Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Insurer Refuses to Pay Out After Victim Misrepresented Their Cyber Controls
In what may be one of the first court filings of its kind, insurer Travelers is asking a district court for a ruling to rescind a policy because the insured allegedly misrepresented its use of multifactor authentication (MFA) – a condition to get cyber coverage.
According to a July filing, Travelers said it would not have issued a cyber insurance policy in April to electronics manufacturing services company International Control Services (ICS) if the insurer knew the company was not using MFA as it said. Additionally, Travelers wants no part of any losses, costs, or claims from ICS – including from a May ransomware attack ICS suffered.
Travelers alleged ICS submitted a cyber policy application signed by its CEO and “a person responsible for the applicant’s network and information security” that the company used MFA for administrative or privileged access. However, following the May ransomware event, Travelers first learned during an investigation that the insured was not using the security control to protect its server and “only used MFA to protect its firewall, and did not use MFA to protect any other digital assets.”
Therefore, statements ICS made in the application were “misrepresentations, omissions, concealment of facts, and incorrect statements” – all of which “materially affected the acceptance of the risk and/or the hazard assumed by Travelers,” the insurer alleged in the filing.
ICS also was the victim of a ransomware attack in December 2020 when hackers gained access using the username and password of an ICS administrator, Travelers said. ICS told the insurer of the attack during the application process and said it improved the company’s cyber security.
Travelers said it wants the court to declare the insurance contract null and void, rescind the policy, and declare it has no duty to indemnify or defend ICS for any claim.
https://www.insurancejournal.com/news/national/2022/07/12/675516.htm#
5 Cyber Security Questions CFOs Should Ask CISOs
Armed with the answers, chief financial officers can play an essential role in reducing cyber risk.
Even in a shrinking economy, organisations are likely to maintain their level of cyber security spend. But that doesn’t mean in the current economic climate of burgeoning costs and a possible recession they won’t take a magnifying glass to how they are spending the money budgeted to defend systems and data. Indeed, at many companies, cyber security spending isn’t targeting the most significant dangers, according to experts — as evidenced by the large number of successful ransomware attacks and data breaches.
Without a comprehensive understanding of the security landscape and what the organisation needs to do to protect itself, how can CFOs make the right decisions when it comes to investments in cyber security technology and other resources? They can’t.
So, CFOs need to ensure they have a timely grasp of the security issues their organisation faces. That requires turning to the most knowledgeable people in the organisation: chief information security officers (CISOs) and other security leaders on the IT front lines.
Here are five questions CFOs should be asking their CISOs about the security of their companies.
How secure are we as an organisation?
What are the main security threats or risks in our industry?
How do we ensure that the cyber security team and the CISO are involved in business development?
What are the risks and potential costs of not implementing a cyber control?
Do employees understand information security and are they implementing security protocols successfully?
The Biggest Cyber Attacks in 2022 So Far — and it’s Just the Tip of the Iceberg
For those in the cyber resilience realm, it’s no surprise that there’s a continued uptick in cyber attacks. Hackers are hacking, thieves are thieving and ransomers are — you guessed it — ransoming. In other words, cyber crime is absolutely a growth industry.
As we cross into the second half of this year, let’s look at some of the most significant attacks so far:
Blockchain schmockchain. Cryptocurrency exchange Crypto.com’s two-factor-identification (2FA) system was compromised as thieves made off with approximately $30 million.
Still the one they run to. Microsoft’s ubiquity makes it a constant target. Earlier this year, the hacking collective Lapsus$ compromised Cortana and Bing, among other Microsoft products, posting source code online.
Not necessarily the news. News Corp. journalist emails and documents were accessed at properties including the Wall Street Journal, Dow Jones and the New York Post in a hack tied to China.
Uncharitable ways. The Red Cross was the target of an attack earlier this year, with more than half a million “highly vulnerable” records of Red Cross assistance recipients compromised.
Victim of success. North Korea’s Lazarus Group made off with $600 million in cryptocurrencies after blockchain gaming platform Ronin relaxed some of its security protocols so its servers could better handle its growing popularity.
