Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.
Top Cyber Stories of the Last Week
Lloyd's to Exclude Certain Nation-State Attacks from Cyber Insurance Policies
Lloyd's of London insurance policies will stop covering losses from certain nation-state cyber attacks and those that happen during wars, beginning in seven months' time.
In a memo sent to the company's 76-plus insurance syndicates, underwriting director Tony Chaudhry said Lloyd's remains "strongly supportive" of cyber attack coverage. However, as these threats continue to grow, they may "expose the market to systemic risks that syndicates could struggle to manage," he added, noting that nation-state-sponsored attacks are particularly costly to cover.
Because of this, all standalone cyber attack policies must include "a suitable clause excluding liability for losses arising from any state-backed cyber attack," Chaudhry wrote. These changes will take effect beginning March 31, 2023 at the inception or renewal of each policy.
At a minimum (key word: minimum) these policies must exclude losses arising from a war, whether declared or not, if the policy doesn't already have a separate war exclusion. They must also at least exclude losses from nation-state cyber attacks that "significantly impair the ability of a state to function or that significantly impair the security capabilities of a state."
Policies must also "set out a robust basis" on which to attribute state-sponsored cyber attacks, according to Chaudhry – and therein lies the rub.
Attributing a cyber attack to a particular crime group or nation-state with 100 percent confidence "is absolutely hard," NSA director of cybersecurity Rob Joyce said at this year's RSA Conference.
Threat analysts typically attribute an attack to a nation-state from its level of sophistication, but as advanced persistent crime groups become more sophisticated – and have more resources at their disposal to buy zero-day exploits and employ specialists for each stage of an attack – differentiating between nation-states and cyber crime gangs becomes increasingly difficult, he explained.
There are times when nation-states will act like criminals, using their tools and infrastructure, and sometimes vice versa. The clear line of sophistication and stealth that many have used as a common sense delineation has blurred. Yet, If you are going to pay out money you are likely going to look for something that is more ironclad and likely related to forensic evidence.
https://www.theregister.com/2022/08/24/lloyds_cybersecurity_insurance/
Cyber Security Top Risk for Enterprise C-Suite Leaders, PwC Study Says
Cyber security is now firmly on the agenda of the entire C-suite, consultancy PricewaterhouseCoopers (PwC) reports in a new survey of more than 700 business leaders across a variety of industries.
Of key enterprise issues, cyber security ranks at the top of business risks, with nearly 80% of the respondents considering it a moderate to serious risk. The warning isn’t confined to just chief information security officers, but ranges from chief executives to chief financial officers, chief operating officers, chief technology officers, chief marketing officers and includes corporate board members. Virtually all roles ranked cyber attacks high on their list of risks, PwC said.
Overall, 40% of business leaders ranked cyber security as the top serious risk facing their companies, and 38% ranked it a moderate risk.
Here are six steps businesses can take to address cyber security concerns:
View cyber security as a broad business concern and not just an IT issue.
Build cyber security and data privacy into agendas across the C-suite and board.
Increase investment to improve security.
Educate employees on effective cyber security practices.
For each new business initiative or transformation, make sure there’s a cyber plan in place.
Use data and intelligence to regularly measure cyber risks. Proactively look for blind spots in third-party relationships and supply chains.
Apathy Is Your Company's Biggest Cyber Security Vulnerability — Here's How to Combat It
Human error continues to be the leading cause of a cyber security breach. Nearly 60% of organisations experienced a data loss due to an employee's mistake on email in the last year, while one in four employees fell for a phishing attack.
Employee apathy, while it may not seem like a major cyber security issue, can leave an organisation vulnerable to both malicious attacks and accidental data loss. Equipping employees with the tools and knowledge they need to prevent these risks has never been more important to keep organisations safe.
A new report from Tessian sheds light on the full extent of employee apathy and its impact on cyber security posture. The report found that a significant number of employees aren't engaged in their organisation's cyber security efforts and don't understand the role they play. One in three employees say they don't understand the importance of cyber security at work. What's more, only 39% say they're very likely to report a cyber security incident. Why? A quarter of employees say they don't care enough about cyber security to mention it.
