
ransomware attacks
cryptocurrency cryptocurrency scam Cyber Crime FBI Identity Fraud ransomware attacks

FBI Reports Surge in Cryptocurrency Scams, Highlighting Growing Threat of Confidence Scams

 

The FBI has recently brought attention to a concerning trend in cybercrime: the rise of cryptocurrency scams, particularly through romance and confidence schemes, which have outpaced ransomware attacks in terms of financial losses. According to the FBI's data, individuals fell victim to cryptocurrency scams amounting to a staggering $4.57 billion in 2023, marking a significant 38% increase compared to the previous year's losses of $3.31 billion. 

These scams typically unfold over a period of several weeks, with fraudsters assuming false identities, often posing as attractive individuals, to establish relationships with their targets. As the relationship progresses, the scammers introduce the idea of joint cryptocurrency investments, recommending fake platforms or apps under their control. Victims are manipulated into making substantial investments, with the scammers fabricating gains to maintain the illusion of profitability. 

When victims attempt to withdraw their funds, the fraudsters employ various tactics, including impersonating customer support representatives and demanding additional fees, resulting in further financial losses for the victims. In contrast, ransomware attacks, a prevalent form of cyber extortion, generated comparatively minor losses of $59.6 million. 

However, the FBI acknowledges that this figure may not fully reflect the true extent of ransomware-related losses, as it fails to account for indirect costs such as business downtime. Moreover, the reported losses only encompass ransomware incidents reported to the Internet Crime Complaint Center (IC3), suggesting that the actual financial impact of ransomware attacks could be significantly higher. The discrepancy in reported losses between cryptocurrency scams and ransomware attacks underscores the evolving landscape of cyber threats and the shifting tactics employed by cybercriminals. 

While ransomware attacks continue to pose a significant threat to businesses and organizations, the surge in cryptocurrency scams highlights the effectiveness of social engineering techniques in deceiving individuals and extracting substantial sums of money. To combat these threats effectively, individuals and businesses must remain vigilant and exercise caution when engaging in online interactions. It is essential to verify the authenticity of investment opportunities and platforms, especially those related to cryptocurrencies, and to refrain from disclosing sensitive information or transferring funds without proper verification. 

Additionally, organizations should implement robust cybersecurity measures, including regular employee training and the deployment of advanced threat detection technologies, to mitigate the risk of falling victim to cyber scams and attacks. As cybercriminals continue to exploit vulnerabilities and devise increasingly sophisticated schemes, collaboration between law enforcement agencies, cybersecurity professionals, and the public is crucial in combating cybercrime and safeguarding against financial losses and data breaches. By raising awareness of emerging threats and adopting proactive security measures, individuals and organizations can better protect themselves against the pervasive threat of cybercrime in today's digital landscape.
Read more »
ransomware attacks
Cyber Attacks cyber threat Cyberalert CyberCrime Cyberhackers Cybersecurity Immigratino System ransomware attacks

Cybersecurity Nightmare Unfolds as Malawi's Immigration Systems Under Attack

 


There has been a recent cyberattack on Malawi, according to President Lazarus Chakwera, which has caused the government to stop issuing passports. However, some observers believe such an attack did not occur. Chakwera informed parliament on Wednesday that security measures were in place to identify and apprehend the attackers who compromised the country's security. 

It was his statement that the attackers were demanding millions in ransom, but the administration was unwilling to pay it. The hacker has been causing the Department of Immigration and Citizenship Services' passport printing system to malfunction over the past three weeks, according to him. In Malawi, there is a high demand for passports with many young people seeking to migrate to find employment. 

As a result of Mr Chakwera's request, the immigration department is expected to provide a temporary solution within three weeks of regaining control of the system to resume passport issuance. There would be an additional security safeguard developed as part of the long-term solution, he said. 

In his address on Wednesday, Chakwera said that he had given the immigration department a three-week deadline to provide a temporary solution to the passport printing issue and to resume printing of passports. He further said at the same event that he had reassured hackers that the Malawi government would not pay ransoms. As a result of the government's termination of the contract with Techno Brain, which had supplied Malawi’s passports since 2019, Malawi has experienced passport issues since 2021. 

As a result of the government's inability to find a replacement for the company in 2023, the company was re-engaged temporarily. Nevertheless, immigration officials often had to scale back production due to shortages of materials or unpaid bills, which resulted in them having to scale down production several times. In addition to being the executive director of the Center for Democracy and Economic Development Initiatives, Sylvester Namiwa is also a member of the organization that has threatened to hold protests within the coming days if it does not receive an immediate resolution. 

According to Chakwera, he has questioned the integrity of the claim that the system had been hacked by someone else. During a radio interview with a local radio station on Thursday, Malawi's Information Minister Moses Nkukuyu explained that the information Chakwera presented in parliament had been provided by immigration experts. VOA's calls and texts to Wellington Chiponde, a spokesperson for the immigration department, were not responded to.
Read more »
ransomware attacks
ALPHV Cyber Crime cyber threat Cyberattacks CyberCrime Cybersecurity Financial Fraud LoanDepot ransomware attacks

ALPHV Ransomware Strikes: LoanDepot and Prudential Financial Targeted

 


Recently, Prudential Financial and loanDepot, two Fortune 500 companies were attacked by the ALPHV/Blackcat ransomware gang, which claims responsibility for the breaches. Despite the threat actors still having to prove their claims, the two companies were added to ALPHV's dark web leak site today, which is the first time the threat actors have added them to the dark web leak site. As a result of failed negotiations, ALPHV will be selling the stolen data from loanDepot's network and releasing Prudential's data for free as well. 

There was a data leak on the site of the infamous ALPHV ransomware operator - the BlackCat group - that revealed Prudential Financial and loanDepot as being the targets of the attacks on both firms, as an apparent admission by the group that it had been behind the attacks on these firms. Currently, the group has only added the names to its site, while the actual data has not yet been available. Because negotiations with Prudential Financial broke down, the group will be publishing its database for free for all to see. 

