21.10.2022
NEWS:
Emotional Toll From Cyberattacks Can Linger Among Staff for Years
The ransomware crisis hasn’t just cost companies time and money, but also the mental health of their employees. New research shows that in the wake of a ransomware or other cyberattack, IT and security staff tasked with responding to a cyberattack can experience intense adverse psychological impacts for years afterward. Research conducted by organizational psychologist Inge van der Beijl, director of behavior & resilience at Northwave, revealed that 1 out of every 7 employees experiences trauma symptoms months after a cyberattack, including trouble sleeping and back pain. Some 75% reported having “negative ruminative thoughts,” and 1 in 5 impacted by a breach has considered a job change, according to the Northwave findings.
Cyberattacks accelerating in Europe, Moody’s says
The number of cyberattacks in Europe has grown significantly this year, highlighting the urgent need for organizations to develop security strategies to protect operations and financial profile, according to a new report from Moody’s investors Service. The report noted that Russian invasion of Ukraine is a contributing factor, with around 38% of attacks related to it. But the conflict is not the only reason for the acceleration. Moody’s also found that the number of attacks that are unrelated to the conflict in the first nine months of 2022 is already more than double the number it reported in all last year. “Increasing digitalization across industries creates a higher number of potential targets as well, and that is unfortunately intensively used by hackers,” Dirk Goedde, VP senior analyst at Moody’s told SC Media in an email.
Phishers Are Leveraging Google Translate to Steal User Data
Phishing attacks can be quite harmful because of the fact that this is the sort of thing that could potentially end up allowing log in credentials to fall into the wrong hands. Cybersecurity researchers are always on the lookout for new phishing attempts, and their studies have shown that phishers are new developing new and evolved techniques for stealing user data with all things having been considered and taken into account. A new phishing campaign has just been discovered, and with all of that having been said and now out of the way it is important to note that it involves Google Translate.
https://www.digitalinformationworld.com/2022/10/phishers-are-leveraging-google.html
Disinformation Attacks Threaten US Midterm Elections
While traditional cyberattack operations against US government organizations have remained fairly consistent, influence and disinformation attacks by foreign nations have increased in the run-up to the US midterm elections. On the cyberattack front, the China-linked hacking group Budworm has targeted several government agencies, including the legislature for a US state, over the past six months, according to Symantec, part of Broadcom Software. The attack on a US government organization is the second recent incident — after a hiatus of more than six years — where the group has targeted a US private-sector agency, the company’s researchers stated in an advisory.
https://www.darkreading.com/threat-intelligence/disinformation-attacks-threaten-us-midterm-elections
INCIDENTS:
Microsoft Customer Data Exposed by Misconfigured Server
Sensitive information for some Microsoft customers were exposed by a misconfigured server, Microsoft Security Response Center said on Wednesday. The misconfigured endpoint was accessible on the Internet and did not require authentication. The exposed information included names, email addresses, email content, company name, phone numbers, and files “relating to business between a customer and Microsoft or an authorized Microsoft partner,” the company said. The endpoint has already been secured to require authentication, and affected customers have been notified.
https://www.darkreading.com/cloud/microsoft-customer-data-exposed-by-misconfigured-server
Ransomware attack freezes newspaper printing system
Several German newspapers were left unable to release printed versions of their papers after a ransomware attack affected their printing systems. Speaking to BleepingComputer, Uwe Ralf Heer, editor-in-chief of Heilbronn Stimme, said the attack hit the entire Stimme Mediengruppe media group, which Heilbronn is a member. Other affected companies under the group are Echo, Pressedruck, and RegioMail. Heer said a “well-known cybercriminal group” carried out the attack last Friday, October 14, leaving systems encrypted. Despite leaving ransom notes. the attackers are yet to make any specific ransom demands.
https://www.malwarebytes.com/blog/news/2022/10/ransomware-attack-freezes-newspaper-printing-system
Indian Energy Company Tata Power’s IT Infrastructure Hit By Cyber Attack
Tata Power Company Limited, India’s largest integrated power company, on Friday confirmed it was targeted by a cyber attack. The intrusion on IT infrastructure impacted “some of its IT systems,” the company said in a filing with the National Stock Exchange (NSE) of India. It further said it has taken steps to retrieve and restore the affected machines, adding it put in place security guardrails for customer-facing portals to prevent unauthorized access.
https://thehackernews.com/2022/10/indian-energy-company-tata-powers-it.html
MALWARE:
New ransomware targets transportation sectors in Ukraine, Poland
A new ransomware campaign has been targeting transportation and logistics organizations in Ukraine and Poland, according to Microsoft. The novel ransomware, labeled “Prestige ransomware,” was first identified October 11 and targeted numerous victims within the same one-hour window, according to Microsoft’s Threat Intelligence Center. Researchers were not able to tie the strain to any of the 94 active ransomware groups they are currently tracking. The victim profiles share similarity to recent Russian state-aligned activity and overlap with previous victims of HermeticWiper malware, but researchers noted that the campaign is separate from those destructive attacks, which have been targeting Ukrainian organizations since before the Russian invasion began in February.
VULNERABILITIES:
Flaw in Microsoft OME Could Lead to Leakage of Encrypted Data
WithSecure researcher Harry Sintonen has released an advisory on issues with Microsoft Office 365 Message Encryption (OME). OME is used to send encrypted emails. It uses the Electronic Codebook implementation, which can leak certain structural information about emails. Issues with ECB are not unknown. In its Announcement of Proposal to Revise Special Publication 800-38A, NIST wrote, “The ECB mode encrypts plaintext blocks independently, without randomization; therefore, the inspection of any two ciphertext blocks reveals whether or not the corresponding plaintext blocks are equal… the use of ECB to encrypt confidential information constitutes a severe security vulnerability.” Sintonen comments, “Attackers who are able to get their hands on multiple messages can use the leaked ECB info to figure out the encrypted contents. More emails make this process easier and more accurate.”
https://www.securityweek.com/flaw-microsoft-ome-could-lead-leakage-encrypted-data
Zoom for macOS Contains High-Risk Security Flaw
Video messaging technology powerhouse Zoom has rolled out a high-priority patch for macOS users alongside a warning that hackers could abuse the software flaw to connect to and control Zoom Apps. The vulnerability, which carries a CVSS severity score of 7.3/10, is documented as a debugging port misconfiguration that is opened by the Zoom client on macOS machines.
https://www.securityweek.com/zoom-macos-contains-high-risk-security-flaw
Researchers Detail Azure SFX Flaw That Could’ve Allowed Attackers to Gain Admin Access
Cybersecurity researchers have shared more details about a now-patched security flaw in Azure Service Fabric Explorer (SFX) that could potentially enable an attacker to gain administrator privileges on the cluster.The vulnerability, tracked as CVE-2022-35829, carries a CVSS severity rating of 6.2 and was addressed by Microsoft as part of its Patch Tuesday updates last week. Orca Security, which discovered and reported the flaw to the tech giant on August 11, 2022, dubbed the vulnerability FabriXss (pronounced “fabrics”). It impacts Azure Fabric Explorer version 8.1.316 and prior.
https://thehackernews.com/2022/10/researchers-detail-azure-sfx-flaw-that.html
Cyber4Dev collates data from Open-Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