This is a serious problem. IT and security teams can't investigate or remediate a threat they don't know about.
Employees play an important role in flagging incidents or suspicious activity early on to prevent them from escalating to a costly breach. Building a strong cyber security culture can mitigate apathy by engaging employees as part of the solution and providing the tools and training they need to work productively and securely.
The World’s Largest Sovereign Wealth Fund Warns Cyber Security Is Top Concern, as Attacks on Banks and Financial Service Double
Cyber security has eclipsed tumultuous financial markets as the biggest concern for the world’s largest sovereign wealth fund, as it faces an average of three “serious” cyber attacks each day.
The number of significant hacking attempts against Norway’s $1.2tn oil fund, Norges Bank Investment Management, has doubled in the past two to three years.
The fund, which reported its biggest half-year dollar loss last week after inflation and recession fears shook markets, suffers about 100,000 cyber attacks a year, of which it classifies more than 1,000 as serious, according to its top executives.
“I’m worried about cyber more than I am about markets,” their CEO told the Financial Times. “We’re seeing many more attempts, more attacks [that are] increasingly sophisticated.”
The fund’s top executives are even concerned that concerted cyber attacks are becoming a systemic financial risk as markets become increasingly digitised.
Their deputy CEO pointed to the 2020 attack on SolarWinds, a software provider, by Russian state-backed hackers that allowed them to breach several US government agencies, including the Treasury and Pentagon, and a number of Fortune 500 companies including Microsoft, Intel and Deloitte.
“They estimate there were 1,000 Russians [involved] in that one attack, working in a co-ordinated fashion. I mean, Jesus, that’s our whole building on one attack, so you’re up against some formidable forces there,” he said.
Cyber attacks targeting the financial industry have risen sharply in recent months. Malware attacks globally rose 11 per cent in the first half of 2022, but they doubled at banks and financial institutions, according to cyber security specialist SonicWall. Ransomware attacks dropped 23 per cent worldwide, but increased 243 per cent against financial targets in the same period.
https://www.ft.com/content/1aa6f92a-078b-4e1a-81ca-65298b8310b2
Configuration Errors to Blame for 80% of Ransomware
The vast majority (80%) of ransomware attacks can be traced back to common configuration errors in software and devices, according to Microsoft.
The tech giant’s latest Cyber Signals report focuses on the ransomware as a service (RaaS) model, which it claims has democratised the ability to launch attacks to groups “without sophistication or advanced skills.” Some RaaS programs now have over 50 affiliate groups on their books.
For defenders, a key challenge is ensuring they don’t leave systems misconfigured, it added.
“Ransomware attacks involve decisions based on configurations of networks and differ for each victim even if the ransomware payload is the same,” the report argued. “Ransomware culminates an attack that can include data exfiltration and other impacts. Because of the interconnected nature of the cyber-criminal economy, seemingly unrelated intrusions can build upon each other.”
Although each attack is different, Microsoft pointed to missing or misconfigured security products and legacy configurations in enterprise apps as two key areas of risk exposure.
“Like smoke alarms, security products must be installed in the correct spaces and tested frequently. Verify that security tools are operating in their most secure configuration, and that no part of a network is unprotected,” it urged. “Consider deleting duplicative or unused apps to eliminate risky, unused services. Be mindful of where you permit remote helpdesk apps like TeamViewer. These are notoriously targeted by threat actors to gain express access to laptops.”
Although not named in the report, another system regularly misconfigured and hijacked by ransomware actors is the remote desktop protocol (RDP), which often is not protected by a strong password or two-factor authentication. It’s widely believed to be one of the top three vectors for attack.
