News Items

The North Korean state-sponsored Lazarus hacking group is taking over Windows Internet Information Service (IIS) web servers to distribute malware. IIS is Microsoft's web server solution used to host websites or application services. ASEC's security analysts previously reported that Lazarus targeted IIS servers for initial access to corporate networks. The cybersecurity company now notes that the threat group also distributes malware via inadequately protected IIS services. The key advantage of this technique is the ease with which it can infect visitors to websites or users of services hosted on compromised IIS servers owned by reputable companies. In the recent attacks observed by ASEC's analysts, Lazarus compromised legitimate South Korean websites in order to conduct 'Watering Hole' attacks against visitors using a vulnerable version of INISAFE CrossWeb EX V6 software. This article continues to discuss the hijacking of IIS web servers by the Lazarus hacking group to distribute malware.

Bleeping Computer reports "Lazarus Hackers Hijack Microsoft IIS Servers to Spread Malware"

While the exact relationship between the Russian threat group KillNet and the Kremlin remains unclear, the group's high-profile and increasingly effective cyberattacks continue to align with Russian state interests. Its public relations campaign is luring cybercriminals and their skills into the operation. According to a new report by Mandiant, KillNet's media branding strategy is effective, helping to consolidate Russian hacker power under one organization. In addition to reflecting Kremlin interests following the invasion of Ukraine, there is little concrete evidence of coordination between KillNet and the Russian government, as other analysts have noted. In a climate rife with disinformation, it can be difficult to discern the truth, and the Mandiant report follows a UK warning about cybercrime mercenaries partnering up with governments to become state proxies. This article continues to discuss observations and findings regarding KillNet.

Dark Reading reports "KillNet's Kremlin Connection Unclear as the Cybercrime Collective Grows"

IBM, Google, and other companies are competing to build the world's fastest quantum computer, a device that could significantly change cryptography as we know it. For their safety and security, communications, banks, and cryptocurrencies rely on robust encryption. One way to measure the power of a quantum system is the number of qubits or quantum-mechanical elements entangled in superposition. Each additional qubit exponentially increases the quantum system's potential processing capacity. Recently, Google announced that its quantum computer has 70 operational qubits. In minutes, this system can complete a task that would take traditional supercomputers decades to accomplish. IBM plans to release 433-qubit quantum systems soon and unveil the world's first universal quantum computer with over 1,000 qubits this year. Quantum computers will provide numerous benefits to society. However, these rapid developments should cause cryptocurrency enthusiasts concern. This article continues to discuss the potential threat to Bitcoin posed by quantum computing advances.

Cybernews reports "Bitcoin Could Be in Danger as Quantum Computing Advances"

The US Department of Justice (DOJ) is merging its cryptocurrency and computer crimes investigation units, echoing the importance of digital assets in ransomware attacks and other cyberattacks. Principal Deputy Attorney General Nicole Argentieri recently announced the move in remarks delivered at the Center for Strategic and International Studies (CSIS). She stated that it is now evident to the cybercrime field that cryptocurrency work and cyber prosecutions are intertwined and will become even more so in the future. Argentieri noted that ransomware prevention is an "urgent priority" and that putting the National Cryptocurrency Enforcement Team (NCET) under the same roof as the Computer Crime and Intellectual Property Section (CCIPS) will better equip federal law enforcement officials to combat cyber threats. This decision is expected to significantly increase the number of federal prosecutors authorized to handle criminal cases involving cryptocurrencies. This article continues to discuss DOJ merging cyber and cryptocurrency units to fight ransomware attacks.

SC Magazine reports "DOJ Merges Cyber, Cryptocurrency Units to Go After Ransomware Attacks"

Recently it was discovered that the names, Social Security numbers, and information from driver's licenses or other identification of just over 40 million people who applied for T-Mobile credit were exposed in a recent data breach. The company stated that the same data for about 7.8 million current T-Mobile customers who pay monthly for phone service also appears to be compromised. T-Mobile noted that no phone numbers, account numbers, PINs, passwords, or financial information from the nearly 50 million records and accounts were compromised. T-Mobile has previously disclosed a number of data breaches over the years, most recently in January and before that in Nov. 2019 and Aug. 2018, all of which involved unauthorized access to customer information. It also disclosed a breach affecting its own employees' email accounts in 2020. And in 2015, hackers stole personal information belonging to about 15 million T-Mobile wireless customers and potential customers in the U.S., which they obtained from credit reporting agency Experian.

