News Items

  • news

    Visible to the public "Pro-Ukrainian DoS Attack Compromises Docker Engine Honeypots to Target Russian, Belarusian Websites"

    Cybersecurity researchers from CrowdStrike have detected a Denial-of-Service (DoS) attack that has been compromising Docker Engine honeypots to take down Russian and Belarusian websites amid the Russia-Ukraine war. The researchers discovered that the honeypots were compromised four times between February 27 and March 1, 2022, with two different Docker images sharing target lists that overlap with domains shared by the Ukraine government-backed IT Army. Therefore, the attacks are believed to be linked to pro-Ukrainian activity against Russia. CrowdStrike warns of the risk of retaliatory activity by threat actors supporting the Russian Federation against organizations being used to carry out disruptive attacks against government, military, and civilian websites. According to the researchers, the honeypots were compromised through an exposed Docker Engine Application Programming Interface (API). This technique is commonly used by campaigns such as LemonDuck and WatchDog to infect misconfigured container engines. One of the Docker images used in the attack was observed in most of the incidents and is hosted on Docker Hub. It has been downloaded more than 100,000 times, but the number of downloads from compromised infrastructure has not been assessed. The Docker image consists of a Go-based HTTP benchmarking tool that uses HTTP-based requests to stress-test a website. Government, military, media, and retail websites have been targeted. This article continues to discuss CrowdStrike's detection of a DoS attack compromising Docker Engine honeypots to target Russian and Belarusian websites.

    CSO Online reports "Pro-Ukrainian DoS Attack Compromises Docker Engine Honeypots to Target Russian, Belarusian Websites"

  • news

    Visible to the public "Cisco Issues Fresh Warning Over Counterfeit Switches"

    Cisco has recently issued a "field notice" to advise customers of its Catalyst 2960X/2960XR switches to upgrade the IOS software on their devices to ensure that they are not counterfeit. Counterfeiters often replicate Cisco equipment due to their popularity, but these devices can introduce security vulnerabilities, and the networking giant says they can cause "severe damage" to an organization's network. The company stated that counterfeit devices do not use Cisco hardware, but they still need to run genuine Cisco firmware, and the vendor has several mechanisms in place to detect device counterfeiting. Cisco noted that to detect and mitigate device counterfeiting and malicious attacks on hardware and software, Cisco uses Hardware Trust Anchor, Secure Unique Device Identifier (SUDI), digitally signed software images, secure boot, and other multilayered security approaches to verify the authenticity and integrity of their solutions. These trustworthy technologies run automated checks of hardware and software integrity and can shut down the boot process if a compromise is detected. The company is advising customers using the Catalyst 2960X/2960XR switches to upgrade the IOS software to version 15.2(7)E4 or later to enable the SUDI verification. Cisco noted that this should be done before the devices are added to the network to validate their authenticity. Cisco stated that the illicit grey market for Cisco's gear carries significant risk for customers who buy unauthorized secondhand, third-party, or even stolen networking gear. Cisco's 2960X/2960XR switches have been a flagship product for many years and subsequently have been diverted into the grey market. The company noted that, in addition to introducing security risks, counterfeit devices do not have a valid software license, don't come with a warranty, and are not eligible for certain support plans. Cisco also shared information on how counterfeit devices can be identified and provided detailed instructions for validating the SUDI feature on switches.

    SecurityWeek reports: "Cisco Issues Fresh Warning Over Counterfeit Switches"

  • news

    Visible to the public "Ransomware Attack Closes Michigan College"

    Kellogg Community College is located in Michigan and has closed its campuses and canceled classes after falling victim to a cyberattack. Kellogg Community College serves approximately 7000 students annually and was targeted with ransomware on Friday. The college announced the cancellation of all Monday and Tuesday classes and the closure of its five campuses in Battle Creek, Albion, Coldwater, and Hastings because of the attack. The college said its campuses would remain closed while the security incident was under investigation and "until they can reopen safely." The college also stated that it is implementing a "forced password reset for all students, faculty, and staff" to improve the cybersecurity of its network. The college noted that they are still working to understand the full extent of this incident, and they have been working diligently with their IRT team.

    Infosecurity reports: "Ransomware Attack Closes Michigan College"

  • news

    Visible to the public "Phishers Exploit Google's SMTP Relay Service to Deliver Spoofed Emails"

    Researchers have observed phishers exploiting a flaw contained by Google's SMTP relay service to deliver malicious emails that spoof popular brands. There has been a significant surge in SMTP relay service exploit attacks in the wild since April 2022. Organizations use Google's SMTP relay service to perform activities such as sending out promotional messages to a large number of users without running the risk of their email server getting blocklisted. However, the relay service has a vulnerability that could allow any Gmail tenant to spoof another tenant, meaning a hacker can use the service to spoof legitimate brands and distribute phishing and malware campaigns. Since Gmail's SMTP relay servers are generally trusted, and recipients see a legitimate-looking email address in the "From:" field, email security solutions are bypassed. Users could notice something is wrong only by checking the headers of the messages. According to Avanan researcher Jeremy Fuchs, this brand impersonation technique only works if the impersonated company has not enabled its DMARC reject policy. DMARC is a DNS-based authentication standard that protects organizations against impersonation attacks by preventing malicious spoofed emails from reaching targets. This article continues to discuss the exploitation of Google's SMTP relay service to deliver spoofed emails, Google's response to this discovery, and the importance of enforcing the DMARC reject policy.

    Help Net Security reports "Phishers Exploit Google's SMTP Relay Service to Deliver Spoofed Emails"

  • news

    Visible to the public "Many IoT Devices Exposed to Attacks Due to Unpatched Flaw in uClibc Library"

    Nozomi Networks, a firm specialized in securing operational technology (OT) and IoT systems, has recently disclosed a potentially severe vulnerability affecting a C standard library used by several major companies. The affected library is uClibc, which is designed for developing embedded Linux systems. According to the official uClibc website, the library is used by Linksys and Netgear for their wireless routers and by Axis for its network cameras. uClibc-ng is a fork for the OpenWRT router operating system and is also impacted by the vulnerability. The security hole, tracked as CVE-2022-05-02, can be exploited for DNS poisoning attacks against affected devices. The researchers stated that there is no patch for the vulnerability, but its disclosure will hopefully lead to the development of a fix. The vulnerability was discovered by Nozomi researchers last year, but the developer initially appeared unresponsive. The developer finally responded in March, saying that they could not fix the vulnerability on their own and asked that it be publicly disclosed in hopes that the community could help address it. Since a patch has yet to be released, Nozomi has not disclosed the names of any impacted products but described them as a "range of well-known IoT devices running the latest firmware versions with a high chance of them being deployed throughout all critical infrastructure."

    SecurityWeek reports: "Many IoT Devices Exposed to Attacks Due to Unpatched Flaw in uClibc Library"

  • news

    Visible to the public "SwRI Develops Cyber Security Intrusion Detection System for Industrial Control Systems"

    Researchers at the Southwest Research Institute (SwRI) have developed an Intrusion Detection System (IDS) for Industrial Control Systems (ICS). The technology aims to help government and industry improve the detection of cyber threats to industrial networks in critical infrastructure. The research behind the IDS was funded by SwRI to address emerging cyber threats faced in the continuously changing industrial automation ecosystem. The team applied algorithms to scan for cyber threats across network protocols that transmit industrial control data for natural gas pipelines, manufacturing robots, and more, which led to the development of the IDS for ICS. Ian R. Meinzen, a SwRI intelligent machines engineer who worked on the project, noted that the design of ICS historically did not consider security as there was the benefit of having an air gap to enable ICS to operate securely without a connection to IT networks. However, it is no longer an option to unplug industrial networks from IT networks for modern automation systems that depend on Internet of Things (IoT) devices to transmit large amounts of data. Connecting IoT devices and other hardware leaves industrial networks vulnerable. Malicious actors could launch attacks via a vulnerable IoT device, network protocols, and outdated software. The SwRI team focused their research on scanning for cyberattacks over the Modbus/TCP protocol, which utilities and industry have used in Supervisory Controls and Data Acquisition (SCADA) systems equipment for decades. The algorithms they developed were applied in testing the recognition of normal Modbus/TCP traffic and identifying cyberattack vectors, such as data fuzzing/manipulation, address probing, and out-of-band timing. Their algorithms classify data packets as "regular" if they originate from an uncompromised industrial control device or "attack" if the source is an unexpected or compromised device. This article continues to discuss SwRI's research and development of the IDS system for ICS.