The bad news for network defenders is they don’t have much time after initial compromise to contain an attack. Microsoft claimed the median time for an attacker to begin moving laterally inside the network after device compromise is one hour, 42 minutes. The median time for an attacker to access private data following a phishing email is one hour, 12 minutes, the firm added.
https://www.infosecurity-magazine.com/news/configuration-errors-blame-80/
Ransomware Surges to 1.2 Million Attacks Per Month
Ransomware threat detections have risen to over one million per month this year, with a French hospital the latest to suffer a major outage.
The 1000-bed Center Hospitalier Sud Francilien (CHSF) near Paris revealed it was hit on Sunday morning, in an attack which has knocked out all the hospital's business software, storage systems including medical imaging, and patient admissions. This has led to all but the most urgent emergency patients being diverted to other facilities in the region.
France24 cited figures claiming cyber-attacks against French hospitals surged 70% year-on-year in 2021. "Each day we need to rewrite patients' medications, all the prescriptions, the discharge prescriptions," Valerie Caudwell, president of the medical commission at CHSF hospital, reportedly said. "For the nurses, instead of putting in all the patients' data on the computer, they now need to file it manually from scratch."
Reports suggest Lockbit 3.0 may be to blame for the $10m ransom demand, which the hospital is refusing to pay.
Barracuda Networks claimed in a new report out today that education, municipalities, healthcare, infrastructure and finance have remained the top five targets for ransomware over the past 12 months. However, while attacks on local government increased only slightly, those targeting educational institutions more than doubled, and attacks on the healthcare and financial verticals tripled. Overall, Barracuda claimed that ransomware detections between January and June of this year climbed to more than 1.2 million per month.
https://www.infosecurity-magazine.com/news/ransomware-surges-to-12-million/
A Massive Hacking Campaign Stole 10,000 Login Credentials From 130 Different Organisations
A phishing campaign targeted Okta users at multiple companies, successfully swiping passwords from staffers and then using them to steal company secrets.
Researchers say that a mysterious “threat actor” (a fancy term for a hacker or hacker group) has managed to steal nearly 10,000 login credentials from the employees of 130 organisations, in the latest far-reaching supply chain attack on corporate America. Many of the victims are prominent software companies, including firms like Twilio, MailChimp, and Cloudflare, among many others.
The news comes from research conducted by cyber security firm Group-IB, which began looking into the hacking campaign after a client was phished and reached out for help. The research shows that the threat actor behind the campaign, which researchers have dubbed “0ktapus,” used basic tactics to target staff from droves of well-known companies. The hacker(s) would use stolen login information to gain access to corporate networks before going on to steal data and then break into another company’s network.
“This case is of interest because despite using low-skill methods it was able to compromise a large number of well-known organisations,” researchers wrote in their blog. “Furthermore, once the attackers compromised an organisation they were quickly able to pivot and launch subsequent supply chain attacks, indicating that the attack was planned carefully in advance.”
https://gizmodo.com/oktapus-okta-hack-twilio-10000-logins-130-companies-1849457420
This Company Paid a Ransom Demand. Hackers Leaked Its Data Anyway
A victim of a ransomware attack paid to restore access to their network – but the cyber criminals didn't hold up their end of the deal.
The real-life incident, as detailed by cyber security researchers at Barracuda Networks, took place in August 2021, when hackers from BlackMatter ransomware group used a phishing email to compromise the account of a single victim at an undisclosed company.
From that initial entry point, the attackers were able to expand their access to the network by moving laterally around the infrastructure, ultimately leading to the point where they were able to install hacking tools and steal sensitive data. Stealing sensitive data has become a common part of ransomware attacks. Criminals leverage it as part of their extortion attempts, threatening to release it if a ransom isn't received.
The attackers appear to have had access to the network for at least a few weeks, seemingly going undetected before systems were encrypted and a ransom was demanded, to be paid in Bitcoin.