We can hear you now. State-sponsored hackers in China have breached global telecom powerhouses worldwide this year, according to the U.S. Cybersecurity & Infrastructure Security Agency.
Politics, the art of the possible. Christian crowdfunding site GiveSendGo was breached twice this year as hacktivists exposed the records of donors to Canada’s Freedom Convoy.
Disgruntled revenge. Businesspeople everywhere were reminded of the risks associated with departing personnel when fintech powerhouse Block announced that a former employee accessed sensitive customer information, impacting eight million customers.
Unhealthy habits. Two million sensitive customer records were exposed when hackers breached Shields Health Care’s network.
They even stole the rewards points. General Motors revealed that hackers used a credentials stuffing attack to access personal information on an undisclosed number of car owners. They even stole gift-card-redeemable customer reward points.
For every breach or attack that generates headlines, millions of others that we never hear about put businesses at risk regularly. The Anti-Phishing Working Group just released data for the first quarter of this year, and the trend isn’t good. Recorded phishing attacks are at an all-time high (more than a million in just the first quarter) and were accelerating as the quarter closed, with March 2022 setting a new record for single-month attacks.
Malware-as-a-Service Creating New Cyber Crime Ecosystem
This week HP released their report The Evolution of Cybercrime: Why the Dark Web is Supercharging the Threat Landscape and How to Fight Back, exploring how cyber-criminals are increasingly operating in a quasi-professional manner, with malware and ransomware attacks being offered on a ‘software-as-a-service’ basis.
The report’s findings showed how cyber crime is being supercharged through “plug and play” malware kits that are easier than ever to launch attacks. Additionally, cyber syndicates are now collaborating with amateur attackers to target businesses, putting the online world and its users at risk.
The report’s methodology saw HP’s Wolf Security threat team work in tandem with dark-web investigation firm Forensic Pathways to scrape and analyse over 35 million cyber criminal marketplaces and forum posts between February and March 2022, with the investigation helping to gain a deeper understanding of how cyber criminals operate, gain trust, and build reputation. Its key findings include:
Malware is cheap and readily available: Over three-quarters (76%) of malware advertisements listed, and 91% of exploits (i.e. code that gives attackers control over systems by taking advantage of software bugs), retail for under $10.
Trust and reputation are ironically essential parts of cyber-criminal commerce: Over three-quarters (77%) of cyber criminal marketplaces analysed require a vendor bond – a license to sell – which can cost up to $3000. Of these, 92% have a third-party dispute resolution service.
Popular software is giving cyber criminals a foot in the door: Kits that exploit vulnerabilities in niche systems command the highest prices (typically ranging from $1,000-$4,000), while zero day vulnerabilities are retailing at 10s of thousands of pounds on dark web markets.
https://www.infosecurity-magazine.com/news/malware-service-cybercrime/
The Rise and Continuing Popularity of LinkedIn-Themed Phishing
Phishing emails impersonating LinkedIn continue to make the bulk of all brand phishing attempts. According to Check Point, 45% of all email phishing attempts in Q2 2022 imitated the style of communication of the professional social media platform, with the goal of directing targets to a spoofed LinkedIn login page and collecting their account credentials.
The phishers are generally trying to pique the targets’ interest with fake messages claiming that they “have appeared in X searches this week”, that a new message is waiting for them, or that another user would like to do business with them, and are obviously taking advantage of the fact that a record number of individuals are switching or are considering quitting their job and are looking for a new one.
To compare: In Q4 2021, LinkedIn-themed phishing attempts were just 8 percent of the total brand phishing attacks flagged by Check Point. Also, according to Vade Secure, in 2021 the number of LinkedIn-themed phishing pages linked from unique phishing emails was considerably lower than those impersonating other social networks (Facebook, WhatsApp).
Other brands that phishers loved to impersonate during Q2 2022 are (unsurprisingly) Microsoft (13%), DHL (12%) and Amazon (9%).
https://www.helpnetsecurity.com/2022/07/21/linkedin-phishing/
Microsoft Teams Default Settings Leave Organisations Open to Cyber Attacks
Relying on default settings on Microsoft Teams leaves organisations and users open to threats from external domains, and misconfigurations can prove perilous to high-value targets.
