29.07.2022
NEWS:
1 in 3 employees don’t understand why cybersecurity is important
According to a new Tessian report, 30% employees do not think they personally play a role in maintaining their company’s cybersecurity posture. What’s more, only 39% of employees say they’re very likely to report a security incident, making investigation and remediation even more challenging and time- consuming for security teams. When asked why, 42% of employees said they wouldn’t know if they had caused an incident in the first place, and 25% say they just don’t care enough about cybersecurity to mention it. Virtually all IT and security leaders agreed that a strong security culture is important in maintaining a strong security posture. Yet, despite rating their organization’s security 8 out 10, on average, three-quarters of organizations experienced a security incident in the last 12 months.
How Conti ransomware hacked and encrypted the Costa Rican government
Details have emerged on how the Conti ransomware gang breached the Costa Rican government, showing the attack’s precision and the speed of moving from initial access to the final stage of encrypting devices. This is the last attack from the Conti ransomware operation before the group transitioned to a different form of organization that relies on multiple cells working with other gangs. Conti’s 5-day intrusion on Costa Rica govt The Conti ransomware operation launched in 2020 to replace Ryuk and quickly grew to infamy after attacking victims in both the private and the public sector, including local governments in the U.S., schools, and national healthcare systems.
How to find and remove spyware from your phone
Our digital selves are now an established part of our identity. The emails we send, the conversations we have over social media — both private and public — as well as the photos we share, the videos we watch, the apps we download, and the websites we visit all contribute to our digital personas. There are ways to prevent a government agency, country, or cybercriminal from peeking into our digital lives, for example, by using virtual private networks (VPNs), end-to-end encryption, and browsers that do not track user activity. However, governments and law enforcement agencies are now taking advantage of sophisticated spyware developed and offered commercially by companies, including NSO groups. It can be extremely difficult to detect or remove when implanted on a device.
https://www.zdnet.com/article/how-to-find-and-remove-spyware-from-your-phone/
The evolution of botnets and DDoS attacks
Distributed Denial of Service (DDoS) attacks have become an ongoing threat for organizations. Using a variety of techniques, a wide range of threat actors from lone hackers, criminal gangs and hacktivists to nation-states are using DDoS attacks to disrupt or disable the performance of target systems. These targets can be small or large businesses, internet service providers, manufacturers, retailers, healthcare providers, schools and universities, or other nation-states. Essentially, any entity with an online presence can become a DDoS target.
Global shortage of fiber-optic cable threatens digital growth
A worldwide shortage of fiber-optic cable has driven up prices and lengthened lead times, endangering companies’ ambitious plans to roll out state-of-the-art telecommunications infrastructure. Europe, India, and China are among the regions most affected by the crunch, with prices for fiber rising by up to 70 percent from record lows in March 2021, from $3.70 to $6.30 per fiber km, according to Cru Group, a market intelligence firm. Although the pandemic prompted some of the biggest tech and telecoms groups to slash their capex, there has been a surge in demand for Internet and data services, leading to a shortfall in availability of the crucial but often overlooked material.
T-Mobile to pay $500M for one of the largest data breaches in US history
When T-Mobile compromised the sensitive personal information of more than 76 million current, former, and prospective customers in 2021, plaintiffs involved in a class action lawsuit complained that the company continued profiting off their data while attempting to cover up “one of the largest and most consequential data breaches in US history.” Now, T-Mobile has admitted no guilt but has agreed to pay a $500 million settlement (pending a judge’s approval), out of which $350 million will go to the settlement fund and “at least $150 million” will go toward enhancing its data security measures through 2023.
INCIDENTS:
Ransomware group targets Italian tax agency
Italian authorities are investigating the theft of roughly 78 gigabytes of data stolen from Italy’s tax agency, l’Agenzia delle Entrate, the Italian news agency ANSA reported Monday. Earlier Monday, LockBit 3.0, one of the most active and prolific ransomware groups going, posted a notice to its website claiming it had stolen “100GB: company documents, scans, financial reports, contracts” from the agency, along with six screenshots purporting to show a sample of the files.