    SwRI reports "SwRI Develops Cyber Security Intrusion Detection System for Industrial Control Systems"

  • news

    Visible to the public "Newly Discovered Black Basta Ransomware Could be Associated With Conti Gang"

    At least a dozen firms have been targeted by a new ransomware operation called Black Basta, which is suspected to be linked to the Conti gang. The threat actors behind Black Basta attempt to take large amounts of data from infected systems to further pressure victims into paying the demanded ransom. A technical investigation of Black Basta ransomware conducted by the cybersecurity firm Minerva reveals that it requires administrator credentials to operate. According to researchers, the malware maintains endurance on infected systems by manipulating the Windows Fax service. The Black Basta organization's website revealed the names of firms it has hit that refused to pay, including the American Dental Association and the German wind turbine manufacturer Deutsche Windtechnik. MalwareHunterTeam researchers say the Black Basta ransomware gang must be related to Conti based on observed similarities between their leak sites, payment sites, and how their support workers speak and behave. This article continues to discuss recent findings surrounding the Black Basta ransomware operation, its suspected link to the infamous Conti gang, and the surge in Conti ransomware activity in past weeks.

    CyberIntelMag reports "Newly Discovered Black Basta Ransomware Could be Associated With Conti Gang"

  • news

    Visible to the public "Open-Source Security: It's Too Easy to Upload 'Devastating' Malicious Packages, Warns Google"

    Google has been working on finding malicious code packages sneaked into open source software projects. The Open Source Security Foundation's (OpenSSF) Package Analysis Project aims to help automate the process of identifying malicious packages distributed on popular package repositories, such as PyPI for Python and npm for JavaScript. The initiative will provide data pertaining to different types of malicious packages and help inform those who work on open source software on how to improve the security of the software supply chain. Package repositories have limited resources to review the large number of daily updates but must maintain an open model in which anyone can contribute. Caleb Brown of Google's Open Source Security Team emphasizes that this has resulted in regular uploads of malicious packages to popular repositories, which could sometimes have devastating consequences for users. The Package Analysis project identified over 200 malicious packages in one month. It discovered token theft attacks targeting Discord users that were distributed on PyPI and npm. A malicious PyPI package, for example, attacked the Discord Windows client through a backdoor downloaded from GitHub and installed on the Discord app to steal Discord tokens. In March, researchers found that developers using Microsoft's Azure cloud were being targeted with hundreds of malicious packages on npm. This article continues to discuss the goals of the Package Analysis Project, the risks of software supply chain security in open source, and other efforts made to bolster supply chain security.

    ZDNet reports "Open-Source Security: It's Too Easy to Upload 'Devastating' Malicious Packages, Warns Google"

  • news

    Visible to the public "SolarWinds Hackers Set Up Phony Media Outlets To Trick Targets"

    Nobelium, the Russian hacking group behind the SolarWinds hack, is setting up new infrastructure to launch attacks using old tricks, researchers at Recorded Future found. The researchers stated that the group has evolved in recent months in an effort to avoid detection. The researchers identified more than four dozen domains the group used in phishing attacks, some of which attempted to emulate real brands. The researchers noted that the tactic in which hackers register potentially misspelled versions of real brand domains to trick targets is known as "typosquatting." Typosquatting is a common tool associated with Nobelium and has been used by the group in other campaigns, including recent attacks against Ukrainian targets. The set of domains that the researchers identified emulated brands across industries but particularly focused on posing as news and media organizations. Nobelium, also known as APT29 or CozyBear, is believed to have ties with the Russian Foreign Intelligence Service. Microsoft researchers recently spotted Nobelium attempting to phish diplomats from Ukraine and NATO members.

    CyberScoop reports: "SolarWinds Hackers Set Up Phony Media Outlets To Trick Targets"

  • news

    Visible to the public "Mental Health and Prayer Apps Fail the Privacy Test"

    Security researchers at Mozilla have discovered that over 90% of mental wellness and prayer apps contain serious privacy issues, while many others raise cybersecurity concerns. The researchers found that 29 out of the 32 apps analyzed did not pass Mozilla's privacy requirements, while 25 out of 32 did not meet its Minimum Security Standards, which cover things like encryption, security updates, strong passwords, and vulnerability management. The researchers reported that many of the apps routinely share sensitive data, allow weak passwords, target vulnerable users with personalized ads, and feature poorly written privacy policies. The six worst offenders on the list featured "incredibly vague and messy privacy policies," shared personal information with third parties, and/or collected chat transcripts. The researchers also noted that only one out of all the app developers they analyzed responded to their questions promptly, despite the app developers being sent requests for more information three times. At least eight apps allowed weak passwords ranging from "1" to "11111111," Mozilla claimed. Only two out of the 32 apps made it into the "best of" category: PTSD Coach, an app created by the US Department of Veterans Affairs, and AI chatbot Wysa.

    Infosecurity reports: "Mental Health and Prayer Apps Fail the Privacy Test"

  • news

    Visible to the public "Scientific Advance Leads to a New Tool in the Fight Against Hackers"

    Quantum mathematicians at the University of Copenhagen have made an advancement towards a new form of security identification that could help protect data from hackers and cybercriminals. They were able to solve a mathematical riddle, which enables the use of a person's geographical location as a personal ID. This ID is said to be secure against cyberattacks, including the most advanced ones. The researchers used the laws of quantum physics to develop a new security protocol that uses a person's geographical location to ensure they are communicating with the correct person. It is called position-based quantum encryption and can be used to guarantee that a person is communicating with an actual bank representative when the bank calls and asks a customer to make changes to their account. The researchers' approach to securing a person's location involves combining the information in a single quantum bit (qubit) and classical bits. Both types of bits are required to send a message that cybercriminals cannot read, hack, or manipulate. Both types are also needed to confirm if a person is at a bank's office or in some faraway country. The qubit serves as a lock on the message because of the role of Heisenberg's Uncertainty Principle in quantum physics that causes quantum information to be disrupted and unable to be decoded when trying to measure it. The researchers say their new method is useful because it only needs one quantum bit for position verification. Unlike other quantum technologies, this new advancement can be applied today as suitable quantum sources that can send a qubit of light already exist. This article continues to discuss the single-qubit position verification protocol that is secure against multi-qubit attacks and why this method could soon be a reality.

    The University of Copenhagen reports "Scientific Advance Leads to a New Tool in the Fight Against Hackers"

  • news

    Visible to the public "One of the Most Powerful DDoSes Ever Targets Cryptocurrency Platform"

    Cloudflare has blocked one of the largest Distributed Denial-of-Service (DDoS) attacks ever recorded. According to Cloudflare, the attack bombarded a cryptocurrency platform with 15.3 million requests. DDoS attacks are measured in different ways, including by the volume of data, the number of packets, or the number of requests sent each second. The current records are 3.4 terabits per second for volumetric DDoS attacks, 809 million packets per second, and 17.2 million requests per second. Although the massive DDoS attack recently mitigated by Cloudflare is still smaller than the record, its power was more significant as the attack was delivered via HTTPS requests instead of HTTP requests. HTTPS requests are more compute-heavy than HTTP requests. Therefore, the latest attack could have put more strain on the targeted platform. The resources used to deliver the HTTPS requests were also greater, thus showing that DDoS attackers are growing more powerful. Cloudflare revealed that the attack came from 112 countries, including Indonesia, Russia, Brazil, India, Columbia, and the US. Within these countries, the attack originated from more than 1,300 different networks, with the flood of traffic mainly coming from data centers such as the German provider Hetzner Online GmbH (Autonomous System Number 24940), Azteca Comunicaciones Colombia (ASN 262186), and OVH in France (ASN 16276). This article continues to discuss Cloudflare's recent mitigation of a massive DDoS attack on a cryptocurrency platform.