The Daily Gazette reports: "Data of 40 Million Plus Exposed in Latest T-Mobile Breach"

The TETRA standard is used globally in radios. According to security researchers, multiple vulnerabilities have been discovered in the fundamental cryptography and its implementation, including issues that enable the decryption of traffic. A group of cybersecurity researchers has discovered what they believe to be an intentional backdoor in the encrypted radios used by police, military, and critical infrastructure entities. They note that the backdoor may have existed for decades, potentially exposing a wealth of confidential information transmitted across them. While the researchers refer to their discovery as a backdoor, the organization responsible for maintaining the standard disputes this specific term, stating that the standard was designed for export controls that determine the encryption's strength. However, the result is radios with traffic that can be decrypted in under a minute using consumer hardware such as a laptop. This article continues to discuss the TETRA vulnerabilities.

Motherboard reports "Researchers Find 'Backdoor' in Encrypted Police and Military Radios"

Researchers have found what they say are the first open source software supply chain attacks that specifically target the banking sector. Checkmarx noted that these attacks exhibited sophisticated techniques, including targeting specific components in the victim bank's web assets by attaching malicious functionalities. In order to appear credible, the attackers created a fake LinkedIn profile and customized command-and-control (C2) centers for each target, exploiting legitimate services for malicious activities. The npm packages have been reported and taken down. In the first attack, the malware author posed as an employee of the target bank and uploaded packages to the npm registry in early April 2023. The modules included a preinstall script for activating the infection sequence. When launched, the script determined the host operating system and downloaded a second-stage malware from a remote server by using a subdomain on Azure that contained the name of the bank. Checkmarx researchers say the perpetrator used Azure's CDN subdomains to effectively deliver the second-stage payload. Due to Azure's status as a legitimate service, this tactic is clever as it circumvents traditional deny list methods. This article continues to discuss the open source software supply chain attacks targeting the banking sector.

THN reports "Banking Sector Targeted in Open-Source Software Supply Chain Attacks"

IBM published its annual Cost of a Data Breach Report, revealing that the global average data breach cost reached $4.45 million in 2023, a 15 percent increase over the previous three years. Detection and escalation costs increased by 42 percent during the same time, representing the largest portion of breach costs and signaling a shift toward more complex breach investigations. According to the report, business strategies regarding the rising cost and frequency of data breaches are diverse. The study found that although 95 percent of organizations studied have experienced multiple breaches, breached organizations are more likely to pass incident costs on to consumers (57 percent) than to increase security investments (51 percent). This article continues to discuss key findings from IBM's latest Cost of a Data Breach Report.

Help Net Security reports "Average Cost of a Data Breach Reaches $4.45 Million in 2023"

Purdue University has been selected as a partner in a new University Transportation Center (UTC) focused on cybersecurity and funded by the US Department of Transportation (DOT). The Transportation Cybersecurity and Resilience (TraCR) center, led by Clemson University, is the first national security center funded by the DOT. UTCs will help the next generation of transportation professionals improve the safety, innovativeness, and efficiency of roads, bridges, shipping, and more. TraCR will monitor and address cybersecurity vulnerabilities in Transportation Cyber-Physical-Social Systems (TCPSS). Researchers will identify challenges and threats across transportation modes, geographies, and applications, as well as develop cybersecurity strategies and solutions for multimodal transportation. They expect to develop software and hardware that will serve as the essential foundation for preventing and mitigating potential cyberattacks on transportation systems, such as data falsification and Global Positioning System (GPS) spoofing. This article continues to discuss Purdue University becoming part of the national research center aimed at bolstering transportation systems against cyberattacks and expected research.

Purdue University reports "Purdue Part of a National Research Center Aimed At Hardening Transportation Systems Against Cyberattacks"

There are various infiltration strategies adversaries can use to threaten the smart grid. For example, in a false-data injection attack, someone could hack into the grid's communication networks and replace actual measurements with false data. Denial-of-Service (DoS) attacks, in which threat actors flood the communication infrastructure with maliciously-generated data packets, are another technique in the cyber intruder's arsenal. Game theory involves mathematical models to simulate and analyze scenarios where the "players" in the game, in this case, the attackers and cyber defenders of the power grid, make a series of interdependent decisions as they execute and adapt their attack and defense strategies. Modeling attack jamming and defense anti-jamming as a zero-sum stochastic (probabilistic) game is part of the research at Purdue University. This article continues to discuss the use of game theory in defending the smart grid against attacks.

