Black Arrow Cyber Threat Briefing 03 March 2023

4 Mar

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

It’s Time to Evaluate Your Security Education Plan with the Rise in Social Engineering Attacks

Security provider Purplesec found 98% of attacks in 2022 involved an element of social engineering. Social engineering attacks can take many forms including phishing, smishing, vishing and quishing and it’s vital to educate your organisation on how to best prepare for these. Education plans should focusing on educating all levels of users, including those at the top. These plans should also be tested to allow organisations to assess where they are at and identify where they can improve.

https://www.darkreading.com/endpoint/as-social-engineering-attacks-skyrocket-evaluate-your-security-education-plan

Mobile Users are More Susceptible to Phishing Attacks

A report conducted by mobile security provider Lookout focused on the impact of mobile phishing. Some of the key findings from the report included that more than 50% of personal devices were exposed to a mobile phishing attack every quarter, the percentage of users falling for multiple mobile phishing links increasing and an increased targeting of highly regulated industries such as insurance, banking and financial services. It is likely that this has resulted from the increase in relaxed bring your own device (BYOD) policies.

https://www.msspalert.com/cybersecurity-research/mobile-users-more-susceptible-to-phishing-attacks-than-two-years-ago/

Phishing as a Service Stimulates Cyber Crime

Phishing attacks are at an all-time high and the usage of Phishing as a Service (PaaS) opens this attack technique to virtually anyone. The sale of “phishing kits” and usage of artificial intelligence has further increased the availability of this attack technique. In response, organisations should look to improve their email security, cloud security and education programs for employees.

https://www.trendmicro.com/en_us/ciso/23/c/phishing-as-a-service-phaas.html

Attacker Breakout Time Drops to Just 84 Minutes

The average time it takes for a threat actor to move laterally from a compromised host within an organisation dropped 14% between 2012 and 2022 down to 84 minutes, according to a report by security provider Crowdstrike. With the reduction in time it takes a threat actor to move across systems, organisations have even less time to enact their incident response plans and contain breaches effectively, putting further pressure on the incident response team. By responding quickly, organisations can minimise the cost and damage of a breach. The report from Crowdstrike found that organisations were facing increasing difficulty in detecting suspicious activity as attackers are choosing to use valid organisation credentials rather than malware, to gain access to an organisation’s systems.

https://www.infosecurity-magazine.com/news/attacker-breakout-time-drops-just/

Attackers are Developing and Deploying Exploits Faster Than Ever

A report from security provider Rapid7 found that over 56% of vulnerabilities were exploited within seven days of public disclosure. Worryingly, the median time for exploitation in 2022 was just one day. The finding from the report highlights the need for organisations to not only conduct threat intelligence to be aware of vulnerabilities but to also look to employ patches where possible in a timely manner.

https://www.helpnetsecurity.com/2023/03/03/attackers-developing-deploying-exploits/

Old Vulnerabilities are Haunting Organisations and Aiding Attackers

Known vulnerabilities, vulnerabilities for which patches have already been made available, are one of the primary attack vectors for threat actors. Vulnerability management vendor Tenable found that the top exploited vulnerabilities were originally disclosed as far back as 2017 and organisations that had not applied these patches were at increased risks of attack.

https://www.helpnetsecurity.com/2023/03/03/known-exploitable-vulnerabilities/

Scams Drive Nearly $9bn Fraud Surge in 2022

Americans lost $8.8 billion to fraud last year, with imposter scams responsible for $2.8 billion of that amount, according to the Federal Trade Commission (FTC). Losses to business imposters were particularly damaging, climbing to $660 million from the previous year. Interestingly, the FTC found that younger people reported losing money to fraud the most often.

https://www.infosecurity-magazine.com/news/investment-scams-drive-9bn-in/

Economic Pressure are Increasing Cyber Security Risks and a Recession Would Only Further This

