Black Arrow Cyber Threat Briefing 08 March 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

FBI Reports Cyber Crime Losses Reached $12.5 billion in 2023, Ransomware Losses Surged by 74%, Average Ransom Demand Reaching $600k

An FBI report into the cost of cyber crime has found that estimated losses in the US alone reached $12.5 billion in 2023. Ransomware accounted for $59.6 million, a 74% increase from the previous year’s report. Of note, the FBI report only deals with complaints made to the FBI; it therefore excludes other countries, and relies on the US organisations to identify that they have been impacted. It is therefore likely that the figure in the US, let alone globally, is significantly higher.

Sources: [Security Boulevard] [Security Week] [Infosecurity Magazine] [Tripwire] [Security Affairs]

Capita Plans £100 Million in Cost Cuts as it Continues to Grapple With 2023 Cyber Attack, Resulting in Significant Job Losses

In the aftermath of a significant cyber attack in 2023, Capita faces a steep financial hurdle with reported losses amounting to £106.6 million. Originally forecasted at £25 million, the revised figure underscores the substantial impact of the breach. Capita’s response strategy, including significant investments in recovery and cyber security bolstering, emphasises the escalating costs associated with data breaches. CEO Adolfo Hernandez announced plans for a substantial cost reduction of over £100 million, indicating the critical need for efficiency improvements to mitigate the financial strain. Capita’s experience serves as a potent reminder of the critical importance of robust cyber resilience strategies. These strategies are not just about preventing attacks, but also about mitigating the potentially devastating financial consequences should a breach occur.

Source: [ITPro]

Employment Law Firm Sues IT Company Over Ransomware Attack

A law firm in California has sued an IT solutions company, saying that after hiring the company to install a network system and server, the law firm suffered a ransomware attack. The law firm found that not long after the network was installed, they were unable to access their data, and when they had gone to retrieve a cloud backup, they had found this was already deleted, forcing them to pay the ransom to get their data back. The law firm is accusing the IT company of negligence and breach of contract and is seeking damages of at least $1 million.

Source: [Law360]

Stolen Passwords are a Hacker Goldmine

Passwords are not only crucial for organisational security, but they also come with significant costs and vulnerabilities. From the time spent by service desks on resets, to the expense of security incidents and breaches, the financial toll is substantial. Weak or reused passwords heighten the vulnerability, with breaches involving stolen credentials costing an average of $4.45 million. Cyber threats are evolving, with hackers increasingly favouring stolen user accounts over traditional malware. This shift, underscored by a notable 71% increase in attacks leveraging valid login credentials in 2023 as reported by CrowdStrike and IBM, highlights the repercussions of compromised credentials. Embracing technologies like multi-factor authentication (MFA) and single sign-on (SSO), along with employee education, can bolster security while alleviating financial strains. Robust identity management and zero-trust security frameworks are essential to mitigate risks further, especially in the face of rising cloud intrusions. Proactive investments in password security software such as password managers can help streamline operations and enhance overall organisational resilience against these evolving threats.

Sources: [Bleeping Computer] [Axios] 

Phishing Attacks Up 40 Percent in 2023; Attackers Leverage Social Engineering for Greater Success

Kaspersky recently released their annual spam and phishing report in which they identified over 709 million attempts to access phishing and scam websites, a 40% increase from the previous year. It should be noted that this number is just related to Kaspersky’s identification; the figure is likely far greater. With reports identifying that 90% of phishing involves social engineering, it is important to understand how it is leveraged.

Phishing attacks generally include an element of trust; for example, a bad actor impersonating a reputable brand or providing details about an individual that makes the attack more credible. Often, social engineering will rely on human characteristics, such as urgency, emotion and habit to try to manipulate the target to perform particular actions. Whilst the tools may change, the basis is the same; a successful phish requires user interaction. To mitigate the impact of phishing in corporate environments, organisations must stay informed about the latest adversarial activity and prioritise security measures such as multi-factor authentication (MFA) and providing employee awareness and education training that goes beyond ticking boxes.

Sources: [Beta News] [CSO Online] [Security Boulevard] [DarkReading]

Business Leaders Don’t Even Know They’ve Been Hacked

A survey of over 10,000 business leaders across various industries has found that a number of business leaders know little when it comes to their organisation’s cyber security landscape, with 1 in 10, “unsure” and unable to provide a definitive answer as to whether their organisation has had a data breach in 2023. The report highlights that there are a number of leadership positions that are not receiving sufficient information about their organisation’s data security situation.

Receiving regular reports with metrics about the organisation’s cyber security posture is key to organisations achieving and maintaining a solid level of governance, something that is required in various standards and regulations.

Source: [Tech.Co]

Rising Cyber Security Risks: Insider Threat Main Concern Among Mid-Market Firms

According to the 2023 CyberArk Identity Security Threat Landscape Report, insider threats are on the rise, with 68% of organisations reporting an increased frequency in the past year. These threats, considered one of the top concerns over the next 12 months, stem from within an organisation where authorised employees exploit their access to steal or leak sensitive data. Factors such as flexible working, an increase in job transitions, workforce reductions, third-party relationships, economic uncertainties, and employee stress levels further compound these challenges. Negligence, accounting for 62% of insider incidents, plays a significant role; these threats aren’t always malicious but can also be negligent or accidental. As these threats evolve, the potential consequences, including revenue loss and reputational damage, are becoming more apparent to business leaders. To mitigate risks, companies must prioritise improving identity security, particularly in controlling privileged access, and embrace a Zero Trust approach. This ensures full visibility and control over access to sensitive data, safeguarding critical assets and enhancing cyber resilience in an increasingly volatile landscape. Other key identified threats include AI-related risks, ransomware, deep fakes, and malware.

Sources: [TechRadar] [Comms Business]

C-Suite Executives: An Attacker’s Dream?

Cyber criminals are increasingly focusing on high-value targets, particularly C-suite executives who hold extensive organisational access. These executives, often overlooked in security practices and training, have become vulnerable links. The cyber security landscape of 2023 saw significant advancements but also revealed vulnerabilities, exacerbated by global conflicts and strategic cyber attacks. Cyber actors are now targeting entities with high return potential, with ransomware attackers tailoring their strikes to maximise revenues, often from smaller organisations. Interestingly, while automation is on the rise, cyber criminals are opting for a human touch, with human operatives often behind attacks. A report last year showed a nearly 30% spike in fraud specifically targeting senior executives, highlighting the vulnerability of the C-suite. This emphasises the need for robust cyber resilience strategies to safeguard these high-value targets.

Source: [SecurityBrief New Zealand]

Security Risks Plague SMEs in Shift to Remote Working

In the wake of the COVID-19 pandemic, remote working surged, offering businesses newfound flexibility and cost efficiencies. However, this paradigm shift comes with its own set of security challenges, particularly impacting startups and small businesses. The inherent flexibility of remote work exposes companies to risks like unauthorised access, IP theft, and malware. These threats are especially potent for SMEs, jeopardising their financial stability and reputation. Robust security measures include VPNs, enforcing regular software updates, and employee training to mitigate these risks. By embracing these strategies, SMEs can navigate the remote work landscape securely, unlocking its benefits while safeguarding against potential threats.

Source: [SecurityBrief New Zealand]

After Collecting $22 Million, Ransomware Group Stages FBI Takedown

The ransomware group responsible for facilitating a huge attack against a US prescription drug company for $22 million has gone dark, days after receiving the payment and standing accused of scamming their own affiliate out of their share of the gains. Days after the payment was made, AlphV’s public website started displaying a message saying it had been seized by the FBI as part of an international law enforcement action. Ransomware researchers have since said that it has not actually been seized, but appears to be a ploy to exit scam affiliates of the ransomware group. This proves the old adage that there really is no honour among thieves.

Source: [Ars Technica]

Cyber Attacks Remain Chief Concern for Businesses

A recent report has underscored the growing concern among UK corporate businesses regarding cyber attacks as the primary fraud threat in the upcoming year, with 73% of respondents expressing worry. As businesses grapple with the shift to hybrid and remote work models, ensuring robust counter-fraud measures and internal controls is imperative to safeguarding workforces regardless of location. This situation emphasises the critical importance of investing in employee training to combat evolving fraud threats. It highlights the far-reaching consequences that fraud can have on organisations and underscores the necessity of fostering an anti-fraud culture across all levels of the enterprise.

Source: [TheHRDirector]

Two New Ransomware Groups Join Forces to Launch Joint Attacks

Two ransomware groups, Ghostsec and Stormous, have joined forces to conduct double extortion ransomware attacks on various businesses across multiple countries. As part of this, their new ransomware-as-a-service (RaaS) program, STMX_GhostLocker, provides various options for their affiliates. GhostSec is already part of a coalition called the five families, involving 4 other entities. The group ventured into RaaS last year, offering services for as little as $269.99 per month.

Source: [The Hacker News]

---

Governance, Risk and Compliance

• FBI: Cyber Crime Losses Exceeded $12.5 Billion in 2023 - Security Week

• 1 in 10 Business Leaders Don’t Even Know They’ve Been Hacked (tech.co)

• Cyber attacks remain chief concern for businesses | theHRD (thehrdirector.com)

• Companies Are Already Not Complying With The New SEC Cyber Security Incident Disclosure Rules (forbes.com)

• What Cyber Security Chiefs Need From Their CEOs (darkreading.com)

• Simply Human: Why HR Needs To Take The Lead In Cyber Security (forbes.com)

• The Security Interviews: Cyber security is about managing risk effectively | Computer Weekly

• NIST Cyber Framework 2.0: Doubling Down on Governance, Expanding Applicability | Law.com

• CISOs Tackle Compliance With Cyber Guidelines (informationweek.com)

• Are C-suite executives cyber security's weakest link? (securitybrief.co.nz

• 30 years of the CISO role – how things have changed since Steve Katz | CSO Online

• How to create an efficient governance control program - Help Net Security

• Demystifying the Maze: A Guide to Cyber Risk Quantification Methods (cybersaint.io)

• Resilience is built on a solid framework | Professional Security

• Cyber Insights 2024: A Dire Year for CISOs? - Security Week

• Cyber Pros’ Knowledge Gaps Lead to Errors | MSSP Alert

• Research finds that cyber security leaders are taking on multiple roles | Security Magazine

• How Security Leaders Can Break Down Barriers to Enable Digital Trust - Infosecurity Magazine (infosecurity-magazine.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• ConnectWise ScreenConnect bug used in Play ransomware breach, MSP attack | SC Media (scmagazine.com)

• FBI: US Ransomware Losses Surge 74% to $59.6 Million in 2023 - Infosecurity Magazine (infosecurity-magazine.com)

• Employment Law Firm Sues IT Co. Over Ransomware Attack - Law360

• Report: Average Initial Ransomware Demand in 2023 Reached $600K - Security Boulevard

• What’s Fueling the Ransomware Epidemic? | Symantec Enterprise Blogs (security.com)

• Banning ransomware payments back on the agenda | Computer Weekly

• BlackCat Goes Dark After Ripping Off Change Healthcare Ransom (darkreading.com)

• Inside an Alphv/BlackCat ransomware attack | TechTarget

• Healthcare facing record ransom as cyber criminals continue to target sector - Emerging Risks Media Ltd

• Uncle Sam intervenes in Change Healthcare ransomware fiasco • The Register

• Alert: GhostSec and Stormous Launch Joint Ransomware Attacks in Over 15 Countries (thehackernews.com)

• Capita drops 18% on £107m loss as financial impact of cyber attack is revealed | LSE:CPI (proactiveinvestors.co.uk)

• US cyber and law enforcement agencies warn of Phobos ransomware attacks (securityaffairs.com)

• Experts echo calls for ransomware ban as LockBit rallies • The Register

• Government urged to ban ransom payments to cyber criminals (computing.co.uk)

• LockBit 3.0’s Bungled Comeback Highlights the Undying Risk of Torrent-Based (P2P) Data Leakage (securityaffairs.com)

• Ransomware spikes against critical infrastructure, says FBI • The Register

• Major shifts in identity, ransomware, and critical infrastructure threat trends - Help Net Security

• Government was third-largest ransomware target last year: FBI - Defense One

• JetBrains TeamCity under attack by ransomware thugs • The Register

Ransomware Victims

• A Deep Dive into the 2024 Prudential and LoanDepot Breaches - Security Boulevard

• Employment Law Firm Sues IT Co. Over Ransomware Attack - Law360

• After collecting $22 million, AlphV ransomware group stages FBI takedown | Ars Technica

• Change Healthcare hack cripples payment systems across health providers - The Washington Post

• Hackers Behind the Change Healthcare Ransomware Attack Just Received a $22 Million Payment | WIRED

• Capita raises threat of further job cuts under plans to save another £100m | BelfastTelegraph.co.uk

• Capita drops 18% on £107m loss as financial impact of cyber attack is revealed | LSE:CPI (proactiveinvestors.co.uk)

• Fidelity Investments Notifying 28,000 People of Data Breach - Fidelity Investments Notifying 28,000 People of Data Breach - Security Week

• First BofA, Now Fidelity: Same Vendor Behind Third-Party Breaches (darkreading.com)

• UnitedHealth's cyber attack should be a 'wake-up call' for healthcare (yahoo.com)