Cyber security agencies warn that despite networks being encrypted, victims shouldn't pay ransom demands for a decryption key because this only shows hackers that such attacks are effective.
https://www.zdnet.com/article/this-company-paid-a-ransom-demand-hackers-leaked-its-data-anyway/
Sophisticated BEC Scammers Bypass Microsoft 365 Multi-Factor Authentication
A Business Email Compromise (BEC) attack recently analysed by cloud incident response company Mitiga used an adversary-in-the-middle (AitM) phishing attack to bypass Microsoft Office 365 MFA and gain access to a business executive's account, and then managed to add a second authenticator device to the account for persistent access. According to the researchers, the campaign they analysed is widespread and targets large transactions of up to several million dollars each.
The attack started with a well-crafted phishing email masquerading as a notification from DocuSign, a widely used cloud-based electronic document signing service. The email was crafted to the targeted business executive, suggesting that attackers have done reconnaissance work. The link in the phishing email led to an attacker-controlled website which then redirects to a Microsoft 365 single sign-on login page.
This fake login page uses an AitM technique, where the attackers run a reverse proxy to authentication requests back and forth between the victim and the real Microsoft 365 website. The victim has the same experience as they would have on the real Microsoft login page, complete with the legitimate MFA request that they must complete using their authenticator app. Once the authentication process is completed successfully, the Microsoft service creates a session token which gets flagged in its systems that it fulfilled MFA. The difference is that since the attackers acted as a proxy, they now have this session token too and can use it to access the account.
This reverse proxy technique is not new and has been used to bypass MFA for several years. In fact, easy-to-use open-source attack frameworks have been created for this purpose.
77% Of Security Leaders Fear We’re in Perpetual Cyber War from Now On
A survey of cyber security decision makers found 77 percent think the world is now in a perpetual state of cyber warfare.
In addition, 82 percent believe geopolitics and cyber security are "intrinsically linked," and two-thirds of polled organisations reported changing their security posture in response to the Russian invasion of Ukraine.
Of those asked, 64 percent believe they may have already been the target of a nation-state-directed cyber attack. Unfortunately, 63 percent of surveyed security leaders also believe that they'd never even know if a nation-state level actor pwned them.
The survey, organised by security shop Venafi, questioned 1,100 security leaders. They said the results show cyber warfare is here, and that it's completely different to many would have imagined. "Any business can be damaged by nation-states," they stated.
It's been common knowledge for some time that government-backed advanced persistent threat (APT) crews are being used to further online geopolitical goals. Unlike conventional warfare, everyone is a target and there's no military or government method for protecting everyone.
Nor is there going to be much financial redress available. Earlier this week Lloyd's of London announced it would no longer recompense policy holders for certain nation-state attacks.
https://www.theregister.com/2022/08/27/in-brief-security/
Cyber Security Governance: A Path to Cyber Maturity
Organisations need cyber security governance programs that make every employee aware of the cyber security mitigation efforts required to reduce cyber-risks.
In an increasingly challenging threat landscape, many organisations struggle with developing and implementing effective cyber security governance. The "Managing Cybersecurity Risk: A Crisis of Confidence" infographic by the CMMI Institute and ISACA stated: "While enterprise leaders recognise that mature cyber security is essential to thriving in today's digital economy, they often lack the insights and data to have peace of mind that their organisations are efficiently and effectively managing cyber risk."
Indeed, damages from cyber crime are projected to cost the world $7 trillion in 2022, according to the "Boardroom Cybersecurity 2022 Report" from Cybersecurity Ventures. As a result, "board members and chief executives are more interested in cyber security now than ever before," the report stated, adding that the time is ripe for turning awareness into action.
How, then, can board leaders have confidence that their organisations are prepared against cyber attacks? The first order of business for most organisations is to enable a strong cyber security governance program.
Cyber security governance refers to the component of governance that addresses an organisation's dependence on cyber space in the presence of adversaries. The ISO/IEC 27001 standard defines cyber security governance as the following: “The system by which an organisation directs and controls security governance, specifies the accountability framework and provides oversight to ensure that risks are adequately mitigated, while management ensures that controls are implemented to mitigate risks”.