    Ars Technica reports "One of the Most Powerful DDoSes Ever Targets Cryptocurrency Platform"

  • news

    Visible to the public "Cyberespionage APT Now Identified as Three Separate Actors"

    The threat group known as TA410 has been found to be composed of three groups, each of which has its own toolsets and targets. The threat group, which has launched sophisticated cyberespionage attacks against US utilities, has been in operation globally since 2018. TA410 is loosely linked to APT10, a group associated with China's Ministry of State Security. According to researchers at the security firm ESET, the group has also targeted diplomatic organizations in the Middle East and Africa. Although TA410 seems to have been active since 2018, it came to researchers' attention in 2019 when Proofpoint discovered a phishing campaign targeting US utilities sector companies that involved the use of a novel malware dubbed LookBack. A year later, the threat group reemerged with a sophisticated Remote Access Trojan (RAT) called FlowCloud targeting Windows systems in the US utilities sector. FlowCloud is capable of accessing installed applications as well as controlling the keyboard, mouse, screen, and more, on an infected computer. ESET researchers have discovered that FlowingFrog, LookingFrog, and JollyFrog make up TA410. The subgroups have overlaps in tactics, techniques, and procedures (TTPs), victimology, and infrastructure. They primarily target government or education organizations. This article continues to discuss the identification of TA410 as three separate groups and key findings surrounding each of the subgroups.

    Threatpost reports "Cyberespionage APT Now Identified as Three Separate Actors"

  • news

    Visible to the public "15 Most Exploited Vulnerabilities of 2021"

    Recently the U.S. Cybersecurity and Infrastructure Security Agency (CISA), U.S. National Security Agency (NSA), U.S. Federal Bureau of Investigation (FBI), Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), New Zealand National Cyber Security Centre (NZ NCSC), and United Kingdom's National Cyber Security Centre (NCSC-UK), published a joint advisory on the 15 Common Vulnerabilities and Exposures (CVEs) most routinely exploited by malicious cyber actors in 2021. This list has three vulnerabilities that were routinely exploited in 2020: CVE-2020-1472, CVE-2018-13379, and CVE-2019-11510. Their continued exploitation in 2021 indicates that many organizations fail to patch software in a timely manner and remain vulnerable to malicious cyber actors. The advisory notes that to mitigate the risks of falling victim to attacks that exploit such vulnerabilities, the advisory urged organizations to implement vulnerability and configuration management, identity and access management, and protective controls and architecture.

    The 15 most targeted vulnerabilities of 2021 were:

    1. CVE-2021-44228 (Log4Shell): Remote code execution (RCE) vulnerability in Apache Log4j
    2. CVE-2021-40539: RCE vulnerability in Zoho ManageEngine AD SelfService Plus
    3. CVE-2021-34523 (ProxyShell): Elevation of privilege vulnerability in Microsoft Exchange Server
    4. CVE-2021-34473 (ProxyShell): RCE vulnerability in Microsoft Exchange Server
    5. CVE-2021-31207 (ProxyShell): Security feature bypass in Microsoft Exchange Server
    6. CVE-2021-27065 (ProxyLogon): RCE vulnerability in Microsoft Exchange Server
    7. CVE-2021-26858 (ProxyLogon): RCE vulnerability in Microsoft Exchange Server
    8. CVE-2021-26857 (ProxyLogon): RCE vulnerability in Microsoft Exchange Server
    9. CVE-2021-26855 (ProxyLogon): RCE vulnerability in Microsoft Exchange Server
    10. CVE-2021-26084: Arbitrary code execution vulnerability in Atlassian Confluence Server and Data Center
    11. CVE-2021-21972: RCE vulnerability in VMware vSphere Client
    12. CVE-2020-1472 (ZeroLogon): Elevation of privilege vulnerability in Microsoft Netlogon Remote Protocol (MS-NRPC)
    13. CVE-2020-0688: RCE vulnerability in Microsoft Exchange Server
    14. CVE-2019-11510: Arbitrary file reading vulnerability in Pulse Secure Pulse Connect Secure
    15. CVE-2018-13379: Path traversal vulnerability in Fortinet FortiOS and FortiProxy

    CSO reports: "15 Most Exploited Vulnerabilities of 2021"

  • news

    Visible to the public "Smile Brands Breach Impacts 2.5 Million Individuals"

    The number of individuals affected by a data breach at one of the largest providers of dental support services in the United States has increased to more than 2.5 million. Smile Brands initially disclosed a data security incident involving ransomware in June 2021. The company became aware of a ransomware attack affecting some of its computer systems on April 24, 2021. An investigation into the incident determined that an unauthorized third party had acquired certain protected health information (PHI). Data compromised in the incident included patients' names, addresses, telephone numbers, Social Security numbers, dates of birth, health insurance information and/or diagnosis information. Smile Brands' report to the United States Department of Health and Human Services, made in June 2021, indicated that 1200 patients were notified of the data breach. That number was later revised to 199,683 individuals. In the most recent update, supplied to the Maine Attorney General's Office on April 12, 2022, the total number of individuals affected by the breach was 2,592,494. In the most recent version of Smile Brands' data breach notice, recipients are warned that an unauthorized third party may have acquired their "personal financial information" and "government-issued identification number."

    Infosecurity reports: "Smile Brands Breach Impacts 2.5 Million Individuals"

  • news

    Visible to the public "Coca-Cola Investigates Data Breach Claim"

    Coca-Cola is investigating claims made by the Russian-linked cybercrime gang Stormus of a large-scale data breach. The ransomware group posted on its website this week that it had successfully hacked the servers of the soft drinks giant and stolen 161GB of data. It also offered the data for sale for more than $64,000, or 1.6467 bitcoin. Stormous did not specify the type of data it stole. Coca-Cola is now investigating Stormous' claim and has informed law enforcement about the alleged incident. In a statement, Coca-Cola communications vice president Scot Leith stated that they are aware of this matter and are investigating to determine the claim's validity. Currently, it is unclear whether the alleged hack was partly motivated by Coca-Cola's decision to close its operations in Russia entirely following the Kremlin's invasion of Ukraine. Shortly after the conflict began, Stormous issued its full support for Russia's actions. The group previously posted a poll on Telegram asking users which company it would most like them to attack. Coca-Cola came out on top, receiving 72% of the votes cast.

    Infosecurity reports: "Coca-Cola Investigates Data Breach Claim"

  • news

    Visible to the public "The Risks Of Attacks That Involve Poisoning Training Data For Machine Learning Models"

    Machine Learning (ML) algorithms can leak information contained by the data used to train them using their model parameters and predictions. Therefore, it is possible for malicious users with general access to the algorithm to reconstruct and infer sensitive information included in the training dataset. Through this, they can steal information ranging from demographic data to bank account numbers. A team of researchers from Google, the National University of Singapore, Yale-NUS College, and Oregon State University recently evaluated the risks of these types of attacks that poison ML models to reconstruct the sensitive information hidden within their parameters or predictions. Their paper covers the nature of these attacks and how they can evade existing cryptographic privacy tools. The team specifically focused on implementing ML algorithms in a secure multi-party setting. In these cases, a combination of data independently provided by different individuals, developers, or other parties is used to train the ML model. They showed that a malicious party could significantly increase information leakage about other parties' data by adding adversarial data and poisoning the pool of training data. A malicious user can prompt a training algorithm to memorize data provided by other parties by poisoning the training data, which in turn, could allow them to reconstruct their victim's data using a series of inference attacks. The researchers evaluated the effectiveness and threat level of three different types of inference attacks, combined with the poisoning of training data. In addition to membership inference attacks, the team analyzed the effectiveness of reconstruction attacks and attribute inference attacks, which enable adversaries to partially reconstruct the training data. This article continues to discuss the study on attacks involving poisoning data for ML models.