• Ransomware Attackers Leak Sensitive Swiss Government Documents, Login - Infosecurity Magazine (infosecurity-magazine.com)

• Security leaders weigh in on the recent UnitedHealth cyber attack | Security Magazine

• LockBit 3.0’s Bungled Comeback Highlights the Undying Risk of Torrent-Based (P2P) Data Leakage (securityaffairs.com)

• Canada's anti-money laundering agency offline after cyber attack (bleepingcomputer.com)

• Uncle Sam intervenes in Change Healthcare ransomware fiasco • The RegisterFidelity Investments Notifying 28,000 People of Data Breach - Security Week

• Duvel says it has "more than enough" beer after ransomware attack (bleepingcomputer.com)

• Thousands of Dutch passports stolen in ransomware attacks available on dark web | NL Times

• Corporate Greed Made the Change Healthcare Cyber attack Worse (nymag.com)

• Switzerland: Play ransomware leaked 65,000 government documents (bleepingcomputer.com)

• Possible China link to Change Healthcare ransomware attack • The Register

• Action needed to avoid repeat of Southern Water cyber attack - Utility Week

Phishing & Email Based Attacks

• Phishing attacks up 40 percent in 2023 (betanews.com)

• Jamf says 9% of smartphone have fallen for phishing attacks (appleinsider.com)

• How attackers leverage social engineering for greater scamming success | CSO Online

• Cyber Criminals Spoof US Government Organisations in BEC, Phishing Attacks - Security Week

• Annual State of Email Security by the Numbers - Security Boulevard

• New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users (thehackernews.com)

• Hackers target Coinbase, Binance staff with phishing clones of Gmail, iCloud (crypto.news)

• AI worm that infects computers and reads emails created by researchers | The Independent

• 95% believe LLMs making phishing detection more challenging - Help Net Security

• Hundreds of orgs targeted with emails aimed at stealing NTLM authentication hashes - Help Net Security

• Kaspersky spam and phishing report for 2023 | Securelist

Other Social Engineering

• How attackers leverage social engineering for greater scamming success | CSO Online

• New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users (thehackernews.com)

• The Rise of Social Engineering Fraud in Business Email Compromise (darkreading.com)

Artificial Intelligence

• Over 225,000 Compromised ChatGPT Credentials Up for Sale on Dark Web Markets (thehackernews.com)

• AI tools put companies at risk of data exfiltration - Help Net Security

• Don't Give Your Business Data to AI Companies (darkreading.com)

• Act now to stop WordPress and Tumblr selling your content to AI firms • Graham Cluley

• GTPDOOR backdoor is designed to target telecom carrier networks (securityaffairs.com)

• Political deepfakes are spreading like wildfire thanks to GenAI | TechCrunch

• Self-Propagating Worm Created to Target Generative AI Systems - Infosecurity Magazine (infosecurity-magazine.com)

• The Future Of AI And ML In Cyber Security (forbes.com)

• AI worm that infects computers and reads emails created by researchers | The Independent

• 95% believe LLMs making phishing detection more challenging - Help Net Security

• Immediate AI risks and tomorrow's dangers - Help Net Security

• Defence: Leonardo CEO says stupidity poses a bigger threat than AI (cnbc.com)

2FA/MFA

• Google and Meta users see their 2FA security codes leaked online - Root-Nation.com

Malware

• No “Apple magic” as 11% of macOS detections last year came from malware | Malwarebytes

• Mobile banking malware growing rapidly, ThreatFabric warns | Biometric Update

• GTPDOOR backdoor is designed to target telecom carrier networks (securityaffairs.com)

• Watch Out for Spoofed Zoom, Skype, Google Meet Sites Delivering Malware (thehackernews.com)

• Linux variant of BIFROSE RAT uses deceptive domain strategies (securityaffairs.com)

• Self-Propagating Worm Created to Target Generative AI Systems - Infosecurity Magazine (infosecurity-magazine.com)

• New Linux malware found targeting mobile networks across the world | TechRadar

• ScreenConnect flaws exploited to drop new ToddleShark malware (bleepingcomputer.com)

• Malware is coming for your ChatGPT credentials • The Register

• North Korea Hits ScreenConnect Bugs to Drop 'ToddleShark' Malware (darkreading.com)

• Linux Malware Campaign Targets Misconfigured Cloud Servers - Security Week

• Linux Malware Targets Docker, Apache Hadoop, Redis and Confluence - Infosecurity Magazine (infosecurity-magazine.com)

• AI worm that infects computers and reads emails created by researchers | The Independent

• New WogRAT malware abuses online notepad service to store malware (bleepingcomputer.com)

• Snake, a new Info Stealer spreads through Facebook messages (securityaffairs.com)

• Linux Variants of Bifrost Trojan Evade Detection via Typosquatting (darkreading.com)

Mobile

• Jamf says 9% of smartphone have fallen for phishing attacks (appleinsider.com)

• Mobile banking malware growing rapidly, ThreatFabric warns | Biometric Update

• Apple warns of increased iPhone security risks | Computerworld

• The Privacy Danger Lurking in Push Notifications | WIRED

• Android's March 2024 Update Patches Critical Vulnerabilities - Security Week

• CISA Adds Android Pixel and Sunhillo Sureline Bugs to Its Known Exploited Vulnerabilities Catalog

• The Importance of Cyber security for Your Smart Devices | HackerNoon

• Phone hacking is a real danger. How to keep your data, location secure (usatoday.com)

Denial of Service/DoS/DDOS

• DDoS Attacks on Financial Services Industry Up 154%, According to New FS-ISAC/Akamai Report (prnewswire.com)

Internet of Things – IoT

• Someone is hacking 3D printers to warn owners of a security flaw (bitdefender.com)

• Popular doorbell camera brands contain security flaws, making them easy to hack: Report  | The Hill

• NCSC flags up cyber security for connected places | UKAuthority

• The Importance of Cyber Security for Your Smart Devices | HackerNoon

• This $4 Billion Car Surveillance Startup Says It Cuts Crime. But It Likely Broke The Law. (forbes.com)

• Flipper Zero WiFi phishing attack can unlock and steal Tesla cars (bleepingcomputer.com)

Data Breaches/Leaks

• The State Of Cyber Security (Part One): Why Are There Still So Many Data Breaches? (forbes.com)

• A leaky database spilled 2FA codes for the world’s tech giants | TechCrunch#

• American Express credit cards exposed in third-party data breach (bleepingcomputer.com)

• Fidelity Investments Notifying 28,000 People of Data Breach - Security Week

• AI tools put companies at risk of data exfiltration - Help Net Security

• 4 Instructive Postmortems on Data Downtime and Loss (thehackernews.com)

Organised Crime & Criminal Actors

• FBI: Cyber Crime Losses Exceeded $12.5 Billion in 2023 - Security Week

• 2023 FBI Internet Crime Report reported cyber crime losses reached $12.5 billion in 2023 (securityaffairs.com)

• $12.5 billion lost to cyber crime, amid tidal wave of crypto investment fraud | Tripwire

• Germany takes down cyber crime market with over 180,000 users (bleepingcomputer.com)

• Poorly paid cyber security staff risk ‘breaking bad’ on the dark web (techinformed.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• $12.5 billion lost to cyber crime, amid tidal wave of crypto investment fraud | Tripwire

• Hackers target FCC, crypto firms in advanced Okta phishing attacks (bleepingcomputer.com)

• Hackers target Coinbase, Binance staff with phishing clones of Gmail, iCloud (crypto.news)

• New Phishing Kit Leverages SMS, Voice Calls to Target Cryptocurrency Users (thehackernews.com)

• Crypto fraud in 2023: How can security teams fight (securityintelligence.com)

Insider Risk and Insider Threats

• Comms Business - Insider threat main concern among mid-market firms

• Current workforce trends feed into rising cyber security risks | TechRadar

• Pentagon Leaker Jack Teixeira Pleads Guilty Under a Deal That Calls for at Least 11 Years in Prison - Security Week

• Army Vet Spills National Secrets to Fake Ukrainian Girlfriend (darkreading.com)

• Chinese engineer accused of stealing Google's GPU and TPU secrets, transferring them to China-based startups | Tom's Hardware (tomshardware.com)

Supply Chain and Third Parties

• Employment Law Firm Sues IT Co. Over Ransomware Attack - Law360

• Capita plans £100 million in cost cuts as it continues to grapple with 2023 cyber attack | ITPro

• First BofA, Now Fidelity: Same Vendor Behind Third-Party Breaches (darkreading.com)

• American Express credit cards exposed in third-party data breach (bleepingcomputer.com)

• Hackers target FCC, crypto firms in advanced Okta phishing attacks (bleepingcomputer.com)

• Switzerland: Play ransomware leaked 65,000 government documents (bleepingcomputer.com)

• Chinese State Hackers Target Tibetans with Supply Chain, Watering Hole Attacks (thehackernews.com)

Cloud/SaaS

• 10 Essential Processes for Reducing the Top 11 Cloud Risks (darkreading.com)

• Human vs. Non-Human Identity in SaaS (thehackernews.com)

• Hackers target Coinbase, Binance staff with phishing clones of Gmail, iCloud (crypto.news)

• Securing Perimeter Products Must Be a Priority, Says NCSC - Infosecurity Magazine (infosecurity-magazine.com)

Identity and Access Management

• Human vs. Non-Human Identity in SaaS (thehackernews.com)

• Major shifts in identity, ransomware, and critical infrastructure threat trends - Help Net Security

Encryption

• Preparing for the post-quantum cryptography environment today | CSO Online

Linux and Open Source

• Open source vulnerabilities dominated 2023, and this year looks no different | ITPro

• Linux Malware Campaign Targets Misconfigured Cloud Servers - Security Week

• Linux Variants of Bifrost Trojan Evade Detection via Typosquatting (darkreading.com)

• Linux Malware Targets Docker, Apache Hadoop, Redis and Confluence - Infosecurity Magazine (infosecurity-magazine.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Hacked WordPress sites use visitors' browsers to hack other sites (bleepingcomputer.com)

• Over 225,000 Compromised ChatGPT Credentials Up for Sale on Dark Web Markets (thehackernews.com)

• Malware is coming for your ChatGPT credentials • The Register

• Stolen passwords are a hacker goldmine now, CrowdStrike and IBM find (axios.com)

• Passwords are Costing Your Organisation Money - How to Minimize Those Costs (bleepingcomputer.com)

• Poor Credential Hygiene - Security Boulevard

• US State AGs tell Meta to fix rampant account takeovers • The Register

Social Media

• Google and Meta users see their 2FA security codes leaked online - Root-Nation.com

• IP address X-posure now a feature on Twitter • The Register

• “Technical Issue” Takes Facebook Offline, Offers No Cyber Security Reassurance | MSSP Alert

• Facebook and Instagram Overrun by Account Hackers, States Warn (bloomberglaw.com)

• Snake, a new Info Stealer spreads through Facebook messages (securityaffairs.com)

• Meta Abandons Hacking Victims, Draining Law Enforcement Resources, Officials Say | WIRED

• US State AGs tell Meta to fix rampant account takeovers • The Register

Training, Education and Awareness

• In the News | Equip and Educate Students to Combat Cyberthreats - Security Boulevard

Regulations, Fines and Legislation

• Companies Are Already Not Complying With The New SEC Cyber Security Incident Disclosure Rules (forbes.com)

• EU council welcomes cyber solidarity act agreement (verdict.co.uk)

• The modern CISO's guide to navigating new SEC cyber regulations (betanews.com)

• Five Unintended Consequences of the New SEC Cyber Security Disclosure Rule - Security Boulevard

• Navigating regulation challenges for protecting sensitive healthcare data - Help Net Security

Models, Frameworks and Standards

• NIST Cyber Security Framework 2.0: 4 Steps to Get Started (darkreading.com)

• NIST Cyber Framework 2.0: Doubling Down on Governance, Expanding Applicability | Law.com

• CIS RAM (Risk Assessment Method) (cisecurity.org)

Data Protection

• Charity has 30 days to stop spamming thousands for donations • The Register

• This $4 Billion Car Surveillance Startup Says It Cuts Crime. But It Likely Broke The Law. (forbes.com)

Careers, Working in Cyber and Information Security

• 11 Top Cyber Security Certifications to Consider In 2024 (datamation.com)

• Cyber and gender | Professional Security

• Poorly paid cyber security staff risk ‘breaking bad’ on the dark web (techinformed.com)

Law Enforcement Action and Take Downs

• Germany takes down cyber crime market with over 180,000 users (bleepingcomputer.com)

• A cyber criminal is sentenced, will it make a difference? - Help Net Security

• Pentagon Leaker Jack Teixeira Pleads Guilty Under a Deal That Calls for at Least 11 Years in Prison - Security Week

• Nigerian National Pleads Guilty of Conspiracy in BEC Operation (darkreading.com)

Misinformation, Disinformation and Propaganda

• Content farm impersonates 60+ major news outlets, like BBC, CNN, CNBC (bleepingcomputer.com)

• The man who tricked Nazi Germany: lessons from the past on how to beat disinformation | Books | The Guardian

• Political deepfakes are spreading like wildfire thanks to GenAI | TechCrunch

• Russian Hackers Target Ukraine Via A Disinformation Campaign - Security Boulevard

