25.02.2022
NEWS:
Russia, Ukraine and the Danger of a Global Cyberwar
On the morning of February 22, 2022, the world woke to the news that Russia had moved troops into two separatist regions of eastern Ukraine. At the time of writing, it is not yet a full invasion of Ukraine, but Russia did conduct attacks on February 24, hitting cities with airstrikes and artillery in what was called a “special military operation” by Russian President Vladamir Putin. Just before this maneuver, SecurityWeek spoke to Marcus Willett to get insight into the role of cyber in aggressive geopolitics. Willett is senior advisor for cyber at the International Institute for Strategic Studies where he researches the use of cyber and related technologies as levers of national power. Before then, he had worked at the UK’s GCHQ for 33 years, including roles such as the agency’s first director of cyber.
https://www.securityweek.com/russia-ukraine-and-danger-global-cyberwar
3 Steps Security Leaders Can Take Toward Closing the Skills Gap
Much has been written about the Great Resignation as its impact is widespread. Sectors including hospitality, food, retail, manufacturing and healthcare have all been affected, making access to goods and services we took for granted hard to come by. You might think that the cybersecurity sector has also felt the pinch, but studies find that’s not the case. In fact, cybersecurity made some headway as the workforce gap decreased from an estimated 3.12 million in 2020 to 2.72 million in 2021. Still, progress has been too little and, for many organizations, too late, as global cybercrime soars to new heights. The hard truth is that the skills shortage we face has been going on for more than a decade and currently 61% of IT security professionals say their teams are understaffed.
https://www.securityweek.com/3-steps-security-leaders-can-take-toward-closing-skills-gap
Preparing for and Mitigating Foreign Influence Operations Targeting Critical Infrastructure
Malicious actors use influence operations, including tactics like misinformation, disinformation, and malinformation (MDM), to shape public opinion, undermine trust, amplify division, and sow discord. Foreign actors engage in these actions to bias the development of policy and undermine the security of the U.S. and our allies, disrupt markets, and foment unrest. While influence operations have historical precedent, the evolution of technology, communications, and networked systems have created new vectors for exploitation.
Cybercriminals Seek to Profit From Russia-Ukraine Conflict
Dark web threat actors are looking to take advantage of the tensions between Russia and Ukraine, offering network access and databases that could be relevant to those involved in the conflict, according to a new report from Accenture. Since mid-January, cybercriminals have started to advertise compromised assets relevant to the Russia-Ukraine conflict, and they are expected to increase their offering of databases and network access, with potentially crippling effects for the targeted organizations. Just over a month ago, soon after the destructive WhisperGate attacks on multiple government, IT, and non-profit organizations in Ukraine, threat actors started to advertise on the dark web access to both breached networks and databases that allegedly contained personally identifiable information (PII).
https://www.securityweek.com/cybercriminals-seek-profit-russia-ukraine-conflict
INCIDENTS:
Ukraine computers hit by data-wiping software as Russia launched invasion
A newly discovered piece of destructive software found circulating in Ukraine has hit hundreds of computers, according to researchers at the cybersecurity firm ESET, part of what Ukrainian officials said was an intensifying wave of hacks aimed at the country. The company said on Twitter that the data wiping program had been installed on hundreds of machines in the country, an attack it said had likely been in the works for the past couple of months.
https://www.cnbc.com/2022/02/23/cyberattack-hits-ukrainian-banks-and-government-websites.html
Cyberattack Hits Global Operations of Logistics Giant Expeditors International
Seattle, Washington-based logistics giant Expeditors International on Sunday announced the disruption of its global systems as a result of a cyberattack. The Fortune 500 company said it had shut down most of its operating systems, and in an update shared on Monday informed customers that its operations had still been impacted. “While our systems are shut down we will have limited ability to conduct operations, including but not limited to arranging for shipments of freight or managing customs and distribution activities for our customers’ shipments,” the company stated. The company described it as a “targeted cyberattack,” but shared no other details. Based on its brief description of the incident, it may have been a ransomware attack.
Defense contractors hit by stealthy SockDetour Windows backdoor
A new custom malware dubbed SockDetour found on systems belonging to US defense contractors has been used as a backup backdoor to maintain access to compromised networks. The malicious payload was spotted by Unit 42 security researchers, who believe that its operators kept the backdoor under the radar for a long time as it has been used in the wild since at least July 2019. SockDetour’s stealthiness can be explained by the fact that it “operates filelessly and socketlessly” on infected Windows servers by hijacking network connections, making it a lot harder to detect at the host and network levels.
MALWARE:
New Wiper Malware Targeting Ukraine Amid Russia’s Military Operation
Cybersecurity firms ESET and Broadcom’s Symantec said they discovered a new data wiper malware used in fresh attacks against hundreds of machines in Ukraine, as Russian forces formally launched a full-scale military operation against the country. The Slovak company dubbed the wiper “HermeticWiper” (aka KillDisk.NCV), with one of the malware samples compiled on December 28, 2021, implying that preparations for the attacks may have been underway for nearly two months.
https://thehackernews.com/2022/02/new-wiper-malware-targeting-ukraine.html
https://www.bleepingcomputer.com/news/security/ransomware-used-as-decoy-in-data-wiping-attacks-on-ukraine/
https://securityaffairs.co/wordpress/128349/malware/wiper-malware-hermeticwipe-ukrain.html
https://www.securityweek.com/destructive-hermeticwiper-malware-targets-computers-ukraine
Microsoft Exchange servers hacked to deploy Cuba ransomware
The Cuba ransomware operation is exploiting Microsoft Exchange vulnerabilities to gain initial access to corporate networks and encrypt devices. Cybersecurity firm Mandiant tracks the ransomware gang as UNC2596 and the ransomware itself as COLDDRAW. However, the ransomware is more commonly known as Cuba, which is how BleepingComputer will reference them throughout this article. Cuba is a ransomware operation that launched at the end of 2019, and while they started slow, they began to pick up speed in 2020 and 2021. This increase in activity led to the FBI issuing a Cuba ransomware advisory in December 2021, warning that the gang breached 49 critical infrastructure organizations in the U.S.
VULNERABILITIES:
Samsung Shattered Encryption on 100M Phones
One cryptography expert said that ‘serious flaws’ in the way Samsung phones encrypt sensitive material, as revealed by academics, are ’embarrassingly bad.’ Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year’s Galaxy S21. Researchers at Tel Aviv University found what they called “severe” cryptographic design flaws that could have let attackers siphon the devices’ hardware-based cryptographic keys: keys that unlock the treasure trove of security-critical data that’s found in smartphones.
Apple AirTag anti-stalking protection bypassed by researchers
When the Apple AirTag hit the market in 2021, it immediately attracted the attention of hackers and reverse engineers. Could AirTags be jailbroken? Could AirTags be simulated? Could the AirTag ecosystem be used for purposes beyond Apple’s own imagination (or at least beyond its intentions)? We soon found ourselves writing up the answer to the “jailbreak” question, given that a researcher with the intriguing handle of LimitedResults figured out a way to subvert the chip used in the AirTag (an nRF52832 microcontroller, if you want to look it up) into booting up with debugging enabled
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
