Black Arrow Cyber Threat Briefing 10 February 2023

12 Feb

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

UK Companies Banned from Paying Ransomware Hackers After Attacks on Royal Mail and Guardian

British companies have been banned from paying ransomware hackers after a spate of attacks on businesses including Royal Mail and the Guardian newspaper.

UK Foreign Secretary James Cleverly on Thursday unveiled sanctions on seven Russian hackers linked to a gang called Conti, effectively banning any payments to the group.

Thursday’s sanctions are the first of their kind to be specifically targeted against Russian ransomware gang members.

The actions follow a spate of high-profile attacks on businesses and amid warnings from GCHQ that Russian and Iranian hackers are stepping up actions in Britain.

https://www.telegraph.co.uk/business/2023/02/09/companies-banned-paying-hackers-attacks-royal-mail-guardian/

Fraud Set to Be Upgraded as a Threat to National Security

Fraud is to be reclassified as a threat to national security under UK government plans that will force police chiefs to devote more officers to solving the crime.

It will be elevated to the same status as terrorism, with chief constables mandated to increase resources and combine capabilities in a new effort to combat a fraud epidemic that now accounts for 30 per cent of all crime.

It will be added to the strategic policing requirement, which means that forces will be required by ministers to treat fraud as a major priority alongside not only terrorism, but also public disorder, civil emergencies, serious and organised crime, cyber attacks and child sexual abuse.

https://www.telegraph.co.uk/news/2023/02/04/fraud-set-upgraded-threat-national-security/

98% of Attacks are Not Reported by Employees to their Employers

Cyber attackers are increasingly using social engineering tactics to lure employees into opening malicious emails in an attempt to trick them into providing login credentials, updating bank account information and paying fraudulent invoices. Worryingly, research conducted by security provider Abnormal has found that 98% of attacks on organisations are not reported to the organisation’s security team. In addition to this, the report found that the volume of business email compromise attacks are spiking, growing by 175% over the past two years. The report also found that nearly two-thirds of large enterprises experiencing a supply chain compromise attack in the second half of 2022.

https://www.msspalert.com/cybersecurity-research/employees-fail-to-report-98-of-email-cyber-hacks-to-security-teams-study-finds/

UK Second Most Targeted Nation Behind America for Ransomware

Security research team Kraken Labs released their report earlier this week, which found that of the 101 different countries that registered victims of ransomware, the UK had registered the second highest number of victims behind the US. Currently, there are over 60 ransomware groups, with the top 3 accounting for a third of all ransomware attacks.

https://www.itsecurityguru.org/2023/02/07/uk-second-most-targeted-nation-behind-america-for-ransomware/

Financial Institutions are Suffering from Increasingly Sophisticated Cyber Attacks

This week security provider Contrast Security released its Cyber Bank Heists report, an annual report that exposes cyber security threats facing the financial sector. The report warns financial institutions that security must be a top-of-mind issue amid rising geopolitical tensions, increased destructive attacks utilising wipers and a record-breaking year of zero-day exploits. The report involved a series of interviews with financial sector security leaders and found some notable results. Some of the results include 64% of leaders seeing an increase in application attacks, 72% of respondents planning to increase investment in application security in 2023, 60% of respondents falling victim to destructive attacks and 50% of organisations detecting campaigns which aimed to steal non-public market information.

https://www.darkreading.com/attacks-breaches/financial-institutions-are-suffering-from-increasingly-sophisticated-cyberattacks-according-to-contrast-security

An Email Attack Can End Up Costing You Over $1 Million

According to a report by security provider Barracuda Network, 75% of organisations had fallen victim to at least one successful email attack in the last 12 months, with those affected facing potential costs of over $1 million for their most expensive attack. The fallout from an email security attack can be significant, with the report finding 44% of those hit had faced significant downtime and business disruption. Additionally financial services greatly impacted by the loss of valuable data (59%) and payments made to attackers (51%). When it came to organisations preparation, 30% felt underprepared when dealing with account takeover and 28% felt unprepared for dealing with business email compromise.