Purdue University reports "Game Theory Comes to the Defense of the Smart Grid"

Cybercriminals continue to look for new methods to manipulate search results. They are flooding Google with paid advertisements through malvertising campaigns, which direct unsuspecting users to malicious websites that exploit their data and trust. The cybersecurity company Sophos disclosed that hackers and fraudsters are paying to place malicious sites at the top of search results in the form of advertisements. This practice, known as malvertising, ensures visibility and typically targets users searching for popular downloads, such as software applications. Previous campaigns targeted users who searched for CCleaner, WinRAR, Notepad++, VLC, OBS, VirtualBox, Blender, or Capcut. Even searching for Adobe, Gimp, Slack, Tor, or Thunderbird may be risky, as malicious advertisements can infect a computer with Aurora Stealer, RedLine, Vidar, FormBook, and other stealers or trojans. The most recent paid advertisements often involve Artificial Intelligence (AI) tools such as Midjourney or ChatGPT. This article continues to discuss recent trends in malvertising.

Cybernews reports "First Search Result Leads to Malware: Crooks Now Paying for Ads"

According to researchers at NCC Group, ransomware attacks in June soared 221% year-on-year to hit a record 434 for the month. The researchers claimed that the figures were driven by Clop's targeting of global organizations via the MOVEit flaw, "consistently high levels" of activity by groups such as Lockbit 3.0, and the appearance of new groups since May. The researchers noted that Clop was responsible for a fifth (21%) of activity last month after it exploited SQL injection zero-day vulnerability CVE-2023-34362 in the popular managed file transfer software MOVEit. LockBit 3.0 accounted for 14% of ransomware attacks in the period, down 21% from the previous month. However, the group is still the most prolific of 2023 so far. The researchers stated that June also saw 8base, a new group first discovered in May, ramp up activity quickly. It was responsible for 40 attacks, 9% of the total recorded by the researchers. Two other groups spotted for the first time in May, Rhysida, and Darkrace, contributed 17 and nine attacks, respectively. The researchers stated that, unsurprisingly, North America once again contributed the most victims (51%), followed by Europe (27%) and Asia (9%). The most targeted sector in June was "industrials," which accounted for a third of victims, followed by "consumer cyclicals" (12%) and technology (11%).

Infosecurity reports: "Clop Drives Record Ransomware Activity in June"

The US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) sent a letter to 130 hospitals and telehealth providers highlighting the security and privacy risks posed by third-party tracking technologies. As previously reported, numerous healthcare data breaches have resulted from the presence of third-party tracking technology on hospital websites, which inadvertently transmitted sensitive data back to technology companies like Facebook and Google. A study published in Health Affairs found third-party tracking technology on 98.6 percent of US nonfederal acute care hospital websites. OCR has previously issued a bulletin regarding the appropriate use of tracking technology under the Health Insurance Portability and Accountability Act (HIPAA), and the FTC has settled high-profile cases with GoodRx and BetterHelp regarding their use of this technology. This article continues to discuss HHS and the FTC bringing further attention to the privacy and security risks of online tracking technologies.

HealthITSecurity reports "HHS, FTC Warn Hospitals and Telehealth Providers About Third-Party Tracking Tech"

Rutgers recently announced that it was among numerous universities across the nation that may have exposed the personal information of students and employees through vendors that use a particular file transfer software that was hacked by a Russian ransomware gang. In the case of Rutgers, the university was notified by the National Student Clearinghouse (NSC), a nonprofit that provides a range of higher education data and research services, of a cybersecurity issue involving NSC information, including data from the university. The NSC issue involves a vulnerability in a third-party software tool, MOVEit Transfer. The NSC determined that an unauthorized party obtained certain files transferred through the clearinghouse's MOVEit environment,' including files from customers. Rutgers noted that the incident was not a data breach of Rutgers' systems. School officials stated that, at this time, the impact on Rutger's information is unclear. The NSC works with 3,600 colleges and universities, including Rutgers, to gather student data required by the U.S. Department of Education. The breach affected multiple other universities, including Stony Brook University, Middlebury College, Rutgers University, Loyola University Chicago, Trinity College in Connecticut, Colorado State University, the University of Dayton, and the University of Alaska.

