Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label threat report. Show all posts
User Security
CrowdStrike outage Cyber Security Hospital System threat report User Security

Patient Care Technology Disruptions Linked With the CrowdStrike Outage, Study Finds

 

A little more than a year ago, nearly 8.5 million Windows-based IT systems went down due to a simple error made during a routine software update. Computers were unable to reboot for several hours due to a bug from CrowdStrike, a cybersecurity business whose products are used to detect and respond to security attacks. Many of the systems needed further manual patches, which prolonged the outage.

The estimated financial toll? Anywhere between $5 billion and $10 billion for Fortune 500 firms – and close to $2 billion for the healthcare sector specifically.

A new report reveals that the negative repercussions on healthcare organisations have gone far beyond financial. A study published in JAMA Network Open by the University of California San Diego found that the incident triggered measurable disruptions in a large proportion of US hospitals, including technical issues that impacted basic operations, research activities, and direct patient care. The researchers discovered that immediately following the CrowdStrike upgrade on July 19, 759 hospitals (out of 2232 with available data) had measurable service disruptions. That represents more than one-third of healthcare organisations.

Of a total of 1098 service outages across those organisations, 21.8% were patient-facing and had a direct impact on patient care. Just over 15% were relevant to health-care operations, with 5.3% affecting research activities. The remaining 57% were either not classified as significant or unknown. 

“Patient-facing services spanned imaging platforms, prehospital medicine health record systems, patient transfer portals, access to secure documentation, and staff portals for viewing patient details,” the researchers explained. “In addition to staff portals, we saw outages in patient access platforms across diverse hospital systems; these platforms, when operating as usual, allow patients to schedule appointments, contact health care practitioners, access laboratory results, and refill prescriptions.” 

Additionally, some hospitals experienced outages in laboratory information systems (LIS), behavioural health apps, and patient monitoring systems like foetal monitors and cardiac telemetry devices. Software in development or pre-deployment stages, informational pages, educational resources for medical and nursing students, or donation pages for institutions were primarily impacted by the outages classified as irrelevant or unknown.

3.9% of hospitals had outages longer than 48 hours, while the majority of hospital services returned within 6 hours. Outages lasting longer than two full days were most common in hospitals in South Carolina, Maryland, and New Jersey. With the majority of assessed hospitals returning to service within six hours, Southern US organizations—including those in Tennessee, North Carolina, Louisiana, Alabama, Texas, and Florida—were among the quickest to recover.

The incident served as a stark reminder that human error is and always will be a serious threat to even the most resilient-seeming technologies, while also highlighting the extraordinarily fragile nature of the modern, hyperconnected healthcare ecosystem. CrowdStrike criticised the UCSD research methods and findings, but it also acknowledged and apologised to its customers and other impacted parties for the disruption and promised to be focused on enhancing the resilience of its platform.
Read more »
User Privacy
Cyber Security Dark Web threat report Travel Agencies User Privacy

Trustwave Reveals Dark Web Travel Agencies' Secrets

 

Within the underground economy, dark web travel agencies have become one of the more sophisticated and profitable businesses. 

According to the Wall Street Journal's report on Trustwave's findings, these shady companies use credit card fraud, compromised loyalty program accounts, and fake identification documents to provide drastically reduced airfare, upscale hotel stays, rental cars, and full vacation packages. However, what some may consider to be inexpensive vacation packages are actually the last in a series of cybercrimes.

One of their main advantages is their flexibility; as soon as one channel is closed, another one opens up, often with better strategies and more extensive service offerings. The core of the issue is a robust, decentralised underground economy that views fraudulent travel as just another way to make money, rather than any one platform or provider. 

Credential theft campaigns, automation, and the development of AI tools only increase the accessibility and scalability of these services. Dark web travel firms will persist as long as there is a need for big travel bargains with no questions asked and as long as data breaches continue to generate profits. 

Potential red flags in the system 

For airlines, hotels, car rental services, and booking platforms, the symptoms of fraud perpetrated by dark web travel companies are often subtle at first, but if ignored, these indicators can swiftly develop into financial losses, reputation harm, and increased fraud risk exposure. Recognising early symptoms of carded bookings is critical for any organisation involved in the travel industry. 

One of the most prevalent red flags is a high-value or international booking made under a newly formed account, especially if it's linked with last-minute travel or same-day check-in. These are traditional methods to shorten the time frame for detecting or reversing fraud. 