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Focus on cyber operations that cause physical damage is not enough | International Committee of the Red Cross (icrc.org)

• Cyber threats impacting the safety and dignity of civilians in conflict | International Committee of the Red Cross (icrc.org)

Nation State Actors

• Complete Guide to Advanced Persistent Threat (APT) Security - Security Boulevard

China

• Chinese nation state actors to ramp up cyber espionage attempts in 2024 - IT Security Guru

• We’re Slowly Learning About China’s Extensive Hacking Network | Mind Matters

• Taiwan's Biggest Telco Breached by Suspected Chinese Hackers (darkreading.com)

• Possible China link to Change Healthcare ransomware attack • The Register

• A New Wave of Cyber Attacks: Five Actions to Take Now | IndustryWeek

• Chinese State Hackers Target Tibetans with Supply Chain, Watering Hole Attacks (thehackernews.com)

• Behind the doors of a Chinese hacking company, a sordid culture fueled by influence, alcohol and sex | AP News

Russia

• The Five Bears: Russia's Offensive Cyber Capabilities (greydynamics.com)

• A Silent World War – Russia’s Cyberwar Against the West (kyivpost.com)

• Germany Urged to Tighten Security After Russia Leaked Classified Information - Bloomberg

• Germany to investigate Russia’s interception of military talks on Ukraine | Germany | The Guardian

• Ukraine intel says its hackers obtained Russian Defence Ministry's classified documents - Euromaidan Press

• Valuable Russian Military Documents Exposed: Report (newsweek.com)

• Focus on cyber operations that cause physical damage is not enough | International Committee of the Red Cross (icrc.org)

• Russian Hackers Target Ukraine Via A Disinformation Campaign - Security Boulevard

North Korea

• Lazarus Group observed exploiting an admin-to-kernel Windows zero-day | SC Media (scmagazine.com)

• North Korea Hits ScreenConnect Bugs to Drop 'ToddleShark' Malware (darkreading.com)

• North Korea’s Kimsuky gang joins rush to exploit new ScreenConnect bugs | SC Media (scmagazine.com)

• North Korea hacks two South Korean chip firms to steal engineering data (bleepingcomputer.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Banks face ‘hacktivist’ cyber attacks (fnlondon.com)

• Hacktivist Collective NoName057(16) Strikes European Targets - Infosecurity Magazine (infosecurity-magazine.com)

• 'The Weirdest Trend in Cyber Security': Nation-States Returning to USBs (darkreading.com)

• Four internet cables cut in Red Sea in 'exceptionally rare' incident | Fortune

• Predator spyware endures even after widespread exposure, analysis shows | CyberScoop

---

Vulnerability Management

• Firms Still Threatened by Old Vulnerabilities (govinfosecurity.com)

• Open source vulnerabilities dominated 2023, and this year looks no different | ITPro

• Organisations are knowingly releasing vulnerable applications - Help Net Security

• Securing Perimeter Products Must Be a Priority, Says NCSC - Infosecurity Magazine (infosecurity-magazine.com)

• Enhancing security through proactive patch management - Help Net Security

Vulnerabilities

• Five Eyes alliance warns of attacks exploiting known Ivanti Gateway flaws (securityaffairs.com)

• ConnectWise ScreenConnect bug used in Play ransomware breach, MSP attack | SC Media (scmagazine.com)

• North Korea’s Kimsuky gang joins rush to exploit new ScreenConnect bugs | SC Media (scmagazine.com)

• North Korea Hits ScreenConnect Bugs to Drop 'ToddleShark' Malware (darkreading.com)

• Hackers exploited Windows 0-day for 6 months after Microsoft knew of it | Ars Technica

• CISA adds Apple iOS and iPadOS memory corruption bugs to its Known Exploited Vulnerabilities Catalog (securityaffairs.com)

• Urgent: Apple Issues Critical Updates for Actively Exploited Zero-Day Flaws (thehackernews.com)

• VMware sandbox escape bugs are so critical, patches are released for end-of-life products | Ars Technica

• VMware Issues Security Patches for ESXi, Workstation, and Fusion Flaws (thehackernews.com)

• VMWare Urges Users to Uninstall EAP Immediately - Security Boulevard

• Cisco Patches High-Severity Vulnerabilities in VPN Product - Security Week

• Critical TeamCity flaw now widely exploited to create admin accounts (bleepingcomputer.com)

• Critical TeamCity Bugs Endanger Software Supply Chain (darkreading.com)

• Android's March 2024 Update Patches Critical Vulnerabilities - Security Week

• CISA Warns of Pixel Phone Vulnerability Exploitation - Security Week

---

Tools and Controls

• Why cyber maturity assessment should become standard practice - Help Net Security

• 1 in 10 Business Leaders Don’t Even Know They’ve Been Hacked (tech.co)

• The Ultimate Guide to Threat Detection, Investigation, and Response (TDIR) (govinfosecurity.com)

• The Future Of AI And ML In Cyber Security (forbes.com)

• The Security Interviews: Cyber security is about managing risk effectively | Computer Weekly

• What Is A Cyber Incident Response Policy? - Security Boulevard

• Cyber Criminals Using Novel DNS Hijacking Technique for Investment Scams (thehackernews.com)

• Demystifying the Maze: A Guide to Cyber Risk Quantification Methods (cybersaint.io)

• Resilience is built on a solid framework | Professional Security

• Simply Human: Why HR Needs To Take The Lead In Cyber Security (forbes.com)

• The critical role of DNS in cyber security and digital thriving | TechRadar

• 5 ways to keep API integrations secure - Help Net Security

• Reduce the Attack Surface | Dell USA

• What is Advanced Threat Protection and How to Use It in Your Business - Security Boulevard

• Human vs. Non-Human Identity in SaaS (thehackernews.com)

• How To Close The DevSecOps Cyber Security Skills Gap And Boost Security (forbes.com)

---

Reports Published in the Last Week

• Kaspersky spam and phishing report for 2023 | Securelist

---

Other News

• Banks face ‘hacktivist’ cyber attacks (fnlondon.com)

• White Hats on Offensive Against Black Hat Hackers: Report (technewsworld.com)

• UK altnets call for action after attacks on fibre infrastructure | Computer Weekly

• Securing the future: Addressing cyber security challenges in the education sector - Help Net Security

• The 3 most common post-compromise tactics on network infrastructure (talosintelligence.com)

• What is Micro Breaching? - Security Boulevard

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 07 March 2024 – Apple, Cisco and VMware Security Updates

Executive Summary

Apple, Cisco and VMware have addressed multiple vulnerabilities across their product range this week, including two actively exploited zero-days affecting Apple products. These vulnerabilities are reportedly being exploited in the wild and have been added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerability (KEV) catalog. The seriousness of the VMware vulnerabilities has led to Vmware releasing patches for end-of-life products.

In addition, CISA has issued a warning about a flaw (CVE-2023-21237) impacting Google Pixel phones. Although Google addressed this vulnerability in June 2023, CISA reports that it is still being actively exploited in the wild and has added it to the KEV catalog.

---

Apple

Apple have released security updates to address several security flaws including two zero-day vulnerabilities that are being actively exploited in the wild and have been added to the (KEV) catalog. This is the third actively exploited zero-day in its software since the start of the year.

What can I do?

Apple have released security patches to address the vulnerabilities and it is advised to update immediately since it has been reported that the vulnerabilities are being exploited in the wild. The vulnerabilities have been addressed in iOS 17.4, iPadOS 17.4, iOS 16.7.6, and iPadOS 16.7.6.

Technical Summary

CVE-2024-23225 – This is a memory corruption issues in the kernel that an attacker with arbitrary kernel read and write capability can exploit to bypass kernel memory protections.

CVE-2024-23296 – This is a memory corruption issue in the RTKit real-time operating system (RTOS) that an attacker with arbitrary kernel read and write can exploit to bypass kernel memory protections.

---

Cisco

Cisco have addressed two high-severity vulnerabilities in it’s VPN application Secure Client, that could lead to remote exploitation without authentication and execution of code with the highest level of privilege.

What can I do?

Organisations using Secure Client should check if they are running vulnerable versions and apply patches immediately. Where a patch is not available, organisations should follow CISCO’s guidance linked below.

Technical Summary

CVE-2024-20337 - A carriage return line feed injection attack that could be caused remotely, by tricking a user in to clicking a maliciously crafted link. According to CISCO, this only impacts Secure Client instances where the VPN headend is configured with the SAML external browser.

CVE-2024-20338 - A vulnerability that can allow an attacker to execute code with root privileges. This vulnerability only Secure Client for Linux and requires authentication prior to exploitation.

The following versions of Secure Client have been impacted:

CVE-2024-20337

versions 4.10.04065 and later - upgrade to version 4.10.08025

version 5.0 - no patch available and users should migrate to a fixed release

Version 5.1 - should apply the patches in version 5.1.2.42

Versions earlier than Earlier than 4.10.04065 are not vulnerable.

CVE-2024-20338

This impacts Linux versions earlier than 5.1.2.42 and requires authentication for successful exploitation. The first fixed release is version 5.1.2.42.

---

VMware

VMware have released security patches to address four security flaws impacting ESXi, Workstation and Fusing, two of which are critical flaws (CVE-2024-22252 and CVE-2024-22253) which if exploited could lead to code execution.

What can I do?

VMware have released patches for the impacted products and it is recommended to patch immediately, given the severity of the vulnerabilities. Organisations should also check any end-of-life products they may be using as these have also had patches released.

The following versions have been impacted:

ESXi 6.5 – fixed in 6.5U3v

ESXi 6.7 - fixed in 6.7U3u

ESXi 7.0 - fixed in ESXi70U3p-23307199

ESXi 8.0 - fixed in ESXi80U2sb-23305545 and ESXi80U1d-23299997

VMware Cloud Foundation (VCF) 5.x/4.x – fixed in version KB88287

Workstation 17.x - fixed in 17.5.1

Fusion 13.x (macOS) - fixed in 13.5.1

Technical Summary

CVE-2024-22254 – This is an out-of-bounds write vulnerability in ESXi that a malicious actor with privileges within VMX process could exploit to trigger a sandbox escape.

CVE-2024-22255 – This is an information disclosure vulnerability in the UHCI USB controller that a malicious actor with administrative access to a virtual machine may exploit to leak memory from the VMX process.

---

Further Information

Apple

Further details on the Apple vulnerabilities can be found here:

https://support.apple.com/en-us/HT214081

Cisco

Further details on the Cisco vulnerabilities can be found here:

CVE-2024-20337 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-client-crlf-W43V4G7

CVE-2024-20338 - https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-secure-privesc-sYxQO6ds

CISA KEV catalog

Further details of CISA’s KEV catalog can be found here:
 https://www.cisa.gov/known-exploited-vulnerabilities-catalog

VMware

Further details on the VMware vulnerabilities can be found here:

https://www.vmware.com/security/advisories/VMSA-2024-0006.html

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity 

Black Arrow Cyber Threat Briefing 01 March 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Risk-based spending: An Imperative for Cyber Security That Demands Board Attention

Staying ahead of the latest cyber security developments is essential to keeping your organisation safe. But with the rise of artificial intelligence and attackers dreaming up new techniques every day, a lot of organisations are left to question how they can create proactive, agile cyber security strategies and what approach gives the best return on investment, mitigating risks and maximising the value of their cyber security investments.

Unfortunately, most organisations do not have an unlimited budget, and for small and medium-sized businesses, there is even less to work with. What is needed is a risk-based approach, where organisations identify and prioritise their greatest vulnerabilities, correlating these to business impact; this is then used to form the cyber risk strategy for the organisation.

Sources: [Security Week] [The Hacker News] [Risk.net]

If you Pay Ransoms, You May not Get Your Data Back and Worse, You Will Probably Get Hit Again, with 78% of Firms who Paid Then Suffering Repeat Ransomware Attacks

Recent research from Proofpoint has found that 69% of organisations experienced a successful ransomware incident in the past year, a rise of 5% compared to the previous year. The report found that 60% reported four or more separate ransomware incidents and of the total involved, 54% admitted to paying a ransom. In a separate report, it was found that 78% of organisations suffering a ransomware attack suffered repeat attacks even after they paid.

Sources: [databreaches.net] [Infosecurity Magazine] [Infosecurity Magazine] [Claims Journal]

Cyber Resilience and Cyber Hygiene: Why They Matter to Your Business

Cyber resilience unites cyber security with business continuity and organisational durability, with proper implementation allowing the continuation of routine operations during adverse cyber incidents. Cyber hygiene, on the other hand, refers to having strong cyber security processes and procedures, to help the organisation mitigate the chance of an incident. The combination of both of these allows an organisation to reduce their likelihood of suffering a cyber incident, whilst improving their likelihood of continuing operations in the event of such an incident.

Sources: [Information Week] [Security Boulevard]

Why Governance, Risk and Compliance Must be Integrated with Cyber Security

With pressure from regulators, the evolving threat landscape and requirements for stronger oversight, governance, risk and compliance (GRC) has even more of an argument for alignment with cyber security. After all, cyber security is still security. Incorporating cyber security into the GRC programme of an organisation allows for cyber to become a business enabler.