A company representative stated that the company would provide free credit monitoring and identity protection to those affected by the data breach. With roughly 6,000 employees and more than $140 billion in loan servicing in the United States, loanDepot is among the largest nonbank retail mortgage lenders in the U.S. A suspected cybercrime group breached Prudential Financial's network on February 4 and stole employee and contractor data. 

Prudential Financial also revealed on Tuesday that this breach occurred on February 4. Despite Prudential's ongoing investigation of the incident, it has not been determined if the attackers also exfiltrated customer or client data, even though the incident is being assessed in its full scope and impact. With revenue expected to exceed $50 billion in 2023, this Fortune 500 company will rank second in the world for life insurance companies in the U.S. 

They employ more than 40,000 people around the world. As part of the State Department's announcement, rewards of up to $10 million are being offered for tips that could lead to the identification or location of ALPHV gang leaders. 

During the first four months of this gang's activity between November 2021 and March 2022, it was linked to more than 60 breaches around the world, and an additional $5 million reward was offered for information on individuals who were either involved or attempted to be involved in ALPHV ransomware attacks. 

Law enforcement agencies estimate that ALPHV will have received at least $300 million through ransom payments from over 1,000 victims by the end of September 2023, as per the law enforcement agency. The Prudential Financial Corporation (Prudential Financial) filed an 8-K form with the Financial Industry Regulatory Authority (FINRA) last week detailing the incident that occurred. 

Although the company is still investigating the incident, its latest findings were that no sensitive information concerning its customers or clients was compromised. More than 40,000 people work for Prudential every year, and as a result, the company has more than $50 billion in revenues each year, making it one of the world's largest financial services companies. 

As a result of the new information, which comes shortly after the U.S. Upon receiving information that could help identify or locate ALPHV leaders, the State Department offered up to $10 million, with an additional $5 million for information on those who participated (or attempted to participate) in the ALPHV ransomware attack, for information that could lead to that identification. 

One of the most popular and active ransomware groups, next to LockBit, or Cl0p, is ALPHV. It has made headlines across the globe for its activism and popularity. In the latter half of 2021, it became apparent that DarkSide and BlackMatter had merged, possibly after these two companies merged. ALPHV and its affiliates are believed to have extorted hundreds of millions of dollars from its victims during its lifetime.
Read more »
USA
Akira Ransomware Canada cyber attack Cyber Attacks Ransomware ransomware attacks USA

Akira Ransomware Unleashes Cyber Storm: Targets North American Companies

In the continually changing realm of cyber threats, organizations find themselves urgently needing to strengthen their cybersecurity measures to combat the increasing complexity of ransomware attacks. The focus is on Akira, a recently discovered ransomware family, highlighting a group of cyber adversaries armed with advanced tactics and led by highly skilled individuals. 

In a recent analysis of blockchain and source code data, the Akira ransomware has surged to prominence, rapidly establishing itself as one of the fastest-growing threats in the cyber landscape. This surge is attributed to its adept utilization of double extortion tactics, adoption of a ransomware-as-a-service (RaaS) distribution model, and the implementation of unique payment options. 

Who are the Targets? 

The Akira ransomware made its debut in March 2023, and its sights are set on companies in the United States and Canada. But what is really catching attention is its unique Tor leak site, which, as per Sophos' report, brings back vibes of "1980s green-screen consoles." Users need to type specific commands to navigate through this throwback-style interface. 

What is even more intriguing is that, despite sharing the same .akira file extension for encrypted files, the new Akira is nothing like its 2017 counterpart when it comes to the code under the hood. This twist highlights the ever-evolving nature of cyber threats, where old names come back with a new style and a fresh set of tricks. 

The Akira encryptor 

The Akira ransomware was found by MalwareHunterTeam, and they shared a part of it with BleepingComputer. When it starts working, Akira does something serious – it deletes Windows Shadow Volume Copies on the device. It uses a special command to do this: 

powershell.exe -Command "Get-WmiObject Win32_Shadowcopy | Remove-WmiObject" 
 
Furthermore, linkages between the Akira ransomware group and the now-defunct Conti ransomware gang have come to light, indicating a potential affiliation. Conti, renowned as one of the most notorious ransomware families in recent history, is believed to have evolved from the highly targeted Ryuk ransomware, marking a lineage of prolific cyber threats. The intricate connections between these ransomware entities underscore the evolving nature of cyber threats and the persistence of criminal organizations in adapting and expanding their malicious operations.
Read more »
water system security
Critical Infrastructure Cyber Threats cybersecurity posture Data Breach ransomware attacks Southern Water Veolia North America water supply water system security

Major Water Suppliers Hit by Ransomware Attacks

 

Recent ransomware attacks have impacted two major water supply systems in the United States and the United Kingdom, with Boston-based Veolia North America and England's Southern Water falling victim to cyber threats. In both instances, attackers have reportedly seized employee or customer data and are demanding ransom payments. Fortunately, neither organization has reported prolonged service disruptions due to encrypted files or folders, and no ransom payments have been disclosed.

Veolia North America, serving approximately 550 communities, acknowledged a ransomware incident affecting its Municipal Water division. The attack prompted the temporary shutdown of some software applications and systems, causing delays in online bill payment systems for customers. The company assured that no operational technology, including industrial control systems, was compromised. Digital forensics investigators were promptly engaged to investigate the intrusion, and affected individuals will be directly notified about the stolen personal information.

Similarly, Southern Water in the UK confirmed a ransomware attack by the Black Basta group but asserted that no data encryption occurred, and critical operations remained intact. The utility, serving 2.5 million water customers and over 4.7 million wastewater customers, is still evaluating the extent of potential data theft. The Black Basta group claimed to have stolen 750 gigabytes of data, including corporate documents and users' personal information. Southern Water emphasized that customer relationships and financial systems remained unaffected, and services continued without disruption.