The World Economic Forum’s recent report found that 93% of cyber security leaders and 86% of business leaders think it is moderately or very likely that global geopolitical instability will lead to a catastrophic cyber event in the next two years. Reinforcing this, a report from (ISC)² found that 80% of business executives believe a weakening economy will increase cyber threats and a recession will only amplify this.

https://www.csoonline.com/article/3689008/economic-pressures-are-increasing-cybersecurity-risks-a-recession-would-amp-them-up-more.html

Cyber Security in this Era of Polycrisis

A year since Russia invaded Ukraine, the geopolitical context is increasingly tense and volatile. The world faces several major crises in what has been coined a 'polycrisis,' a cluster of global shocks with compounding effects. This, along with increasing geopolitical tensions causes a rise in risk from cyber attacks. In fact, the European Union Agency for Cyber Security (ENISA) recently issued an alert regarding actors conducting malicious cyber activities against businesses and governments in the European Union and findings from Google show a 300% increase in state-sponsored cyber attacks targeting users in NATO countries.

https://www.weforum.org/agenda/2023/02/cybersecurity-in-an-era-of-polycrisis/

Russian Ransomware Projects Rebranded to Avoid Western Sanctions

Research provider TRM labs found that some major Russian-linked ransomware crime gangs have rebranded their activities in 2022 to avoid sanctions. To strengthen their anonymity, two major ransomware crime gangs LockBit and Conti restructured their activities. Conti is reported to have restructured into three smaller groups named Black Besta, BlackByte, Karakurt. LockBit on the other hand launched LockBit 3.0, which is focused on monetary gain. Additionally, the report found that Russian-speaking darknet markets had amassed over $130 million in sales.

https://cryptopotato.com/russian-ransomware-projects-rebranded-to-avoid-western-sanctions-report/

Ransomware Attacks Ravaged Big Names in February

Despite the apparent slight drop in ransomware activity last month, several high profile targets of various industries were hit; this ranges from the likes of the US Marshal Service, retailer WH Smith, satellite provider Dish and many more. These attacks reinforce the concept that any organisation can be a victim, regardless of industry.

https://www.techtarget.com/searchsecurity/news/365532056/Ransomware-attacks-ravaged-big-names-in-February

Firms Who Pay Ransoms Subsidise New Attacks

A report from security provider Trend Micro found that whilst only a relatively small number of ransomware victims pay their extorters, those that do pay are effectively funding 6-10 new attacks. The report also found that attackers are aware of which industries and countries pay ransoms more often, so organisations belonging to those industries and countries may find themselves an even more attractive target.

https://www.infosecurity-magazine.com/news/firms-pay-ransom-subsidise-10/

How the Ukraine War Opened a Fault Line in Cyber Crime

A report from threat intelligence provider Recorded Future has highlighted the impact that the Russian invasion of Ukraine has had on cyber. Recorded Future explain how a number of threat actor groups fled during the war and in addition to differing political views between groups, there has been a disruption to the cyber environment. In fact, Recorded Future found that Russian-language dark web marketplaces have taken a major hit and the prediction is that the epicentre of cyber crime may shift to English-speaking dark web forums, shops and marketplaces.

https://www.darkreading.com/analytics/ukraine-war-fault-line-cybercrime-forever

Threats

Ransomware, Extortion and Destructive Attacks

Phishing & Email Based Attacks

BEC – Business Email Compromise

Other Social Engineering; Smishing, Vishing, etc

2FA/MFA

Phone Attacks and MFA Bypass Drive Phishing to New Heights - Infosecurity Magazine (infosecurity-magazine.com)

Malware

Mobile

Denial of Service/DoS/DDOS

Danish Hospitals Struck By Cyber attack From ‘Anonymous Sudan’ (informationsecuritybuzz.com)

Data Breaches/Leaks

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

Economic pressures are increasing cybersecurity risks; a recession would amp them up more | CSO Online

Fraud, Scams & Financial Crime

AML/CFT/Sanctions

Russian Ransomware Projects Rebranded to Avoid Western Sanctions: Report (cryptopotato.com)

Insurance

Dark Web

Sale of Stolen Credentials and Initial Access Dominate Dark Web Markets (darkreading.com)