Source: [CSO Online]

More and More UK Firms Concerned About Insider Threats

A report has found that 54% of UK business decision makers are concerned about the likelihood of their employees disclosing sensitive information or providing network access to fraudsters. In a separate report, 35% of respondents cited overworked and distracted staff making mistakes as a reason why they thought their business experienced insider risk. Certainly, insider risk does not just involve malicious employees; it can also include negligence and in some cases, employees may not be trained enough to identify the risk they are placing on the organisation such as not knowing or following an organisation’s call back procedure. It is important for organisations to consider whether their current training addresses this and whether the programme is doing enough to ensure that insider risk is mitigated.

Source: [Infosecurity Magazine]

98% of Businesses Linked to Breached Third Parties

A new report has found that 98% of organisations are associated with a third party that has experienced a breach, and these breaches often take months or more to be discovered. 75% of external business-to-business (B2B) relationships that enabled third-party breaches involved software or other technology products and services. Third party security is an important part of an organisation’s cyber security and to manage it correctly, organisations need to implement a third party risk management programme.

Source: [Help Net Security]

Phishing, Smishing and Vishing Skyrocket 1,265%

According to a report, since the launch of ChatGPT in November 2022, vishing, smishing, and phishing attacks have increased by a staggering 1,265%. Despite different techniques, these attacks all have one focus, and that’s on the user. Organisations looking to protect themselves should consider a blend of mitigations, including advanced email filtering, enabling multi-factor authentication and arguably the most important, effective user education and awareness training. This training should go beyond ticking boxes, by instead teaching employees how to both recognise and report phishing attempts.

A separate report analysed over 1 billion emails. Some of the key findings included that the majority of phishing attempts (71%) rely on deceptive links, but attachments (22%) and predatory QR codes (7%) are on the rise. When it came to spoofs, Microsoft was the most spoofed entity and financial services were amongst those most targeted sectors.

Source: [Bleeping Computer] [Help Net Security] [Security Affairs]

Business Email Compromise Attacks Are Evolving, But What Can Be Done About It

Business Email Compromise (BEC) attacks remain a dominant danger, with a staggering $51 billion lost over the last decade. A recent report underscores the prevalence of email as the primary battlefield, far outstripping other cyber attack methods. The low-cost, high-reach nature of email makes it an attractive starting point for cyber criminals. As organisations embrace cloud-based infrastructures, these attacks have morphed, presenting new challenges. Attackers have progressed from direct phishing attempts, to compromising business partners, vendors and other third parties. In this arms race, artificial intelligence (AI) assumes a pivotal role as an essential ally, efficiently discerning between benign and malicious content. This development signifies a significant milestone in the realm of email security resilience.

Source: [ITPro]

Vulnerabilities Count Set to Rise by 25% in 2024

The cyber threat landscape is rapidly evolving, with an anticipated 25% increase in published systems vulnerabilities for 2024. This surge, reaching approximately 2,900 vulnerabilities per month, underscores the critical need for robust vulnerability management strategies. Vulnerabilities serve as prime entry points for ransomware actors, heightening the urgency for organisations to fortify their defences. However, the sheer volume of vulnerabilities poses a daunting challenge for security and IT teams already thinly stretched. Timely risk-scoring remains a significant issue, leaving defenders vulnerable to exploits with threat actors often gaining a head start. Honeypot data reveals a concerning uptick in scans targeting remote desktop protocol (RDP), with businesses running end-of-life (EOL) software at heightened risk. In this dynamic cyber security climate, proactive risk management and expert intervention, such as Managed Detection and Response (MDR), are imperative to safeguarding against emerging threats.

Source: [Help Net Security]

BYOD Increases Mobile Phishing; Risks Have Never Been Higher

The risk of cyber attacks looms large, with stolen employee login credentials serving as a prime target for malicious actors. Mobile phishing has emerged as a significant threat, with data revealing a surge in encounter rates, especially in hybrid work environments and amid Bring Your Own Device (BYOD) policies. Personal devices, once considered outside the realm of corporate security, now pose substantial risks, as attackers exploit social engineering schemes to breach organisational networks. The financial implications of a successful phishing attack are staggering, with estimates suggesting potential losses of up to $4 million for organisations. As phishing encounter rates continue to rise, it's imperative for businesses to bolster their security strategies, ensuring comprehensive protection against mobile phishing threats across all employee devices. To navigate this evolving landscape and safeguard sensitive data, organisations must stay vigilant and adopt proactive measures.

Source: [MSSP Alert]

What Companies Should Know About Rising Legal Threats

The cyber security landscape is witnessing a significant shift as legal actions increasingly target both corporations and individual security officers. Recent cases including lawsuits by Tesla against ex-employees for cyber security breaches and charges by regulatory bodies like the US FTC and SEC, underscore the mounting legal risks associated with cyber security breaches. Notably, private companies are not exempt from such liabilities, facing scrutiny from authorities, regulators, customers and other affected parties. This environment has prompted many cyber security leaders to reconsider their roles, with concerns raised about the future of the profession. Amidst escalating threats and enforcement actions, there's a pressing need for enhanced cyber security budgets, robust risk-based controls and proactive audits or other independent assurance.

Source: [Darkreading]

CIOs Rethink All-In Cloud Strategies as Five Eyes Nations Warn of Evolving Russian Cyber Espionage Practices Targeting Cloud Environments

As organisations embrace the cloud, CIOs recognise that a one-size-fits-all approach may not be optimal. Many now favour a nuanced strategy, shifting workloads from public clouds to platforms offering productivity gains and cost savings; a trend known as ‘cloud exit.’ CIOs are rethinking cloud strategies, assessing each application’s suitability and fostering context-aware hosting decisions.

This comes as a recent advisory issued jointly by cyber security agencies from the UK, US, Australia, Canada, and New Zealand reveals that Russian cyber espionage units, including APT29 and Cozy Bear, are adapting tactics to target cloud environments used by both public and private organisations. These sophisticated attacks pose significant threats across industries. Implementing basic cloud security measures is crucial to regularly evaluate dormant accounts, limit system-issued token validity, and enforce stringent device policies. As cloud adoption rises, prioritise cyber security fundamentals for effective defence.

Sources: [CyberScoop] [CIO]

---

Governance, Risk and Compliance

• Why governance, risk, and compliance must be integrated with cyber security | CSO Online

• Chart: Cyber Crime Expected To Skyrocket in Coming Years | Statista

• The Imperative for Modern Security: Risk-Based Vulnerability Management - Security Week

• Why Cyber Resilience May Be More Important Than Cyber Security (informationweek.com)

• Beating the drum on cyber risk: the battle for boardroom attention - Risk.net

• What is cyber hygiene and why businesses should know about it - Security Boulevard

• Bridging the Gap: Connecting Cyber Security Spending to Business Results - Security Boulevard

• What Companies & CISOs Should Know About Rising Legal Threats (darkreading.com)

• Essential Guide To Security Metrics For Businesses (informationsecuritybuzz.com)

• Essential Guide To Information Security Compliance (informationsecuritybuzz.com)

• Mastering Risk Management: The Art Of Effective Strategy (informationsecuritybuzz.com)

• The CISO: 2024’s Most Important C-Suite Officer (forbes.com)

• UK Unveils Draft Cyber Security Governance Code - Infosecurity Magazine (infosecurity-magazine.com)

• How to Prioritize Cyber Security Spending: A Risk-Based Strategy for the Highest ROI (thehackernews.com)

• Cyber security 'blind spot' leaves businesses exposed - Accountancy Age

• MTTR: The Most Important Security Metric (darkreading.com)

• Building Your Cyber Incident Response Team - Security Boulevard

• 9 Steps to Fostering a Cyber Security-Aware Culture (newsweek.com)

• AWS on why CISOs should track 'the metric of no' | TechTarget

• 2024 will see more cyber threats emerge – here is what SMEs need to know | TechRadar

---

Threats

Ransomware, Extortion and Destructive Attacks

• Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities (trendmicro.com)

• If you pay ransom, you may not get your data back and worse, you probably WILL get hit again – Cybereason Survey (databreaches.net)

• 78% of Organisations Suffer Repeat Ransomware Attacks After Paying - Infosecurity Magazine (infosecurity-magazine.com)

• 69% of Organisations Infected by Ransomware in 2023 - Infosecurity Magazine (infosecurity-magazine.com)

• Stages of LockBit Grief: Anger, Denial, Faking Resurrection? (inforisktoday.com)

• What CISOs Need To Know About The Lockbit Takedown - Security Boulevard

• Ransomware crews lean into infostealers for initial access • The Register

• 78% of Organisations Suffer Repeat Ransomware Attacks After Paying (claimsjournal.com)

• Challenges Remain in Evaluating Ransomware Crackdowns | Decipher (duo.com)

• Privacy Beats Ransomware as Top Insurance Concern (darkreading.com)

• Do ransomware attackers keep their word? - TechCentral.ie

• What Are Ransomware Attacks and Can They Be Stopped? Explainer - Bloomberg

• Study: Ransom payment not a shield against future attacks | SC Media (scmagazine.com)

• FBI, CISA warn US hospitals of targeted BlackCat ransomware attacks (bleepingcomputer.com)

• Held to ransom: How criminal gangs are weaponising AI in the name of cyber extortion (holyrood.com)

• Is Now the Right Time for a Ransomware Payment Ban? (govtech.com)

• What is Old is New Again: Lessons in Anti-Ransom Policy | Recorded Future

• 3 Ways Your Organisation Could Be Susceptible To Ransomware Attacks (forbes.com)

• What the war on terrorism teaches us about the war on ransomware | SC Media (scmagazine.com)

• Cyber criminals follow the money to hit manufacturing sector • The Register

• Why your legitimate software is not safe from ransomware attacks (networkingplus.co.uk)

Ransomware Victims

• Change Healthcare Ransomware Attack: BlackCat Hackers Quickly Returned After FBI Bust | WIRED

• LoanDepot Ransomware Attack Exposed 16.9 Million Individuals - Security Week

• Rhysida ransomware wants $3.6 million for children’s stolen data (bleepingcomputer.com)

• Stolen Donald Trump Court Files Will Be Published February 29, Hackers Say (forbes.com)

• Epic Games attacked by new ransomware group Mogilevich | SC Media (scmagazine.com)

• Hackers claim to have stolen 7GB of data from Irish Department of Foreign Affairs | Independent.ie

• Insomniac Games alerts employees hit by ransomware data breach (bleepingcomputer.com)

• German Steelmaker Thyssenkrupp Confirms Ransomware Attack - Security Week

• US pharmacy outage caused by Blackcat attack on Optum (securityaffairs.com)

• MGM Resorts Says Regulators Probing September Cyber Attack (claimsjournal.com)

Phishing & Email Based Attacks

• European retailer Pepco loses €15.5 million in phishing (possibly BEC?) attack - Help Net Security

• Vishing, smishing, and phishing attacks skyrocket 1,265% post-ChatGPT - Help Net Security

• BYOD Increases Mobile Phishing; Risks Have Never Been Higher | MSSP Alert

• SMBs are being targeted by this new phishing scam — make sure you don't fall victim | TechRadar

• Need to Know: Key Takeaways from the Latest Phishing Attacks (bleepingcomputer.com)

• Unmasking 2024's Email Security Landscape (securityaffairs.com)

• Lookout Discovers Advanced Phishing Kit Targeting US Federal Agency and Cryptocurrency Exchange Organisations | Business Wire

• Registrars can now block all domains that resemble brand names (bleepingcomputer.com)

• Criminals hijacked more than 8,000 trusted domains, sent millions of malicious emails | TechSpot

Other Social Engineering

• Vishing, smishing, and phishing attacks skyrocket 1,265% post-ChatGPT - Help Net Security

• The Silent Threat: Why Vishing is Causing Major Problems for Businesses - Security Boulevard

• Registrars can now block all domains that resemble brand names (bleepingcomputer.com)

• How to stay safe from cyber criminal "quishing" attacks | TechRadar

• Scammers Often Rely on This Psychological Trick | TIME

Artificial Intelligence

• Blackstone's Schwarzman sees peril in “not bright” criminals getting their hands on AI | Fortune

• AI threats: The importance of a concrete strategy in fighting novel attacks | ITPro

• New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks (thehackernews.com)

• Putin's AI threat to democracy: Russian spies 'have developed artificial intelligence cyber tool to spread disinformation and meddle in elections across the West' | Daily Mail Online

• AI in cyber security presents a complex duality - Help Net Security

• AI and cyber security: Navigating the risks and opportunities | World Economic Forum (weforum.org)

• Held to ransom: How criminal gangs are weaponising AI in the name of cyber extortion (holyrood.com)

• Cyber experts raise AI fears security fears in Parliament | IT Reseller Magazine (itrportal.com)

• UK ICO Vows to Safeguard Privacy in AI Era - Infosecurity Magazine (infosecurity-magazine.com)

• BEAST AI attack can break LLM guardrails in a minute • The Register

2FA/MFA

• Strengths & Weaknesses of MFA Methods Against Cyber Attacks | Duo Security

Malware

• Ransomware crews lean into infostealers for initial access • The Register

• BobTheSmuggler: Open-source tool for undetectable payload delivery - Help Net Security

• New IDAT Loader Attacks Using Steganography to Deploy Remcos RAT (thehackernews.com)