These incidents come amid a broader surge in ransomware attacks, as highlighted in a report by British consultancy NCC Group, revealing an 84% increase in known ransomware attacks in 2023 compared to the previous year. The U.S. Cybersecurity and Infrastructure Security Agency recently released an incident response guide for the water and wastewater sector, emphasizing the potential cascading impacts of a compromise in critical infrastructure sectors.

The White House has been urging various critical infrastructure sectors to enhance their cybersecurity posture, with a focus on reviewing and improving defenses. The attacks also underscore the ongoing challenges in ensuring the cybersecurity of essential services, prompting organizations to remain vigilant and proactive in safeguarding their systems.
Read more »
ransomware attacks
Cyberattacks Cybersecurity LoanDepot malware Malware. Cybercrime Mortgage Loan ransomware attacks

Guardians of Finance: loanDepot Confronts Alleged Ransomware Offensive

 


Among the leading lenders in the United States, loanDepot has confirmed that the cyber incident it announced over the weekend was a ransomware attack that encrypted data. In the United States, LoanDepot is one of the biggest nonbank mortgage lenders. 

With over $140 billion in loan services and approximately 6,000 employees, this company is the largest nonbank loan broker. It was reported that customers were having issues when trying to access the loanDepot payment portal on Saturday, which prevented them from paying loans or contacting them. 

As a result of a cyberattack that disrupted the loan processing and telephone service of loanDepot, the U.S. retail mortgage lender is struggling to recover. A company filing on Monday with the Securities and Exchange Commission informed investors that data had been encrypted by a “third party” who broke into the company’s computer system by gaining access to it. 

As part of its efforts to contain the incident, certain unspecified systems had been shut down. A spokesperson for the Irvine, California-based firm said they had contacted law enforcement and were still determining the extent to which the attack could have an impact on their operation. 

According to BleepingComputer, this attack is the fifth-largest retail mortgage lender in the country and has been funding more than $275 billion in loans since it was founded in 2010. The company has been in business since 2010 and has more than 6,000 employees. 

As of 2022, it has generated a revenue of $1.8 billion. According to the company, during a cyberattack that took place in August 2022, an unknown number of customers' information was accessed. A loanDepot team of cybersecurity experts generated an investigation after discovering that a security breach had occurred, and they began notifying relevant agencies and regulators as soon as they became aware of the problem.

In the aftermath of the attack, the company informed its customers that automatic recurring payments would still be processed, but would take a while before they would appear in their account history. In any case, affected customers are advised to contact the call centre for assistance if they wish to make new payments through the servicing portal. 

New payments will not be possible through this portal. In contrast to what loanDepot states, which claims that the threat actors gained access to systems and encrypted files, ransomware gangs have been known to steal company and customer data as leverage when they attempt to pressure victims into paying a ransom to prevent them from making a payment in the first place. 

It is important to stay alert for potential phishing attacks and identity theft attempts because loanDepot holds sensitive customer data such as financial and bank account information. After a cyberattack targeted the company on August 20, 2022, loanDepot disclosed in May 2023 that the company had suffered a data breach as a result of the cyberattack. 

There was a cyberattack by a cybercriminal that resulted in a data breach that exposed the personal data of 14.7 million customers of the mortgage giant Mr Cooper in November 2023. A copy of the cyberattack that occurred before Christmas affected some of the systems of First American Financial Corporation (FAFC), which was one of the target companies in the U.S. title insurance industry. 

Fidelity National Financial was hit by a ransomware attack in November, which knocked the company down for more than a week due to a ransomware attack on one of the largest insurance providers in the United States. A December cyberattack claimed the identity of more than 14 million customers of the mortgage and loan company Mr Cooper.

It came in the wake of an attack in October that compromised the personal data of the company's customers. Cooper said that as a result of the incident the company was expected to have to incur more than $25 million in additional costs as a result of the incident, primarily because of the credit monitoring that it will have to do for its affected customers.
Read more »
Threat Landscape
cyber adversaries Cyber Security Data Privacy Information Sharing managed security services Network Protection ransomware attacks Security Awareness small business security Threat Landscape

Small Businesses Prime Targets for Cyberattacks: Key Signs & Defense Strategies

 

In the wake of prominent cyberattacks targeting major entities such as casinos, tech giants, and power grids, there is a common misconception that small and midsize businesses are less susceptible to such threats.
However, recent research conducted on over 2,000 enterprises in this category reveals alarming statistics. Approximately 52% of small and midsize businesses and 71% of midmarket firms experienced ransomware attacks in the past year. Additionally, 56% of small and midsize businesses and 88% of midmarket firms faced various other forms of cyberattacks.

Dismissing the assumption that cyber adversaries only target large corporations may lead to overlooking crucial signs indicating otherwise. Here are three indicators that your business might be on the radar of cyber adversaries:

1. Targeting Multiple Companies in the Same Industry:

Cyber threat actors strategically exploit their knowledge of specific industries to launch targeted attacks on entire classes of enterprises. This involves taking advantage of vulnerabilities in widely used software within a particular sector, such as file transfer applications in regional banks or credit unions. Other instances include targeting healthcare facilities relying on new online services and interconnected devices, as well as exploiting major online sales events in sectors like retail, travel, and hospitality.

2. Repetitive Attacks on the Same Company:
 
Businesses falling victim to ransomware attacks tend to fall into two categories: those that comply with the ransom demands and pay, and those that refuse. Once threat actors discern a company's willingness to pay, research indicates an 80% likelihood of a second attack, with the ransom amount typically escalating. This underscores the importance of understanding your environment and taking proactive measures to prevent recurring incidents.