Supply Chain and Third Parties

Software Supply Chain

Cloud/SaaS

Containers

Hackers Exploit Containerized Environments to Steals Proprietary Data and Software (thehackernews.com)

Hybrid/Remote Working

Encryption

Signal would 'walk' from UK if Online Safety Bill undermined encryption - BBC News

API

Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Training, Education and Awareness

As Social Engineering Attacks Skyrocket, Evaluate Your Security Education Plan (darkreading.com)

Parental Controls and Child Safety

Hackers Target Young Gamers: How Your Child Can Cause Business Compromise (darkreading.com)

Regulations, Fines and Legislation

Governance, Risk and Compliance

Models, Frameworks and Standards

CISA releases free ‘Decider’ tool to help with MITRE ATT&CK mapping (bleepingcomputer.com)

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs

Privacy, Surveillance and Mass Monitoring

Artificial Intelligence

Misinformation, Disinformation and Propaganda

China spends billions on pro-Russia disinformation, US special envoy says | China | The Guardian

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

Nation State Actors

Vulnerability Management

Vulnerabilities

Tools and Controls

Other News

Sector Specific

Industry specific threat intelligence reports are available.

· Automotive

· Construction

· Critical National Infrastructure (CNI)

· Defence & Space

· Education & Academia

· Energy & Utilities

· Estate Agencies

· Financial Services

· FinTech

· Food & Agriculture

· Gaming & Gambling

· Government & Public Sector (including Law Enforcement)

· Health/Medical/Pharma

· Hotels & Hospitality

· Insurance

· Legal

· Manufacturing

· Maritime

· Oil, Gas & Mining

· OT, ICS, IIoT, SCADA & Cyber-Physical Systems

· Retail & eCommerce

· Small and Medium Sized Businesses (SMBs)