    News Update UK reports "The Risks Of Attacks That Involve Poisoning Training Data For Machine Learning Models"

  • news

    Visible to the public "New Bumblebee Malware Loader in Active Development"

    Three threat groups have been observed delivering a new sophisticated malware loader dubbed Bumblebee. According to researchers with Proofpoint, the loader, written in C++, is in active development and applies complex detection evasion techniques. The loader aims to download and execute additional payloads. It has been observed dropping Cobalt Strike, shellcode, and Sliver in several different campaigns. An analysis conducted by the researchers reveals that Bumblebee contains anti-virtualization checks and a unique implementation of common downloader capabilities even though it is early in development. The threat actors seen using the loader had previously delivered the BazaLoader and IcedID malware. One of the groups is TA578, which has been executing email-based campaigns since at least May 2020 to deliver Ursnif, IcedID, and BazaLoader. TA579 is another one of the threat actors that has delivered BazaLoader and IcedID since at least August 2021. The actors leveraging Bumblebee could be initial access facilitators that compromise targets and then sell that access to follow-on threat actors. Attacks in which Bumblebee was deployed include email campaigns involving malicious ISO files or thread hijacking. For example, one campaign involved DocuSign-branded emails attempting to trick targets into downloading a malicious ISO file hosted on OneDrive through a hyperlink in the email or an HTML attachment that then redirected targets, which led to the execution of the downloader. The downloader collects system information, including the hostname and UUID, and then establishes communication with the command-and-control (C2) server to receive commands. This article continues to discuss key observations surrounding the Bumblebee malware loader.

    Decipher reports "New Bumblebee Malware Loader in Active Development"

  • news

    Visible to the public "AI, Machine Learning to Help Defend Against Cyberattacks"

    Artificial Intelligence (AI) and Machine Learning (ML) are two tools helping cybersecurity professionals deal with the growing volume of threats and cyberattacks. Cybersecurity professionals are using AI and ML to detect new malware, fraudulent credit card charges, fraudulent network login attempts, and more. These tools are also being used to block phishing messages on email services and help companies with cloud management detect anomalies that traditional cyber defense technologies may not detect. Although AI and ML security methods are still in their infancy, they have been proven to be useful in helping analysts find vulnerabilities in large datasets. However, some cybercriminals are using some of the same advanced tools, such as AI and ML, to carry out cyberattacks. Amanda Fennell, an information technology and cybersecurity expert in Tulane University's School of Professional Advancement, has talked about how institutions are using AI and ML for data and system protection, and how hackers are using these tools against them. This article continues to discuss the use of AI and ML to help cybersecurity professionals defend against cyberattacks, how hackers are using these same tools, and Fennell's thoughts on AI showing promise for security.

    Homeland Security News Wire reports "AI, Machine Learning to Help Defend Against Cyberattacks"

  • news

    Visible to the public "Can Your Mobile Phone Get a Virus? Yes – And You'll Have To Look Carefully To See the Signs"

    Smartphones have become an increasingly attractive target for hackers as their use and the dependence on them continue to grow. Nearly 84 percent of the world's population now owns a smartphone, and there were 3.5 million detected malicious attacks on mobile users in 2021. Over one-fifth of mobile devices have encountered malware and four in ten mobile phones worldwide are vulnerable to cyberattacks. Just like personal computers, phones can get infected with malware. For example, ten million Android devices were infected with the Hummingbad virus in 2016, putting about 85 million devices at risk. A phone virus typically works the same as a computer virus as it involves infecting a device, replicating itself, and spreading to other devices via automated messages to others in a victim's contact list or auto-forwarding as an email. Malware can disrupt a phone's functionality, transmit personal information to hackers, send malware-linked spam messages to contacts, capture keyboard inputs, and more. In Australia, there were 16,000 reports of the Flubot virus over eight weeks in 2021. The Flubot virus sent text messages to Android and iPhone users with links that led to a malicious app being downloaded, which gave scammers access to victims' personal information. Although Apple devices are generally considered more secure than Android devices, and are less vulnerable to virus attacks, iPhone users who jailbreak or modify their phone could open themselves up to attacks. Android users who install apps from third-party app stores increase their risk of installing malware. All phone users should watch out for signs of malware infection, which include poor performance, random crashes, excessive battery drain, increased mobile data consumption, unexplained billing charges, unusual pop-ups, and unexpected device overheating. This article continues to discuss notable phone viruses, differences in security between Apple and Android devices, signs for infection on a mobile device, how phone users could prevent further damage by a virus, and how to protect phones from malware infection.

    The Conversation reports "Can Your Mobile Phone Get a Virus? Yes - And You'll Have To Look Carefully To See the Signs"

  • news

    Visible to the public "Ransomware Demands Are Growing, but Life Is Getting Tougher for Malware Gangs"

    According to cybersecurity researchers at Sophos, the average ransom payment made by ransomware attack victims has increased to $812,260, which is a significant increase compared to the 2020 average of $170,000. The proportion of victims who give in to paying ransoms of over $1 million also increased to 11 percent in 2021 from 4 percent in 2020. An analysis conducted by Sophos finds that ransomware victims who pay the demanded ransom consider it to be the fastest way to restore their network despite the decryption keys provided by the cybercriminals not being trustworthy. Security experts believe that paying a ransom may only motivate the malicious actors to target the same victim again. Ransomware attacks remain successful because there are still common cybersecurity vulnerabilities that cybercriminals can exploit to infiltrate networks and deploy ransomware. Ransomware remains a major cybersecurity problem, but there are signs that the situation could get better. Chester Wisniewski, the principal research scientist at Sophos, highlights efforts being made by the US Homeland Security Department's Cybersecurity and Infrastructure Security Agency (CISA) and the UK National Cyber Security Centre (NCSC) to provide accessible and meaningful advice on how to bolster cybersecurity against such attacks. He also points out the demand for better security preparations from companies by cyber insurance providers before issuing policies. This article continues to discuss the increase in the average ransom payment made by ransomware attack victims and improved efforts to prevent ransomware attacks.

    ZDNet reports "Ransomware Demands Are Growing, but Life Is Getting Tougher for Malware Gangs"

  • news

    Visible to the public "Over 300,000 Internet-Exposed Databases Identified in 2021"

    Group-IB discovered over 91,000 publicly-exposed databases in the first quarter of 2022, which is significantly more than that of 2021. In 2021, the cybersecurity firm identified a total of 308,000 exposed databases, with over 165,000 discovered in the second half of the year. Most of the publicly-exposed databases were found to be using the Redis database management system, followed by MongoDB and Elastic. Group-IB emphasizes that improperly inventoried Internet-facing assets such as databases could be abused in the launch of cyberattacks, which could lead to costly data breaches. Last year, IBM discovered that the average cost of a data breach exceeded $4.2 million during the pandemic, a 10 percent increase from the previous year. In addition, the average time to identify and address a data breach had also increased to 287 days. Although the number of exposed databases has increased, the average amount of time it takes for a database owner to fix the issue is still the same as a year ago, at 170 days. This article continues to discuss the increase in the number of exposed databases, the potential impact of such exposure, and how to improve database security.