https://www.helpnetsecurity.com/2023/02/10/email-attack-damage-1-million/

Cyber Crime Shows No Signs of Slowing Down

Global risks from population pressures and climate change to political conflicts and industrial supply chain challenges characterised 2022. Cyber criminals used this turmoil to exploit these trending topics, including significant events, public affairs, social causes, and anywhere else opportunity appeared. According to security researchers at Zscaler TheatLabz, 2023 will see a rise in Crime-as-a-service (CaaS), supply chains will be bigger targets than ever, there will be a greater need for defence in depth as endpoint protection will not be enough and finally, there will be a decrease in the time between initial compromise and the final stage of an attack.

https://www.darkreading.com/zscaler/cybercrime-shows-no-signs-of-slowing-down

Surge of Swatting Attacks Targets Corporate Executive and Board Members

Swatting is the act of deceiving an emergency service with the purpose of the service then sending an emergency response, often armed, to a targeted persons address. Security provider Black Cloak has found that swatting incidents are now beginning to target C-suite executives and corporate board members, with the number of incidents increasing over the last few months. Malicious actors are using information from the dark web, company websites and property records to construct their swatting attacks.

https://www.csoonline.com/article/3687177/surge-of-swatting-attacks-targets-corporate-executives-and-board-members.html#tk.rss_news

Phishing Surges Ahead, as ChatGPT and Artificial Intelligence Loom

Artificial Intelligence (AI) is making it easier for threat actors to create sophisticated and malicious email campaigns. In their report, security provider Vade found that Q4 of 2022 saw a 36% volume increase in phishing campaigns compared to the previous quarter, with over 278.3 million unique phishing emails in that period. The researchers found in particular, new AI tools such as ChatGPT had made it easy for anyone, including those with limited skills, to conduct a sophisticated phishing campaign. Furthermore, the ability of ChatGPT to tailor phishing to different languages is an area for concern.

https://www.darkreading.com/vulnerabilities-threats/bolstered-chatgpt-tools-phishing-surged-ahead

Pro-Russian Hacktivist Group is Only Getting Started, Experts Warn

A pro-Russian hacktivist group's low-level distributed denial-of-service (DDoS) attacks on US critical infrastructure could be a precursor to more serious cyber attacks, health care and security officials warned this week. A DDoS attack involves overwhelming a targeted service, service or network with traffic in an attempt to disrupt it. Earlier this week Killnet, a politically motivated Russian hacking group, overloaded and took down some US healthcare organisations. The attack came after threatening western healthcare organisations for the continued NATO support of Ukraine.

https://www.axios.com/2023/02/03/killnet-russian-hackers-attacks

Crypto Investors Lost Nearly $4 Billion to Hackers in 2022

Last year marked the worst year on record for cryptocurrency hacks, according to analytic firm Chainalysis’ latest report. According to the report, hackers stole $3.8 billion in 2022, up from $3.3 billion the previous year. De-centralised finance products, which are products that have no requirement for an intermediary or middle-man accounted for about 82% of all crypto stolen.

https://www.cnbc.com/2023/02/04/crypto-investors-lost-nearly-4-billion-dollars-to-hackers-in-2022.html

PayPal and Twitter Abused in Turkey Relief Donation Scams

Scammers are now exploiting the ongoing humanitarian crisis in Turkey and Syria. This time, stealing donations by abusing legitimate platforms such as PayPal and Twitter. It has been identified that multiple scams are running which call for fundraising, linking the victim to a legitimate PayPal site. The money however, is kept by the scammer.

https://www.bleepingcomputer.com/news/security/paypal-and-twitter-abused-in-turkey-relief-donation-scams/

Mysterious Leak of Booking.com Reservation Data is Being Used to Scam Customers

For almost 5 years, Booking.com customers have been on the receiving end of a continuous series of scams that demonstrate criminals have obtained travel plans amongst other personally identifiable information that were provided to Booking.com. The scams have involved users receiving fake emails purporting to be from Booking.com with genuine travel details that victims had provided. These emails contain links to malicious URL’s that look nearly identical to the Booking.com website. These then display the victim’s expected travel information, requiring them to input their card details. Some of the scams have developed and involve scammers sending WhatsApp messages after payment has been made, purporting to be from hotels which have been booked by the victims.