3. Optimizing for Return on Investment:

 Cyber adversaries often prioritize smaller businesses due to the lower level of effort and risk involved. Smaller enterprises typically possess limited security resources, lower security awareness, and fewer security tools and processes. Notably, only 32% of employees in small and midsize businesses understand phishing, and merely 15% have received security awareness training. Threat actors exploit these vulnerabilities to operate stealthily within the network, causing more prolonged and damaging impacts.

Addressing cybersecurity concerns in today's complex threat landscape requires a proactive approach. Entrepreneurs and business leaders can take the following steps to mitigate risks:

1. Collaborate and Share Threat Intelligence: Coordinate with industry peers to prepare organizationally and technologically for potential attacks. Sharing experiences and lessons learned from compromises can enhance collective preparedness. Utilize Information Sharing and Analysis Centers to gather open-source intelligence and network protection insights.

2. Learn from Attacks and Stay Informed: Stay abreast of security research and advisories provided by vendors, analysts, and government organizations. Understanding the tactics, techniques, and procedures employed by threat actors enables businesses to fortify their defenses. Seek recommendations from peers and security partners on valuable information sources.

3. Implement Security Basics and Engage with Managed Security Service Providers: Focus on fundamental security measures such as patching, email security, secure domain name system configuration, and browser security. Consider working with managed security service providers to enhance visibility into your environment. Regular security awareness training for employees is essential to bolster the human side of cybersecurity.

Moreover, cyber adversaries may possess more information about your business than anticipated. However, by comprehending their tactics, implementing basic security measures, and fortifying your security posture, businesses can significantly reduce the risk of falling victim to cyber threats.
Read more »
Shimano
Canyon Bicycles Cyber Attacks Cybercime Cybersecurity LockBit ransomware attacks Shimano

Shimano's Cyber Siege: A Saga of Resistance Against Ransomware

 


Shimano Industries, a prominent Japanese multinational manufacturing company specializing in cycling components, fishing tackle, and rowing equipment, seems to have been hit by a massive data breach by the ransomware attacker LockBit, who has threatened to release confidential data, including information such as factory inspection results, lab tests and financial documents by 5 November if their demands are not met. 

The group stole 4.5 terabytes of sensitive company data.  The company had previously been involved in the production of golf supplies until 2005 and snowboarding gear until 2008. Situated in Sakai, Osaka Prefecture, the corporation operates with 32 consolidated and 11 unconsolidated subsidiaries. 

Its primary manufacturing facilities are strategically located in Kunshan (China), as well as in Malaysia and Singapore.  LockBit is a major international cybercrime group that uses malware to breach global corporations' security protocols and attempts to extort money in exchange. Its previous targets have included Royal Mail, with the British postal company's international services severely disrupted in January 2023 due to the attack. 

American aeroplane and missiles manufacturer Boeing is the latest victim of the group, with the company officially confirming the attack yesterday. Another major brand hit recently by a similar cybersecurity threat includes Canyon Bicycles. 

A victim who does not make a ransom payment within a few days will have their data posted on the dark web in addition to being threatened with posting their data on the dark web if a ransom payment is not made. 

Shimano Industries Ltd, a Japanese manufacturer of bicycle parts, was recently targeted by a ransomware attack that demanded payment of a ransom. Shimano was unwilling to pay the ransom and the blackmail gang offered to put stolen data online, which is what they did. Now the stolen data is probably widely available online. 

Escape Collective updated their report late last week and said, upon contacting an industry-leading cyber-security firm, it was said that the delay in publishing could be an indication that Shimano was in negotiations. This has been the case until recently.

Several attempts to contact LockBit itself via Sonar, a web messenger that can be used in the Tor darknet browser, have not been successful. In a recent report from LockBit, cybercriminals claim to have successfully penetrated the Japanese manufacturer's network and obtained access to several terabytes of data. It was announced by the attackers that Shimano would publish the stolen data after they ignored their ultimatum. 

The Russian ransomware group LockBit appears to have released much of the company data on its darknet page after the ransom has expired. The company has been releasing 4.5 terabytes of various company data. Now that LockBit has expired, much of the data has been released, however. Shimano did not respond to a request for comment on the matter. 

Experts have yet to clarify who made them. Several financial records and personal information, including financials of employees and customers, have been revealed to have been leaked in the current case. Drawings, diagrams, test evaluations, development material, etc., have also reportedly been reported to have been exposed, as well as contracts and non-disclosure agreements. 

Recently, the Russian-speaking ransomware gang LockBit caused a sensation by attacking the US aircraft manufacturer Boeing. They were one of the most active ransomware gangs at the time. Shimano has yet to release a statement regarding the attack, and it is also not mentioned on the Shimano homepage of any kind regarding the cyberattack. 

It seems that Shimano was hacked by hackers and that cash was not paid to them for this backdoor. It's also clear from the report that sensitive information was leaked. However, the company has not elaborated on its original statements following the hack. A Shimano spokesperson has been contacted by Cycling News and has replied to their inquiry by saying, "This is an internal matter at Shimano and is under investigation. 

For the time being, we cannot address the situation." According to the original ransom note issued by the LockBit group, the following threats were made: “If you do not pay the ransom, we will attack your company again in the future.” 

A researcher in cyber security at the University of Warwick, Dr Harjinder Lallie, explained to Cycling Weekly earlier this month that the leak may lead to intellectual property being transferred to competitors if it is not paid for.
Read more »
User Privacy
Automaker cyber attack Data Leak Personal Data ransomware attacks User Privacy

Private Data Of 185,000 Customers Stolen in AutoZone Cyber Attack

 

In May, a ransomware gang compromised AutoZone, the biggest automotive parts retailer in the United States. An intrusion into AutoZone's data storage took place in May of this year, exposing sensitive information of nearly 185,000 customers.

