Threat Intelligence Blog
Contact us to discuss any insights from our Blog, and how we can support you in a tailored threat intelligence report.
Black Arrow Cyber Advisory 26/05/2022 – Check the security of IoT Devices, Increase in Linux Botnet Malware
Black Arrow Cyber Advisory 26/05/2022 – Check the security of IoT Devices, Increase in Linux Botnet Malware.
Executive Summary
Microsoft has detected a significant increase in malware targeted at Linux systems to create botnets which can be used for distributed denial-of-service (DDOS) and other types of attack. Internet-of-Things (IoT) or Smart Devices often use a Linux operating system to run their service. These are often not patched regularly, if at all, making them a target for this type of attack. Cloud service providers also often use Linux based operating systems.
Black Arrow Cyber Threat Briefing 20 May 2022
Black Arrow Cyber Threat Briefing 20 May 2022
-Fifth of Businesses Say Cyber Attack Nearly Broke Them
-Weak Security Controls and Practices Routinely Exploited for Initial Access
-How Do Ransomware Attacks Impact Victim Organisations’ Stock?
-Prioritise Patching Vulnerabilities Associated with Ransomware
-Researchers Warn of Advanced Persistent Threats/Nation State Actors (APTs), Data Leaks as Serious Threats Against UK Financial Sector
-Remote Work Hazards: Attackers Exploit Weak WiFi, Endpoints, and the Cloud
-Small Businesses Under Fire from Password Stealers
-Email Is the Riskiest Channel for Data Security
-Phishing Attacks for Initial Access Surged 54% in Q1
-State of Internet Crime in Q1 2022: Bot Traffic on The Rise, And More
-Fears Grow for Smaller Nations After Ransomware Attack on Costa Rica Escalates
Black Arrow Cyber Advisory 19/05/2022 – VMware provides patches for critical vulnerabilities in multiple product lines. CISA advise to disconnect systems if they cannot be patched
Black Arrow Cyber Advisory 19/05/2022 – VMware provides patches for critical vulnerabilities in multiple product lines. CISA advise to disconnect systems if they cannot be patched.
Black Arrow Cyber Threat Briefing 13 May 2022
Black Arrow Cyber Threat Briefing 13 May 2022
-UK, US Intelligence Agencies Warn Managed Service Providers, including External IT Providers, Are Now Prime Targets for Cyber Attacks
-Wannacry – 5 Years On, 68% Of Enterprises Are Still At Risk
-You Can’t Eliminate Cyber Attacks, So Focus on Reducing the Blast Radius
-Just In Time? Bosses Are Finally Waking Up to The Cyber Security Threat
-Most Organisations Hit by Ransomware Would Pay Up If Hit Again
-31,000 FTSE 100 Logins Found on Dark Web
-Ransomware: How Executives Should Prepare Given the Current Threat Landscape
-What Your Cyber Insurance Application Form Can Tell You About Ransomware Readiness
-NCSC Shut Down 2.7 Million Scams in 2021
-Top 6 Security Threats Targeting Remote Workers
-Password Reuse Is Rampant Among Employees in All Sectors
Are you Awesome? We're Hiring!
