Android mobile devices from top vendors in China have pre-installed malware
Researchers reported that the top-of-the-line Android mobile devices sold in China are shipped with malware. China is currently the country with the largest number of Android mobile devices, but a recent study conducted by researchers from the University of Edinburgh and the Trinity College of Dublin revealed that top-of-the-line Android devices sold in the country are shipped with spyware.
Ransomware Revolution: 4 Types of Cyber Risks in 2023
Security leaders and CISOs have been protecting their organizations from ransomware for decades, adapting with changes in technology to defend against the costly risks of stolen data or interruptions to critical systems. But adversaries always have new tricks up their sleeves and now the global community of ransomware groups seems poised for a revolution that could make them more effective, versatile, and dangerous. How will ransomware’s business model change?
https://www.trendmicro.com/en_us/ciso/23/b/cyber-risk-types-2023.html
Keeping KillNet at Bay: Use the IP Address Blocklist
SecurityScorecard has pulled together a list of proxy IP addresses used by KillNet to launch distributed denial-of-service attacks (DDoS) against various entities around the world over the past year. KillNet has taken responsibility for DDoS attacks against US-based hospitals and airports, as well as financial and government organizations in Germany. The pro-Russian group is targeting countries supporting Ukraine, especially NATO countries. In a DDoS attack, the attack group cause thousands of connection requests and packets to be sent to the targeted entity’s server or website per minute.
https://www.darkreading.com/dr-tech/keeping-killnet-at-bay-use-the-ip-address-blocklist
Patching & Passwords Lead the Problem Pack for Cyber-Teams
Weak credential policies and a lax approach to patching were among the most common points of IT security failure for organizations in 2022, while a failure to configure tools properly could leave organizations open to attack. That’s according to a recent study by cybersecurity firm Horizon3.ai, based on findings from approximately 7,000 penetration tests that evaluated approximately 1 million assets. Of the Top 10 vulnerabilities Horizon3.ai detected in 2022, the use of weak or reused credentials topped the list, followed by weak or default credential checks in protocols (SSH and FTP) and threat actors using Dark Web credential dumps from Windows or Linux hosts.
https://www.darkreading.com/cloud/patching-passwords-problem-pack-cyber-teams
INCIDENTS:
Hackers breach Reddit to steal source code and internal data
Reddit suffered a cyberattack Sunday evening, allowing hackers to access internal business systems and steal internal documents and source code. The company says the hackers used a phishing lure targeting Reddit employees with a landing page impersonating its intranet site. This site attempted to steal employees’ credentials and two-factor authentication tokens. After one employee fell victim to the phishing attack, the threat actor was able to breach internal Reddit systems to steal data and source code.
British steel industry supplier Vesuvius ‘currently managing cyber incident’
Engineering company Vesuvius Plc, which produces ceramics used by steelmakers, reported Monday that it was “currently managing a cyber incident.” The British manufacturer confirmed that the incident “involved unauthorized access to our systems,” although it did not provide further details on what the access was or what kind of cyber actor may have been responsible. Vesuvius, which employs more than 10,000 people and is one of the 350 most valuable businesses listed on the London Stock Exchange, disclosed the incident through the Regulatory News Service.
https://therecord.media/vesuvius-plc-cyber-incident-steel-industry-supplier/
MALWARE:
CISA releases recovery script for ESXiArgs ransomware victims
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released a script to recover VMware ESXi servers encrypted by the recent widespread ESXiArgs ransomware attacks. Starting last Friday, exposed VMware ESXi servers were targeted in a widespread ESXiArgs ransomware attack. Since then, the attacks encrypted 2,800 servers according to a list of bitcoin addresses collected by CISA technical advisor Jack Cable.
A new variant of ESXiArgs ransomware makes recovery much harder
Experts warn of new ESXiArgs ransomware attacks using an upgraded version that makes it harder to recover VMware ESXi virtual machines. Experts spotted a new variant of ESXiArgs ransomware targeting VMware ESXi servers, authors have improved the encryption process, making it much harder to recover the encrypted virtual machines. The new variant was spotted less than a week after the first alert was launched by CERT-FR warning of an ESXi ransomware targeting thousands of VMware servers in a global- scale campaign.
VULNERABILITIES:
Critical Infrastructure at Risk from New Vulnerabilities Found in Wireless IIoT Devices
A set of 38 security vulnerabilities has been uncovered in wireless industrial internet of things (IIoT) devices from four different vendors that could pose a significant attack surface for threat actors looking to exploit operational technology (OT) environments. “Threat actors can exploit vulnerabilities in Wireless IIoT devices to gain initial access to internal OT networks,” Israeli industrial cybersecurity company Otorio said. “They can use these vulnerabilities to bypass security layers and infiltrate target networks, putting critical infrastructure at risk or interrupting manufacturing.”
https://thehackernews.com/2023/02/critical-infrastructure-at-risk-from.html
Vulnerability Provided Access to Toyota Supplier Management Network
A severe vulnerability in the web portal of Toyota’s global supplier management network allowed a security researcher to gain access to sensitive information. The issue was identified by US-based researcher Eaton Zveare in Toyota’s Global Supplier Preparation Information Management System (GSPIMS), a web portal that provides Toyota employees and suppliers with access to ongoing projects, surveys, information on purchases, and more. The issue, Zveare says, was related to the implementation of JWT (JSON Web Token) authentication and could allow access to any account to anyone using a valid email address. Essentially, JWT is a session token that is typically generated when logging in to a website, and which is then used to authenticate the user to secure sections of the website or APIs.
Cyber4Dev collates data from Open-Source websites, any opinions or attributions expressed in the articles are not those of Cyber4Dev and are not endorsed by the project or the EU.