Hackers discovered vulnerabilities in the file transfer programme MOVEit, which led the ransomware gang Cl0p to claim responsibility for the attack. The State of Maine, British Airways, the Louisiana Department of Motor Vehicles, and the public school system in New York City are among the other organisations that are impacted.

The report estimates that the data leak affected at least 62 million people, and the overall financial damage is estimated to be around $12 billion. It was only last week that AutoZone notified the Maine Attorney General of the ransomware attack. Prior to patching any holes in its system, the company carried out its own investigation. 

"AutoZone became aware that an unauthorised third party exploited a vulnerability associated with MOVEit and exfiltrated certain data from an AutoZone system that supports the MOVEit application," reads the letter from AutoZone. The company claims that it is "not aware" of any incidents in which fraud was committed using a customer's personal information. 

However, AutoZone has stated that it will provide affected customers with a year of free credit monitoring software. This will allow them to monitor potential fraud and suspicious activity involving their identity and credit. Cl0p, according to BC, leaked the data it obtained from AutoZone. It contained sensitive information such as payroll documents, details about parts suppliers, and tax information. Affected companies are expected to pay the ransomware gang more than $75 million. 

Cyberattacks on the automotive industry are nothing new. Ferrari announced earlier this year that it had been the victim of a ransomware attack. Client data (including names, phone numbers, and addresses) had been leaked, according to an official release - not what you want to hear if you have a collection of exotics like the SF90. This could have been disastrous for Ferrari's affluent customers. Fortunately, details on owned or ordered cars had been kept private.
Read more »
Stolen Data
British Library Data Breach ransomware attacks Ransomware Gangs Rhysida Rhysida ransomware gang Stolen Data

British Library Staff Passports Leaked Online, Hackers Demand £600,000 Ransom


In a ransomware attack, the British Library staff passports have been leaked online, where the threat actors are demanding a ransom of £600,000 (to be paid in Bitcoin) in order to retrieve the stolen documents. 

The responsibility of the attack has been claimed by ransomware gang Rhysida. The group has listed the library as their victim over its darknet forum, where it has leaked the low resolution snippets of the stolen information. The gang is offering to auction the further information for 20 Bitcoin, or about £600,000, to the highest bidder.

As a result of the attacks, the library’s operations have been disrupted for weeks. The stolen data includes images of passport photos and HMRC employment records. 

In the darknet website, the listing for the British Library reads, “With just seven days on the clock, seize the opportunity to bid on exclusive, unique and impressive data. Open your wallets and be ready to buy exclusive data.”

The aforementioned listing appeared on the website on Monday, where the group has demanded the ransom to be paid till November 27.

In regards to this, Emisoft’s threat analyst, Brett Callow says that the data “auction” was effectively a “continuation of the extortion attempt” by the gang.

British Library Cyber Attack

The cyberattack on the British Library started in late October, where the attackers stole large chunks of the library’s website. 

Staff at the archive's St Pancras location have been compelled by the disruption to disable the public Wi-Fi and only accept cash payments for some transactions.

Staff at the archive's St Pancras location have been compelled by the disruption to disable the public Wi-Fi and only accept cash payments for some transactions.

The British Library released the following statement on Monday: "We are aware that some data has been exposed, after confirmation last week that this was a ransomware attack. It looks like these are from our own HR records.”

“We have no evidence that data of our users has been compromised.”

The National Cyber Security Centre (NCSC), which is affiliated with GCHQ, and the Metropolitan Police are collaborating with the library to strengthen its IT infrastructure and carry out a forensic examination.

Sir Roly Keating, chief executive of the British Library, said: “We are immensely grateful to our many users and partners who have shown such patience and support as we work to analyse the impact of this criminal attack and identify what we need to do to restore our online systems in a safe and sustainable manner.”  

Read more »
Royal Ransomware
Advisory BlackSuit BleepingComputer CISA Cyber Attacks FBI ransomware attacks Ransomware group Royal Ransomware

FBI and CISA Reveals: ‘Royal’ Ransomware Group Targeted 350 Victims for $275 Million


In a joint advisory, the FBI and CISA have revealed a network breach conducted by the ‘Royal ransomware gang’ that has targeted nearly 350 organizations globally since 2022. 

Giving further details of the original advisory published in March, in the information acquired during the FBI investigation, the agencies noted that the ransomware campaign was connected to ransom demands totalling more than $275 million.

"Since September 2022, Royal has targeted over 350 known victims worldwide and ransomware demands have exceeded 275 million USD," the advisory reads.

"Royal conducts data exfiltration and extortion prior to encryption and then publishes victim data to a leak site if a ransom is not paid. Phishing emails are among the most successful vectors for initial access by Royal threat actors."

In March, the two agencies shared their initial indicators of an apparent compromise, along with a list of tactics, methods, and procedures (TTPs), in order to assist defenders in identifying and thwarting attempts to deploy Royal ransomware payloads onto their networks.

The Department of Health and Human Services (HHS) security team discovered in December 2022 that the ransomware operation was responsible for several attacks against U.S. healthcare organizations. This led to the release of the joint advisory.

Royal to BlackSuit

The advisory update also states that BlackSuit ransomware shares several coding traits with Royal, suggesting that Royal may be planning a rebranding campaign and/or a spinoff variation.

While it was anticipated that the Royal ransomware operation would rebrand in May, during the course of the BlackSuit ransomware operation, the rebranding never happened. 

According to a report published by BleepingCompter in June, the Royal ransomware gang was apparently testing a new BlackSuit encryptor, similar to the operation’s conventional encryptor. 

At the time, Partner and Head of Research and Development at RedSense – Yelisey Bohuslavskiy believed that this experiment did not in fact go well.

However, since then, Royal was able to rebrand into BlackSuit and restructure into a more centralized business, following the same blueprint as Team 2 (Conti2) when they were a member of the Conti syndicate.