Due to our continued growth and expansion, and to coincide with the opening of our first UK office in Bristol, we are recruiting for a number of cyber roles in the UK:
Cyber Security Analysts
Threat Intelligence Analysts
Incident Responders and Digital Forensics
IT Security/Technical Specialists
Microsoft 365 Security Specialists
Cyber Risk and Governance Consultants
Penetration Testers and Red Team Specialists
Trainers
Cyber Operations Specialists
Contact us for more information careers@blackarrowcyber.com
blackarrowcyber.com/careers
Black Arrow Cyber Threat Briefing 05 May 2022
Black Arrow Cyber Threat Briefing 05 May 2022
-Cyber Scams Cost Victims $6.9b-Plus Worldwide in 2021
-Bad Actors Are Maximizing Remote Everything
-New Hacker Group Pursuing Corporate Employees Focused on Mergers and Acquisitions
-FBI: Business Email Compromise: The $43 Billion Scam
-Disgruntled Employees Cashing in On Confidential Information Over Dark Web
-Google Sees More APTs Using Ukraine War-Related Themes
-Cryptocurrency Regulators Are Scrambling to Catch Up with Hackers Who Are Swiping Billions
-Tackling the Threats Posed by Shadow IT
-Hackers Used the Log4j Flaw to Gain Access Before Moving Across a Company's Network, Say Security Researchers
-This Sneaky Hacking Group Hid Inside Networks For 18 Months Without Being Detected
Black Arrow Cyber Advisory 04/05/2022 – Avaya and Aruba Switch Vulnerability
Black Arrow Cyber Advisory 04/05/2022 – Avaya and Aruba Switch Vulnerability
Black Arrow Cyber Advisory 03/05/2022 – Hacking tool disclosed for Privilege Escalation on Windows
Black Arrow Cyber Advisory 03/05/2022 – Hacking tool disclosed for Privilege Escalation on Windows
Black Arrow Cyber Threat Briefing 29 April 2022
Black Arrow Cyber Threat Briefing 29 April 2022
-Ransomware Attacks Surged to New Highs in 2021
-NCSC and Allies Publish Advisory on The Most Commonly Exploited Vulnerabilities In 2021
-Network Attacks Increased to a 3-Year High
-World War Three Is Far More Likely Than Anyone Is Prepared to Admit
-The Ransomware Crisis Deepens, While Data Recovery Stalls
-Ransoms Only Make Up 15% of Ransomware Costs
-Defending Your Business Against Russian Cyber Warfare
-5-Year Vulnerability Trends Are Both Surprising and Sadly Predictable
-Cisco Talos Observes 'Novel Increase' in APT Activity in Q1
-Deepfakes Set to Be Used in Organised Crime
-Smart Contract Developers Not Really Focused on Security. Who Knew?
-Tractor-Trailer Brake Controllers Vulnerable to Remote Hacker Attacks
Black Arrow Cyber Advisory 26/04/2022 – Actively exploited vulnerability affecting Microsoft Exchange Server (on-premise)
Black Arrow Cyber Advisory 26/04/2022 – Actively exploited vulnerability affecting Microsoft Exchange Server (on-premise)
Black Arrow Cyber Threat Briefing 22 April 2022
Black Arrow Cyber Threat Briefing 22 April 2022:
-Why Ransomware Attacks Prefer Small Business Targets Rather Than Rich Enterprises
-Ransomware Plagues Finance Sector as Cyber Attacks Get More Complex
-76% of Organisations Worldwide Expect to Suffer a Cyber Attack This Year
-Most Email Security Approaches Fail to Block Common Threats
-Financial Leaders Grappling with More Aggressive and Sophisticated Attack Methods
-Hackers Sneak Malware into Resumes Sent to Corporate Hiring Managers
-West Warns of Russian Cyber-Attacks As Concerns Rise Over Putin’s Nuclear Rhetoric
-Criminals Adopting New Methods To Bypass Improved Defences, Says Zscaler
-Cyber Criminals Are ‘Drinking the Tears’ Of Ukrainians
-Hackers For Hire Attempt to Destroy Hedge Fund Manager's Reputation
-New Threat Groups and Malware Families Emerging
-Economic Warfare: Attacks on Critical Infrastructure Part of Geopolitical Conflict
Black Arrow Cyber Advisory 20/04/2022 – Vulnerabilities identified within Lenovo Laptop UEFI BIOS
Black Arrow Cyber Advisory 20/04/2022 – Vulnerabilities identified within Lenovo Laptop UFEI BIOS
Black Arrow Cyber Threat Briefing 15 April 2022
Black Arrow Cyber Threat Briefing 15 April 2022:
-Cyber Security Is Getting Harder: More Threats, More Complexity, Fewer People
-Terrible Cloud Security Is Leaving the Door Open for Hackers. Here's What You're Doing Wrong
-More Organisations Are Paying the Ransom. Why?
-Cyber Attack Puts City Firms on High Alert To Bolster Defences
-More Than 60% of Organisations Suffered a Breach in the Past 12 Months
-Account Takeover Poised to Surpass Malware as The No. 1 Security Concern
-Security Research Reveals 42% Rise In New Ransomware Programs In 2021
-Fraudsters Stole £58m with Remote Access Trojans (RATs) in 2021
-As State-Backed Cyber Threats Grow, Here's How the World Is Reacting
-Q1 Reported Data Compromises Up 14% Over 2021
-Europol Announces Operation to Hit Russian Sanctions-Evaders
Black Arrow Cyber Advisory 13/04/2022 – Microsoft Patch Tuesday – patches released for various vulnerabilities
Black Arrow Cyber Advisory 13/04/2022 – Microsoft Patch Tuesday – patches released for various vulnerabilities
Black Arrow Cyber Advisory 13/04/2022 – Adobe releases security patches to address various vulnerabilities.
