Black Arrow Cyber Threat Briefing 17 February 2023

19 Feb

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

High Risk Users May be Few, but the Threat They Pose is Huge

High risk users represent approximately 10% of the worker population according to research provider, Elevate Security research. The research found that high risk users were responsible for 41% of all simulated phishing clicks, 30% of all real-world phishing clicks, 54% of all secure-browsing incidents and 42% of all malware events. This is worrying, considering the rise in sophisticated targeted phishing campaigns.

https://www.helpnetsecurity.com/2023/02/16/high-risk-behavior/

The Cost of Cyber Security Insurance is Soaring so Firms Need to Take Prevention More Seriously

State-backed cyber attacks are on the rise, but they are not raising the level of alarm that they should in the corporate world. Unfortunately, this is not a productive way of thinking. Come the end of March, insurance provider Lloyds will no longer cover damage from cyber attacks carried out by state or state-backed groups. In the worst cases, this reduced insurance coverage could exacerbate the trend of companies taking a passive approach toward state-backed attacks as they feel there is now really nothing they can do to protect themselves. The uncertainty however, could be the motivation for companies to take the threat of state-backed attacks more seriously.

https://fortune.com/2023/02/15/cost-cybersecurity-insurance-soaring-state-backed-attacks-cover-shmulik-yehezkel/

Cyber Attacks Worldwide Increased to an All-Time Record-Breaking High, Report Shows

According to a report by security provider Check Point, cyber attacks rose 38% in 2022 compared to the previous year. Some of the key trends in the report included an increase in the number of cloud-based networking attacks, with a 48% rise and non-state affiliated hacktivist groups becoming more organised and effective than ever before. Additionally, ransomware is becoming more difficult to attribute and track and extra focus should be placed on exfiltration detection.

https://www.msspalert.com/cybersecurity-research/cyberattacks-worldwide-increased-to-an-all-time-high-check-point-research-reveals/

Most Organisations Make Cyber Security Decisions Without Insights

A report by security provider Mandiant found some worrying results when it came to organisational understanding of threat actors. Some of the key findings include, 79% of respondents stating that most of their cyber security decisions are made without insight into the treat actors targeting them, 79% believing their organisation could focus more time and energy on identifying critical security trends, 67% believing senior leadership teams underestimate the cyber threats posed to their organisation and finally, 47% of respondents felt that they could not prove to senior leadership that their organisation has a highly effective cyber security program.

https://www.msspalert.com/cybersecurity-research/mandiant-report-most-organizations-make-cybersecurity-decisions-without-insights/

Ransomware Attackers Finding New Ways to Weaponise Old Vulnerabilities

Ransomware attackers are finding new ways to exploit organisations’ security weaknesses by weaponising old vulnerabilities. A report by security provider Cyber Security Works had found that 76% of the vulnerabilities currently being exploited were first discovered between 2010-2019.

https://venturebeat.com/security/ransomware-attackers-finding-new-ways-to-weaponize-old-vulnerabilities/

Are Executives Fluent in IT Security Speak? 5 Reasons Why the Communication Gap is Wider Than You Think

Using data from two different reports conducted by security provider Kaspersky, the combined data showed some worrying results. Some of the results include 98% of respondents revealing they faced at least one IT security miscommunication that regularly leads to bad consequences, 62% of managers revealing miscommunication led to at least one cyber security incident, 42% of business leaders wanting their IT security team to better communicate and 34% of C-level executives struggle to speak about adopting new security solutions.

https://www.msspalert.com/cybersecurity-research/are-c-suite-executives-fluent-in-it-security-speak-five-reasons-why-the-communication-gap-is-wider-than-you-think/

Business Email Compromise Groups Target Firms with Multilingual Impersonation Attacks

Security providers Abnormal Security have identified two Business Email Compromise (BEC) groups “Midnight Hedgehog” and “Mandarin Capybara” which are conducting impersonation attacks in at least 13 different languages. Like many payment fraud attacks, finance managers or other executives are often targeted. In a separate report by Abnormal Security, it was found that business email compromise (BEC) attacks increased by more than 81% during 2022.

https://www.infosecurity-magazine.com/news/bec-groups-multilingual/

EU Countries Told to Step up Defence Against State Hackers

European states have raced to protect their energy infrastructure from physical attacks but the European Systemic Risk Board (ESRB) said more needed to be done against cyber warfare against financial institutions and the telecommunications networks and power grids they rely on. "The war in Ukraine, the broader geopolitical landscape and the increasing use of cyber attacks have significantly heightened the cyber threat environment," the ESRB said in a report. In addition, the ESRB highlight an increased risk of cyber attacks on the EU financial system, suggesting that stress tests and impact analyses should be carried out to identify weaknesses and measure resilience.