"In September 2023, Royal accomplished a full rebrand into BlackSuit, most likely entirely dismantling their Royal infrastructure. Moreover, according to the primary source intel, Royal has also accomplished a broader reorganization during the rebrand, making the group structure more corporate and more similar to their Conti2 origins," said Yelisey Bohuslavskiy.  

Read more »
ransomware attacks
Cyberattacks Cybersecurity Google malware Microsoft ransomware attacks

Worldwide Alliance: 50 Countries Join Forces Against Ransomware Attacks

 


The technology giant has launched a new initiative in response to six high-profile cyberattacks that exploited different aspects of Microsoft's security and cloud infrastructure in the past few years, which aimed to revamp the company's approach to software security in the wake of previous high-profile attacks. 

A key feature of Microsoft's new initiative is the company's plans to use Artificial Intelligence to help fend off sophisticated attacks from actors with state-backed backing - notably Microsoft Secure Copilot - which is one of the highlights of the initiative. 

As part of an international coalition of technology companies and law enforcement agencies, several organizations are appealing for a coordinated approach to the problem of ransomware. There were nearly 50 recommendations given by the Ransomware Task Force (RTF) to government authorities, along with representatives from Microsoft, Amazon, the FBI, and the UK's National Crime Agency. 

It was announced on Tuesday that the White House would be signing a pledge that 50 countries would sign pledging to never pay ransoms to cybercriminals to put a strain on their resources in the future. At the current time, almost half of ransomware attacks occur in the United States, which means that the International Counter Ransomware Initiative was formed at a time when the number of ransomware attacks is still on the rise globally. 

When a company's system is encrypted by ransomware, hackers demand payments in exchange for unlocking the system to prevent its data from being exposed. As a result, they are also often capable of stealing sensitive data and using it both to extort victims and leak it over their websites as soon as a payment is not made. 

If countries do not work together or work with one another, then they stand no chance of stopping these hackers from using the stolen information to attack other countries as well, which is why it is so important for countries to work together if they want to stand a chance of stopping their attacks. The 50 countries of the alliance include Albania, Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Colombia, Costa Rica, Croatia, the Czech Republic, the Dominican Republic, Egypt, Estonia, the European Union, France, Germany, Greece, India, INTERPOL, Ireland, Israel, Italy, Japan, Jordan, Kenya, Lithuania, Mexico, the Netherlands, New Zealand, Nigeria, Norway, Papua New Guinea, Poland, Portugal, the Republic of Korea, Romania, Rwanda, Sierra Leone, Singapore, Slovakia, South Africa, Spain, Sweden, Switzerland, Ukraine, the United Arab Emirates, the United Kingdom, the United States, and Uruguay. 

They are also joined by Interpol and the European Union according to the White House official. By the principles laid out in the charter of the alliance, cybercriminals cannot operate effectively without ransom payments. This document outlines that Lithuania will create a platform for information sharing, while Israel and the UAE will release one jointly. 

Ransomware attacks, which are initiated through a simple email in 69% of cases, primarily focus on vulnerable companies that have not adequately strengthened their security measures. These attacks can cause significant harm to businesses, often leading to employee layoffs in 40% of instances where a ransomware attack occurs. 

Organizations must be vigilant and take proactive steps to protect against such threats. For several years now, various cyber-security organizations have continuously made claims about the presence of openly operating ransomware gangs in North Korea, Iran, and Russia. These allegations have raised concerns about the extent to which these countries are involved in cybercrime activities. 

In a recent development, the US government took action by imposing sanctions on multiple Russian entities. This move was prompted by the belief that the Kremlin actively supports and utilizes criminal hackers, including the notorious Evil Corp, to carry out disruptive ransomware attacks. 

Furthermore, it has come to light that the US Department of Justice has established an internal team specifically dedicated to addressing the growing threat posed by ransomware attacks. This indicates the seriousness of the issue and the need for proactive measures to counter this escalating menace. 

In response to the increasing prevalence of cyber threats, a unified global coalition of 50 nations, consisting of prominent technology companies, law enforcement agencies, and government entities, has come together to tackle the growing challenges posed by ransomware and state-sponsored cyberattacks. This collaborative effort, which includes Microsoft's groundbreaking AI initiative, aligns seamlessly with the White House's firm commitment to abstain from making ransom payments, thereby demonstrating a united front in safeguarding against data breaches and upholding international security.

Furthermore, as part of its robust approach to combating ransomware activities, the US government has implemented targeted sanctions against entities involved in such malicious acts, while the Department of Justice has established a dedicated team with specialized expertise to counter this ever-evolving menace. This unwavering dedication to cybersecurity underscores the gravity of the situation and reinforces the collective resolve to address and mitigate these threats effectively.
Read more »
ransomware attacks
CCleaner Cyber Hackers Cyberattacks CyberCrime Data Breach MOVE-it ransomware attacks

CCleaner Data Privacy at Risk: MOVEit Mass-Hack Exposes User Information

 


It has come to light that the popular PC optimization app CCleaner has been compromised by hackers following a massive data breach associated with the MOVEit service. According to the company, there was no breach of sensitive data that could be compromised. 

There has been a massive amount of discussions going on on some of the CCleaner and Windows forums recently about a recent security breach that the company informed users about. A vulnerability was exploited by the hackers in the widely used MOVEit file transfer tool, which is used by thousands of organizations, including CCleaner, as a means to move large sets of sensitive data over the internet to obtain more information. 

Consequently, the hacker was able to gain access to the names and contact information of CCleaner's customers, as well as information about the products they had purchased. The software community forum claimed that one of the forum's admins responded that this was a scam email and that users should ignore it after a user inquired if CCleaner did send such emails in the software community forum. 

Several people contacted CCleaner, and the company got back to them and confirmed that it sent out emails to those who were affected. It was revealed to Cybernews that the company had suffered a breach that affected both employee data and some low-risk customer information. 