• North Korean Hackers Targeting Developers with Malicious npm Packages (thehackernews.com)

• Open-Source Xeno RAT Trojan Emerges as a Potent Threat on GitHub (thehackernews.com)

• GitHub besieged by millions of malicious repositories in ongoing attack | Ars Technica

• Pikabot returns with new tricks up its sleeve - Help Net Security

• TimbreStealer Malware Spreading via Tax-themed Phishing Scam Targets IT Users (thehackernews.com)

• Chinese Hackers Exploiting Ivanti VPN Flaws to Deploy New Malware (thehackernews.com)

• CISA warns against using hacked Ivanti devices even after factory resets (bleepingcomputer.com)

• Cloud-focused malware campaigns on the increase (betanews.com)

• Hackers are infecting Macs with malware using calendar invites and meeting links | Tom's Guide (tomsguide.com)

• New Backdoor Targeting European Officials Linked to Indian Diplomatic Events (thehackernews.com)

Mobile

• BYOD Increases Mobile Phishing; Risks Have Never Been Higher | MSSP Alert

• Kaspersky Finds Attacks on Mobile Devices Significantly Increased in 2023 (darkreading.com)

• Meet 'XHelper,' the All-in-One Android App for Global Money Laundering (darkreading.com)

Denial of Service/DoS/DDOS

• Down, Not Out: Russian Hacktivists Claiming DDoS Disruptions (govinfosecurity.com)

• DDoS attacks against web apps and APIs surge (betanews.com)

Internet of Things – IoT

• Half of IT Leaders Identify IoT as Security Weak Point - Infosecurity Magazine (infosecurity-magazine.com)

• The White House Warns Cars Made in China Could Unleash Chaos on US Highways | WIRED

Data Breaches/Leaks

• U-Haul says 67K customers' data was stolen in cyber attack • The Register

• Pharma giant hit by major cyber attack — Cencora confirms data was stolen | TechRadar

Organised Crime & Criminal Actors

• Chart: Cyber Crime Expected To Skyrocket in Coming Years | Statista

• 8 Worrying Cyber Security Statistics You Need to Know in 2024 (tech.co)

• It’s only February and cyber crime is already running rampant (techinformed.com)

• Scottish Police Face Toil and Trouble From Cyber Crime (govinfosecurity.com)

• How active adversaries divide labour to more effectively target victims | SC Media (scmagazine.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• SonicWall: Cryptojacking Attacks Spike 659% in 2023 | MSSP Alert

• Lookout Discovers Advanced Phishing Kit Targeting US Federal Agency and Cryptocurrency Exchange Organisations | Business Wire

• Cryptojacking is no longer the sole focus of cloud attackers - Help Net Security

Insider Risk and Insider Threats

• US man accused of making $1.8m from listening in on wife’s remote work calls | Securities and Exchange Commission | The Guardian

• Are remote workers at greater risk of cyber security threats? | TechRadar

• Over Half of UK Firms Concerned About Insider Threats - Infosecurity Magazine (infosecurity-magazine.com)

• Understanding employees' motivations behind risky actions - Help Net Security

• The human element of cyber security: Why people are the ultimate defence. (thecyberwire.com)

Insurance

• Privacy Beats Ransomware as Top Insurance Concern (darkreading.com)

• A Cyber Insurance Backstop - Schneier on Security

Supply Chain and Third Parties

• New Hugging Face Vulnerability Exposes AI Models to Supply Chain Attacks (thehackernews.com)

• 98% of businesses linked to breached third parties - Help Net Security

Cloud/SaaS

• Five Eyes nations warn of evolving Russian cyberespionage practices targeting cloud environments | CyberScoop

• Russia's 'Midnight Blizzard' Targeting Service Accounts for Initial Cloud Access (darkreading.com)

• CIOs rethink all-in cloud strategies | CIO

• Cryptojacking is no longer the sole focus of cloud attackers - Help Net Security

• Your Data Has Moved to the Cloud: Can Your Security Strategy Keep Up? | MSSP Alert

• Cloud-focused malware campaigns on the increase (betanews.com)

Identity and Access Management

• Superusers Need Super Protection: How to Bridge Privileged Access Management and Identity Management (thehackernews.com)

• How organisations can navigate identity security risks in 2024 - Help Net Security

• Echoes of SolarWinds in New 'Silver SAML' Attack Technique (darkreading.com)

Linux and Open Source

• From Open Source to Enterprise Ready: 4 Pillars to Meet Your Security Requirements - Security Week

Passwords, Credential Stuffing & Brute Force Attacks

• Russia's 'Midnight Blizzard' Targeting Service Accounts for Initial Cloud Access (darkreading.com)

Social Media

• Rights groups file GDPR suits on Meta's pay-or-consent model • The Register

• Meta Patches Facebook Account Takeover Vulnerability - Security Week

Malvertising

• How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin | WIRED

• Google faces $2.27 billion lawsuit over advertising practices (searchengineland.com)

Training, Education and Awareness

• Cyber awareness education is a change-management initiative | CSO Online

• Cyber Security Training Not Sticking? How to Fix Risky Password Habits (bleepingcomputer.com)

• 4 Ways Organisations Can Drive Demand for Software Security Training (darkreading.com)

• Creating a cyber security training curriculum for SMBs and MSPs | TechRadar

• 9 Steps to Fostering a Cyber Security-Aware Culture (newsweek.com)

Regulations, Fines and Legislation

• 81% of security leaders predict SEC rules will impact their businesses | Security Magazine

• Orgs Face Major SEC Penalties for Failing to Disclose Breaches (darkreading.com)

• Getting Ahead of Cyber Security Materiality Mayhem - Security Boulevard

• NIST Publishes Final “Cyber Security Resource Guide” on Implementing the HIPAA Security Rule | Foley & Lardner LLP - JDSupra

• UK ICO Vows to Safeguard Privacy in AI Era - Infosecurity Magazine (infosecurity-magazine.com)

Backup and Recovery

• MTTR: The Most Important Security Metric (darkreading.com)

Models, Frameworks and Standards

• NIST CSF 2.0 released, to help all organisations, not just those in critical infrastructure - Help Net Security

• NIST Adds “Govern” Function to Cybersecurity Framework | MSSP Alert

• Top 3 NIST Cyber Security Framework 2.0 takeaways | SC Media (scmagazine.com)

• Preparing for the NIS2 Directive - Help Net Security

Data Protection

• UK ICO issues warning on biometric employee tracking, guidance for businesses | Biometric Update

• Privacy Beats Ransomware as Top Insurance Concern (darkreading.com)

• Rights groups file GDPR suits on Meta's pay-or-consent model • The Register

• UK ICO Vows to Safeguard Privacy in AI Era - Infosecurity Magazine (infosecurity-magazine.com)

Careers, Working in Cyber and Information Security

• A Perfect Cyber Storm is Leading to Burnout | Network Computing

• The Next Gen of Cyber Security Could Be Hiding in Big Tech (darkreading.com)

• Lost to the Highest Bidder: The Economics of Cyber Security Staffing - Security Boulevard

Law Enforcement Action and Take Downs

• Is the LockBit gang resuming its operation? (securityaffairs.com)

• Challenges Remain in Evaluating Ransomware Crackdowns | Decipher (duo.com)

• Russian hacker is set to face trial for the hack of a local power grid (securityaffairs.com)

Misinformation, Disinformation and Propaganda

• Putin's AI threat to democracy: Russian spies 'have developed artificial intelligence cyber tool to spread disinformation and meddle in elections across the West' | Daily Mail Online

• US leading global alliance to counter foreign government disinformation | Cyberwar | The Guardian

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• 15 Countries with Cyber Warfare Capabilities (yahoo.com)

• Cyber Espionage France’s Top Threat Ahead of 2024 Paris Olympics - Infosecurity Magazine (infosecurity-magazine.com)

Nation State Actors

China

• Hackers backed by Russia and China are infecting SOHO routers like yours, FBI warns | Ars Technica

• US Official Warns Of China’s Growing Offensive Cyber Power – Analysis – Eurasia Review

• When Hackers Are Hacked, A Chinese Spy Story - Worldcrunch

• Chinese Cyber Attacks:A 12-month Outlook (greydynamics.com)

• Chinese Cyber Espionage Set To Ramp Up This Year (forbes.com)

• The Drums of US-China Cyber War by Stephen S. Roach - Project Syndicate (project-syndicate.org)

• Chinese Hackers Exploiting Ivanti VPN Flaws to Deploy New Malware (thehackernews.com)

• The White House Warns Cars Made in China Could Unleash Chaos on US Highways | WIRED

• Foreign Firms in China Flag Lack of Feedback on Data Security (bloomberglaw.com)

• Beijing Silent Over Russia's Reported War-Gaming of China Invasion

Russia

• Two Years On: How Ukraine's Cyber Warfront Is Redefining Global Cyber Security Strategies | HackerNoon

• Hackers backed by Russia and China are infecting SOHO routers like yours, FBI warns | Ars Technica

• Five Eyes nations warn of evolving Russian cyberespionage practices targeting cloud environments | CyberScoop

• Russia may have just carried out its first direct action against the West (yahoo.com)

• Moscow Military Hackers Used Microsoft Outlook Vulnerability (inforisktoday.com)

• Russia's 'Midnight Blizzard' Targeting Service Accounts for Initial Cloud Access (darkreading.com)

• Ukraine signs security deals with Western allies to help counter Russian cyber attacks (therecord.media)

• Russia cyber spies behind SolarWinds breach adopting new tactics, warn Five Eyes agencies (therecord.media)

• Cyber Security Agencies Warn Ubiquiti EdgeRouter Users of APT28's MooBot Threat (thehackernews.com)

• Putin's AI threat to democracy: Russian spies 'have developed artificial intelligence cyber tool to spread disinformation and meddle in elections across the West' | Daily Mail Online

• Down, Not Out: Russian Hacktivists Claiming DDoS Disruptions (govinfosecurity.com)

• Lazarus APT exploited 0-day in Win driver to gain kernel privileges (securityaffairs.com)

• Lovers' Spat? North Korea Backdoors Russian Foreign Affairs Ministry (darkreading.com)

• Russia warns of "military-technical" response to Sweden's NATO membership (newsweek.com)

• Russian hacker is set to face trial for the hack of a local power grid (securityaffairs.com)

• Russia and Belarus targeted by at least 14 nation-state hacker groups, researchers say (therecord.media)

• Beijing Silent Over Russia's Reported War-Gaming of China Invasion

• Russia subjected to deluge of nation-state, hacktivist cyber threats | SC Media (scmagazine.com)

• How the Pentagon Learned to Use Targeted Ads to Find Its Targets—and Vladimir Putin | WIRED

Iran

• Iran-Linked UNC1549 Hackers Target Middle East Aerospace & Defence Sectors (thehackernews.com)

North Korea

• North Korean Hackers Targeting Developers with Malicious npm Packages (thehackernews.com)

• Lovers' Spat? North Korea Backdoors Russian Foreign Affairs Ministry (darkreading.com)

---

Vulnerability Management

• The Imperative for Modern Security: Risk-Based Vulnerability Management - Security Week

• CVE count set to rise by 25% in 2024 - Help Net Security

• Most Commercial Code Contains High-Risk Open Source Bugs - Infosecurity Magazine (infosecurity-magazine.com)

• The rising threat of zero-day attacks | Security Magazine

Vulnerabilities

• Threat Actor Groups, Including Black Basta, are Exploiting Recent ScreenConnect Vulnerabilities (trendmicro.com)

• Moscow Military Hackers Used Microsoft Outlook Vulnerability (inforisktoday.com)

• Lazarus APT exploited 0-day in Win driver to gain kernel privileges (securityaffairs.com)

• Cisco Patches High-Severity Vulnerabilities in Data Center OS - Security Week

• CISA warns against using hacked Ivanti devices even after factory resets (bleepingcomputer.com)

• Five Eyes Agencies Warn of Active Exploitation of Ivanti Gateway Vulnerabilities (thehackernews.com)

• One of Apple's best iOS productivity tools had a pretty concerning security flaw, so patch now | TechRadar

• Critical Flaw in Popular 'Ultimate Member' WordPress Plugin - Security Week

• Meta Patches Facebook Account Takeover Vulnerability - Security Week

• MITRE Rolls Out 4 Brand-New CWEs for Microprocessor Security Bugs (darkreading.com)

• Citrix, Sophos software impacted by 2024 leap year bugs (bleepingcomputer.com)

• Ivanti integrity checker tool needs latest update to work, Five Eyes alert warns | CyberScoop

• Zyxel fixed four bugs in firewalls and access points (securityaffairs.com)

---

Tools and Controls

• The Imperative for Modern Security: Risk-Based Vulnerability Management - Security Week

• Cyber awareness education is a change-management initiative | CSO Online

• Why Cyber Security Must Include Protective DNS (hyas.com)

• Championing ethical hackers: a vital defence for the financial industry during turbulent times (finextra.com)

• Strengths & Weaknesses of MFA Methods Against Cyber Attacks | Duo Security

• AI and cyber security: Navigating the risks and opportunities | World Economic Forum (weforum.org)

• How Zero Trust Data Detection & Response is Changing the Game - Security Boulevard