Traditionally, cyber security is viewed through the lens of a technical or operational issue to be handled in the technology space. Cyber security planning needs to fully transition from a back-office operational function to its own area aligned with law, privacy and enterprise risk. The CISO should have a seat at the table alongside the CIO, COO, CFO and CEO. This helps the C-suite understand cyber security as an enterprise-wide risk management issue, along with the legal implications of cyber-risks, and not solely a technology issue.
https://www.techtarget.com/searchsecurity/post/Cybersecurity-governance-A-path-to-cyber-maturity
The Rise of Data Exfiltration and Why It Is a Greater Risk Than Ransomware
Ransomware is the de facto threat organisations have faced over the past few years. Threat actors were making easy money by exploiting the high valuation of cryptocurrencies and their victims' lack of adequate preparation.
Think about bad security policies, untested backups, patch management practices not up-to-par, and so forth. It resulted in easy growth for ransomware extortion, a crime that multiple threat actors around the world perpetrate.
Something's changed, though. Crypto valuations have dropped, reducing the monetary appeal of ransomware attacks due to organisations mounting better defence against ransomware.
Threat actors have been searching for another opportunity – and found one. It's called data exfiltration, or exfil, a type of espionage causing headaches at organisations worldwide.
Information exfiltration is rapidly becoming more prevalent. Earlier this year, incidents at Nvidia, Microsoft, and several other companies have highlighted how big of a problem it's become – and how, for some organisations, it may be a threat that's even bigger than ransomware.
Nvidia, for example, became entangled in a complex tit-for-tat exchange with hacker group Lapsus$. One of the biggest chipmakers in the world was faced with the public exposure of the source code for invaluable technology, as Lapsus$ leaked the source code for the company's Deep Learning Super Sampling (DLSS) research.
When it comes to exfil extortion, attackers do not enter with the primary aim of encrypting a system and causing disruption the way that a ransomware attacker does. Though, yes, attackers may still use encryption to cover their tracks.
Instead, attackers on an information exfiltration mission will move vast amounts of proprietary data to systems that they control. And here's the game: attackers will proceed to extort the victim, threatening to release that confidential information into the wild or to sell it to unscrupulous third parties.
https://thehackernews.com/2022/08/the-rise-of-data-exfiltration-and-why.html
Threats
Ransomware
[Whoa] Ransomware Strains Almost Double in Six Months from 5,400 to 10,666 (knowbe4.com)
Ransomware dominates the threat landscape - Help Net Security
We need to think about ransomware differently - Help Net Security
NATO investigates hacker sale of missile firm data - BBC News
Cyber attackers disrupt services at French hospital, demand $10 million ransom (france24.com)
New 'Agenda' Ransomware Customized for Each Victim | SecurityWeek.Com
LockBit gang hit by DDoS attack after Entrust leaks • The Register
New ransomware HavanaCrypt poses as Google software update | CSO Online
LockBit Ransomware Site Hit by DDoS Attack as Hackers Start Leaking Entrust Data | SecurityWeek.Com
New Golang Ransomware Agenda Customizes Attacks (trendmicro.com)
New 'BianLian' Ransomware Variant on the Rise (darkreading.com)
New 'Donut Leaks' extortion gang linked to recent ransomware attacks (bleepingcomputer.com)
Quantum ransomware attack disrupts govt agency in Dominican Republic (bleepingcomputer.com)
Car Dealership Hit by Major Ransomware Attack - Infosecurity Magazine
Ransomware Gang Leaks Data Allegedly Stolen from Greek Gas Supplier | SecurityWeek.Com
BEC – Business Email Compromise
Phishing & Email Based Attacks
Phishing attacks abusing SaaS platforms see a massive 1,100% growth (bleepingcomputer.com)