The Unsolved Mystery Attack on Internet Cables in Paris
BURIED DEEP BENEATH your feet lie the cables that keep the internet online. Crossing cities, countrysides, and seas, the internet backbone carries all the data needed to keep economies running and your Instagram feed scrolling. Unless, of course, someone chops the wires in half. On April 27, an unknown individual or group deliberately cut crucial long-distance internet cables across multiple sites near Paris, plunging thousands of people into a connectivity blackout. The vandalism was one of the most significant internet infrastructure attacks in France’s history and highlights the vulnerability of key communications technologies.
https://www.wired.com/story/france-paris-internet-cable-cuts-attack/
MALWARE:
Cyberspies use Google Chrome extension to steal emails undetected
A North Korean-backed threat group tracked as Kimsuky is using a malicious browser extension to steal emails from Google Chrome or Microsoft Edge users reading their webmail. The extension, dubbed SHARPEXT by Volexity researchers who spotted this campaign in September, supports three Chromium-based web browsers (Chrome, Edge, and Whale) and can steal mail from Gmail and AOL accounts. The attackers install the malicious extension after compromising a target’s system using a custom VBS script by replacing the ‘Preferences’ and ‘Secure Preferences’ files with ones downloaded from the malware’s command-and-control server.
Snowballing Ransomware Variants Highlight Growing Threat to VMware ESXi Environments
The latest confirmations of the growing attacker interest in VMware ESXi environments are two ransomware variants that surfaced in recent weeks and have begun hitting targets worldwide. One of the malware tools, dubbed Luna, is written in Rust and can encrypt data on ESXi virtual machines (VMs) in addition to data on Linux and Window systems. The other is Black Basta, a rapidly proliferating ransomware variant written in C++ that, like Luna, targets ESXi VMs and also works on Windows and Linux systems as well. They add to a collection of ransomware variants aimed at ESXi, VMware’s bare- metal hypervisor for running virtual machines. Numerous organizations use the technology to deploy multiple VMs on a single host system or across a cluster of host systems, making the environment an ideal target for attackers looking to cause widespread damage.
VULNERABILITIES:
Moxa NPort Device Flaws Can Expose Critical Infrastructure to Disruptive Attacks
Two potentially serious vulnerabilities that could allow threat actors to cause significant disruption have been found in a widely used industrial connectivity device made by Moxa. The Taiwan-based industrial networking and automation solutions provider has addressed the flaws. The two security holes, tracked as CVE-2022-2043 and CVE-2022-2044 and rated ‘high severity’, affect Moxa’s NPort 5110 device servers, which are designed for connecting serial devices to Ethernet networks. The vulnerabilities can be exploited by a remote attacker to cause the targeted device to enter a denial of service (DoS) condition.
https://www.icsrange.com/blog/two-moxa-zerodays
Attackers increasingly abusing IIS extensions to establish covert backdoors
Microsoft warns of threat actors that are increasingly abusing Internet Information Services (IIS) extensions to establish covert backdoors into servers and maintain persistence in the target networks. IIS backdoors are also hard to detect because they follow the same code structure as legitimate and harmless modules. The attackers usually exploit a critical vulnerability in the hosted application to gain initial access and drop a script web shell as the first stage of the attack chain. Then the web shell is used to install a rogue IIS module that establishes persistent access to the server which is hard to discover. The shell also monitors incoming and outgoing requests and runs commands sent by remote attackers, it also allows attackers to dump credentials in the background as the user authenticates to the web application.
Critical FileWave MDM Flaws Open Organization-Managed Devices to Remote Hackers
FileWave’s mobile device management (MDM) system has been found vulnerable to two critical security flaws that could be leveraged to carry out remote attacks and seize control of a fleet of devices connected to it. “The vulnerabilities are remotely exploitable and enable an attacker to bypass authentication mechanisms and gain full control over the MDM platform and its managed devices,” Claroty security researcher Noam Moshe said in a Monday report. FileWave MDM is a cross-platform mobile device management solution that allows IT administrators to manage and monitor all of an organization’s devices, including mobile phones, tablets, laptops, workstations, and smart TVs.
https://thehackernews.com/2022/07/critical-filewave-mdm-flaws-open.html
Cyber4Dev collates data from Open Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