The multinational software company Gen Digital, which owns the brands of CCleaner, Avast, Norton LifeLock, and Avira, informed its customers in an email that the hackers exploited a vulnerability in their widely used file transfer tool MOVEit, which is used by thousands of organizations, including CCleaner, to transfer large amounts of sensitive data across the internet, including the MOVEit file transfer tool. 

It was claimed in an email that the hackers stole names, contact information, and information regarding the purchases made by the customers. Piriform Software, the company which developed CCleaner, is owned by cybersecurity company Avast. 

Over 2.5 billion downloads of this popular utility have been made by Piriform Software, a company that has been around since 2004. CCleaner has been compromised by a backdoor-installing Trojan horse since 2017. As a result of the backdoor in the software, attackers could have gained access to millions of devices. 

There has been much discussion about the target of the attack, but researchers believe that the primary targets were technology companies, including Samsung, Sony, Asus, and others. As a result of a zero-day bug in the MOVEit Transfer software earlier this year, the Clop ransomware cartel was able to access and download all data stored within the application.

There are millions of users of CCleaner around the world, but Gen Digital does not break down how many of its customers have paid for CCleaner. However, the company claims that its cybersecurity portfolio, including CCleaner, includes 65 million paid customers. 

There is no clear reason for CCleaner to have delayed disclosing the incident to affected customers for several months. Researchers at Emsisoft reported that more than 2,500 organizations, mostly in the United States, have been affected by MOVEit attacks from the Russia-linked ransomware cartel, with more than 66 million individuals affected. 

The impact of Clop attacks would add up to a staggering $10.7 billion if we take IBM's estimate, based on the estimated cost of a data breach at $165 per leaked record, and multiply it by the cost of a data breach per leaked record.
Read more »
Threat actors
Cyber Security Cyber Threats Cybersecurity Cybersecurity measures cybersecurity trends Data Breach Data protection malware Online Security ransomware attacks Threat actors

Report: September Sees Record Ransomware Attacks Surge

 

In September, a notable surge in ransomware attacks was recorded, as revealed by NCC Group's September Threat Pulse. Leak sites disclosed details of 514 victims, marking a significant 153% increase compared to the same period last year. This figure surpassed the previous high set in July 2023 at 502 attacks.

Among the fresh wave of threat actors, LostTrust emerged as the second most active group, accounting for 10% of all attacks with a total of 53. Another newcomer, RansomedVC, secured the fourth spot with 44 attacks, making up 9% of the total. LostTrust, believed to have formed in March of the same year, mirrors established threat actors' tactics of employing double extortion.

Notably, well-established threat actors remained active in September. Lockbit maintained its lead from August, while Clop's activity diminished, responsible for only three ransomware attacks in September.

In line with previous trends, North America remained the primary target for ransomware attacks, experiencing 258 incidents in September.

Europe followed as the second most targeted region with 155 attacks, trailed by Asia with 47. Nevertheless, there was a 3% rise in attacks on North America and a 2% increase on Europe, while Asia saw a 6% decrease from the previous month. This indicates a shifting focus of threat actors towards Western regions.

Industrials continued to bear the brunt of attacks, comprising 40% (19) of the total, followed by Consumer Cyclicals at 21% (10), and Healthcare at 15% (7). The sustained focus on Industrials is unsurprising, given the allure of Personally Identifiable Information (PII) and Intellectual Property (IP) for threat actors. 

The Healthcare sector witnessed a notable surge, experiencing 18 attacks, marking an 86% increase from August. This trend aligns with patterns observed earlier in the year, suggesting that August's dip was an anomaly. The pharmaceutical industry's susceptibility to ransomware attacks continues due to the potential financial impact.

The surge in ransomware attacks can be attributed in part to the emergence of new threat actors, notably RansomedVC. Operating similarly to established organizations like 8Base, RansomedVC also functions as a penetration testing entity. 

However, their approach to extortion incorporates compliance with Europe's General Data Protection Regulation (GDPR), pledging to report any vulnerabilities discovered in the target's network. This unique approach intensifies pressure on victims to meet ransom demands, as GDPR allows for fines of up to 4% of a victim's annual global turnover.

RansomedVC garnered attention by claiming responsibility for the attack on Sony, a major Japanese electronics company, on September 24th. In this incident, RansomedVC compromised the company's systems and offered to sell stolen data. This successful targeting of a global giant like Sony highlights the significant impact RansomedVC is exerting, indicating its continued activity in the months ahead.

Matt Hull, Global Head of Threat Intelligence at NCC Group, commented on the situation, noting that the surge in attacks in September was somewhat anticipated for this time of year. However, what sets this apart is the sheer volume of these attacks and the emergence of new threat actors playing a major role in this surge. Groups like LostTrust, Cactus, and RansomedVC stand out for their adaptive techniques, putting extra pressure on victims. 

The adoption of the double extortion model and the embrace of Ransomware as a Service (Raas) by these new threat actors signify an evolving landscape in global ransomware attacks. Hull predicts that other groups may explore similar methods in the coming months to increase pressure on victims.
Read more »
Sony Data Breach
Cyber Attacks Infection time LockBit Ransomware ransomware attacks Ransomware group Sony Data Breach

Time Taken by Ransomware to Infect Systems Witnesses a Significant Drop


The amount of time it will take for a threat actor to completely infect the targeted system with ransomware has decreased significantly over the past 12 months. 

According to a report published by The Register, the average dwell time — the interval between the start of an assault and the deployment of ransomware — was 5.5 days in 2021 and 4.5 days in 2022. The dwell duration was less than 24 hours last year, but less this year. Ransomware was even distributed within five hours after first access in 10% of cases, according to Secureworks' annual State of the Threat Report.