  • Mismatched information is another crucial indicator. This includes discrepancies between the ID shown at check-in, the credit card name, and the booking name. In situations involving hotels and rental cars, a visitor may act evasively when asked for confirmation, appear unfamiliar with the booking details, or refuse to provide further proof. 
  • Loyalty-based bookings may show high or unexpected point redemptions, particularly from dormant accounts or those accessed from foreign IP addresses. Fraudsters frequently abuse these apps using previously compromised login credentials or phishing efforts. 
  • Finally, be wary of repeat bookings with similar names or patterns that come from different accounts. This could imply organised abuse, in which a dark web agency operates primarily through a specific travel platform or API.

Safety tips 

  • Monitor the Dark Web and Telegram Channels for Brand Abuse: Invest in threat intelligence tools or collaborate with cybersecurity firms that can detect unauthorised mentions of your company on underground forums, marketplaces, and encrypted messaging platforms.
  • Improve loyalty program security: Add MFA, transaction alerts, and geofencing to your loyalty accounts. These programs are commonly targeted since they make it easy to monetise miles and points for bookings. 
  • Review API Access and Third-Party Integrations: Dark web retailers frequently exploit flaws in booking APIs or third-party aggregators. Regularly check these systems for abuse patterns, access controls, and rate-limiting enforcement.
Read more »
User Security
Cyber Attacks keylogger Microsoft Exchange threat report User Security

Keylogger Injection Targets Microsoft Exchange Servers

 

Keylogging malware is a particularly dangerous as it is often designed to steal login passwords or other sensitive information from victims. When you add a compromised Exchange server to the mix, it makes things significantly worse for any organisation. 

Positive Technologies researchers recently published a new report on a keylogger-based campaign that targets organisations worldwide. The effort, which is identical to an attack uncovered in 2024, targets compromised Microsoft Exchange Server installations belonging to 65 victims in 26 nations. 

The attackers infiltrated Exchange servers by exploiting well-known security flaws or using completely novel techniques. After getting access, the hackers installed JavaScript keyloggers to intercept login credentials from the organization's Outlook on the Web page. 

OWA is the web version of Microsoft Outlook and is integrated into both the Exchange Server platform and the Exchange Online service within Microsoft 365. According to the report, the JavaScript keyloggers gave the attackers persistence on the compromised servers and went unnoticed for months.

The researchers uncovered various keyloggers and classified them into two types: those meant to save captured inputs to a file on a local server that could be accessed from the internet later, and those that transferred stolen credentials across the global network using DNS tunnels or Telegram bots. The files containing the logged data were properly labelled to help attackers identify the compromised organisation.

PT researchers explained that most of the affected Exchange systems were owned by government agencies. A number of other victims worked in industries like logistics, industry, and IT. The majority of infections were found in Taiwan, Vietnam, and Russia; nine infected companies were found in Russia alone. 

The researchers emphasised that a huge number of Exchange servers remain vulnerable to well-known security issues. The PT experts encouraged companies to regard security flaws as major issues and implement adequate vulnerability management strategies. 

Furthermore, organisations that use the Microsoft platform should implement up-to-date web applications and security measures to detect malicious network activities. It is also a good idea to analyse user authentication files on a regular basis for potentially malicious code.
Read more »
User Privacy
Mobile Security SMS Code threat report two-factor authentication User Privacy

Here's Why Using SMS Two-Factor Authentication Codes Is Risky

 

We've probably all received confirmation codes via text message when trying to enter into an account. These codes are intended to function as two-factor verification, confirming our identities and preventing cybercriminals from accessing our accounts solely through a password. But who handles the SMS codes, and can they be trusted? 

 New findings from Bloomberg and the collaborative investigative newsroom Lighthouse findings offer insight on how and why text-based codes might put people in danger. In their investigations, both organisations stated that they got at least a million data packets from a phone company whistleblower. Individual users got the packets, which contained SMS texts with two-factor authentication codes. 

You may believe that these messages are handled directly by the companies and websites with which you have an account. However, Bloomberg and Lighthouse's investigation suggests that this is not always the case. In this case, the messages went through a contentious Swiss company called Fink Telecom Services. And Bloomberg used the label "controversial" to describe Fink for a reason. 

"The company and its founder have worked with government spy agencies and surveillance industry contractors to surveil mobile phones and track user location. Cybersecurity researchers and investigative journalists have published reports alleging Fink's involvement in multiple instances of infiltrating private online accounts,” Bloomberg reported. 