https://www.reuters.com/world/europe/eu-countries-told-step-up-defence-against-state-hackers-2023-02-14/

Cyber Criminals Exploit Fear and Urgency to Trick Consumers

Threats using social engineering to steal money, such as refund and invoice fraud and tech support scams, increased during Q4 of 2022 according to a report by software provider Avast. “At the end of 2022, we have seen an increase in human-centred threats, such as scams tricking people into thinking their computer is infected, or that they have been charged for goods they didn’t order. It’s human nature to react to urgency, fear and try to regain control of issues, and that’s where cyber criminals succeed” Avast commented.

https://www.helpnetsecurity.com/2023/02/13/cybercriminals-exploit-fear-urgency-trick-consumers/

How to Manage Third Party and Supply Chain Cyber Security Risks that are Too Costly to Ignore

Many organisations have experienced that “after the breach” feeling — the moment they realise they have to tell customers their personal information may have been compromised because one of the organisations’ vendors had a data breach. Such situations involve spending significant amount of money and time to fix a problem caused by a third party. An organisation’s ability to handle third-party cyber risk proactively depends on its risk management strategies.

https://techcrunch.com/2023/02/10/why-third-party-cybersecurity-risks-are-too-costly-to-ignore/

Russian Spear Phishing Campaign Escalates Efforts Towards Critical UK, US and European Targets

Following the advisory from the NCSC, it is clear that Russian state-sponsored hackers have become increasingly sophisticated at launching phishing attacks against critical targets in the UK, US and Europe over the last 12 months. The attacks included the creation of fake personas, supported by social media accounts, fake profiles and academic papers, to lure targets into replying to sophisticated phishing emails. In some cases, the bad actor may never leverage the account to send emails from and only use it to make decisions based on intelligence collection.

https://www.computerweekly.com/news/365531158/Russian-spear-phishing-campaign-escalates-efforts-toward-critical-UK-US-and-European-targets

5 Biggest Risks of Using Third Party Managed Service Providers

As business processes become more complex, companies are turning to third parties to boost their ability to provide critical services from cloud storage to data management to security. It’s often more efficient and less expensive to contract out work. But it does present risks. 5 of the biggest risks to be considered are: indirect cyber attacks, financial risks from incident costs, reputational damage, geopolitical risk and regulatory compliance risk.

https://www.csoonline.com/article/3687812/5-major-risks-third-party-services-may-bring-along-with-them.html#tk.rss_news

Cyber Crime as a Service: A Subscription Based Model in the Wrong Hands

Arguably nothing in tech has changes the landscape more than ‘as a Service’ offerings, the subscription-based IT service delivery model, in fact, the ‘as a Service’ offering has made its way into the cyber crime landscape. And cyber crime, for its part, has evolved beyond a nefarious hobby; today it’s a means of earning for cyber criminals. Organised cyber crime services are available for hire, particularly to those lacking resources and hacking expertise but willing to buy their way into cyber criminal activities. Underground cyber crime markets have thus emerged, selling cyber attack tools and services ranging from malware injection to botnet tools, Denial of Service and targeted spyware services.

https://www.splunk.com/en_us/blog/learn/cybercrime-as-a-service.html

Threats

Ransomware, Extortion and Destructive Attacks

Phishing & Email Based Attacks

BEC – Business Email Compromise

BEC Groups Target Firms With Multilingual Impersonation Attacks - Infosecurity Magazine (infosecurity-magazine.com)

2FA/MFA

Reddit Hack Shows Limits of MFA, Strengths of Security Training (darkreading.com)

Malware

Mobile

RedEyes hackers use new malware to steal data from Windows, phones (bleepingcomputer.com)

Botnets

Mirai V3G4 botnet exploits 13 flaws to target IoT devices-Security Affairs

Denial of Service/DoS/DDOS

Internet of Things – IoT

Data Breaches

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

A former Credit Suisse employee leaked employees' historic bonus data (efinancialcareers.com)

Fraud, Scams & Financial Crime

Supply Chain and Third Parties

Cloud/SaaS

Attack Surface Management

To thwart cyber attacks, enterprises must have visibility of their assets: Sophos CEO - The Hindu BusinessLine

Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Malvertising

AdSense fraud campaign relies on 10,890 sites that were infected since September 2022-Security Affairs

Training, Education and Awareness

Regulations, Fines and Legislation

Governance, Risk and Compliance

Backup and Recovery

A CISOs Practical Guide to Storage and Backup Ransomware Resiliency (thehackernews.com)

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs

Privacy, Surveillance and Mass Monitoring

The FBI’s most controversial surveillance tool is under threat | Ars Technica

Artificial Intelligence

Misinformation, Disinformation and Propaganda

Revealed: the hacking and disinformation team meddling in elections | Technology | The Guardian

Spyware, Cyber Espionage & Cyber Warfare, including Russian Invasion of Ukraine

Nation State Actors

Vulnerability Management

Ransomware attackers finding new ways to weaponize old vulnerabilities | VentureBeat

Vulnerabilities

Tools and Controls

Sector Specific

Industry specific threat intelligence reports are available.

· Automotive

· Construction

· Critical National Infrastructure (CNI)

· Defence & Space

· Education & Academia

· Energy & Utilities

· Estate Agencies

· Financial Services

· FinTech

· Food & Agriculture

· Gaming & Gambling

· Government & Public Sector (including Law Enforcement)

· Health/Medical/Pharma

· Hotels & Hospitality

· Insurance

· Legal

· Manufacturing

· Maritime

· Oil, Gas & Mining

· OT, ICS, IIoT, SCADA & Cyber-Physical Systems

· Retail & eCommerce

· Small and Medium Sized Businesses (SMBs)