Microsoft Teams has over 270 million active monthly users, with government institutions using the software in the US, UK, Netherlands, Germany, Lithuania, and other countries at varying levels.
Cyber security researchers have discovered that relying on default MS Teams settings can leave firms and high-value users vulnerable to social engineering attacks. Attackers could create group chats, masquerade as seniors within the target organisation and observe whether users are online.
Attackers could, rather convincingly, impersonate high-ranking officials and possibly strike up conversations, fooling victims into believing they’re discussing sensitive topics with a superior. Skilled attackers could do a lot of harm with this capability.
https://cybernews.com/security/microsoft-teams-settings-leave-govt-officials-open-to-cyberattacks/
Top 10 Cyber Security Attacks of Last Decade Show What is to Come
Past is prologue, wrote William Shakespeare in his play “The Tempest,” meaning that the present can often be determined by what has come before. So it is with cyber security, serving as the basis of which is Trustwave’s “Decade Retrospective: The State of Vulnerabilities” over the last 10 years.
Threat actors frequently revisit well-known and previously patched vulnerabilities to take advantage of continuing poor cyber security hygiene. “If one does not know what has recently taken place it leaves you vulnerable to another attack,” Trustwave said in its report that identifies and examines the “watershed moments” that shaped cyber security between 2011 and 2021.
With a backdrop of the number of security incidents and vulnerabilities increasing in volume and sophistication, here are Trustwave’s top 10 network vulnerabilities in no particular order that defined the decade and “won’t be forgotten.”
SolarWinds hack and FireEye breach, Detected: December 8, 2020 (FireEye)
EternalBlue Exploit, Detected: April 14, 2017
Heartbleed, Detected: March 21, 2014
Shellshock, Remote Code Execution in BASH, Detected: September 12, 2014
Apache Struts Remote Command Injection & Equifax Breach, Detected: March 6, 2017
Chipocalypse, Speculative Execution Vulnerabilities Meltdown & Spectre
BlueKeep, Remote Desktop as an Access Vector, Detected: January, 2018
Drupalgeddon Series, CMS Vulnerabilities, Detected: January, 2018
Microsoft Windows OLE Vulnerability, Sandworm Exploit, Detected: September 3, 2014
Ripple20 Vulnerabilities, Growing IoT landscape, Detected: June 16, 2020
Software Supply Chain Concerns Reach C-Suite
Major supply chain attacks have had a significant impact on software security awareness and decision-making, with more investment planned for monitoring attack surfaces.
Organisations are waking up to the need to establish better software supply chain risk management policies and are taking action to address the escalating threats and vulnerabilities targeting this expanding attack surface.
These were among the findings of a CyberRisk Alliance-conducted survey of 300 respondents from both software-buying and software-producing companies.
Most survey respondents (52%) said they are "very" or "extremely" concerned about software supply chain risks, and 84% of respondents said their organisation is likely to allocate at least 5% of their AppSec budgets to manage software supply chain risk.
Software buyers are planning to invest in procurement program metrics and reporting, application pen-testing, and software build of materials (SBOM) design and implementation, according to the findings.
Meanwhile, software developers said they plan to invest in secure code review as well as SBOM design and implementation.
https://www.darkreading.com/application-security/software-supply-chain-concerns-reach-c-suite
EU Warns of Russian Cyber Attack Spillover, Escalation Risks
The Council of the European Union (EU) said that Russian hackers and hacker groups increasingly attacking "essential" organisations worldwide could lead to spillover risks and potential escalation.
"This increase in malicious cyber activities, in the context of the war against Ukraine, creates unacceptable risks of spillover effects, misinterpretation and possible escalation," the High Representative on behalf of the EU said.
"The latest distributed denial-of-service (DDoS) attacks against several EU Member States and partners claimed by pro-Russian hacker groups are yet another example of the heightened and tense cyber threat landscape that EU and its Member States have observed."
In this context, the EU reminded Russia that all United Nations member states must adhere to the UN's Framework of responsible state behaviour in cyberspace to ensure international security and peace.
