6 Ransomware Trends & Evolutions For 2023
More than any other industry, cybersecurity is constantly changing. But the number of major paradigm shifts that transformed the world of cybersecurity in the past few years has been unprecedented, especially when it comes to combating ransomware. The costly and global threat of ransomware has evolved alongside changing technology in the past two decades. Just as threat researchers and engineers rethink their solutions when the currents of cybersecurity shift, their adversaries are always following the latest trends to successfully target their victims.
https://www.trendmicro.com/en_us/ciso/23/b/ransomware-trends-evolutions-2023.html
ChatGPT May Already Be Used In Nation State Cyberattacks, Say IT Decision Makers in BlackBerry Global Research
BlackBerry Limited today released new research revealing that half (51%) of IT professionals predict that we are less than a year away from a successful cyberattack being credited to ChatGPT, and 71% believe that foreign states may already be using the technology for malicious purposes against other nations. The survey of 1,500 IT decision makers across North America, UK, and Australia exposed a perception that, although respondents in all countries see ChatGPT as generally being put to use for ‘good’ purposes, 74% acknowledge its potential threat to cybersecurity and are concerned.
North Korean hackers stole research data in two-month-long breach
A new cyber espionage campaign dubbed ‘No Pineapple!’ has been attributed to the North Korean Lazarus hacking group, allowing the threat actors to stealthily steal 100GB of data from the victim without causing any destruction. The campaign lasted between August and November 2022, targeting organizations in medical research, healthcare, chemical engineering, energy, defense, and a leading research university. The operation was discovered by Finnish cybersecurity firm WithSecure, whose analysts were called to investigate a potential ransomware incident on one of its customers.
Why CISOs Should Care About Brand Impersonation Scam Sites
Enterprises often don’t know whose responsibility it is to monitor for spoofed brand sites and scams that steal customers’ trust, money, and personally identifiable information. Impersonation stands at the heart of so many cybercriminal schemes today. Whether used to fuel traditional phishing or malware propagation attacks, business email compromise (BEC), advertising fraud, or e-commerce fraud, there’s nothing quite so effective as piggybacking off the trust and goodwill of a brand to lure people into a scam.
https://www.darkreading.com/edge-articles/why-cisos-should-care-about-brand-impersonation-scam-sites
INCIDENTS:
Ransomware attack halts London trading
Ion Markets, a financial data group crucial to the financial plumbing underlying the derivatives trading industry, has fallen prey to the cybercrime group Lockbit. The company has revealed that 42 clients have been affected by the attack, which has caused major disruption in its cleared derivatives division. Reports suggest that some clients have been unable to contact Ion by phone since Tuesday, with some travelling to the company’s office at St Pauls to seek more information. “The incident is contained to a specific environment, all the affected servers are disconnected, and remediation of services is ongoing,” according to a post on Ion’s website.
New DDoS-as-a-Service platform used in recent attacks on hospitals
A new DDoS-as-a-Service (DDoSaaS) platform named ‘Passion’ was seen used in recent attacks by pro-Russian hacktivists against medical institutions in the United States and Europe. A DDoS (distributed denial of service) attack is when threat actors send many requests and garbage traffic to a target server to overwhelm the server and cause it to stop responding to legitimate requests. DDoSaaS platforms rent their available firepower to those looking to launch disruptive attacks on their targets, absolving them from the need to build their own large botnets or coordinate volunteer action.
GitHub Breach: Hackers Stole Code-Signing Certificates for GitHub Desktop and Atom
GitHub on Monday disclosed that unknown threat actors managed to exfiltrate encrypted code signing certificates pertaining to some versions of GitHub Desktop for Mac and Atom apps. As a result, the company is taking the step of revoking the exposed certificates out of abundance of caution. The following versions of GitHub Desktop for Mac have been invalidated: 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.1.0, 3.1.1, and 3.1.2.
https://thehackernews.com/2023/01/github-breach-hackers-stole-code.html
MALWARE:
Google ads push ‘virtualized’ malware made for antivirus evasion
An ongoing Google ads malvertising campaign is spreading malware installers that leverage KoiVM virtualization technology to evade detection when installing the Formbook data stealer. KoiVM is a plugin for the ConfuserEx .NET protector that obfuscates a program’s opcodes so that the virtual machine only understands them. Then, when launched, the virtual machine translates the opcodes back to their original form so that the application can be executed.
PoS malware can block contactless payments to steal credit cards
New versions of the Prilex point-of-sale malware can block secure, NFC-enabled contactless credit card transactions, forcing consumers to insert credit cards that are then stolen by the malware. On a payment terminal, contactless transactions use NFC (Near Field Communication) chips embedded in credit cards and mobile devices to conduct close-proximity payments via credit cards, smartphones, or even smartwatches. They are very convenient, and their popularity has exploded since the COVID-19 pandemic, with over $34.55 billion in contactless transactions recorded in 2021.
Dutch, European Hospitals ‘Hit by Pro-Russian Hackers’
Dutch cyber authorities said Wednesday that several hospital websites in the Netherlands and Europe were likely targeted by a pro-Kremlin hacking group because of their countries’ support for Ukraine. The UMCG hospital in the northern Dutch city of Groningen, one of the largest in the country, saw its website crash in a cyberattack on Saturday.
VULNERABILITIES:
Vulnerability in Cisco industrial appliances is a potential nightmare (CVE-2023-20076)
Cisco has released patches for a high-severity vulnerability (CVE-2023-20076) found in some of its industrial routers, gateways and enterprise wireless access points, which may allow attackers to insert malicious code that can’t be deleted by simply rebooting the device or updating its firmware.
30k Internet-Exposed QNAP NAS Devices Affected by Recent Vulnerability
Attack surface management firm Censys has identified roughly 30,000 internet-exposed QNAP network- attached storage (NAS) appliances that are likely affected by a recently disclosed critical-severity code injection vulnerability. Tracked as CVE-2022-27596 (CVSS score of 9.8), the security defect is described as an SQL injection bug that allows remote attackers to inject malicious code into vulnerable NAS devices.
Exploit released for critical VMware vRealize RCE vulnerability
Horizon3 security researchers have released proof-of-concept (PoC) code for a VMware vRealize Log Insight vulnerability chain that allows attackers to gain remote code execution on unpatched appliances. VMware patched four security vulnerabilities in its vRealize log analysis tool last week, two being critical and allowing remote attackers to execute code on compromised devices. Both are tagged as critical severity with CVSS base scores of 9.8/10 and can be exploited as part of low-complexity attacks that don’t require user interaction.
Cyber4Dev collates data from Open-Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