NJ Advanced Media reports: "Rutgers Among Universities Impacted by MOVEit Hack That Exposed Data"

According to GitHub, a social engineering campaign is attempting to infect the devices of developers in the blockchain, cryptocurrency, online gambling, and cybersecurity industries with malware. The campaign has been attributed to the North Korean state-sponsored Lazarus Group, also known as Jade Sleet and TraderTraitor. The hacking group is known for targeting cryptocurrency companies and researchers to conduct cyber espionage and steal cryptocurrency. In a new security alert, GitHub warns that Lazarus Group is impersonating developers and recruiters on GitHub and social media by compromising legitimate accounts or creating fake personas. These personas are used to initiate conversations with targets. After gaining the target's trust, the threat actors invite them to collaborate on a project and clone a GitHub repository themed around media players and cryptocurrency trading tools. However, according to GitHub, these projects use malicious NPM dependencies that download malware. This article continues to discuss Lazarus hackers targeting developers with malicious projects.

Bleeping Computer reports "GitHub Warns of Lazarus Hackers Targeting Devs With Malicious Projects"

According to Code42, life sciences companies, such as medical device manufacturers, biotechnology companies, and pharmaceutical companies, are experiencing increased insider-caused data loss. With this expanding threat, life sciences leaders increasingly prioritize effective modern data loss prevention strategies. While data loss from insiders, or insider risk, occurs in all industries, it is especially damaging for life sciences companies as they contain large amounts of sensitive data, including patient information, product designs, formulations, trial results, and manufacturing details. Therefore, it is essential to protect sensitive data from unauthorized access in order to maintain a competitive advantage and guarantee uninterrupted business operations. Nearly 70 percent of respondents in the life sciences sector have observed an increase in data loss incidents caused by insiders over the past year, and they expect an even greater increase over the next 12 months. Seventy-eight percent of CISOs in the life sciences industry have a program dedicated to insider risk or threats, indicating that they recognize the issue's urgency. This article continues to discuss key findings regarding data exposure in the life sciences sector.

Help Net Security reports "Life Sciences Leaders Act to Counter Insider-Driven Data Loss"

Two years ago, ransomware criminals breached the hardware manufacturer Gigabyte and released over 112 GB of data, including information from Intel and AMD, two of its most important supply chain partners. Researchers now warn that the leaked information exposed critical zero-day vulnerabilities that could threaten much of the computing world. The vulnerabilities exist within the firmware AMI makes for Baseboard Management Controllers (BMCs). BMCs enable cloud centers and sometimes their customers to streamline the remote management of vast fleets of computers. They allow administrators to remotely reinstall operating systems, install and deactivate applications, and more. Researchers from the security company Eclypsium analyzed the leaked AMI firmware from the 2021 ransomware attack and discovered vulnerabilities that had remained dormant for years. They can be exploited by any local or remote adversary with access to the industry-standard remote management interface Redfish to execute malicious code that will run on every server inside a data center. This article continues to discuss the new AMI BMC vulnerabilities.

Ars Technica reports "Firmware Vulnerabilities in Millions of Computers Could Give Hackers Superuser Status"

On July 5, 2023, Phoenician Medical Center, Inc. and its affiliates, Phoenix Neurological & Pain Institute and Laser Surgery Center (collectively, "PMC"), filed a notice of data breach with the U.S. Department of Health and Human Services Office for Civil Rights after discovering that an unauthorized party accessed and potentially stole patient data. According to PMC, on March 31, they learned of a data security incident after some of the company's systems experienced disruption.

On July 19, 2023, Tampa General Hospital ("TGH") recently announced that the personal information of about 1.2 million Tampa General Hospital patients was leaked in a recent cyberattack. On May 31, 2023, TGH detected suspicious activity within its computer systems. In response, TGH notified the FBI, contained the incident, and then launched an investigation with the assistance of third-party data security specialists. The TGH investigation confirmed that an unauthorized third party accessed TGH's network and obtained certain files from its systems between May 12, 2023, and May 30, 2023. After learning that sensitive consumer data was accessible to an unauthorized party, TGH reviewed the compromised files to determine what information was leaked and which consumers were impacted. While the breached information varies depending on the individual, it may include an individual's name, Social Security number, address, phone number, date of birth, health insurance information, medical record number, patient account number, dates of service, and treatment information. On July 19, 2023, Tampa General sent out data breach letters to anyone who was affected by the recent data security incident.

JD Supra reports: "Tampa General Hospital To Notify 1.2 Million Patients of Recent Data Breach"

According to experts on energy infrastructure, the US power grid is facing many escalating cybersecurity risks and threats from foreign adversaries and domestic extremists. The latest annual threat assessment from the Intelligence Community identifies Chinese cyber operations against the US homeland as a significant national security threat. It warns that Beijing can almost certainly launch cyberattacks capable of disrupting national critical infrastructure services, such as the power grid. In recent months, domestic extremists have been charged with plotting to attack energy facilities and power infrastructure across the country. Bruce Walker, former assistant secretary for the US Department of Energy's (DOE) Office of Electricity, testified before the House Energy and Commerce subcommittee on oversight and investigations that the most important evolving threat to the electric grid is related to cybersecurity and physical security. He called for increased public-private collaboration. This article continues to discuss the power grid facing heightened cyber threats from foreign adversaries and domestic extremist groups that can pose significant consequences for the nation's electricity supply.