https://arstechnica.com/information-technology/2023/02/mysterious-leak-of-booking-com-reservation-data-is-being-used-to-scam-customers/

Threats

Ransomware, Extortion and Destructive Attacks

Phishing & Email Based Attacks

BEC – Business Email Compromise

What SOCs Need to Know About Water Dybbuk A BEC Actor Using Open-Source Toolkits (trendmicro.com)

Malware

Mobile

Denial of Service/DoS/DDOS

Internet of Things – IoT

Data Breaches/Leaks

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

Fraud, Scams & Financial Crime

Impersonation Attacks

AML/CFT/Sanctions

Insurance

Dark Web

Supply Chain and Third Parties

Software Supply Chain

Security pros say third parties are increasingly the cause of cyber security incidents | SC Media (scmagazine.com)

Cloud/SaaS

Hybrid/Remote Working

Identity and Access Management

4 identity predictions for 2023 | TechTarget

Encryption

Social Media

Malvertising

Training, Education and Awareness

Parental Controls and Child Safety

It’s never too early to chat to your kids about online safety | Sarah Ayoub | The Guardian

Regulations, Fines and Legislation

Governance, Risk and Compliance

Models, Frameworks and Standards

NIST Picks IoT Standard for Small Electronics Cyber security (darkreading.com)

Data Protection

Law Enforcement Action and Take Downs

Privacy, Surveillance and Mass Monitoring

Artificial Intelligence

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

Nation State Actors

Vulnerability Management

Vulnerabilities

Tools and Controls

Other News

Sector Specific

Industry specific threat intelligence reports are available.

· Automotive

· Construction

· Critical National Infrastructure (CNI)

· Defence & Space

· Education & Academia

· Energy & Utilities

· Estate Agencies

· Financial Services

· FinTech

· Food & Agriculture

· Gaming & Gambling

· Government & Public Sector (including Law Enforcement)

· Health/Medical/Pharma

· Hotels & Hospitality

· Insurance

· Legal

· Manufacturing

· Maritime

· Oil, Gas & Mining

· OT, ICS, IIoT, SCADA & Cyber-Physical Systems

· Retail & eCommerce

· Small and Medium Sized Businesses (SMBs)