The EU urged all states to take any actions required to stop malicious cyber activities conducted from their territory.
The EU's statement follows a February joint warning from CISA and the FBI that wiper malware attacks targeting Ukraine could spill over to targets from other countries.
Google's Threat Analysis Group (TAG) said in late March that it observed phishing attacks orchestrated by the Russian COLDRIVER hacking group against NATO and European military entities.
In May, the US, UK, and EU accused Russia of coordinating a massive cyber attack that hit the KA-SAT consumer-oriented satellite broadband service in Ukraine on February 24 with AcidRain data destroying malware, approximately one hour before Russia invaded Ukraine.
A Microsoft report from June also confirms the EU's observation of an increase in Russian malicious cyber activities. The company's president said that threat groups linked to Russian intelligence agencies (including the GRU, SVR, and FSB) stepped up cyber attacks against government entities in countries allied with Ukraine after Russia's invasion.
In related news, in July 2021, President Joe Biden warned that cyber attacks leading to severe security breaches could lead to a "real shooting war," a statement issued a month after NATO said that cyber attacks could be compared to "armed attacks" in some circumstances.
Critical Flaws in GPS Tracker Enable “Disastrous” and “Life-Threatening” Hacks
A security firm and the US government are advising the public to immediately stop using a popular GPS tracking device or to at least minimise exposure to it, citing a host of vulnerabilities that make it possible for hackers to remotely disable cars while they’re moving, track location histories, disarm alarms, and cut off fuel.
An assessment from security firm BitSight found six vulnerabilities in the Micodus MV720, a GPS tracker that sells for about $20 and is widely available. The researchers who performed the assessment believe the same critical vulnerabilities are present in other Micodus tracker models. The China-based manufacturer says 1.5 million of its tracking devices are deployed across 420,000 customers. BitSight found the device in use in 169 countries, with customers including governments, militaries, law enforcement agencies, and aerospace, shipping, and manufacturing companies.
BitSight discovered what it said were six “severe” vulnerabilities in the device that allow for a host of possible attacks. One flaw is the use of unencrypted HTTP communications that makes it possible for remote hackers to conduct adversary-in-the-middle attacks that intercept or change requests sent between the mobile application and supporting servers. Other vulnerabilities include a flawed authentication mechanism in the mobile app that can allow attackers to access the hardcoded key for locking down the trackers and the ability to use a custom IP address that makes it possible for hackers to monitor and control all communications to and from the device.
Russian Hackers Behind Solarwinds Breach Continue to Scour US And European Organisations for Intel, Researchers Say
The Russian hackers behind a sweeping 2020 breach of US government networks have in recent months continued to hack US organisations to collect intelligence while also targeting an unnamed European government that is a NATO member.
The new findings show how relentless the hacking group — which US officials have linked with Russia's foreign intelligence service — is in its pursuit of intelligence held by the US and its allies, and how adept the hackers are at targeting widely used cloud-computing technologies.
The hacking efforts come as Russia's invasion of Ukraine continues to fray US-Russia relations and drive intelligence collection efforts from both governments.
In recent months, the hacking group has compromised the networks of US-based organisations that have data of interest to the Russian government.
In separate activity revealed Tuesday, US cyber security firm Palo Alto Networks said that the Russian hacking group had been using popular services like Dropbox and Google Drive to try to deliver malicious software to the embassies of an unnamed European government in Portugal and Brazil in May and June.
https://edition.cnn.com/2022/07/19/politics/russia-solarwinds-hackers/index.html
The Next Big Security Threat Is Staring Us in The Face. Tackling It Is Going to Be Tough
If the ongoing fight against ransomware wasn't keeping security teams busy, along with the challenges of securing the ever-expanding galaxy of Internet of Things devices, or cloud computing, then there's a new challenge on the horizon – protecting against the coming wave of digital imposters or deepfakes.
A deepfake video uses artificial intelligence and deep-learning techniques to produce fake images of people or events.
One recent example is when the mayor of Berlin thought he was having an online meeting with former boxing champion and current mayor of Kyiv, Vitali Klitschko. But the mayor of Berlin grew suspicious when 'Klitschko' started saying some very out of character things relating to the invasion of Ukraine, and when the call was interrupted the mayor's office contacted the Ukrainian ambassador to Berlin – to discover that, whoever they were talking to, it wasn't the real Klitschko.