· Startups

· Telecoms

· Third Sector & Charities

· Transport & Aviation

· Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

purpleseclookoutcrowdstrikerapid7tenableftcfederal trade commissionworld economic forumisc2european agency for cyber securityenisapolycrisistrm labslockbitcontiblack bestablackbytekarakurtlockbit 3.0wh smithdishus marshall servicetrend microrecorded futurepurecryptervesuviusmanaged xdrredline stealerrig exploit kitexfiltrator-22pypiiron tigerparallaxblacklotusgootloadersignaldanish hospitalsanonymous sudanlastpassstanford universityactivisionhatch bankbooking.comgunactionchick-fil-agodaddysbomscarleteelespionage billcode42breachquestdecidergartnerdojdepartment of justicehivechatgptcisablackflytiktokcertclamavfortinetmanageenginezk javatpmciscoarubawizroyal mailmortalkombatbitdefenderroyal ransomwaregoanywheregoogle cloudmetaeu parliamentgamersus air forceusafukraineibmwordpresszohoarubaosnews corpwefpig butcheringblack arrowblack arrow cybercyber expertscyber consultingcyber investigatorscybercyber securityinfosecinformation securitythreat intelthreat intelligencethreat reportbusiness riskbusiness riskscyber risk managementrisk managementcyber riskcyber security riskcyber risk assessmentrisk assessmentcyber incident responsecyber incident response teamcyber emergency responsecomputer incident responsecomputer emergency responseemergency responsesubject matter expertsit securitytrusted advisertrusted partnervcisovirtual chief information security officervisoinformation security officersecurity executive on demandsecurity as a servicesecurity on demandcyber security strategycyber strategycyber kill chainsecurity as a a servicesecurity-as-a-servicehrhuman resourceshuman resources managementhrmtprmthird party risk managementbritish intelligencenational securityuk national securitymilitary intelligencemodministry of defencepolicelaw enforcementftse 100ftse100offshore financial servicesgfscguernsey financial services commissionfortune 500fortune500ncscnational cyber security centrecpnimi5gchqcert-ukcert.ggfive eyescyber guernseyguernsey cyberncanational crime agencyeuropolinterpolnatoaustralian cyber security centreacsccanadian centre for cyber securitycccsnew zealand national cyber security centrencsc-nzcybersecurity and infrastructure agencynational security administrationnsafederal bureau of investigationfbicentral intelligence agencyciadepartment of homeland securitydhssecret serviceodpaoffice of the data protection authorityicoinformation commissioners officeisacacomptiasanssmesmbsmall businessmedium sized businessaccountinglaw firmslegal sectoracademiaeducationschoolsretailmaritimeaviationaerospacetransportdefencedefensedefence contractorcniscadaicsindustrial control systemsoperational technologyothealthcaremedicalpharmapharmaceuticalspci-dsspayment cardpayment card industryestate agentsestate agencychild safetyparental controlsregulated firmsfinancial servicescritical infrastructuremergers and acquisitionsmandam&aresearch and developmentr&dintellectual propertyiptelecomstelecommunicationsexecutivesexecutiveinsidersinsider threatstaffusersend userssenior executivesc-suiteboardshuman elementhuman centric securityhuman centricweakest linkboardroomboard roomcisoceoctociocfonistcyber essentialscyber essentials plusiasmeiasme governanceiasme goldiso 27001iso27001cyber killchainmitremitre att&ckciscis controlscap1753cap 1753caacivil aviation authorityfraud investigationsforensicscyber forensicsforensic investigationsexpert witnesstechnical investigationsaptchinarussiairannorth koreanation state actorsgrusvrfsbdprkransomwareransomware-as-a-serviceraascrime-as-a-servicebecbusiness email compromiseemailphishingspear-phishingwhalingcredentialscredential stuffingaccount takeoveraccount takeoversatoextortionblackmaildenial of servicedistributed denial of servicedosddosrddosbotnetcryptominingcryptojackingrootkitsrootkitshadow itremote code executionrcezero-daymalwarevishingsmishingheat attacksheathighly evasive adaptive threatsratremote access trojancyber bullyingcyber stalkingsextortionblockchainwipersdestructive attacksvulnerabilityvulnerabilitiesvulnerability managementpatch managementpatchingkevkevsknown exploited vulnerabilitiesepsscvssinsurancecyber insuranceincident responseincident response plandisaster recoverydisaster recovery plandrpbusiness continuitybusiness continuity planningbusiness continuity plantrainingeducation and awareness trainingawarenessexercisingexerciseproctored exercisefacilitated exercisesimulationsgap analysiscyber gap analysisboard upskillingsenior executive cyber risk and governancesenior executive cyber risk and governance workshopstechnical assessmenttechnical analysispenetration testingpentestingphysical penetration testingtastargeted attack simulationsiso 27001 iso27001technical IT securityiamidamidentity and access managementdigital transformationchange managementcompliancegrcgovernance risk and complianceesghackerscriminalscyber criminalscyber warfareespionagecyber espionagefraudstersfraudscammersscamsscamorganised crimecriminal actorcriminal actorsterrorismterroristscyber terroristscyber terrorismsupply chainthird partiesmsspmspmanaged service providermanaged security service providerexternal it providerinternal itapplemacmacosiosiphoneandroidmicrosoftwindowscloudsaasiaaspaasdark webdatabasesencryptioncryptocurrenciesiotaiendpoint protectionantivirusantimalwarewfhwork from homednsemail gatewayonlineopen sourceattack surfaceedrmdrxdrmonitoring and detectionapiandorraanguillaantigua and barbudabahamasbarbadosbermudabritish virgin islandsbvicayman islandschannel islandscicyprusdominicadublindutch antillesgibraltargrenadaguernseyisle of manjerseyliechtensteinlondonluxembourgmaltamonaconetherlands antillesphilippinesst kitts and nevisst luciast vincent and grenadinesswitzerlandturks and caicos islandsscotlandedinburghglasgowbristolsouthamptonportsmouthcoshamfarehamexetereuropeoffshoresouth westsouth eastukenglandgreat britainbritish islesgermanysouth africairelandaustralianew zealandcanada