NextGov reports "US Power Grid Faces Escalating Cyber Threats, Infrastructure Experts Warn"

Kevin Mitnick, a hacker who famously served time in prison for various computer and communications-related crimes, has died after a battle with pancreatic cancer. He was 59. Mitnick gained global fame in the mid-1990s when the FBI arrested him on computer hacking and wire fraud charges. After a plea deal, he was sentenced to prison, and would later write books, and was considered "world's most famous hacker ever." At the time of his death, Mitnick worked as a security evangelist and "Chief Hacking Officer" at KnowBe4, a security awareness training company based in Florida.

SecurityWeek reports: "Famed Hacker Kevin Mitnick Dead at 59"

Researchers have discovered a vulnerability in the secure networking suite OpenSSH, tracked as CVE-2023-38408, that would enable hackers to remotely execute code using simple commands. Exploiting the vulnerability involves the helper program in OpenSSH called ssh-agent, which stores a user's private keys for frequent, often automated SSH public key authentication. Administrators managing remote servers often enable 'ssh-agent forwarding,' which allows the ssh-agent to be accessed from a specified server so that local SSH keys can be used without storing keys on the server itself. According to Qualys researchers, when a forwarded agent is set up using default settings, with PKCS11 enabled, a threat actor with a connection to the same remote server can load and unload shared libraries on a victim's machine with malicious side effects. Security researchers were able to use this technique for one-shot, Remote Code Execution (RCE) by combining only four side effects of loading and unloading common shared libraries. This article continues to discuss the potential exploitation and impact of the OpenSSH vulnerability.

ITPro reports "OpenSSH Vulnerability Uncovered by Researchers, RCE Exploit Developed"

According to security researchers at Endor Labs, open source is playing a growing role across the AI technology stack, but most (52%) projects reference known vulnerable dependencies in their manifest files. The researchers claimed that just five months after its release, ChatGPT's API is used in 900 npm and PyPI packages across "diverse problem domains," with 70% of these brand new packages. The researchers warned that, as for any open source projects, the security risks associated with vulnerable dependencies must be managed. The researchers stated that, unfortunately, organizations appear to be underestimating the risk not only of AI APIs in open source dependencies but security sensitive APIs in general. Over half (55%) of applications have calls to security sensitive APIs in their code base, which rises to 95% when dependencies are included. The researchers also warned that large language model (LLM) technology like ChatGPT is poor at scoring the malware potential of suspicious code snippets. It found that OpenAI GPT 3.5 had a precision rate of just 3.4%, while Vertex AI text-bison performed a little better, at 7.9%. The researchers noted that both models produced a significant number of false positives, which would require manual review efforts and prevent automated notification to the respective package repository to trigger a package removal. The researchers also found during their research that developers may be wasting their time remediating vulnerabilities in code which isn't even used in their applications. The researchers found that 71% of typical Java application code is from open source components but that apps use only 12% of imported code. The researchers noted that vulnerabilities in unused code are rarely exploitable and that organizations can eliminate or de-prioritize up to 60% of remediation work with reliable insight into which code is reachable throughout an application.

Infosecurity reports: "Half of AI Open Source Projects Reference Buggy Packages"

After facing criticism following a recent espionage attack campaign aimed at its email infrastructure, Microsoft has announced that it will expand cloud logging capabilities to help organizations investigate cybersecurity incidents and gain more visibility. The company noted that the change directly responds to the increasing frequency and evolution of cyber threats from nation-states. The rollout is expected to begin in September 2023 for all government and commercial customers. Microsoft will provide its customers access to wider cloud security logs at no additional cost. The US Cybersecurity and Infrastructure Security Agency (CISA) applauded the action, emphasizing that having access to key logging data is essential for quickly mitigating cyber intrusions and that this is a major step forward in advancing security by design principles. The development follows disclosures that a China-based threat actor named Storm-0558 compromised 25 organizations by exploiting a validation error in the Microsoft Exchange environment. This article continues to discuss Microsoft expanding cloud logging capabilities, what prompted this move, and the response to this decision.

THN reports "Microsoft Expands Cloud Logging to Counter Rising Nation-State Cyber Threats"