Of course, Fink Telecom didn't exactly take that and other comments lying down. In a statement shared with ZDNET, Fink called out the article: "A simple reading of this article reveals that it presents neither new findings nor original research," Fink noted in its statement. "Rather, it is largely a near-verbatim repetition of earlier reports, supplemented by selective and out-of-context insinuations intended to create the appearance of a scandal-without providing any substantiated factual basis.”

Bloomberg and Lighthouse discovered that the senders included major tech companies including Google, Meta, and Amazon. Several European banks were also involved, as were applications like Tinder and Snapshot, the Binance cryptocurrency market, and even encrypted communication apps like Signal and WhatsApp. 

Why would businesses leave their two-factor authentication codes to an outside source, especially one with a questionable reputation? Convenience and money. External contractors can normally handle these types of SMS messages at a lower cost and with greater ease than enterprises themselves. That is especially true if a company has to interact with clients all around the world, which can be complicated and costly. 

Instead, firms turn to providers like Fink Telecom for access to "global titles." A global title is a network address that allows carriers to interact between countries. This makes it appear that a company is headquartered in the same country as any of its consumers. 

According to Lighthouse's investigation, Fink utilised worldwide titles in Namibia, Chechnya, the United Kingdom, and his native Switzerland. Though outsourcing such messages can be convenient, it carries risks. In April, UK phone regulator Ofcom banned global title leasing for UK carriers, citing the risk to mobile phone users. 

The key issue here is whether the data in the documents examined by Bloomberg and Lighthouse was ever at risk. In an interview with Bloomberg, Fink Telecom CEO Andreas Fink stated: "Our company offers infrastructure and technical services, such as signalling and routing capabilities. We do not analyse or meddle with the traffic sent by our clients or their downstream partners. 

Fink further shared the following statement with ZDNET: "Fink Telecom Services GmbH has always acted transparently and cooperatively with the authorities," Fink said. "Legal opinions and technical documentation confirm that the company's routing services are standardized, internationally regulated, and do not require authorization under Swiss telecommunications law, export control law, or sanctions legislation. Authorities were also informed that the company is in no way involved in any misuse of its services.”

In terms of outsourcing, Google, Meta, Signal, and Binance informed Bloomberg that they did not deal directly with Fink Telecom. Google also stated that it was discontinuing the use of SMS to authenticate accounts, although Signal stated that it provided solutions to SMS vulnerabilities. A Meta representative told Bloomberg that the company has warned its partners not to do business with Fink Telecom.
Read more »
threat report
Business Security Cyber Security HoneyWell ransomware attacks threat report

Ransomware Attacks Continue to Rise in an Alarming Trend

 

The frequency and intensity of cyberthreats seem to be increasing despite businesses' ongoing efforts to thwart malicious actors. Honeywell, a global technology and manufacturing firm that also provides cybersecurity solutions, reported a 46% rise in ransomware extortion attacks between October 1, 2024, and March 31, 2025, as compared to the previous six-month period. 

Win32.Worm.Ramnit, a Trojan that typically targets the banking sector to steal account details, was found in 37% of files blocked by Honeywell's SMX product. That represented a 3,000% rise from the second quarter of 2024, when Honeywell last reported on it. 

In its investigation report, Honeywell stated that "it can likely be assumed it has been repurposed to extract control system credentials" due to the Trojan's saturation presence in the ecosystems of its industrial clients. "Existing adversaries continue to disrupt operations across critical sectors, even in the absence of new ransomware variants specifically designed for industrial control systems." 

1,929 ransomware incidents were made public throughout the reporting period. Eight verticals accounted for the vast majority (71%) of the cases, with the industries most affected being manufacturing, construction, healthcare, and technology. 

Given that ransomware attacks are normally "more opportunistic, typically creating a normal distribution of attacks across different industries," Honeywell noted that this was a really unusual pattern. The report claims that supply chain disruptions, manual failovers, and forced production outages caused by ransomware have been experienced by manufacturing plants, water treatment facilities, and energy providers. 

In response to the elevated threats, during the reporting period, some organisations "doubled down on best practices that would be considered baseline," according to Honeywell. Such procedures include, for example, immutable data backups and regular vulnerability assessments. According to Honeywell, as of October 2024, victimised organisations had paid out more than $1 billion in ransomware. 

Another new cybersecurity report, from the Information Security Media Group, focused on artificial intelligence, which it described as the "defining force" of cybersecurity-related disruption. 