It's a sign that deepfakes are getting more advanced and quickly. Previous instances of deepfake videos that have gone viral often have tell-tale signs that something isn't real, such as unconvincing edits or odd movements, but the developments in deepfake technology mean it isn't difficult to imagine it being exploited by cyber criminals, particularly when it comes to stealing money.
While ransomware might generate more headlines, business email compromise (BEC) is the costliest form of cyber crime today. The FBI estimates that it costs businesses billions of dollars every year. The most common form of BEC attack involves cyber criminals exploiting emails, hacking into accounts belonging to bosses – or cleverly spoofing their email accounts – and asking staff to authorise large financial transactions, which can often amount to hundreds of thousands of dollars.
The emails claim that the money needs to be sent urgently, maybe as part of a secret business deal that can't be disclosed to anyone. It's a classic social-engineering trick designed to force the victim into transferring money quickly and without asking for confirmation from anyone else who could reveal it's a fake request. By the time anyone might be suspicious, the cyber criminals have taken the money, likely closed the bank account they used for the transfer – and run.
BEC attacks are successful, but many people might remain suspicious of an email from their boss that comes out the blue and they could avoid falling victim by speaking to someone to confirm that it's not real. But if cyber criminals could use a deepfake to make the request, it could be much more difficult for victims to deny the request, because they believe they're actually speaking to their boss on camera.
Many companies publicly list their board of directors and senior management on their website. Often, these high-level business executives will have spoken at events or in the media, so it's possible to find footage of them speaking. By using AI-powered deep-learning techniques, cyber criminals could exploit this public information to create a deepfake of a senior-level executive, exploit email vulnerabilities to request a video call with an employee, and then ask them to make the transaction. If the victim believes they're speaking to their CEO or boss, they're unlikely to deny the request.
Threats
Ransomware
Post-Breakup, Conti Ransomware Members Remain Dangerous (darkreading.com)
The Kronos Ransomware Attack: What You Need to Know So Your Business Isn't Next (darkreading.com)
New Luna ransomware encrypts Windows, Linux, and ESXi systems (bleepingcomputer.com)
Digital security giant Entrust breached by ransomware gang (bleepingcomputer.com)
Protecting Against Kubernetes-Borne Ransomware (darkreading.com)
Knauf cyber attack: Black Basta ransomware gang claims responsibility (techmonitor.ai)
New Redeemer ransomware version promoted on hacker forums (bleepingcomputer.com)
Kaspersky report on Luna and Black Basta ransomware | Securelist
New Cross-Platform 'Luna' Ransomware Only Offered to Russian Affiliates | SecurityWeek.Com
Conti’s Reign of Chaos: Costa Rica in the Crosshairs | Threatpost
Researchers uncover potential ransomware network with U.S. connections - CyberScoop
How Conti ransomware hacked and encrypted the Costa Rican government (bleepingcomputer.com)
A small Canadian town is being extorted by a global ransomware gang - The Verge
BEC – Business Email Compromise
Phishing & Email Based Attacks
Phishing Bonanza: Social-Engineering Savvy Skyrockets as Malicious Actors Cash In (darkreading.com)
Outlook users report suspicious activity from Microsoft IPs • The Register
PayPal Used to Send Malicious “Double Spear” Invoices - Infosecurity Magazine
LinkedIn remains the most impersonated brand in phishing attacks (bleepingcomputer.com)
Google Calendar provides new way to block invitation phishing (bleepingcomputer.com)
Other Social Engineering
Malware
Hacking group '8220' grows cloud botnet to more than 30,000 hosts (bleepingcomputer.com)
Buy ‘plug-n-play’ malware for the price of a pint of beer (computerweekly.com)