    Security Week reports "Over 300,000 Internet-Exposed Databases Identified in 2021"

  • news

    Visible to the public Pub Crawl #61


    Pub_Crawl_web.jpgPub Crawl summarizes, by hard problems, sets of publications that have been peer reviewed and presented at SoS conferences or referenced in current work. The topics are chosen for their usefulness for current researchers.

  • news

    Visible to the public "North Korean Hackers Targeting Journalists with Novel Malware"

    Ricochet Chollima is a North Korean state-sponsored hacking group, also known as APT37, that has been targeting journalists covering the country. The group has been delivering a novel malware strain called Goldbackdoor to journalists through phishing attacks. The phishing emails came from the account belonging to the former director of South Korea's National Intelligence Service (NIS), who APT37 previously compromised. The campaign goes through a two-stage infection process, giving the threat actors more deployment versatility and making it difficult for analysts to sample payloads. The emails sent to journalists include a link to download ZIP archives containing LNK files, both named after Kang Min-chol, North Korea's Minister of Mining Industries. The LNK file (Windows shortcut) uses a document icon to disguise itself. It also uses padding to artificially increase its size to 282.7 MB, thus preventing easy uploads to Virus Total and other online detection tools. When executed, a PowerShell script is launched, and a decoy document is opened for distraction as a second script is decoded in the background. The decoy document has an embedded external image hosted on the Heroku platform that alerts the threat actors when the document is viewed. The second script downloads and executes a shellcode payload called Fantasy, stored on Microsoft OneDrive, which is unlikely to generate AV alerts. According to malware experts at Stairwell, Fantasy is the first of two Goldbackdoor deploying mechanisms, both of which rely on stealthy process injection. This article continues to discuss the APT37 hacking group's targeting of journalists with Goldbackdoor malware.

    Bleeping Computer reports "North Korean Hackers Targeting Journalists with Novel Malware"

  • news

    Visible to the public "Report: Four Cybercrime Statistics To Watch"

    The security platform Atlas VP recently released a report highlighting different types of cybercrime that intensified over the past year. Romance scams made a bigger impact than ever before as they cost Americans nearly $350 million in 2021. This type of scam involves tricking a person into believing they are in a romantic relationship with someone they have met online when in actuality, the person on the other side is a cybercriminal looking to get money or financial information. According to the Federal Trade Commission (FTC), romance scams were found to be more effective on those between the ages of 60 and 69. The FTC reported that over a third of people who lost money due to an online romance scam in 2021 said it was initiated on Facebook or Instagram. The report also reveals that US military personnel were prime targets for fraudsters as this group lost about $822 million from 2017 through 2021 to various forms of digital crime. In addition, the report suggests blockchain hackers are escalating their attempts at stealing cryptocurrency despite the number of security upgrades that have been made to the technology. During the first quarter of 2022, blockchain hackers stole almost $1.3 billion, attacking many cryptocurrency projects and ecosystems. This article continues to discuss key findings shared in the report regarding the rise of different types of cybercrime.

    NextGov reports "Report: Four Cybercrime Statistics To Watch"

  • news

    Visible to the public SoS Musings #60 - Nature-Inspired Cybersecurity Enhancements

    SoS Musings #60 -

    Nature-Inspired Cybersecurity Enhancements

  • news

    Visible to the public Cyber Scene #67 - What in the World Is Going On?

    Cyber Scene #67 -

    What in the World Is Going On?

  • news

    Visible to the public Spotlight on Lablet Research #29 - Analytics for Cyber-Physical Systems Cybersecurity (archived)

    Spotlight on Lablet Research #29 -

    Analytics for Cyber-Physical Systems Cybersecurity

  • news

    Visible to the public Cybersecurity Snapshots #29 - The LAPSUS$ Hacking Group

    Cybersecurity Snapshots #29 -

    The LAPSUS$ Hacking Group

  • news

    Visible to the public "Firms Push for CVE-Like Cloud Bug System"

    Security firms are pushing for improved cloud vulnerability and risk management. Significant gaps exist in the Common Vulnerability and Exposures (CVE) system as dangerous flaws contained by cloud services are not addressed. Oftentimes, cloud providers expose customers to risk by not sharing details about bugs found on their platform. Therefore, many firms are calling for a CVE-like approach to cloud bug management to help customers weigh exposure and impact as well as mitigate risk. A growing number of security firms argue that the current model is broken because CVE identification rules only assign CVE tracking numbers to vulnerabilities that end-users and network administrators can directly manage. MITRE, the non-profit organization behind the CVE system, does not assign CVE IDs for security issues considered cloud providers' responsibility. The assumption is that cloud providers own the problem, and assigning CVEs not controlled by customers or patched by administrators is outside the CVE system's scope of concern. Scott Piper, a cloud-security researcher with Summit Route, says it is a false assumption that all issues can be resolved by the cloud provider and do not need a tracking number. Even if the cloud provider can solve an issue, researchers still believe it warrants having a record. According to Alon Schindel and Shir Tamari, researchers with the cloud security firm Wiz, as new types of vulnerabilities are discovered, more issues are found not fitting the current MITRE CVE reporting model. Therefore, the security industry is urging the creation of a centralized cloud vulnerability database. Although cloud service providers do respond quickly to cloud bugs and work fast to mitigate issues, the process of identifying, tracking, and helping impacted users needs to be streamlined. Shared industry goals behind the cloud bug CVE approach include standardized notification channels for all cloud service providers, standardized bug or issue tracking, severity scoring to help prioritize mitigation efforts, and transparency into vulnerabilities and their detection. This article continues to discuss the need for a CVE-like cloud bug system.

    Threatpost reports "Firms Push for CVE-Like Cloud Bug System"

  • news

    Visible to the public "Researchers Takeover Unpatched 3rd-Party Antivirus Sandboxes via VirusTotal"

    Security researchers at CySource discovered a security flaw that attackers could have exploited to use the VirusTotal platform as a channel for achieving Remote Code Execution (RCE) on unpatched third-party sandboxing machines used by antivirus engines. VirusTotal is Google's malware-scanning service that checks suspicious files and URLs for viruses using over 70 third-party antivirus products. The flaw, which has now been patched, made it possible to remotely execute commands via the VirusTotal platform and gain access to the platform's scanning capabilities. The attack method involves uploading a DjVu file using VirusTotal's web user interface. When the file is passed to multiple third-party malware scanning engines, it could trigger an exploit for a high-severity RCE flaw in ExifTool, which is an open-source utility used to read and edit EXIF metadata information contained by image and PDF files. The high-severity vulnerability, tracked as CVE-2021-22204, stems from ExifTool's improper handling of DjVu files. The researchers noted that this type of exploitation granted a reverse shell to impacted machines linked to some unpatched antivirus engines. This article continues to discuss the RCE vulnerability that could have allowed malicious actors to take control over unpatched third-party antivirus sandboxes.

    THN reports "Researchers Takeover Unpatched 3rd-Party Antivirus Sandboxes via VirusTotal"

  • news

    Visible to the public "41% of Businesses Had an API Security Incident Last Year"

    Web Application Program Interfaces (APIs) have grown as integrated web and mobile-based offerings require more data sharing across products. Security challenges such as broken authentication, accidental disclosure, or the breach of data come with the increased dependence on APIs. A 451 Research and Noname Security report highlights key characteristics and security risks associated with API usage and the benefits of taking a holistic approach to API security. The report includes results from a survey of IT experts from more than 350 global companies in different industries. Responses reveal that API usage is heavy, with an average of 15,564 APIs in use by survey respondent organizations, and a growth rate of 201 percent over the past 12 months. Of the organizations represented by survey respondents, 41 percent had an API security incident within the last 12 months, 63 percent of which said the incident involved a data breach or data loss. Over 30 percent of the survey respondents revealed that API security concerns have resulted in the delay of projects. More than 80 percent of those participants believe more effective integration of API security testing into developer pipeline activities could have prevented the delays. This article continues to discuss key findings from the report on the characteristics and security risks present in API usage.