As businesses use AI to automate threat detection and scale response capabilities, "adversaries are using the same technologies to enhance phishing, generate polymorphic malware, and conduct identity fraud with unprecedented precision," according to the ISMG research. ISMG added that the combination of AI and quantum computing "further signals a critical shift requiring crypto-agility and forward planning.”
Read more »
User Privacy
Cloud Security Cyber Security data security threat report User Privacy

Data Security Posture Insights: Overcoming Complexity and Threat Landscape

 

In today's competitive landscape, it is becoming more critical for businesses to find ways to adapt their data security, governance, and risk management strategies to the volatile economy by increasing efficiency or lowering costs while maintaining the structure, consistency, and guidance required to manage cyber threats and ensure compliance. 

As organisations increasingly migrate various on-premises applications and data workloads to multicloud environments, the complexity and dispersed nature of cloud environments presents significant challenges in terms of managing vulnerabilities, controlling access, understanding risks, and protecting sensitive data.

What is data security risk? 

Data security refers to the process of preserving digital information from unauthorised access, corruption, or theft throughout its lifecycle. Risks are introduced into databases, file servers, data lakes, cloud repositories, and storage devices via all access channels to and from these systems. 

Most importantly, the data itself, whether in motion or at rest, deserves the same level of protection. When effectively executed, a data-centric approach will secure an organization's assets and data from cyberattacks while also guarding against insider threats and human error, which are still among the major causes of data breaches.

Complexity factor into data security risk 

Many variables contribute to organisational growth while also increasing security complexity. Complexity undermines operational stability and has an equivalent influence on security. Understanding and analysing all the causes of complexity allows organisations to develop focused initiatives and efficiently automate observability and control, fostering a lean and responsive operational team. 

Cloud Security Alliance's Understanding Data Security Risk 2025 Survey Report outlines major topics that organisations are actively addressing:

High growth with AI-driven innovation and security: As AI stimulates innovation, it also broadens the threat landscape. Rapid expansion frequently outpaces the creation of required infrastructures, processes, and procedures, resulting in ad hoc measures that add complexity. Gen-AI also introduces a new level of difficulty as it becomes more prominent in cloud environments, which remain a major target owing to their complexity and scale. 

Processes and automation: We understand that limited staff and inefficient or outdated processes frequently result in manual and redundant efforts. This places a significant load on teams that struggle to stay up, resulting in reactive stopgap or workaround actions. To summarise, manual efforts can be error-prone and time-consuming. At the same time, organisations may encounter unwanted bottlenecks, which can increase complexity and impede risk detection and security enforcement. Automate as much as possible, including data security and risk intelligence, to ensure that risks are managed proactively, reducing the escalation of critical occurrences. 

Technology integration: Although technology provides answers for efficiency and effectiveness, integrating several systems without careful planning can result in disjointed security process silos, ineffective security infrastructure, and mismatched security stack components. Fragmented visibility, control, and access enforcement are the unstated costs of fragmented tools. Even though they are crucial, traditional compliance and security systems frequently lack the integration and scalability required for contemporary and successful risk management. 

Proactive data security posture management 

To improve security posture, organisations are adopting proactive, risk-based solutions that include continuous monitoring, real-time risk assessments, and dynamic actionable workflows. This strategy allows for the detection and mitigation of flaws before they are exploited, resulting in a more strong defence against threats. 

According to the poll results, 36% prioritise assessment results, 34% believe a dedicated dashboard is most useful, and 34% want risk scores to better understand their organization's data risk. 

 onquering complexity necessitates a comprehensive approach that incorporates technology, best practices, and risk awareness. By prioritising data security throughout your cloud journey, you can keep your data safe, your apps running smoothly, and your business thriving in the ever-changing cloud landscape.
Read more »
User Security
Cyber Crime Hospital Devices Medical Tool threat report User Security

Hospital Equipments Can be Used as Murder Weapons, Swiss Experts Warn

 

Swiss specialists have issued a grave warning that cyber attackers could use hospital devices to commit murder. In an alarming new research from Zurich-based cybersecurity firm Scip AG, specialists showed how they were simply able to hijack medical devices in a major healthcare facility and exploit them remotely. 

Png pacemakers, insulin pumps, and painkiller drips can all be automatically converted into twisted weapons of assassination.