• APIs become the leading attack vector, cyber security research shows (securitybrief.co.nz)

• Superusers Need Super Protection: How to Bridge Privileged Access Management and Identity Management (thehackernews.com)

• How organisations can navigate identity security risks in 2024 - Help Net Security

• MTTR: The Most Important Security Metric (darkreading.com)

• 9 Steps to Fostering a Cyber Security-Aware Culture (newsweek.com)

• Artificial Arms Race: What Can Automation and AI do to Advance Red Teams - Security Week

• Savvy Seahorse gang uses DNS CNAME records to power investor scams (bleepingcomputer.com)

• Cloud Apps Make the Case for Pentesting-as-a-Service (darkreading.com)

---

Reports Published in the Last Week

• A Comparative Study on Cyber Risk: Business vs. Security Perspectives (inforisktoday.com)

• Cyber threat landscape report | Professional Security

• Email Security in 2024: An Expert Look at Email-Based Threats - VIPRE

---

Other News

• Cyber attacks on UK law firms on the rise - Spear's (spearswms.com)

• IntelBroker claimed the hack of the Los Angeles International Airport (securityaffairs.com)

• It's time to stop trusting your antivirus software | Digital Trends

• Three new advanced threat groups targeted industrial organisations last year | CSO Online

• What’s on the Radar for Aviation Industry Cyber Security? - Security Boulevard

• Business leaders warn of rising cyber security threat | The Herald (heraldscotland.com)

• Why Health Care Is Top Target for Cyber Criminals (govtech.com)

• RCMP investigating cyber attack as its website remains down (bleepingcomputer.com)

• Hackers exploit 14-year-old CMS editor on govt, edu sites for SEO poisoning (bleepingcomputer.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Informational 27 February 2024 – NIST Officially Release Version 2.0 of Globally used Cyber Security Framework

Executive summary

After a multi-year collaborative effort across industry, academia, and governments around the world, The US National Institute of Standards and Technology have released version 2.0 of their globally recognised and internationally respected cyber security framework (CSF). The new framework builds on it’s long standing principles, adding to governance to the original 5 functions (identify, protect, detect, respond and recover). The framework also directly addresses supply chain risk.

What can I do?

Businesses now have access to an updated framework which reflects, addresses and helps to mitigates the cyber threats we are seeing today. The framework offers a taxonomy of high-level cyber security outcomes that can be used by any organisation, regardless of size, sector or maturity, to better understand, assess, prioritise and communicate its cyber security efforts.

The official NIST release can be found below:

https://www.nist.gov/cyberframework

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 23 February 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Despite Recent NCA and FBI Disruptions, a Rise in Ransomware Means 2024 Will be a Volatile Year for Cyber Security

There has been a lot of high profile coverage this week of the infamous and prolific LockBit gang’s infrastructure having been seized by law enforcement following an international Police operation led by the UK’s National Crime Agency. Whilst the international operation shows the seriousness of the matter, and the success of the operation should be celebrated, those celebrations should be muted and organisations should not become lax. Like the Hydra of Greek mythology, when one head disappears, a few more appear in its place. Ransomware really is a case of if, not when, and your organisation needs to be prepared.

Further, a recent threat report has found that the median ransom demand rose by 20% year on year, hitting an average of $600,000 and it is expected that 2024 will be even more volatile. Ransomware groups are expanding their target lists and exploring new pressure tactics in response to increasingly effective law enforcement efforts, and this is coupled with the increasing regulatory impact on organisations.

Sources: [Sky News] [GOV Infosecurity] [Bleeping Computer] [Infosecurity Magazine] [Cyber Reason]

The Old, Not the New: Basic Security Issues Still the Biggest Threat to Enterprises

In the latest IBM X-Force Threat Intelligence Index, it was revealed that basic security issues remain the most significant threat to enterprises. Cyber criminals are increasingly turning to credential stuffing, using and exploiting valid accounts harvested from the darkweb and previous breaches, with a 266% uptick in info-stealing malware. This tactic is harder to detect and elicits a costly response from enterprises. On the other hand, it is also important to adopt an attacker mindset for effective security. Understanding the attacker’s tools, motives, and efforts can help in limiting access, compartmentalising the impact of any successful attack, and minimising the time to attack detection. In essence, while organisations continue to grapple with complex cyber threats, the biggest security problem boils down to the basic and the already known. Therefore, it is crucial to focus on strengthening basic security measures and thinking like an attacker to proactively mitigate the risk for a more secure attack surface.

Source: [Help Net Security] [Forbes]

Reevaluating Your Cyber Security Priorities

Both technology and cyber criminals are evolving, yet many companies and organisations are not. For many corporate leaders, they may not know where to begin. Organisations looking to evolve their cyber security posture should look to elevate cyber to the C-suite and board, conduct audits of their sensitive information, create or update and test their incident response plan and finally, revisit their cyber hygiene training to ensure it is doing more than just ticking boxes. Organisations doing the above will find themselves improving their cyber security posture, and mitigating their risk to threats.

Source: [Dark Reading]

Cyber Threat Environment at its Most Dangerous for SMBs, as Geopolitical Tenison, Extortion and Attacks Present Biggest Risks

A new study has found that extortion campaigns, geopolitical threats, and attacks on small and medium-sized businesses (SMBs) are amongst the greatest threats to cyber security defences currently. The report, conducted by Mimecast, highlights how individual ransom groups have claimed over 1,000 victims and over $300 million in payments. Regarding SMBs, the report found that these businesses encountered twice the normal number of threats, at over 30 threats per user, as compared to larger companies who saw approximately 15. Not only are SMBs at more risk, but they also do not have the same resources a large company would have to mitigate such threats. SMBs must be efficient in the way they prioritise and address their cyber risk as part of their larger risk management strategy.

Sources: [Emerging Risks] [The HR Director]

Legal Sector Grows as a Target, with Cyber Attacks on Law Firms Surging by Over a Third

A new report has found that the number of reported cyber breaches on UK law firms has increased 30% from the previous year, as attackers increasingly target the profession. As a note, this does not include firms who may be unaware that they have been breached. Law firms are an attractive target to attackers due to the sensitive information such as M&A activity, divorce information and big ticket litigation; many attackers believe that law firms will pay handsomely to have this data back.

Sources: [Emerging Risks] [Legal Cheek]

It’s Not Only Ransomware Seeing Huge Rises: Business Email Compromise (BEC) Attacks are Also Seeing a Huge Rise. Is Your Business Prepared?

A recent report found that business email compromise (BEC) saw a staggering increase of 10 time the amount compared to the previous year. BEC involves a genuine business email account being compromised by a threat actor; this could be your supplier, a client, or anyone you have legitimate contact with. With such an increase, organisations must consider if they would be able to spot and mitigate BEC in their corporate environment through robust operational controls such as callback procedures for example. Due to the rise in deep fake fraud with voice cloning and video, the efficacy of traditional safeguards such as callbacks are not providing the assurance they once did. Firms and employees need to be on their guard to these changing tactics to safeguard the business.

Source: [TechRadar]

Deepfake Phishing Grew by 3,000% in 2023, and it’s Just the Beginning

Phishing remains one of the most prevalent cyber security threats, and with the emergence of artificial intelligence it is only going to carry on getting worse. According to a recent report, the number of deepfake fraud attempts rose by 3,000%. In one instance, the CEO of an energy enterprise sent €220,000 to a supplier after getting a call from the parent company’s leader requesting the exchange; the call was a deepfake.

Source: [HackerNoon]

Cyber Attacks are Getting Faster, More Common and More Successful, Although Detection is More Advanced Than Ever. New Report Signals the Threats to Businesses, Supply Chains, and Democracy

A recent report from CrowdStrike sheds light on the increasing speed and sophistication of cyber attacks. Breakout times have plummeted to an average of 62 minutes, with a record time of just two minutes and seven seconds observed. Hackers are now targeting the cloud, exploiting its vulnerabilities and leveraging AI assistance to escalate attacks. The human factor remains a primary entry point for threat actors, with social engineering and phishing campaigns on the rise. As organisations transition to the cloud, threat actors follow suit, with cloud intrusions soaring by 75%. CrowdStrike warns of state-sponsored adversaries targeting critical elections, emphasising the need for a platform-based approach bolstered by threat intelligence to safeguard against evolving threats.

Source: [TechRadar]

Report Finds Malicious Emails Bypassing Secure Email Gateways Rose by 105%

A report by Cofense has found a 105% increase in malicious emails that successfully bypassed Secure Email Gateways (SEGs), with approximately one malicious email navigating their way past SEGs every 57 seconds. The report suggests that phishing efforts are outpacing that of SEGs, and such phishing efforts are responsible for 90% of data breaches. Whilst SEGs may be filtering out a number of malicious emails, they, like everything in cyber security, are not a silver bullet. Organisations should not fall foul of believing that they are impenetrable because they have a SEG.

Sources: [SiliconANGLE] [Security Magazine] [Help Net Security]

Rising Cyber Threats Identified as Major Business Risk for 2024

In the latest Allianz risk barometer, cyber incidents have been identified as the most significant concern for companies globally in 2024. This is particularly true for remote desktop connections, which have become a prime target for cyber attacks since the shift to a work-from-home environment. The report also highlights that the risk landscape is being shaped by digitalisation, climate change, and geopolitical uncertainties. Meanwhile, a report from Coalition reveals that the cyber attack surface has expanded due to new ways of working. The report found that smaller businesses often lack the resources to prepare for a wide range of risk scenarios, which can lead to longer recovery times after an unexpected incident. These findings underscore the importance of robust cyber security measures and the need for continuous monitoring and improvement of an organisation’s digital defences.

Sources: [Reinsurance News] [Allianz]

Huge Cyber Security Leak Lifts the Lid on China’s Hackers for Hire

A huge leak of data from a Chinese cyber security firm, iSoon, has revealed state security agents paying tens of thousands of pounds to harvest data on targets, including the likes of foreign governments, and the leak shows this has been going on for years. Since the release, CrowdStrike has drawn overlaps between the firm and multiple known Chinese threat actors who are well resourced and conduct attacks over an extended period (referred to as advanced persistent threats, APTs). Among some of the 500 leaked documents are product manuals, lists of clients and employees, and WeChat instant messages. The leaks show over 14 governments have been attacked, as well as gambling and telecommunications companies.

Sources: [Dark Reading] [The Guardian]

Fifth of British Kids Have Broken the Law Online

In a recent study by the UK National Crime Agency (NCA), one in five children aged 10 to 16 have engaged in online offences with the figure rising to 25% among online gamers. These "low-level" cyber crimes, such as attempting to access protected servers or launching distributed denial of service (DDoS) attacks, may not be perceived by young individuals as violating the Computer Misuse Act. The consequences, however, are severe, including potential arrest, criminal records, and restrictions on future opportunities. The NCA stresses the importance of educating both children and adults about the legal and ethical implications of such actions, highlighting the transition from minor offences to more serious cyber crimes. With a significant shortage of cyber security professionals globally, fostering positive digital skills among young individuals is crucial for meeting industry demands and deterring cyber crime. Parents, teachers, and children are encouraged to explore resources provided by the NCA's Cyber Choices website to prevent inadvertent involvement in illegal online activities.

Source: [Infosecurity Magazine]

Over 40% of Firms Struggle with Cyber Security Talent Shortage

A recent report from Kaspersky has unveiled a critical global challenge: over 40% of companies are struggling to fill essential cyber security roles, with information security research and malware analysis roles particularly affected. This scarcity is felt most acutely in Europe and Latin America. Roles within security operations centres (SOCs) and network security are also understaffed, with figures around 35% and 33% respectively. The government sector faces the most significant demand for cyber security experts, followed closely by the telecoms and media sectors. While efforts like offering competitive salaries and enhanced training are underway, the gap persists due to the rapid pace of technological advancement outstripping educational initiatives. The report emphasises the need for innovative solutions to bridge this shortfall, highlighting recruitment, training, and technological advancements as key components of a comprehensive strategy to bolster cyber security resilience in the face of evolving threats.