    Help Net Security reports "41% of Businesses Had an API Security Incident Last Year"

  • news

    Visible to the public "These Hackers Showed Just How Easy It Is to Target Critical Infrastructure"

    Two Dutch researchers won $90,000 and a championship trophy at Pwn2Own Miami 2022, a hacking contest focused on Industrial Control Systems (ICS), by hitting the software that runs the world's power grids, gas pipelines, and more. Daan Keuper and Thijs Alkemade targeted a communications protocol called OPC UA that is used by different parts of a critical-operations system to talk to each other in industrial settings. They successfully demonstrated the possibility of bypassing the trusted-application check. Keuper emphasized that OPC UA is widely used in the industrial world as a connector between systems, thus making it an essential component of typical industrial networks and a significant finding that its authentication can be bypassed to read or modify anything. Another notable target at Pwn2Own was the Iconics Genesis64, a human-machine interface tool that hackers can infiltrate to take down critical targets while tricking human operators into thinking nothing is wrong. The Iconics Genesis64 was hacked at least six times, giving attackers complete control. The teams who took the challenge of hacking Iconics Genesis64 won a total of $75,000. This article continues to discuss achievements made at Pwn2Own 2022, other hacks demonstrated by Keuper, and the importance of bolstering the security of critical infrastructure.

    MIT Technology Review reports "These Hackers Showed Just How Easy It Is to Target Critical Infrastructure"

  • news

    Visible to the public "T-Mobile Breached Again; Lapsus$ Behind the Attack"

    The US telecommunications carrier T-Mobile has confirmed that the Lapsus$ ransomware group breached its internal network through compromised employee accounts. However, the company claims that the hackers did not steal any sensitive customer or government information. According to the information security blogger Brian Krebs who recently reviewed a copy of private chat messages between members of the Lapsus$ cybercrime group before its most active members were arrested last month, T-Mobile had been breached by Lapsus$ several times. The group allegedly also stole source code from various company projects. A spokesperson for T-Mobile stated that its monitoring tools detected a bad actor using stolen credentials to infiltrate internal systems housing operational tools software, but no customer or government information was stolen. Lapsus$ openly operated on its Telegram chat channel since December 2021, which currently has nearly 60,000 followers. The group used this channel to leak sensitive data stolen from victims. This article continues to discuss the breach of T-Mobile's systems by Lapsus$ hackers, the group's other activities, the arrest of its most active members, and other notable attacks on T-Mobile.

    DataBreachToday reports "T-Mobile Breached Again; Lapsus$ Behind the Attack"

  • news

    Visible to the public "Hack DHS: Homeland Security’s First Bug Bounty Turns Up 122 Vulnerabilities"

    "Hack DHS," the US Department of Homeland Security's (DHS) first bug bounty with external researchers, resulted in the discovery of 122 vulnerabilities, 27 or nearly 22 percent of which were found to be critical. The bug bounty involved over 450 vetted security researchers who were offered between $500 and $5,000 for each vulnerability they discovered. Approved participants were invited to run a virtual assessment on select DHS systems. DHS was the first federal agency to amend its bug bounty program to cover Log4J vulnerabilities across all public-facing information system assets, allowing it to identify and fix flaws that have not emerged through other means besides the bug bounty. DHS did not reveal how many of the discovered flaws were associated with Log4J or the number of identified bugs that were eligible for the $5,000 award. The first of DHS' three-phase program is complete. The second phase welcomes security researchers to participate in a live in-person hacking event, while the third phase will be used to collect findings that inform future bug bounty programs. The Cybersecurity and Infrastructure Security Agency (CISA) created the bug bounty platform used by Hack DHS, and the DHS Office of the Chief Information Officer (CIO) governed and monitored the rules of engagement. This article continues to discuss the results and structure of the Hack DHS program.

    ZDNet reports "Hack DHS: Homeland Security's First Bug Bounty Turns Up 122 Vulnerabilities"

  • news

    Visible to the public "Unpatched Vulnerability Allows Hackers to Steal Emails of RainLoop Users"

    Security researchers at application security firm Sonar have discovered that an unpatched vulnerability affecting the RainLoop webmail client can be exploited to hijack a user's session and steal their emails. RainLoop is an open source web-based email client used by many organizations. Sonar reported identifying thousands of internet-exposed instances using the Shodan search engine. The researchers discovered that RainLoop 1.16.0, the latest version of the application released roughly one year ago, is affected by a stored cross-site scripting (XSS) vulnerability that can be exploited against default configurations. The researchers noted that the attacker could exploit the flaw by simply sending a specially crafted email to a RainLoop user. Once the victim opens the malicious email, a hidden JavaScript payload is executed in the browser without other user interaction being required. The security hole, tracked as CVE-2022-29360, is caused by what the researchers describe as a "logic bug after the sanitization process." The researchers warned that an attacker could exploit the vulnerability to gain access to highly sensitive information that may be stored in the victim's emails, including passwords, documents and password reset links. The company has released a video showing the exploit in action. The vulnerability was initially reported to RainLoop developers in late November 2021, and there were two more responsible disclosure attempts in December and January, but the researchers said they received no response.

    SecurityWeek reports: "Unpatched Vulnerability Allows Hackers to Steal Emails of RainLoop Users"

  • news

    Visible to the public "LemonDuck Botnet Plunders Docker Cloud Instances in Cryptocurrency Crime Wave"

    LemonDuck botnet operators are targeting Docker instances in a cryptocurrency mining campaign. According to researchers, LemonDuck is a cryptocurrency mining malware with a botnet structure that exploits older vulnerabilities such as the Microsoft Exchange ProxyLogon bugs to gain access to cloud systems and servers. Microsoft's security team noted that the threat actors behind the LemonDuck malware are selective in regard to timing, so they may execute an attack when teams are focused on patching a vulnerability, not the investigation of compromise. Crowdstrike says LemonDuck has expanded its operations from Windows machines to Linux and Docker. The threat actors are now targeting Docker Application Programming Interfaces (APIs) to infiltrate cloud instances. Researchers found that LemonDuck is taking advantage of the misconfigurations in instances that lead to API exposure in order to deploy exploit kits and launch malware. In one case, an API was used to run a custom Docker ENTRYPOINT instruction and download an image file disguised as a Bash script. The file was downloaded from a domain in LemonDuck's command-and-control (C2) infrastructure. Researchers noted the discovery of multiple campaigns being operated through the domain targeting Windows and Linux. The image file launches a Linux cronjob in the vulnerable container and then downloads a secondary Bash file, which is the main LemonDuck payload. After LemonDuck is triggered by the cronjob, it kills network connections, rival cryptocurrency mining operations, existing ties to mining pools, and other processes. The malware will also target known daemons responsible for monitoring, such as Alibaba Cloud's monitoring service. Once the server is prepared, the cryptocurrency mining operation begins. XMRig, used to generate Monero (XMR), is executed with a configuration set to proxy pools in order to hide the attacker's true cryptocurrency wallet address. The malware goes beyond one Docker instance as it also searches for SSH keys in the file system to log into other servers and repeat its operations. This article continues to discuss the LemonDuck botnet's targeting of exposed Docker APIs.

