This week, over 160 of Mozambique’s burgeoning cyber community took part either in person or online in our comprehensive CSIRT Essentials Training, which is part of Cyber4Dev’s training portfolio. Making our first trip to Maputo at the invitation of INTIC (Instituto Nacional de Tecnologias de Informação e Comunicação), we are delighted to support Mozambique’s efforts to develop enhanced cyber resilience.
This week, in Tallinn, we have been sharing our insights on the development of the cyber ecosystem with our colleague Priyankara Perera, from Sri Lanka CERT -CC.
During this immersive and wide-ranging visit, our Cyber4Dev experts and partners in Tallinn have explored the principles and techniques that have helped to forge Estonia’s reputation as the world’s leading digital society.
https://staging.cyber4dev.eu/2022/08/26/sri-lanka-cert-cc-study-visit-to-tallinn/
NEWS:
Ransomware attacks surged by 47% in July
According to a report by NCC Group’s Global Threat Intelligence division, ransomware attacks increased by 47% in July compared to June, adding more evidence for a trend of rising global cybercrime. The report has its own particular metrics but it mirrors others that have come out recently which collectively paint a picture of increasing international cybercrime, with NCC claiming ransomware attacks were up by almost half, from 135 in June to 198 in July. It seems to measure large scale attacks levelled at businesses as opposed to tracking every induvial who has clicked on a dodgy link, which would obviously create a much higher number.
How attackers use and abuse Microsoft MFA
Microsoft has been pushing for the use of multi-factor authentication (MFA) to thwart attackers for many years. But threat actors are keeping up with the increasing enterprise adoption of MFA and are constantly coming up with ways to bypass the additional protection it offers. We have already seen attacks involving SIM swapping, exploitation of vulnerabilities, rogue apps, legacy authentication protocols, MFA prompt bombing (aka MFA fatigue), stolen session cookies, and (custom) phishing kits with MFA-bypassing capability.
Air-Gapped Devices Can Send Covert Morse Signals via Network Card LEDs
A security researcher who has a long line of work demonstrating novel data exfiltration methods from air-gapped systems has come up with yet another technique that involves sending Morse code signals via LEDs on network interface cards (NICs). The approach, codenamed ETHERLED, comes from Dr. Mordechai Guri, the head of R&D in the Cyber Security Research Center in the Ben Gurion University of the Negev in Israel, who recently outlined GAIROSCOPE, a method for transmitting data ultrasonically to smartphone gyroscopes. “Malware installed on the device could programmatically control the status LED by blinking or alternating its colors, using documented methods or undocumented firmware commands,” Dr. Guri said.
https://thehackernews.com/2022/08/air-gapped-devices-can-send-covert.html
Crypto hackers have stolen nearly $2 billion this year—Here’s why it’s a growing problem
Hackers have already stolen nearly $2 billion worth of cryptocurrency in 2022 — and the year is only half over. As of July, $1.9 billion in crypto has been stolen by cybercriminal hacks, according to Chainalysis’ “Mid-year Crypto Crime Update.” At this point last year, hackers had stolen $1.2 billion, according to the report. That’s a spike of nearly 60% compared to a year ago. “Despite the misconception that cryptocurrency is anonymous, it remains easier to run away with coins or tokens,” says Max Krupyshev, co-founder and leader of crypto payment ecosystem CoinsPaid. “I don’t think that crypto hackers are stronger than the ‘usual’ kinds, it’s just that crypto platforms are new and hold valuable assets.”
https://www.cnbc.com/2022/08/19/crypto-hackers-stole-billions-why-its-a-growing-problem.html
INCIDENTS:
Quantum ransomware attack disrupts govt agency in Dominican Republic
The Dominican Republic’s Instituto Agrario Dominicano has suffered a Quantum ransomware attack that encrypted multiple services and workstations throughout the government agency. The Instituto Agrario Dominicano (IAD) is part of the Ministry of Agriculture and is responsible for executing Agrarian Reform programs in the country.
Local media reports that the ransomware attack occurred on August 18th, which has impacted the agency’s operation. “They ask for more than 600 thousand dollars. We were affected by four physical servers and eight virtual servers; virtually all servers,” IAD Director of Technology Walixson Amaury Nuñez told local media.