Source: [Infosecurity Magazine]

---

Governance, Risk and Compliance

• Cyber attacks are getting faster, more common and more successful, even though detection is more advanced than ever | TechRadar

• 7 Ways Companies’ Cyber Related Governance Disclosures Will Evolve Post-SEC Rule Change (harvard.edu)

• Cyber security professionals admit “knowledge gaps” have led to serious security blunders | ITPro

• The old, not the new: Basic security issues still biggest threat to enterprises - Help Net Security

• Cyber threat environment more dangerous then ever - Mimecast (emergingrisks.co.uk)

• Over two-thirds of IT security decision-makers report an increase in cyber security budgets for 2024 | IT Reseller Magazine (itrportal.com)

• Geopolitical tension, extortion and attacks present biggest cyber security risks | theHRD (thehrdirector.com)

• 2024 CrowdStrike Global Threat Report: From Breakout to Breach in Under Three Minutes; Cloud Infrastructure Under Attack | Business Wire

• Gartner: Three top trends in cyber security for 2024 | Computer Weekly

• Barracuda report highlights rise of high-risk business security threats in 2023 (securitybrief.co.nz)

• Coalition report reveals rising cyber threats amidst business vulnerabilities - Reinsurance News

• Over 40% of Firms Struggle With Cyber Security Talent Shortage - Infosecurity Magazine (infosecurity-magazine.com)

• Thinking Like An Attacker—Another Look At Enterprise Security (forbes.com)

• Hackers using stolen credentials to launch attacks as info-stealing peaks | CSO Online

• The evolution of the CISO - Compare the Cloud

• How CISOs Balance Business Growth, Security in Cyber Threat Landscape (darkreading.com)

• Allianz Risk Barometer: Identifying the major business risks for 2024

• How to mitigate C-Suite cyber risks | Professional Security

• Why cyber security can boost organisational innovation | TechRadar

• 4 Key Steps to Reevaluate Your Cyber Security Priorities (darkreading.com)

• Cyber security success -- elevate your defence against cyber threats (betanews.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Ransom demands surge by 20% in 2023, hitting key industries hardest - SiliconANGLE

• Police arrests LockBit ransomware members, release decryptor in global crackdown (bleepingcomputer.com)

• LockBit takedown is a “huge win for law enforcement”, but let’s not celebrate too soon, security experts warn | ITPro

• LockBit Attempts to Stay Afloat with a New Version (trendmicro.com)

• LockBit registered nearly 200 "affiliates" over the past two years | TechRadar

• 2024 will be a volatile year for cyber security as ransomware groups evolve - Help Net Security

• Ransomware Experts See Problems With Banning Ransom Payments (govinfosecurity.com)

• Initial Ransomware Demands Jump 20% to $600,000 in 2023 - Infosecurity Magazine (infosecurity-magazine.com)

• Ransomware: True Cost to Business 2024 (cybereason.com)

• Ransomware and BEC are seeing a huge rise — is your business ready? | TechRadar

• ConnectWise exploit could spur ‘ransomware free-for-all,’ expert warns | SC Media (scmagazine.com)

• 3 trends set to drive cyber attacks and ransomware in 2024 | World Economic Forum (weforum.org)

• Year-over-year, the median initial ransom has risen by 20% | Security Magazine

• Alpha ransomware linked to NetWalker operation dismantled in 2021 (bleepingcomputer.com)

• Why are ransomware gangs making so much money? | TechCrunch

• Akira Ransomware Exploiting Cisco Anyconnect Vulnerability (gbhackers.com)

• Knight ransomware source code for sale after leak site shuts down (bleepingcomputer.com)

• Exclusive: eSentire Confirms Rhysida Ransomware Victims - Infosecurity Magazine (infosecurity-magazine.com)

• Stuck in cyber attack nightmare? Call the negotiators (techxplore.com)

• Why some cyber attacks hit harder than others - BBC News

• Report: Manufacturing bears the brunt of industrial ransomware | CyberScoop

Ransomware Victims

• eSentire Confirms Rhysida Ransomware Victims - Infosecurity Magazine (infosecurity-magazine.com)

• Why some cyber attacks hit harder than others - BBC News

• ALPHV ransomware claims loanDepot, Prudential Financial breaches (bleepingcomputer.com)

• Cactus ransomware gang claims the theft of 1.5TB of data from Energy management and industrial automation firm Schneider Electric (securityaffairs.com)

• Dead Man's Fingers maker cuts over 500 jobs and enters the red after cyber attack hits sales (cityam.com)

• 147 ransomware attacks on large Dutch companies, institutions last year; 18% paid ransom | NL Times

• Pharmacy Delays Across US Blamed on Nation-State Hackers (darkreading.com)

Phishing & Email Based Attacks

• New report warns of ongoing rise of malicious emails bypassing secure email gateways - SiliconANGLE

• Secure email gateways struggle to keep pace with sophisticated phishing campaigns - Help Net Security

• The phishing bait you're most likely to take (betanews.com)

• Deepfake Phishing Grew by 3,000% in 2023 — And It's Just Beginning | HackerNoon

• SMBs at Risk From SendGrid-Focused Phishing Tactics - Infosecurity Magazine (infosecurity-magazine.com)

Other Social Engineering

• What ‘psychological warfare’ tactics do scammers use, and how can you protect yourself? (theconversation.com)

• North Koreans using ChatGPT to scam LinkedIn users; "attacks are getting very sophisticated" - MSPoweruser

• What Is Social Engineering? Types Of Attacks To Beware Of (forbes.com)

Artificial Intelligence

• AI models can be weaponized to hack websites on their own • The Register

• North Koreans using ChatGPT to scam LinkedIn users; "attacks are getting very sophisticated" - MSPoweruser

• Deepfake Phishing Grew by 3,000% in 2023 — And It's Just Beginning | HackerNoon

• Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard

• As adversaries harness AI, tech firms peer through chat logs to catch them - Defense One

• Here Comes the Flood of AI-Generated Clickbait | WIRED

• Air Canada Has to Honor a Refund Policy Its Chatbot Made Up | WIRED

• 36% of code generated by GitHub CoPilot contains security flaws - Help Net Security

• Employees input sensitive data into generative AI tools despite the risks | ZDNET

• Ransomware Declines as InfoStealers and AI Threats Gain Ground: IBM X-Force - SecurityWeek

• Gartner: Three top trends in cyber security for 2024 | Computer Weekly

• Global AI Regulatory Update - Lexology

Malware

• PDF Malware on the Rise, Used to Spread WikiLoader, Ursnif and DarkGat - Infosecurity Magazine (infosecurity-magazine.com)

• FBI's Most-Wanted Zeus and IcedID Malware Mastermind Pleads Guilty (thehackernews.com)

• Iranian Hackers Target Middle East Policy Experts with New BASICSTAR Backdoor (thehackernews.com)

• VIPRE report predicts 276% rise in malware in 2024 (securitybrief.co.nz)

• Anatsa Android malware downloaded 150,000 times via Google Play (bleepingcomputer.com)

• 'Lucifer' Botnet Turns Up the Heat on Apache Hadoop Servers (darkreading.com)

• What are Botnets and Why are MSSPs So Concerned? | MSSP Alert

• New SSH-Snake malware steals SSH keys to spread across the network (bleepingcomputer.com)

• Ransomware Declines as InfoStealers and AI Threats Gain Ground: IBM X-Force - SecurityWeek

• Your Mac Is Not Virus Proof. It Never Has Been. (gizmodo.com)

• Click: Your innocent mouse could be a cyber criminal's silent weapon - Digital Journal

• Vibrator virus steals your personal information | Malwarebytes

Mobile

• Meta Warns of 8 Spyware Firms Targeting iOS, Android, and Windows Devices (thehackernews.com)

• New Wave of 'Anatsa' Banking Trojans Targets Android Users in Europe (darkreading.com)

• Your fingerprints can be recreated from the sounds made when you swipe on a touchscreen — Chinese and US researchers show new side channel can reproduce fingerprints to enable attacks | Tom's Hardware (tomshardware.com)

• VoltSchemer attacks use wireless chargers to inject voice commands, fry phones (bleepingcomputer.com)

• New Wi-Fi Vulnerabilities Expose Android and Linux Devices to Hackers (thehackernews.com)

• Zero-Click Apple Shortcuts Vulnerability Allows Silent Data Theft (darkreading.com)

Denial of Service/DoS/DDOS

• Cyber attacks in Malta, Hungary, Ukraine, Bosnia are a 'wake-up call', IPI warns (timesofmalta.com)

• Average DDoS attack cost businesses £325,000 in 2023, according to new Zayo data | IT Reseller Magazine (itrportal.com)

• Top UK Universities Recovering Following Targeted DDoS Attack - Infosecurity Magazine (infosecurity-magazine.com)

Internet of Things – IoT

• 'Anywhere there's a camera, now there's a risk': Billions of users at risk of Peeping Toms — scientists devise incredibly simple eavesdropping system costing only a few hundred dollars | TechRadar

• Wyze camera glitch gave 13,000 users a peek into other homes (bleepingcomputer.com)

• As Cyber attacks Ramp Up, Electric Vehicles Are Vulnerable (autoweek.com)

• Wi-Fi jamming to knock out cameras suspected in nine Minnesota burglaries -- smart security systems vulnerable as tech becomes cheaper and easier to acquire | Tom's Hardware (tomshardware.com)

• Is new technology making cars less secure? - Verdict

Data Breaches/Leaks

• Bank of America Suffers Massive Data Breach, Exposing Social Security Numbers, Addresses and Additional Sensitive Data To Hackers - The Daily Hodl

• Infosys subsidiary named as source of Bank of America leak • The Register

• Why Data Breaches Spiked in 2023 (hbr.org)

• Massive Cloud Database Leak Exposes 380 Million Records (hackread.com)

• UK council's sneaky insider steals 79k email addresses • The Register

• Eye Care Services Firm Faces Lawsuit Over Data Breach Impacting 2.3 Million - SecurityWeek

Cyber Crime General & Criminal Actors

• Fifth of British Kids Have Broken the Law Online - Infosecurity Magazine (infosecurity-magazine.com)

• Despite Knowing Risks, Brits Continue to Expose Themselves to Cyber Criminals Finds IDnow | The Fintech Times

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Cyber Criminals Are Employing New Tactics To Launder Money, Warns Report - Benzinga

Insider Risk and Insider Threats

• UK council's sneaky insider steals 79k email addresses • The Register

Insurance

• Personal cyber insurance nascent but growing in demand as digital crimes increase - Victoria Times Colonist

• Insurers Use Claims Data to Recommend Cyber Security Technologies (darkreading.com)

• Cyber Insurance Needs to Evolve to Ensure Greater Benefit (darkreading.com)

• What is Cyber Insurance and Does Your Small Business Need It? (smallbiztrends.com)

Supply Chain and Third Parties

• Infosys subsidiary named as source of Bank of America leak • The Register

• North Korean hackers linked to defence sector supply-chain attack (bleepingcomputer.com)

Cloud/SaaS

• 2024 CrowdStrike Global Threat Report: From Breakout to Breach in Under Three Minutes; Cloud Infrastructure Under Attack | Business Wire

• Cyber security report reveals 75% spike in cloud attacks (securitybrief.co.nz)

• Cyber security fears drive a return to on-premise infrastructure from cloud computing - Help Net Security

• Massive Cloud Database Leak Exposes 380 Million Records (hackread.com)

• How Nation-State Actors Target Your Business: New Research Exposes Major SaaS Vulnerabilities (thehackernews.com)

• Cyber attacks follow businesses to the cloud (betanews.com)

• Six steps for stronger cloud security | SC Media (scmagazine.com)

Identity and Access Management

• Why identity fraud costs organisations millions - Help Net Security

• Orgs are having a major identity crisis • The Register

• Active Directory outages can cost organisations $100,000 per day - Help Net Security

Encryption

• European Court of Human Rights rules against government backdoors in end-to-end encryption - Neowin

Linux and Open Source

• New Wi-Fi Vulnerabilities Expose Android and Linux Devices to Hackers (thehackernews.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Hackers using stolen credentials to launch attacks as info-stealing peaks | CSO Online

• How to proactively prevent password-spray attacks on legacy email accounts | CSO Online

Social Media

• EU Watchdog Urged to Reject Meta 'Pay for Privacy' Scheme - SecurityWeek

• Social Media Platforms Are in an ‘Information Trafficking Business’: Cyber Security Adviser | NTD

• ChatGPT Used by North Korean Hackers to Scam LinkedIn Users (tech.co)

• 76% of Super Bowl Traffic From Elon Musk's X to Advertisers Could Be Fake (thewrap.com)

• Elon Musk’s X allows China-based propaganda banned on other platforms | Ars Technica

• European Union deepens its investigation of TikTok • The Register

Training, Education and Awareness

• People cannot be patched (betanews.com)

Regulations, Fines and Legislation

• European Court of Human Rights rules against government backdoors in end-to-end encryption - Neowin

• Hedge Funds Warn SEC Cyber Lapses Risk Exposing Trading Secrets (bloomberglaw.com)

• One Year After the Colonial Pipeline Attack, Regulation Is Still a Problem (securityintelligence.com)

• 7 Ways Companies’ Cyber Related Governance Disclosures Will Evolve Post-SEC Rule Change (harvard.edu)

• European Union deepens its investigation of TikTok • The Register

• Decoding DORA: Navigating the digital regulatory landscape | World Finance

• 81 Percent of Security Leaders Say SEC Cyber Security Rules Will Substantially Impact Their Business | Business Wire

• FTC Fines Avast $16.5 Million For Selling Browsing Data Harvested by Antivirus (404media.co)

• Avast settles claims of customer data peddling for $17M • The Register

• Global AI Regulatory Update - Lexology

Careers, Working in Cyber and Information Security

• Over 40% of Firms Struggle With Cyber Security Talent Shortage - Infosecurity Magazine (infosecurity-magazine.com)

• The Psychology of Cyber Security Burnout (informationweek.com)

• How can we adapt work practices to protect CISO mental health? | Computer Weekly

Misinformation, Disinformation and Propaganda

• Feds deliver stark warnings to state election officials ahead of November - Iowa Capital Dispatch

• UK election cyber attack warning after Putin's hackers target US (inews.co.uk)

• Social Media Platforms Are in an ‘Information Trafficking Business’: Cyber Security Adviser | NTD

• Elon Musk’s X allows China-based propaganda banned on other platforms | Ars Technica