    ZDNet reports "LemonDuck Botnet Plunders Docker Cloud Instances in Cryptocurrency Crime Wave"

  • news

    Visible to the public "HHS Underscores Risk of Hive Ransomware"

    The US Department of Health and Human Services' (HHS) Health Sector Cybersecurity Coordination Center (HC3) released an analyst note pertaining to the Hive ransomware group, a cybercrime group that has launched several attacks against the healthcare sector. HC3 warns that Hive is an aggressive financially-motivated ransomware group with sophisticated capabilities. Hive was behind the August 2021 attack against the Memorial Health System, which impacted more than 200,000 individuals and resulted in the exfiltration of sensitive data. Additionally, Hive was behind the cyberattack on the Missouri Delta Medical Center that occurred in September 2021. HC3 identified the Hive group as one of the top US healthcare ransomware threats in Q3 2021. In March 2022, Hive stole 850,000 records consisting of Personally Identifiable Information (PII) from Partnership HealthPlan of California. HC3's latest analyst note says Hive conducts double extortion and operates based on the Ransomware-as-a-Service (RaaS) model, thus enabling them and affiliates to gain access to victim infrastructure. The group uses Golang (Go)-written malware, and leverages Remote Desktop Protocol (RDP) and Virtual Private Network (VPN) compromise as well as phishing. Their operations include searching victim systems for processes responsible for backing up data and disrupting them by deleting shadow copies and system snapshots. Much of Hive's operations are considered standard practice amongst ransomware operators, but they have a set of unique capabilities. According to the FBI, Hive uses various tactics, techniques, and procedures (TTPs), making mitigation and defense efforts challenging. To defend against Hive, organizations are encouraged to enable Multi-factor Authentication (MFA), use strong passwords, and regularly backup data. HC3 recommends organizations adopt the 3-2-1 rule for data backups by storing data in three different locations, on two forms of media, and with one of them stored offline. This article continues to discuss HC3's analyst note regarding the Hive ransomware group's history, capabilities, and severity, as well as how to defend against this group.

    HealthITSecurity reports "HHS Underscores Risk of Hive Ransomware"

  • news

    Visible to the public "BlackCat Emerges as One of the Top Ransomware Threats"

    The BlackCat ransomware gang has become one of the major ransomware threats. BlackCat, also known as ALPHV, appears to be a descendant of the BlackMatter ransomware group. The group has been in operation since November and has launched significant attacks such as the disruption of OilTanking GmbH, a German fuel company, and the February attack on the aviation company Swissport. In addition, the ransomware group recently claimed that it was responsible for attacks against Florida International University and the University of North Carolina A&T. The Federal Bureau of Investigation (FBI) released a flash alert regarding BlackCat ransomware, which included indicators of compromise (IOCs). According to the FBI, the ransomware gang has attacked at least 60 organizations globally as of last month, through the use of previously compromised user credentials to gain access to victims' networks. Matthew Radolec, senior director of incident response and cloud operations at Varonis, says most of BlackCat's attacks stem from the increasingly adopted Ransomware-as-a-Service (RaaS) model. One of the key aspects of BlackCat that makes them unique from other ransomware groups and effective in deploying their malware, is that the gang uses the programming language Rust. As Rust emphasizes performance, the process of encryption is fast. Rust is also cross-platform, which makes it easier for attackers to create variants for both Windows and Linux systems. RaaS groups are expected to increasingly use the Rust programming language because it is more flexible than Objective C or Visual Basic. This article continues to discuss the growing threat of the BlackCat ransomware gang.

    TechTarget reports "BlackCat Emerges as One of the Top Ransomware Threats"

  • news

    Visible to the public "Several Critical Vulnerabilities Affect SmartPPT, SmartICS Industrial Products"

    A security researcher named Michael Heinzl has discovered several vulnerabilities, including ones rated critical- and high-severity, in industrial products made by Elcomplus, a Russian company specializing in professional radio communications and industrial automation. The researcher discovered a total of nine vulnerabilities in Elcomplus' SmartPTT SCADA product, which combines the capabilities of SCADA/IIoT systems with dispatch software for professional radio systems. In addition, it appears that products made by SmartICS, an Elcomplus unit that specializes in SCADA and industrial IoT visualization platforms, are also affected by some of the vulnerabilities, as they share code. The affected products are used by more than 2,000 organizations across 90 countries, including in the United States, which is why the US Cybersecurity and Infrastructure Security Agency (CISA) this week published two advisories to inform organizations about these vulnerabilities. The list of security holes includes path traversal, cross-site scripting (XSS), arbitrary file upload, authorization bypass, cross-site request forgery (CSRF), and information disclosure issues. Exploiting these vulnerabilities can allow an attacker to upload files, read or write arbitrary files on the system, obtain credentials stored in clear text, carry out various actions on behalf of a user, execute arbitrary code, and elevate privileges to access admin functionality. In some cases, exploitation requires authentication or user interaction. Michael reported the vulnerabilities to the vendor through CISA in April 2021. While the vendor has not been very responsive, it appears that it did release patches by the end of 2021.

    SecurityWeek reports: "Several Critical Vulnerabilities Affect SmartPPT, SmartICS Industrial Products"

  • news

    Visible to the public "FBI Warns US Farmers of Ransomware Surge"

    The FBI is warning that US food supply chains are at risk of potentially devastating ransomware attacks. A new Private Industry Notification sent out this week claimed that agricultural cooperatives may be viewed as attractive targets during the planting and harvesting seasons. The FBI stated that the attacks could cause financial loss and operational disruption and impact the food supply chain, given that grain is also used for animal feed. Compromises at dairy or meat processing facilities can lead to delays which result in spoiled products, the notice explained. The FBI stated that threat actors might perceive cooperatives as lucrative targets with a willingness to pay due to the time-sensitive role they play in agricultural production. The notice listed multiple examples of unnamed agricultural sector firms that have been compromised by ransomware since last year. These include a supply chain attack in which a software company was attacked in July 2021, impacting downstream agricultural clients. The FBI stated that initial intrusion vectors included known but unpatched common vulnerabilities and secondary infections from the exploitation of shared network resources or compromise of managed services. Production was impacted for some of the targeted entities, resulting in slower processing due to manual operations, while other targeted entities lost access to administrative functions such as websites and email but did not have production impacted. The FBI also listed multiple best practice recommendations in the notice, including regular patching, multi-factor authentication, disabling RDP ports, and improving employee cybersecurity awareness.

    Infosecurity reports: "FBI Warns US Farmers of Ransomware Surge"

  • news

    Visible to the public "Critical Bug in Android Could Allow Access to Users’ Media Files"

    Android devices running on Qualcomm and MediaTek chipsets have been discovered by security analysts to be vulnerable to Remote Code Execution (RCE) attacks. The vulnerability stems from a flaw in the implementation of Apple Lossless Audio Codec (ALAC), which is an audio coding format for lossless audio compression. Apple open-sourced ALAC in 2011 and has since then been releasing updates, including security fixes, for the format. However, some third-party vendors using ALAC have not applied the updates, including two of the largest smartphone chip makers, Qualcomm and MediaTek. The bug impacts chipsets present in nearly the entire range of products Qualcomm released over the past several years. A remote attacker can exploit the vulnerability to execute code on a target device by sending a specially crafted audio file and tricking an unsuspecting user into opening it. Researchers have dubbed this attack ALHACK. RCE attacks can lead to data breaches, the planting and execution of malware, the modification of device settings, account takeover, and more. An analysis of the vulnerability revealed that the ALAC decoder implementations from Qualcomm and MediaTek suffer from out-of-bounds reads as well as the improper validation of audio frames. These problems could lead to information disclosure and elevated privileges without the need for user interaction. This article continues to discuss the critical chipset bug that opens millions of Android devices to RCE attacks.

    Bleeping Computer reports "Critical Bug in Android Could Allow Access to Users' Media Files"

  • news

    Visible to the public "APTs Have Tools That Can Take Over Critical Infrastructure"

    In a joint warning from the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, and the National Security Agency, infrastructure providers are cautioned that threat actors have shown the capability to take over multiple industrial control systems devices. The custom designed tools allow the hackers to elevate privileges, disrupt critical devices, and move within the operational technology environment. The entire industrial control environment is at risks once treat actors are inside. Schneider Electric MODICON and MODICON Nano programmable are two of a number of devices that are vulnerable.