French hospital hit by $10M ransomware attack, sends patients elsewhere
The Center Hospitalier Sud Francilien (CHSF), a 1000-bed hospital located 28km from the center of Paris, suffered a cyberattack on Sunday, which has resulted in the medical center referring patients to other establishments and postponing appointments for surgeries. CHSF serves an area of 600,000 inhabitants, so any disruption in its operations can endanger the health, and even lives, of people in a medical emergency. “This attack on the computer network makes the hospital’s business software, the storage systems (in particular medical imaging), and the information system relating to patient admissions inaccessible for the time being,” explains CHSF’s announcement.
Password management software firm LastPass has suffered a data breach, threat actors have stolen source code and other data.
“Two weeks ago, we detected some unusual activity within portions of the LastPass development environment.” reads a notice published by the company. “We have determined that an unauthorized party gained access to portions of the LastPass development environment through a single compromised developer account and took portions of source code and some proprietary LastPass technical information. Our products and services are operating normally.”
MALWARE:
Hackers Using Fake DDoS Protection Pages to Distribute Malware
WordPress sites are being hacked to display fraudulent Cloudflare DDoS protection pages that lead to the delivery of malware such as NetSupport RAT and Raccoon Stealer. “A recent surge in JavaScript injections targeting WordPress sites has resulted in fake DDoS prevent prompts which lead victims to download remote access trojan malware,” Sucuri’s Ben Martin said in a write-up published last week. Distributed denial-of-service (DDoS) protection pages are essential browser verification checks designed to deter bot- driven unwanted and malicious traffic from eating up bandwidth and taking down websites.
https://thehackernews.com/2022/08/hackers-using-fake-ddos-protection.html
The Week in Ransomware – August 19th 2022 – Evolving extortion tactics
This week saw the return of the BlackByte ransomware operation, which launched a new data leak site using extortion tactics similar to LockBit 3.0. This week’s attacks were on Argentina’s Judiciary of Córdoba, a UK water supplier (though Clop attributed to the wrong company), and LockBit claiming to be behind the attack on Entrust. Finally, researchers found a new variant of the SOVA Android malware that includes a ransomware feature to encrypt mobile devices. While Entrust has not responded to our queries about the attack, sources have told us that LockBit conducted the attack.
VULNERABILITIES:
Vulnerable Hikvision Cameras Exposed Online
Cybercriminals in Russian forums are selling logon credentials to Hikvision-brand security cameras, tens of thousands of which remain vulnerable to a well-known exploit, warns a threat intelligence firm. A study by Cyfirma reveals that more than 80,000 Hikvision cameras used across the globe contain a critical flaw first identified more than a year ago. Chinese manufacturer Hangzhou Hikvision Digital Technology Co. issued a patch for the vulnerability last September. Tracked as CVE-2021-36260, this command injection vulnerability allows attackers to execute arbitrary system commands on the victim’s host operating system. Attackers could exploit the vulnerability to add the cameras to a botnet or as a launching point for lateral movement deeper into the camera operator’s network.
https://www.databreachtoday.com/vulnereable-hikvision-cameras-exposed-online-a-19875
GitLab ‘strongly recommends’ patching critical RCE vulnerability
GitLab is urging users to install a security update for branches 15.1, 15.2, and 15.3 of its community and enterprise editions to fix a critical vulnerability that could enable an attacker to perform remote command execution via Github import. GitLab is a web-based Git repository for developer teams that need to manage their code remotely. It has approximately 30 million registered users and one million paying customers. The vulnerability addressed by this security update is tracked as CVE-2022-2884 and assigned a CVSS v3 criticality score of 9.9. It impacts all versions starting from 11.3.4 and up to 15.1.4, those between 15.2 and 15.2.3, and 15.3.
Privilege Escalation Flaw Haunts VMware Tools
Virtualization technology software giant VMware on Tuesday released patches to fix an important-severity security flaw in the VMware Tools suite of utilities. The vulnerability, tracked as CVE-2022-31676, could be exploited by attackers to escalate privileges on a compromised system. “VMware Tools was impacted by a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine,” VMWare said in an advisory.
https://www.securityweek.com/privilege-escalation-flaw-haunts-vmware-tools
VMware Releases Security Update
VMware has released a security update to address a vulnerability in Tools. A remote attacker could likely exploit the vulnerability to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory VMSA-2022-0024 and apply the necessary update.
https://www.cisa.gov/uscert/ncas/current-activity/2022/08/23/vmware-releases-security-update
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