New ‘Lightning Framework’ Linux malware installs rootkits, backdoors (bleepingcomputer.com)
Mobile
Google pulls malware-infected apps, 3 million users at risk • The Register
Roaming Mantis hits Android and iOS users in malware, phishing attacks (bleepingcomputer.com)
BYOD
Data Breaches/Leaks
Neopets data breach exposes personal data of 69 million members (bleepingcomputer.com)
Verified Twitter Vulnerability Exposes Data from 5.4 Million Accounts | RestorePrivacy
Mixed Messages as Neopets Scrambles to Respond to Mega Breach - Infosecurity Magazine
Organised Crime & Criminal Actors
Cyber crime escalates as barriers to entry crumble | CSO Online
Understanding the Evolution of Cyber Crime to Predict its Future | SecurityWeek.Com
The growth in targeted, sophisticated cyber attacks troubles top FBI cyber official - CyberScoop
'AIG' Threat Group Launches with Unique Business Model (darkreading.com)
US DOJ report warns of escalating cyber crime, 'blended' threats (techtarget.com)
Chaotic LAPSUS$ Group Goes Quiet, but Threat Likely Persists (darkreading.com)
Last member of Gozi malware troika arrives in US for criminal trial – Naked Security (sophos.com)
Romanian hacker faces US trial over virus-for-hire service - The Verge
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
This Cloud Botnet Has Hijacked 30,000 Systems to Mine Cryptocurrencies (thehackernews.com)
Hackers Use Evilnum Malware to Target Cryptocurrency and Commodities Platforms (thehackernews.com)
Singapore distances itself from local crypto companies • The Register
FBI Warns Fake Crypto Apps are Bilking Investors of Millions | Threatpost
Ex-Coinbase manager charged in crypto insider trading case • The Register
FBI Warns of Fake Cryptocurrency Apps Stealing Millions from Investors (thehackernews.com)
My Big Coin founder guilty of $6m crypto-fraud • The Register
Insider Risk and Insider Threats
Fraud, Scams & Financial Crime
AML/CFT/Sanctions
UK Regulator Issues Record Fines as Financial Crime Surges - Infosecurity Magazine
Broker Fined £2m for Financial Crime Control Failings - Infosecurity Magazine
Insurance
82% of global insurers expect the rise in cyber insurance premiums to continue - Help Net Security
Will Your Cyber Insurance Premiums Protect You in Times of War? (darkreading.com)
Dark Web
Supply Chain and Third Parties
Software Supply Chain
Improving Software Supply Chain Cyber Security (trendmicro.com)
Why SBOMs aren't the silver bullet they're portrayed as - Help Net Security
Breaking down CIS's new software supply chain security guidance | CSO Online
Cloud/SaaS
60% of IT leaders are not confident about their secure cloud access - Help Net Security
Public Cloud Customers Admit Security Challenges - Infosecurity Magazine
The New Weak Link in SaaS Security: Devices (thehackernews.com)
Identity and Access Management
Encryption
Open Source
Open source security needs automation as usage climbs amongst organisations | ZDNet
New ‘Lightning Framework’ Linux malware installs rootkits, backdoors (bleepingcomputer.com)
The US military wants to understand the most important software on earth | MIT Technology Review
Passwords, Credential Stuffing & Brute Force Attacks
The importance of secure passwords can't be emphasized enough - Help Net Security
3rd Party Services Are Falling Short on Password Security (bleepingcomputer.com)
Okta Exposes Passwords in Clear Text for Possible Theft (darkreading.com)
Enforcing Password History in Your Windows AD to Curb Password Reuse (bleepingcomputer.com)
Social Media
LinkedIn remains the most impersonated brand in phishing attacks (bleepingcomputer.com)
Hacker selling Twitter account data of 5.4 million users for $30k (bleepingcomputer.com)
TikTok Engaging in Excessive Data Collection - Infosecurity Magazine
Privacy
Parental Controls and Child Safety
Regulations, Fines and Legislation
UK Regulator Issues Record Fines as Financial Crime Surges - Infosecurity Magazine
Legal Experts Concerned Over New UK Digital Reform Bill - Infosecurity Magazine
Understanding Proposed SEC Rules Through an ESG Lens (darkreading.com)
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