Researchers Warn of AiTM Attack Targeting Google G-Suite Enterprise Users (thehackernews.com)
Hiding a phishing attack behind the AWS cloud • The Register
10 key facts about callback phishing attacks - CyberTalk 2022
Other Social Engineering; Smishing, Vishing, etc
Malware
Threat actor abuses Genshin Impact Anti-Cheat driver to disable antivirus - Security Affairs
Fake DDoS Protection Alerts Distribute Dangerous RAT (darkreading.com)
Meet Borat RAT, a New Unique Triple Threat (thehackernews.com)
Donot Team group updates its Windows malware framework - Security Affairs
How 'Kimsuky' hackers ensure their malware only reach valid targets (bleepingcomputer.com)
Grandoreiro banking malware targets Mexico and Spain - Security Affairs
Fake Chrome extension 'Internet Download Manager' has 200,000 installs (bleepingcomputer.com)
Threat actors are using the Tox P2P messenger as C2 server - Security Affairs
Mobile
Internet of Things – IoT
Cyber criminals Are Selling Access to Chinese Surveillance Cameras | Threatpost
IoT Vulnerability Disclosures Up 57% in Six Months, Claroty Reveals - Infosecurity Magazine
Thousands of Organisations Remain at Risk from Critical Zero-Click IP Camera Bug (darkreading.com)
Data Breaches/Leaks
LastPass data breach: threat actors stole portion of source code - Security Affairs
Plex discloses data breach and urges password reset - Security Affairs
Plex was compromised, exposing usernames, emails, and passwords - The Verge
DoorDash discloses new data breach tied to Twilio hackers (bleepingcomputer.com)
Data on California Prisons' Visitors, Staff, Inmates Exposed | SecurityWeek.Com
Expert Commentary On The Plex Data Breach (informationsecuritybuzz.com)
Textile Company Sferra Discloses Data Breach | SecurityWeek.Com
Novant Health: Oops, we leaked 1.3m patients' info to Meta • The Register
Organised Crime & Criminal Actors
RaaS Kits Are Hiding Who The Attackers Really Are – Expert Comments (informationsecuritybuzz.com)
Researchers warn of darkverse emerging from the metaverse | CSO Online
Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain
An anatomy of crypto-enabled cyber crime | Financial Times (ft.com)
Cryptojackers Spread Across Computers Globally- IT Security Guru
Hackers Are Breaking Into and Emptying Cash App Accounts (vice.com)
Threat actors are stealing funds from General Bytes Bitcoin ATMSecurity Affairs
How Economic Changes and Crypto's Rise Are Fuelling the use of "Cyber Mules" | SecurityWeek.Com
Fraud, Scams & Financial Crime
Scammers Create “AI Hologram” of C-Suite Crypto Exec - Infosecurity Magazine
Employee fraud: Beware of deepfake job applicants - Protocol
A closer look at identity crimes committed against individuals - Help Net Security
What type of fraud enables attackers to make a living? - Help Net Security
Insurance
Software Supply Chain
Denial of Service DoS/DDoS
DDoS attacks jump 203%, patriotic hacktivism surges - Help Net Security
Threat Actor Deploys Raven Storm Tool to Perform DDoS Attacks - Infosecurity Magazine
LockBit gang hit by DDoS attack after Entrust leaks • The Register
Cloud/SaaS
Mitiga: Attackers evade Microsoft MFA to lurk inside M365 (techtarget.com)
Phishing attacks abusing SaaS platforms see a massive 1,100% growth (bleepingcomputer.com)
How complicated access management protocols have impacted cloud security - Help Net Security
Identity and Access Management
IT leaders struggling to address identity sprawl - Help Net Security
Identity Security Pain Points and What Can Be Done (darkreading.com)
Thoma Bravo: Securing digital identities has become a major priority - Help Net Security
Encryption
CISA: Action required now to prepare for quantum computing cyber threats | ZDNET
Encrypted Traffic Analysis: Mitigating Against The Risk Of Encryption (informationsecuritybuzz.com)
US Government: Stop Dickering and Prepare for Post-Quantum Encryption Now - CNET
API
Passwords, Credential Stuffing & Brute Force Attacks
Credential phishing attacks rise and represent a huge threat to businesses - Help Net Security
Twilio hackers breached over 130 organisations during months-long hacking spree | TechCrunch