“We could have overdosed patients with lethal amounts of drugs within minutes,” said Marc Ruef, head of research at Scip. “And we even hacked the monitors to fake the vital signs so no one would know it had happened.”

One expert admitted to hacking his own pain pump during a hospital stay, simply out of boredom. But the situation is far more serious, as perpetrators might not only silently kill victims in their beds, but they could also hide their tracks by showing completely normal health indicators. This isn't the first red flag either. A German university warned last year that pacemakers might be a 'perfect target for assassination.’

Johannes Rundfeldt, a cybersecurity expert and spokesperson for the independent expert organisation AG Kritis, claimed that this even applies to really powerful people, like world leaders, who may be subtly removed using a heart-hacking device.

“These can involve individual attacks on individuals: heads of state, generals, ministers, or similar individuals.How would we even prove it?...A sudden cardiac arrest wouldn't raise suspicion – and hackers leave no fingerprints,” Rundfeldt stated.

Cyber attacks have recently crippled entire hospitals, not simply devices. In January, cybercriminals took down a clinic in Lower Saxony, western Germany, and demanded a ransom to restore equipment. The first instance of a patient's death being specifically connected to a cyberattack occurred in 2020. 

Prosecutors in Cologne stated that a female patient from Düsseldorf was set to receive critical care at Düsseldorf University Hospital in Germany when the September 9 attack disrupted systems. The ransomware attack struck the hospital at night, encrypting data and rendering computer systems inoperable. When Düsseldorf could no longer provide care, she was moved 30 kilometres away to another hospital for life-saving therapy. 

Ciaran Martin, former CEO of the UK's National Cyber Security Centre, stated at the time: "If confirmed, this tragedy would be the first known case of a death directly linked to a cyber-attack.”

“It is not surprising that the cause of this is a ransomware attack by criminals rather than an attack by a nation state or terrorists. Although the purpose of ransomware is to make money, it stops systems working. So if you attack a hospital, then things like this are likely to happen. There were a few near misses across Europe earlier in the year and this looks, sadly, like the worst might have come to pass.”
Read more »
threat report
2FA Cyber Attacks Phishing Campaign Roman Encryption threat report

Roman Encryption Employed In Nearly 9K Phishing Attacks

 

Unpredictability is a hallmark of cybersecurity work. I doubt you expected to read an article linking Julius Caesar, the ancient Roman ruler, to almost a million phishing attacks so far in 2025. But, here we are. The phishing threat continues to grow, motivated by the lure of disseminating infostealer malware and exemplified by more sophisticated efforts, as the FBI has warned. 

The majority of cybercriminals involved in phishing assaults are not malicious coding experts; rather, they are what you might refer to as low-level chancers, with little expertise but high aspirations for a lucrative payout. Phishing-as-a-service platforms, which eliminate the need for all that bothersome technical expertise, aid them in this evil undertaking. According to recently published research, Tycoon 2FA is the most popular of these platforms and that's where Julius Caesar comes in.

It should come as no surprise that phishing is a persistent menace to both consumers and organisations. These are no longer the simple "you've won the Canadian lottery" or "I'm a Nigerian Prince and want to give you money" hoaxes of the past, but, thanks to AI, they've become much more difficult to detect and, as a result, much tougher to resist. As previously stated, the use of phishing-as-a-service platforms to accelerate attack formulation and deployment is especially problematic. 

Barracuda Networks security researchers released a report on March 19 outlining a whopping one million attacks in January and February alone. This figure becomes even more concerning when you consider that one platform, Tycoon 2FA, accounted for 89% of them. 

Nuch of this seems to be recent, with an outbreak in the middle of February, according to Deerendra Prasad, an associate threat analyst in Barracuda Network's threat analyst team, who stated that an investigation "revealed that the platform has continued to develop and enhance its evasive mechanisms, becoming even harder to detect.”

The malicious scripts used to prevent defenders from analysing the phishing pages have been updated to help evade discovery, Prasad said. The new script is not in plain text, but—wait for it—encrypted using a shifting substitution cipher. Indeed, there is something called a Caesar Cipher. This works by replacing every plaintext letter in a string with another that is a specified number of letters down the alphabet. 

To be honest, it's about as simple as it gets, because decrypting such messages requires only the shift number. It is named after Julius Caesar, who was known to use encryption to keep his personal communication private while in transit. "This script is responsible for several processes," Prasad told me, "such as stealing user credentials and exfiltrating them to an attacker-controlled server.”
Read more »
Subscribe to: Posts (Atom)