EU warns of risks of spillover effects associated with ongoing war - Security Affairs
US Cyber Command IDs new malware strains targeting Ukraine • The Register
Russian hackers use fake DDoS app to infect pro-Ukrainian activists (bleepingcomputer.com)
Experts Uncover New CloudMensis Spyware Targeting Apple macOS Users (thehackernews.com)
Hackers attempt to infiltrate Ukrainian tech company with backdoor malware, Talos says - CyberScoop
Will Your Cyber-Insurance Premiums Protect You in Times of War? (darkreading.com)
Hackers Target Ukrainian Software Company Using GoMet Backdoor (thehackernews.com)
Copycat DoS App Created by Russian Hackers to Target Ukraine - IT Security Guru
Albanian government websites go dark after cyber attack • The Register
Mysterious, Cloud-Enabled macOS Spyware Blows Onto the Scene (darkreading.com)
Belgium claims China-linked APT groups hit its ministries - Security Affairs
Nation State Actors
Nation State Actors – Russia
Google, EU Warn of Malicious Russian Cyber Activity | SecurityWeek.Com
Google warns Kremlin-backed goons pose as pro-Ukraine app • The Register
Russia Released a Ukrainian App for Hacking Russia That Was Actually Malware (vice.com)
Cloaked Ursa (APT29) Hackers Use Trusted Online Storage Services (paloaltonetworks.com)
Russian SVR hackers use Google Drive, Dropbox to evade detection (bleepingcomputer.com)
Russia, Iran discuss broad tech collaboration • The Register
Half of Russian spies in Europe expelled since Ukraine invasion, says MI6 chief | MI6 | The Guardian
Nation State Actors – China
Belgium says Chinese APT gangs attacked its government • The Register
Government blocks Chinese tech deal on national security grounds | Business News | Sky News
Nation State Actors – North Korea
Nation State Actors – Iran
Nation State Actors – Misc APT
Vulnerability Management
Vulnerabilities
Chrome 103 Update Patches High-Severity Vulnerabilities | SecurityWeek.Com
Critical Bugs Threaten to Crack Atlassian Confluence Workspaces Wide Open (darkreading.com)
WordPress Page Builder Plug-in Under Attack, Can't Be Patched (darkreading.com)
SonicWall: Patch critical SQL injection bug immediately (bleepingcomputer.com)
Cisco fixes bug that lets attackers execute commands as root (bleepingcomputer.com)
Atlassian reveals critical flaws across its product line • The Register
Netwrix Auditor Vulnerability Can Facilitate Attacks on Enterprises | SecurityWeek.Com
Azure's Security Vulnerabilities Are Out of Control - Last Week in AWS Blog
Oracle Releases 349 New Security Patches With July 2022 CPU | SecurityWeek.Com
0-day used to infect Chrome users could pose threat to Edge and Safari users, too | Ars Technica
Juniper Networks Patches Over 200 Third-Party Component Vulnerabilities | SecurityWeek.Com
Google Chrome Zero-Day Weaponized to Spy on Journalists (darkreading.com)
Apple Ships Urgent Security Patches for macOS, iOS | SecurityWeek.Com
Juniper Releases Patches for Critical Flaws in Junos OS and Contrail Networking (thehackernews.com)
Code Execution and Other Vulnerabilities Patched in Drupal | SecurityWeek.Com
Atlassian Rolls Out Security Patch for Critical Confluence Vulnerability (thehackernews.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
Other News
Hackers for Hire: Adversaries Employ 'Cyber Mercenaries' | Threatpost
Companies around the globe still not implementing MFA - Help Net Security
Global Firms Fear the Worst Over Risk Management Failures - Infosecurity Magazine
Humans are becoming the primary security risk for organisations around the world - Help Net Security
What threats and challenges are CISOs and CROs most focused on? - Help Net Security
What InfoSec Pros Can Teach the Organisation About ESG (darkreading.com)
SATAn Turns Hard Drive Cable Into Antenna To Defeat Air-Gapped Security | Hackaday
Lack of staff and resources drives smaller teams to outsource security - Help Net Security
Office macro security: on-again-off-again feature now BACK ON AGAIN! – Naked Security (sophos.com)
Removing the blind spots that allow lateral movement - Help Net Security
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.