FBI: Beware Residential IPs Hiding Credential Stuffing - Infosecurity Magazine
Social Media
Privacy
Travel
Hackers target hotel and travel companies with fake reservations (bleepingcomputer.com)
British Airways passengers targeted in baggage scam using Twitter | The Independent
Models, Frameworks and Standards
Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine
Lloyd's of London Introduces New War Exclusion Insurance Clauses | SecurityWeek.Com
EU Outlines Critical Cyber Response to Ukraine War - Infosecurity Magazine
Unprecedented cyber attack hit State Infrastructure of Montenegro - Security Affairs
Suspected Iranian Hackers Targeted Several Israeli Organisations for Espionage (thehackernews.com)
Nation State Actors
Nation State Actors – Russia
Microsoft: Russian hackers gain powerful 'MagicWeb' authentication bypass | ZDNET
Microsoft Attributes New Post-Compromise Capability to Nobelium - Infosecurity Magazine
Nation State Actors – Iran
Nation State Actors – Misc APT
Vulnerability Management
Up to 35% more CVEs published so far this year compared to 2021 | CSO Online
Why patching quality, vendor info on vulnerabilities are declining | CSO Online
How fast is the financial industry fixing its software security flaws? - Help Net Security
Highlighting What should be Patched First at the Endpoint (bleepingcomputer.com)
Vulnerabilities
Cisco Patches High-Severity Vulnerabilities in Business Switches | SecurityWeek.Com
CISA Warns of Active Exploitation of Palo Alto Networks' PAN-OS Vulnerability (thehackernews.com)
Critical flaw impacts Atlassian Bitbucket Server and Data Center - Security Affairs
VMware fixes privilege escalation vulnerabilities in VMware Tools - Infosecurity Magazine
VMware LPE Bug Allows Cyber attackers to Feast on Virtual Machine Data (darkreading.com)
Critical RCE bug in GitLab patched, update ASAP! (CVE-2022-2884) - Help Net Security
Zoom patches root exploit, patches patch due to root exploit • The Register
US government really hopes you've patched your Zimbra server • The Register
Apple security flaw ‘actively exploited’ by hackers to fully control devices | Apple | The Guardian
Microsoft publicly discloses details on critical ChromeOS flaw - Security Affairs
Mozilla Patches High-Severity Vulnerabilities in Firefox, Thunderbird | SecurityWeek.Com
'DirtyCred' Vulnerability Haunting Linux Kernel for 8 Years | SecurityWeek.Com
Privilege Escalation Flaw Haunts VMware Tools | SecurityWeek.Com
Other News
How attackers use and abuse Microsoft MFA - Help Net Security
There is an urgent need to reduce systemic cyber risks | Financial Times (ft.com)
We Need to Talk About How Good A.I. Is Getting - The New York Times (nytimes.com)
A lack of endpoint security strategy is leaving enterprises open to attack - Help Net Security
Twitter whistleblower report holds security lessons (techtarget.com)
Nearly 3 Years Later, SolarWinds CISO Shares 3 Lessons From the Infamous Attack (darkreading.com)
Data governance: 5 tips for holistic data protection - Microsoft Security Blog
US Government Spending Billions on Cyber security (thehackernews.com)
Sector Specific
Industry specific threat intelligence reports are available.
Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.
· Automotive
· Construction
· Critical National Infrastructure (CNI)
· Defence & Space
· Education & Academia
· Energy & Utilities
· Estate Agencies
· Financial Services
· FinTech
· Food & Agriculture
· Gaming & Gambling
· Government & Public Sector (including Law Enforcement)
· Health/Medical/Pharma
· Hotels & Hospitality
· Insurance
· Legal
· Manufacturing
· Maritime
· Oil, Gas & Mining
· OT, ICS, IIoT, SCADA & Cyber-Physical Systems
· Retail & eCommerce
· Small and Medium Sized Businesses (SMBs)
· Startups
· Telecoms
· Third Sector & Charities
· Transport & Aviation
· Web3
As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.
Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.
You can also follow us on Facebook, Twitter and LinkedIn.
Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.