Black Arrow Cyber Advisory 13/04/2022 – Adobe releases security patches to address various vulnerabilities.
Black Arrow Cyber Threat Briefing 08 April 2022
Black Arrow Cyber Threat Briefing 08 April 2022
-Nearly Two-Thirds of Ransomware Victims Paid Ransoms Last Year, Finds "2022 Cyberthreat Defense Report"
-New Android Banking Malware Remotely Takes Control of Your Device
-Network Intrusion Detections Skyrocketing
-Organisations Underestimating the Seriousness Of Insider Threats
-Watch Out For Phishing Emails From Genuine Mailing Lists, Following Mailchimp Hack
-SpringShell Attacks Target About One in Six Vulnerable Orgs
-New Threat Group Underscores Mounting Concerns Over Russian Cyber Threats
-Consumer Fraud Tripled in The Last Two Years
-Borat RAT: Multiple Threat of Ransomware, DDoS and Spyware
-Bank Had No Firewall License, Intrusion or Phishing Protection – Guess The Rest
-Global APT Groups Use Ukraine War for Phishing Lures
-Paying Ransom Doesn’t Guarantee Data Recovery
Black Arrow Cyber Advisory 07/04/2022 – VMware provides patches for critical vulnerabilities in multiple products.
Black Arrow Cyber Advisory 07/04/2022 – VMware provides patches for critical vulnerabilities in multiple products.
Black Arrow Cyber Advisory – Spring4Shell Remote Code Execution Vulnerability - updated 05/04/2022 under active exploitation
Black Arrow Cyber Advisory – Spring4Shell Remote Code Execution Vulnerability – update 05/04/2022 under active exploitation
Update 05/04/2022: CISA have now confirmed that there is Active Exploitation of Critical Spring4Shell Vulnerability. It is recommended that patches are applied as soon as possible.
Executive Summary
Spring Core is a popular framework used for creating Java-based enterprise applications. Spring4Shell is a critical zero-day bug within this framework, that allows attackers to remotely execute code on affecting systems running certain, non-default configurations. Due to the popularity, Spring Core may be found within many java-based enterprise applications, and Java, is an almost ubiquitous software that’s found in billions of devices across the globe, from the enterprise to the home. The bug has been deemed “Critical”, primarily due to the remote root or administrator capabilities of an attacker if exploited.
This bug is currently receiving a large quantity of media attention. While we do not believe that this issue is of major concern at this time, it is something that is important to be aware of. We will continue to monitor and upgrade our advisory if we deem appropriate.
Black Arrow Cyber Advisory 05/04/2022 – Sophos Remote Code Execution Vulnerability identified.
Executive Summary
A critical flaw has been discovered in Sophos Firewall, allowing for remote code execution within the User Portal and Webadmin areas of the product. The bug impacts Sophos Firewall Network Access Control (NAC) systems, running versions v18.5 MR3 [18.5.3] and lower. The bug, achieving a 9.8 on the Common Vulnerability Scoring System (CVSS), allows attackers to remotely execute code on the device.
What’s the risk to my business?
Due to the severity of the bug, and the ability for attackers to gain remote code execution on a critical perimeter defence, the risk to businesses operating Sophos Firewalls is high, however if the device is configured using device access best practices as recommended by Sophos, then the bug is mitigated.
What can I do?
The bug has been reported, and a patch has been issued. Businesses operating these devices are urged to implement as soon as possible. Note: If “Allow automatic installation of hotfixes” feature is enabled, then the hotfixes should have already been installed.
Additional mitigations of ensuring that the User Portal and Webadmin portal are not exposed to the Wide Area Network (WAN) should be applied if not already in place following device access best practices issued by Sophos.
Technical Summary
Sophos have issued a patch for bug CVE-2022-1040, which was disclosed on 25/03/2022. Older, unsupported versions will require an upgrade in order to apply this fix. Follow Sophos Firewall: Verify if the hotfix for CVE-2022-1040 is applied to confirm that the hotfix has been applied. No further technical details on the bug are available at this time.
Need help understanding your gaps, or just want some advice? Get in touch with us.