· Startups

· Telecoms

· Third Sector & Charities

· Transport & Aviation

· Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

elevate securitycheck pointmandiantkasperskymidnight hedgehogmandarin capybaraesrbeuropean systemic risk boardukraineavastcity of oaklanddallas central appraisal districtmtuesxiesxiargsclopiontechnion universitypepsipepsi bottling ventureslockbitroyal mailarnold clarkvmwareciscoburton snowboardsmortalkombatmunster technological universitynamecheapmetamaskvenmoredditta886chatgptlokibotagentteslaw4spredeyeswordpresshavocmiraicloudflaretoratlassiangoanywherescandinavian airlinesanonymous sudanhydraenigmavectortgtoxicsidewindermoneygrampig butcheringpaypalcontisophossaltstackeurostarelon muskccpacpraonline safety billveeamspacexstarlinkspy balloonsalaskamagicweblazarusgroup-ibshadowpadfortra mftterramaster nasgnutlsopenssladobeadobe illustratoradobe after effectsmicrosoftmicrosoft patch tuesdayintelsgxsplunkcitrixtrellixdlpfirefoxmozillaclamavbae systemsalan turingblack arrowblack arrow cybercyber expertscyber consultingcyber investigatorscybercyber securityinfosecinformation securitythreat intelthreat intelligencethreat reportbusiness riskbusiness riskscyber risk managementrisk managementcyber riskcyber security riskcyber risk assessmentrisk assessmentcyber incident responsecyber incident response teamcyber emergency responsecomputer incident responsecomputer emergency responseemergency responsesubject matter expertsit securitytrusted advisertrusted partnervcisovirtual chief information security officervisoinformation security officersecurity executive on demandsecurity as a servicesecurity on demandcyber security strategycyber strategycyber kill chainsecurity as a a servicesecurity-as-a-servicehrhuman resourceshuman resources managementhrmtprmthird party risk managementbritish intelligencenational securityuk national securitymilitary intelligencemodministry of defencepolicelaw enforcementftse 100ftse100offshore financial servicesgfscguernsey financial services commissionfortune 500fortune500ncscnational cyber security centrecpnimi5gchqcertcert-ukcert.ggfive eyescyber guernseyguernsey cyberncanational crime agencyeuropolinterpolenisanatoaustralian cyber security centreacsccanadian centre for cyber securitycccsnew zealand national cyber security centrencsc-nzcybersecurity and infrastructure agencycisanational security administrationnsafederal bureau of investigationfbicentral intelligence agencyciadepartment of homeland securitydhssecret serviceodpaoffice of the data protection authorityicoinformation commissioners officeisc2isacacomptiasanssmesmbsmall businessmedium sized businessaccountinglaw firmslegal sectoracademiaeducationschoolsretailmaritimeaviationaerospacetransportdefencedefensedefence contractorcniscadaicsindustrial control systemsoperational technologyothealthcaremedicalpharmapharmaceuticalspci-dsspayment cardpayment card industryestate agentsestate agencychild safetyparental controlsregulated firmsfinancial servicescritical infrastructuremergers and acquisitionsmandam&aresearch and developmentr&dintellectual propertyiptelecomstelecommunicationsexecutivesexecutiveinsidersinsider threatstaffusersend userssenior executivesc-suiteboardshuman elementhuman centric securityhuman centricweakest linkboardroomboard roomcisoceoctociocfonistcyber essentialscyber essentials plusiasmeiasme governanceiasme goldiso 27001iso27001cyber killchainmitremitre att&ckciscis controlscap1753cap 1753caacivil aviation authorityfraud investigationsforensicscyber forensicsforensic investigationsexpert witnesstechnical investigationsaptchinarussiairannorth koreanation state actorsgrusvrfsbdprkransomwareransomware-as-a-serviceraascrime-as-a-servicebecbusiness email compromiseemailphishingspear-phishingwhalingcredentialscredential stuffingaccount takeoveraccount takeoversatoextortionblackmaildenial of servicedistributed denial of servicedosddosrddosbotnetcryptominingcryptojackingrootkitsrootkitshadow itremote code executionrcezero-daymalwarevishingsmishingheat attacksheathighly evasive adaptive threatsratremote access trojancyber bullyingcyber stalkingsextortionblockchainwipersdestructive attacksvulnerabilityvulnerabilitiesvulnerability managementpatch managementpatchingkevkevsknown exploited vulnerabilitiesepsscvssinsurancecyber insuranceincident responseincident response plandisaster recoverydisaster recovery plandrpbusiness continuitybusiness continuity planningbusiness continuity plantrainingeducation and awareness trainingawarenessexercisingexerciseproctored exercisefacilitated exercisesimulationsgap analysiscyber gap analysisboard upskillingsenior executive cyber risk and governancesenior executive cyber risk and governance workshopstechnical assessmenttechnical analysispenetration testingpentestingphysical penetration testingtastargeted attack simulationsiso 27001 iso27001technical IT securityiamidamidentity and access managementdigital transformationchange managementcompliancegrcgovernance risk and complianceesghackerscriminalscyber criminalscyber warfareespionagecyber espionagefraudstersfraudscammersscamsscamorganised crimecriminal actorcriminal actorsterrorismterroristscyber terroristscyber terrorismsupply chainthird partiesmsspmspmanaged service providermanaged security service providerexternal it providerinternal itapplemacmacosiosiphoneandroidwindowscloudsaasiaaspaasdark webdatabasesencryptioncryptocurrenciesiotaiendpoint protectionantivirusantimalwarewfhwork from homednsemail gatewayonlineopen sourceattack surfaceedrmdrxdrmonitoring and detectionapiandorraanguillaantigua and barbudaarubabahamasbarbadosbermudabritish virgin islandsbvicayman islandschannel islandscicyprusdominicadublindutch antillesgibraltargrenadaguernseyisle of manjerseyliechtensteinlondonluxembourgmaltamonaconetherlands antillesphilippinesst kitts and nevisst luciast vincent and grenadinesswitzerlandturks and caicos islandsscotlandedinburghglasgowbristolsouthamptonportsmouthcoshamfarehamexetereuropeoffshoresouth westsouth eastukenglandgreat britainbritish islesgermanysouth africairelandaustralianew zealandcanada

Black Arrow Cyber Threat Briefing 17 February 2023

Top Cyber Stories of the Last Week

High Risk Users May be Few, but the Threat They Pose is Huge

The Cost of Cyber Security Insurance is Soaring so Firms Need to Take Prevention More Seriously

Cyber Attacks Worldwide Increased to an All-Time Record-Breaking High, Report Shows

Most Organisations Make Cyber Security Decisions Without Insights

Ransomware Attackers Finding New Ways to Weaponise Old Vulnerabilities

Are Executives Fluent in IT Security Speak? 5 Reasons Why the Communication Gap is Wider Than You Think

Business Email Compromise Groups Target Firms with Multilingual Impersonation Attacks

EU Countries Told to Step up Defence Against State Hackers

Cyber Criminals Exploit Fear and Urgency to Trick Consumers

How to Manage Third Party and Supply Chain Cyber Security Risks that are Too Costly to Ignore

Russian Spear Phishing Campaign Escalates Efforts Towards Critical UK, US and European Targets

5 Biggest Risks of Using Third Party Managed Service Providers

Cyber Crime as a Service: A Subscription Based Model in the Wrong Hands