· Startups

· Telecoms

· Third Sector & Charities

· Transport & Aviation

· Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

james cleverlyroyal mailthe guardianguardian newspaperzscalerbarracudacrime-as-a-servicecaasswattingchatgptkillnetchainalysispaypaltwitterbooking.comesxiesxiargsionracksapcevmwarevmware esxiroyal ransomwarenevada ransomwareitalyfrancesingaporefloridavesuviuslockbitmedusaclop ransomwarehivemks instrumentshong kong policenewspenguinawswater dybbukscreenshottermalvert loaderformbook malwareguloaderpixpirateqaknoteqbotcryptoromxiaomioneplusmiraitruthfinderus cyber ambassadorfinlandoptusftxsygniaubiquitiracromance fraudtelegramhi mumbrushingtrickbotblacksprutsolarwindstoyotatiktokvastaamoexclugraphironsnpscottish national partympstewart mcdonaldzimbravmware workstationgoanywherebinwalkciscoioxf5 big-ipjirasonicwallgoogle chromedmsopensslblack arrowblack arrow cybercyber expertscyber consultingcyber investigatorscybercyber securityinfosecinformation securitythreat intelthreat intelligencethreat reportbusiness riskbusiness riskscyber risk managementrisk managementcyber riskcyber security riskcyber risk assessmentrisk assessmentcyber incident responsecyber incident response teamcyber emergency responsecomputer incident responsecomputer emergency responseemergency responsesubject matter expertsit securitytrusted advisertrusted partnervcisovirtual chief information security officervisoinformation security officersecurity executive on demandsecurity as a servicesecurity on demandcyber security strategycyber strategycyber kill chainsecurity as a a servicesecurity-as-a-servicehrhuman resourceshuman resources managementhrmtprmthird party risk managementbritish intelligencenational securityuk national securitymilitary intelligencemodministry of defencepolicelaw enforcementftse 100ftse100offshore financial servicesgfscguernsey financial services commissionfortune 500fortune500ncscnational cyber security centrecpnimi5gchqcertcert-ukcert.ggfive eyescyber guernseyguernsey cyberncanational crime agencyeuropolinterpolenisanatoaustralian cyber security centreacsccanadian centre for cyber securitycccsnew zealand national cyber security centrencsc-nzcybersecurity and infrastructure agencycisanational security administrationnsafederal bureau of investigationfbicentral intelligence agencyciadepartment of homeland securitydhssecret serviceodpaoffice of the data protection authorityicoinformation commissioners officeisc2isacacomptiasanssmesmbsmall businessmedium sized businessaccountinglaw firmslegal sectoracademiaeducationschoolsretailmaritimeaviationaerospacetransportdefencedefensedefence contractorcniscadaicsindustrial control systemsoperational technologyothealthcaremedicalpharmapharmaceuticalspci-dsspayment cardpayment card industryestate agentsestate agencychild safetyparental controlsregulated firmsfinancial servicescritical infrastructuremergers and acquisitionsmandam&aresearch and developmentr&dintellectual propertyiptelecomstelecommunicationsexecutivesexecutiveinsidersinsider threatstaffusersend userssenior executivesc-suiteboardshuman elementhuman centric securityhuman centricweakest linkboardroomboard roomcisoceoctociocfonistcyber essentialscyber essentials plusiasmeiasme governanceiasme goldiso 27001iso27001cyber killchainmitremitre att&ckciscis controlscap1753cap 1753caacivil aviation authorityfraud investigationsforensicscyber forensicsforensic investigationsexpert witnesstechnical investigationsaptchinarussiairannorth koreanation state actorsgrusvrfsbdprkransomwareransomware-as-a-serviceraasbecbusiness email compromiseemailphishingspear-phishingwhalingcredentialscredential stuffingaccount takeoveraccount takeoversatoextortionblackmaildenial of servicedistributed denial of servicedosddosrddosbotnetcryptominingcryptojackingrootkitsrootkitshadow itremote code executionrcezero-daymalwarevishingsmishingheat attacksheathighly evasive adaptive threatsratremote access trojancyber bullyingcyber stalkingsextortionblockchainwipersdestructive attacksvulnerabilityvulnerabilitiesvulnerability managementpatch managementpatchingkevkevsknown exploited vulnerabilitiesepsscvssinsurancecyber insuranceincident responseincident response plandisaster recoverydisaster recovery plandrpbusiness continuitybusiness continuity planningbusiness continuity plantrainingeducation and awareness trainingawarenessexercisingexerciseproctored exercisefacilitated exercisesimulationsgap analysiscyber gap analysisboard upskillingsenior executive cyber risk and governancesenior executive cyber risk and governance workshopstechnical assessmenttechnical analysispenetration testingpentestingphysical penetration testingtastargeted attack simulationsiso 27001 iso27001technical IT securityiamidamidentity and access managementdigital transformationchange managementcompliancegrcgovernance risk and complianceesghackerscriminalscyber criminalscyber warfareespionagecyber espionagefraudstersfraudscammersscamsscamorganised crimecriminal actorcriminal actorsterrorismterroristscyber terroristscyber terrorismsupply chainthird partiesmsspmspmanaged service providermanaged security service providerexternal it providerinternal itapplemacmacosiosiphoneandroidmicrosoftwindowscloudsaasiaaspaasdark webdatabasesencryptioncryptocurrenciesiotaiendpoint protectionantivirusantimalwarewfhwork from homednsemail gatewayonlineopen sourceattack surfaceedrmdrxdrmonitoring and detectionapiandorraanguillaantigua and barbudaarubabahamasbarbadosbermudabritish virgin islandsbvicayman islandschannel islandscicyprusdominicadublindutch antillesgibraltargrenadaguernseyisle of manjerseyliechtensteinlondonluxembourgmaltamonaconetherlands antillesphilippinesst kitts and nevisst luciast vincent and grenadinesswitzerlandturks and caicos islandsscotlandedinburghglasgowbristolsouthamptonportsmouthcoshamfarehamexetereuropeoffshoresouth westsouth eastukenglandgreat britainbritish islesgermanysouth africairelandaustralianew zealandcanada