    Threatpost reports "APTs Have Tools That Can Take Over Critical Infrastructure"

  • news

    Visible to the public "Microsoft Obtains Court Order to Take Down Domains Used to Target Ukraine"

    Microsoft was granted a court order to take down seven domains used by APT28, a cyber espionage group sponsored by Russia's military intelligence. Their goal was to prevent attacks by APT28 on Ukraine online resources. Microsoft was able to redirect attacks to a Microsoft sinkhole and let victims know about possible hacks on Ukrainian institutions and government agencies as well as other organizations in the U.S. and Europe.

    THN reports "Microsoft Obtains Court Order to Take Down Domains Used to Target Ukraine"

  • news

    Visible to the public "Microsoft and Google Users Targeted by Threat Actors on Free Calendar App"

    Hackers using free sites and apps to send phishing emails and to download host malware. A report from infosecurity firm Inky, warns that a free calendar app called Calendly which runs on Microsoft 365 and Google Workspace invites users to click on a new document received. If clicked, the users are sent to bogus events in a credentials harvesting operation. By hovering over the link, security minded users could have seen that the link led to a hijacked site listed in the Google, Firefox, and Netcraft threat feeds. But most users would have missed this tell and entered account names and passwords. Inky started the investigation after being alerted by users of Google Workspace and Microsoft 365 about suspicious documents in their inboxes.

    Cybernews reports "Microsoft and Google Users Targeted by Threat Actors on Free Calendar App"

  • news

    Visible to the public "Bob's Red Mill Reports Data Breach"

    Bob's Red Mill Natural Foods, a popular American brand of whole-grain foods, issued a data breach notice on April 15 after learning that it had fallen victim to a data scraping cyberattack that began two months ago. The company stated that they recently learned that, between February 23 and March 1, 2022, malicious software was used to "scrape" purchase-related information entered into their website. The company said that data entered into its website is usually sent directly to the company's payment processor via secure protocols. However, unidentified cyberattackers used malicious software to divert the information. The company noted that they do not believe any of its physical/in-person count-of-sale terminals have been impacted or that purchases made outside the February 23 - March 1 window have been impacted. Data that may have been exposed in the attack includes online customers' payment card information, billing and shipping addresses, email addresses, phone numbers, and purchase amounts. The company said that no information had been found to indicate that any Social Security numbers, dates of birth, driver's license numbers, or other government-issued ID numbers had been exposed in the attack.

    Infosecurity reports: "Bob's Red Mill Reports Data Breach"

  • news

    Visible to the public "Phishing Attacks on Government up 110 Percent"

    Zscaler's 2022 ThreatLabz Phishing Report reveals a 110 percent increase in attempted phishing attacks in the government sector between 2020 and 2021. Phishing attacks remain one of the most prevalent cyber threats, as it has showed a 29 percent increase globally over the past year. The US is still the most targeted country, accounting for 60 percent of all phishing attempts. The report covers over 20 of the most common types of phishing attacks and places them into three main categories: link, prompt, or attachment. Victims are usually encouraged to click a malicious link to a phishing site, hosted file, or malware. Other victims are encouraged to submit sensitive information. Another common phishing tactic attempts to trick users into clicking email attachments that deliver malware. Email phishing is the most common form of attack, making up more than 90 percent of tracked phishing attacks. This article continues to discuss other key findings shared in Zscaler's report on the state of phishing.

    GCN reports "Phishing Attacks on Government up 110 Percent"

  • news

    Visible to the public "Most Email Security Approaches Fail to Block Common Threats"

    According to a survey of business customers who use Microsoft 365 for email, commissioned by Cyren and conducted by Osterman Research, many security teams believe their email security systems are ineffective against ransomware and other significant inbound threats. Security team managers were found to be the most concerned about current email security solutions not being able to block serious inbound threats, which require time for response and remediation by the security team before users trigger dangerous threats. Less than 50 percent of those surveyed said that their organizations can block the delivery of email threats. Less than half of the organizations rank their current email security solutions as effective. Protections implemented against impersonation threats are considered the least effective, followed by measures to detect and block mass-mailed phishing emails. Nearly all of the organizations polled have experienced one or more types of email breaches. Most of the organizations faced one or more successful email breach types during the previous 12 months. The number of email breaches per year has doubled since 2019, most of which were due to successful phishing attacks that stole Microsoft 365 credentials. The survey also revealed that successful ransomware attacks have increased by 71 percent in the last three years. In addition, Microsoft 365 credential compromise grew by 49 percent, and successful phishing attacks increased by 44 percent. This article continues to discuss the key findings from the report on phishing, Business Email Compromise (BEC), and ransomware threats faced by Microsoft 365 Users, as well as where email defense breaks down.

    Threatpost "Most Email Security Approaches Fail to Block Common Threats"

  • news

    Visible to the public "Two-Thirds of Global Banks Report Surge in Destructive Attacks"

    Researchers at VMware have discovered that nearly two-thirds (63%) of global financial institutions experienced a rise in destructive attacks over the past year, with many fearing further threats as the war in Ukraine escalates. The researchers polled 130 financial-sector CISOs and security leaders worldwide to compile its Modern Bank Heists report. According to the head of cybersecurity strategy at VMware, Tom Kellermann, the number of participants reporting an increase in destructive malware surged 17% from last year's report. Tom noted that destructive attacks are launched punitively to destroy, disrupt, or degrade victim systems by taking actions such as encrypting files, deleting data, destroying hard drives, terminating connections, or executing malicious code. Nearly three-quarters (74%) of respondents experienced at least one ransomware attack over the past year, with 63% paying the ransom, a figure Tom branded "staggering." Tom argued that ransomware-as-a-service offerings and remote access tools (RATs) have helped cybercriminals be more successful during cyberattacks against banks. Tom noted that ransomware has a sinister relationship with these RATs, given these tools allow bad actors to persist within the environment and establish a staging server that can be used to target additional systems. Once an adversary has gained this limited access, they will typically work to monetize it by relying on the victim's data for extortion (including double and triple extortion) or through stealing resources from cloud services using cryptojacking attacks.

    Infosecurity reports: "Two-Thirds of Global Banks Report Surge in Destructive Attacks"

  • news

    Visible to the public "Five Eyes Agencies Issue Detailed Russian Cyber-Threat Warning"

    Cybersecurity agencies in the US, UK, Australia, Canada, and New Zealand have issued another warning to organizations beyond Ukraine's borders that pro-Russian hackers may soon target them. The so-called "Five Eyes" intelligence group published its most detailed threat assessment yesterday, including information on Kremlin-backed units and cybercrime groups that have pledged to support Russia. The Russian state groups named in the report are the Russian Federal Security Service (FSB), Russian Foreign Intelligence Service (SVR), Russian General Staff Main Intelligence Directorate (GRU), Russian Ministry of Defense, and the Central Scientific Institute of Chemistry and Mechanics (TsNIIKhM). The researchers claim that the cybercrime groups that could threaten Western countries' critical infrastructure (CNI) include data leak extortionists the CoomingProject, DDoS-ers Killnet, Emotet operators Mummy, and Sality botnet developer Salty Spider. Also included on the list are malware-as-a-service group Scully Spider, Smoke Loader bot developer Smokey Spider, TrickBot and Conti group Wizard Spider, and The XakNet Team. The report contains multiple useful resources, a lengthy list of mitigations, and technical details on each group, including common tactics, techniques and procedures (TTPs). National Cyber Security Centre (NCSC) CEO Lindy Cameron stated that it is vital that all organizations accelerate plans to raise their overall cyber-resilience, particularly those defending CNI.

    Infosecurity reports: "Five Eyes Agencies Issue Detailed Russian Cyber-Threat Warning"