It is interesting to note that the cybersecurity industry has become much better at spotting the activity that occurs before a ransomware outbreak, which is one of the factors contributing to this dramatic decrease in infection time. Because of this, Secureworks explains, "threat actors are focusing on simpler and quicker to implement operations, rather than big, multi-site enterprise-wide encryption events that are significantly more complex."

Also, this year has witnessed a considerable increase in the number of ransomware victims and data leaks due to the significant emergence of "several new and very active threat groups." Attacks are therefore occurring more frequently and in greater numbers.

The ransomware groups are now majorly utilizing three vectors to try and infect targeted systems. The first is known as scan-and-exploit, which looks for exploitable flaws in a system. When detected, stolen credentials are also exploited, and phishing emails are used to try to deceive people into giving attackers access to secure systems quickly.

Currently, Sony is one of the most recent high-profile victims of ransomware gang, but the company did not yet reveal the extent to which its systems are affected or data stolen. Another ransomware attack was recently witnessed in a Danish cloud-hosting company that compromised most of its customer data. Furthermore, a case came to light when the LockBit ransomware gang stole data from 8.9 million dental insurance customers earlier this year. 

However, on a positive note, the FBI was able to take down the renowned Qakbot botnet, which was revealed to be in charge of 700,000 compromised machines and was utilized in numerous ransomware assaults.  

Read more »
ransomware attacks
Cyber Attacks data compromised MGM Casinos MGM Resorts ransomware attacks

MGM Resorts Refuse to Pay Ransom Following the Cyberattack


Cyberattack struck MGM Resorts have apparently refused the ransom demands made by the attackers.

According to a report by the Wall Street Journal, this decision was made late Thursday. On the same day, the company also published a regulatory filing, revealing further details of the breach.

MGM Resort Attack

MGM Resort is a premier hospitality and casino giant, that operates on a global scale with establishments in more than a dozen cities, including Las Vegas. Applications for internet betting are also available. The company's most recent fiscal year saw more than $13 billion in revenue.

In September, the company experienced a high-profile cyberattack, resulting in a disruption in its operations. Following the intrusion, there were protracted disruptions of the company's resorts' slot machines, ATMs, and other systems. Employees reportedly had to use pen and paper to check guests in.

In its Thursday regulatory filing, the company noted that the hackers had acquired the personal data of “some” customers, who had used its services before March 2019. This data included customers’ contact details, gender, dates of birth, and license numbers. A "limited" number of Social Security and passport numbers were also stolen by the hackers.

The company has not yet revealed the exact number of affected customers. However, they confirm that no bank details or payment card information has been compromised. Also, the hackers did not target the company’s Cosmopolitan of Las Vegas resort. 

As per the filing, hackers had stolen the private information of the company’s customers and claimed that the breach would cost them roughly $100 million. Less than a tenth of that amount was spent on costs related to fixing the breach. In its report, MGM Resorts revealed how little it spent on "remedial technology consulting, legal, and advisory services."

The company adds that to remediate the issue, it will cover the expenses with its cybersecurity insurance. But it did issue a warning that the "full scope of the costs and related impacts of this issue has not been determined."

The incident resulted in a drop in occupancy at MGM Resorts' Las Vegas properties, with occupancy reaching 88% in September as opposed to 93% a year earlier, according to the company's filing. MGM Resorts anticipates doing better this month, with internal forecasts predicting occupancy levels in October will reach 93%, which would represent a decline of only 1% from last year.

However, the company assures that it will have a financial boost in its fourth quarter, all because of the Formula One event scheduled next month in Las Vegas. MGM Resorts confirmed that they do not expect the breach to “have a material effect on its financial condition and results of operations for the year.”  

Read more »
victim statistics
Cyber Security Cyber Threats Data Extortion malware deployment ransomware attacks Secureworks threat report victim statistics

Cybercriminal Groups Unleashing Ransomware Within a Day of Target Breach

 

A recent threat report reveals a significant shift in cybercriminal tactics, indicating a noteworthy decline in the time it takes for them to deploy ransomware after initially infiltrating their targets. 

Last year's average of 4.5 days has now plummeted, with cybercriminals now striking within the first 24 hours of gaining access, according to findings by cybersecurity firm Secureworks. 

This alarming trend underscores the company's warning that 2023 may witness an unprecedented surge in ransomware attacks, with three times as many victims appearing on leak sites in May compared to the same period last year.

However, Secureworks highlights a caveat regarding leak sites as a metric for gauging the scale of the ransomware issue. Notably, the report emphasizes that leak sites may only represent around 10% of the total victims known to law enforcement. 

Consequently, it urges caution when interpreting leak site data. Despite this, the aggregate data undeniably underscores the enduring appeal of ransomware and data extortion as lucrative criminal enterprises, posing a substantial threat to businesses.

Secureworks further reveals a disturbing statistic: in over 50% of its incident response cases, hackers managed to unleash their malware within a mere 24 hours of infiltrating the victim's network. 

This marks a stark drop from the 4.5-day average observed last year. In 10% of cases, ransomware was deployed within a staggeringly short five-hour window from initial access.

Don Smith, VP Threat Intelligence at Secureworks Counter Threat Unit, sheds light on the driving force behind this reduction in dwell time. He posits that cybercriminals are motivated by a desire to minimize the chances of detection, as the cybersecurity industry has become more proficient at identifying precursors to ransomware attacks. 

Consequently, threat actors are shifting focus towards simpler and faster operations, forsaking larger-scale, complex encryption events that span multiple enterprise sites. However, the risk posed by these expedited attacks remains significantly high.

Smith adds a cautionary note, emphasizing that despite the prevalence of familiar threat actors, the emergence of new and highly active threat groups is contributing to a notable surge in both victims and data breaches. 

Even in the face of high-profile crackdowns and sanctions, cybercriminals exhibit a remarkable capacity for adaptation, ensuring that the threat continues to escalate at an alarming pace.
Read more »
Subscribe to: Posts (Atom)