• Election security threats in 2024 range from AI to … anthrax • The Register

• 76 percent of Super Bowl LVIII traffic from Twitter dubbed 'fake' (awfulannouncing.com)

• Iran and Hezbollah Hackers Launch Attacks to Influence Israel-Hamas Narrative (thehackernews.com)

• Russian Hackers Target Ukraine with Disinformation and Credential-Harvesting Attacks (thehackernews.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Countries fear state-sponsored cyber war | The World from PRX

• Cyberwar: What Is It Good For? - GovInfoSecurity

Nation State Actors

• Cyber attacks are getting faster, more common and more successful, even though detection is more advanced than ever — new report signals the threats to businesses, supply chains, and democracy | TechRadar

• Countries fear state-sponsored cyber war | The World from PRX

• How Nation-State Actors Target Your Business: New Research Exposes Major SaaS Vulnerabilities (thehackernews.com)

• Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard

• Pharmacy Delays Across US Blamed on Nation-State Hackers (darkreading.com)

China

• In the evolving cyberwar, China aims to take down our critical infrastructure | SC Media (scmagazine.com)

• 'Major Chinese hack' on Foreign Office urgently investigated by UK spies (inews.co.uk)

• Leaked Chinese Hacking Files Reveal How Compromised the US Could Be (businessinsider.com)

• iSoon's Secret APT Status Exposes China's Foreign Hacking Machination (darkreading.com)

• Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard

• China’s Cyber Security and Statecraft – The Diplomat

• Elon Musk’s X allows China-based propaganda banned on other platforms | Ars Technica

• China’s Spy Agency Sees Threats Everywhere in Data Security Push - Bloomberg

Russia

• FBI disrupts hacking network 'linked to Russian intelligence services' | US News | Sky News

• Russian APT 'Winter Vivern' Targets European Governments, Military (darkreading.com)

• Russian Cyber attackers Launch Multiphase PsyOps Campaign (darkreading.com)

• Russian-Linked Hackers Target 80+ Organisations via Roundcube Flaws (thehackernews.com)

• Russian military botnet discovered on 1000+ compromised routers — FBI deactivated Moobot by taking control of impacted routers | Tom's Hardware (tomshardware.com)

• NHS hospitals ‘easy targets’ for Russian hackers (thetimes.co.uk)

• Russia-Aligned TAG-70 Targets European Government and Military Mail Servers in New Espionage Campaign (recordedfuture.com)

• Generative AI and elections are key focus for hackers in 2024, report warns | Evening Standard

• Russian Turla Cyber Spies Target Polish NGOs With New Backdoor - SecurityWeek

• Russian-Aligned Network Doppelgänger Targets German Elections - Infosecurity Magazine (infosecurity-magazine.com)

• Russian Hackers Target Ukraine with Disinformation and Credential-Harvesting Attacks (thehackernews.com)

• NATO's chief information officer on what Ukraine did right in its cyberwar with Russia (therecord.media)

• Russian Government Software Backdoored to Deploy Konni RAT Malware (thehackernews.com)

• Three terms sure to grab attention: Russia, nuclear, anti-satellite weapon | Ars Technica

Iran

• Iranian Hackers Target Middle East Policy Experts with New BASICSTAR Backdoor (thehackernews.com)

• Iranian APTs Dress Up As Hacktivists for Disruption, Influence Ops (darkreading.com)

• Iran and Hezbollah Hackers Launch Attacks to Influence Israel-Hamas Narrative (thehackernews.com)

• Iran-Backed Charming Kitten Stages Fake Webinar Platform to Ensnare Targets (darkreading.com)

• Israeli Aircraft Survive “Cyber Hijacking” Attempts - Infosecurity Magazine (infosecurity-magazine.com)

North Korea

• ChatGPT Used by North Korean Hackers to Scam LinkedIn Users (tech.co)

• North Korean hackers linked to defence sector supply-chain attack (bleepingcomputer.com)

• North Koreans using ChatGPT to scam LinkedIn users; "attacks are getting very sophisticated" - MSPoweruser

• Russian Government Software Backdoored to Deploy North Korean Konni RAT Malware (thehackernews.com)

---

Vulnerability Management

• CVEs expected to increase 25% in 2024 | Security Magazine

• Coalition: Vulnerability scoring systems falling short | TechTarget

Vulnerabilities

• Ransomware Warning as CVSS 10.0 ConnectWise ScreenConnect Bug is Exploited - Infosecurity Magazine (infosecurity-magazine.com)

• ConnectWise exploit could spur ‘ransomware free-for-all,’ expert warns | SC Media (scmagazine.com)

• Exploiting critical ConnectWise bug is 'embarrassingly easy' • The Register

• Akira Ransomware Exploiting Cisco AnyConnect Vulnerability (gbhackers.com)

• New Ivanti Vulnerability Observed as Widespread Security Concerns Grow - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft Exchange flaw CVE-2024-21410 could impact up to 97,000 servers (securityaffairs.com)

• VMware Alert: Uninstall EAP Now - Critical Flaw Puts Active Directory at Risk (thehackernews.com)

• VMware issues no-patch advisory for critical flaw in old SSO plugin | SC Media (scmagazine.com)

• Russian-Linked Hackers Target 80+ Organisations via Roundcube Flaws (thehackernews.com)

• ESET fixed high-severity local privilege escalation bug in Windows products (securityaffairs.com)

• SolarWinds addressed critical RCEs in Access Rights Manager (securityaffairs.com)

• Chrome 122, Firefox 123 Patch High-Severity Vulnerabilities - SecurityWeek

• Critical Vulnerability in VMware vSphere Plug-in Allows Session Hijacking (darkreading.com)

• Joomla XSS Bugs Open Millions of Websites to RCE (darkreading.com)

• Zero-Click Apple Shortcuts Vulnerability Allows Silent Data Theft (darkreading.com)

• Urgent patches available for QNAP vulnerabilities, one 0-day • The Register

• Hackers exploit critical RCE flaw in Bricks WordPress site builder (bleepingcomputer.com)

---

Tools and Controls

• Secure email gateways struggle to keep pace with sophisticated phishing campaigns - Help Net Security

• NCSC Sounds Alarm Over Private Branch Exchange Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Stuck in cyber attack nightmare? Call the negotiators (techxplore.com)

• New Google Chrome feature blocks attacks against home networks (bleepingcomputer.com)

• How Businesses Can Safeguard Their Communication Channels Against Hackers (thehackernews.com)

• Limiting remote access exposure in hybrid work environments | CSO Online

• Cyber Insurance Needs to Evolve to Ensure Greater Benefit (darkreading.com)

• The double-edged sword of zero trust - Help Net Security

• Orgs are having a major identity crisis • The Register

• Active Directory outages can cost organisations $100,000 per day - Help Net Security

• SOC Landscapes: Insights from SANS' 2023 SOC Report (trendmicro.com)

• 36% of code generated by GitHub CoPilot contains security flaws - Help Net Security

• Microsoft expands free logging capabilities after May breach (bleepingcomputer.com)

• Why ransomware gangs love using RMM tools—and how to stop them | Malwarebytes

• People cannot be patched (betanews.com)

• “Ruthlessly prioritize what’s critical”: Check Point expert on CISOs and the evolving attack surface | ITPro

---

Reports Published in the Last Week

• VIPRE report predicts 276% rise in malware in 2024 (securitybrief.co.nz)

• CrowdStrike 2024 Global Threat Report | CrowdStrike

• IBM XForce Threat Intelligence Index 2024.pdf

• Cyber Threat Index 2024: Scans, Honeypots, and CVEs  (coalitioninc.com)

---

Other News

• Israeli Aircraft Survive “Cyber-Hijacking” Attempts - Infosecurity Magazine (infosecurity-magazine.com)

• The Power Sector’s High-Stakes Battle for Cyber-Resiliency (powermag.com)

• Ways to elevate public sector cyber security | Professional Security

• Increasing Europe's cyber resilience - government.lu (gouvernement.lu)

• Industries most targeted by active adversaries | SC Media (scmagazine.com)

• Library Cyber Defences Are Falling Down (darkreading.com)

• How conveyancers can protect themselves against a cyber attack | Today's Conveyancer (todaysconveyancer.co.uk)

• US govt shares cyber attack defence tips for water utilities (bleepingcomputer.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 19 February 2024 – Google and Yahoo Change Email Policy Impacting Delivery of Emails from Businesses, What You Need to Know

Executive summary

Google and Yahoo are tackling spam with their new rules for bulk emails. Gmail and Yahoo have introduced new regulations for bulk email senders, which applies to anyone sending 5,000 or more messages to personal accounts in a 24 hour period. As part of these rules, sending accounts will need to verify themselves, through Domain-based Message Authentication (DMARC).

What’s the risk to me or my business?

Some business unknowingly not be following these rules and as such, their emails will not be hitting the inboxes of customers. Further, this can lead to legitimate businesses being marked as spam from Google.

What can I do?

Businesses who are likely to be considered bulk senders or are currently experiencing issues with their emails should look to follow the guidelines outlined by Google, to make sure they are aligned.

Further details can be found below:

The full list of Google requirements can be found below:

https://support.google.com/a/answer/81126?hl=en

Details on how to add DMARC can be found here:

https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 16 February 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Active Phishing Campaigns Targeting Office 365, Another Forcing Remote Management Software Downloads

Proofpoint have released an alert relating to an active hacking operation in which cyber criminals are employing phishing traps and shared Office 365 documents to steal credentials. Hackers have been threading together credential phishing and account takeover (ATO) tactics to gain access to enterprise resources, with multiple organisations already hit. One of the identified methods in use involves attackers inserting links that direct users to click to view a document. This subsequently links them to a phishing page controlled by the attacker.

In another currently active phishing campaign, threat actors are targeting potential victims via email and SMS, with personalised content to match victim roles within their organisation. But instead of phishing for information directly, they are convincing victims to download remote monitoring and management software. Victims were directed to newly registered websites mimicking various financial institutions and asked to download a “live chat application”, which turned out to be an old version of AnyDesk. Once downloaded, the software would then allow full access to victim’s machine and network resources.

Sources: [Verdict] [Help Net Security]

Cyber Security is Your Defensive Strategy, Cyber Resilience is Your Business

A cyber attack is a matter of when, not if, and as such businesses must prepare for such an event happening to them. Whilst cyber security aims to defend the organisation, cyber resilience is about ensuring that your digital operations, which are the heart of your organisation, can withstand and quickly recover from any cyber attack, technical malfunction, or even deliberate tampering. If we think back to Covid, a lot of organisations suddenly had to adapt, to ensure that they could function as close to normal as possible. How many have tested their organisation’s ability to continue work since, or prepared for a loss of access to critical systems for an extended period of time? It’s the cyber resilient organisations that know they’ve made the right investments to significantly reduce the risk of their operations grinding to a halt.

Source: [Security Brief]

Leveraging Threat Intelligence for Regulatory Compliance

The collective improvement of cyber security is a high international priority and a wealth of EU legislation, such as NIS2 and the Digital Operational Resilience Act (DORA) is in the pipeline, to oblige organisations to understand and manage their cyber risks appropriately. As part of these regulations, threat intelligence is often a feature that can be leveraged to improve cyber resilience.

Threat intelligence can be collected from a variety of sources such as governmental advisories, dark web monitoring, private sector feeds, intelligence-sharing communities and open source information. The key for organisations is to be able to digest this, and apply it accordingly to their specific organisation, to improve their cyber resilience efforts.

Black Arrow provides weekly threat intelligence free of charge through our online blog and weekly subscription summary email. To sign up, visit https://www.blackarrowcyber.com/subscribe

Source: [BetaNews]

The Risks of Quishing and How Enterprises Can Stay Secure

QR codes have surged in popularity in the past two years, mainly due to their convenient and touchless features that streamline daily transactions, making it easy for users to scan and access information quickly. However, this surge in popularity has also caught the attention of cyber criminals, who exploit QR codes to perpetrate phishing attacks, known as "quishing." Attackers use tactics, such as disguising malicious QR codes in seemingly legitimate contexts; these pose substantial risks, leading to compromised personal and corporate data, financial loss, and reputational damage. Organisations must prioritise understanding and fortifying defences against quishing, as these attacks pose significant risks to both individuals and organisations. By educating employees on discerning phishing attempts, enforcing device security measures, and leveraging specialised solutions, organisations can bolster their resilience against QR code-based cyber threats and safeguard their digital assets effectively.

Source: [Zimperium]

Phishing Attacks Increased 106% Year Over Year as 91% of Organisations Impacted by AI-enhanced Phishing Attacks

A recent report found that phishing attempts increased 106% year on year, with malware detections up 40%. In a separate report on phishing, it was found that 91% of organisation were impacted by AI-enhanced phishing attacks. Such numbers reinforce the reason for organisations to implement effective phishing training, and this should include training regarding AI-enhanced phishing emails.

Sources: [The Fintech Times] [Security Magazine]

Microsoft and OpenAI Warn State-backed Threat Actors are Using AI En Masse to Wage Cyber Attacks

Microsoft has released a report detailing how prominent state-linked actors are using generative AI to enhance their attack methods. Russian, North Korean, Iranian, and Chinese-backed threat actors are attempting to use generative AI to inform, enhance, and refine their attacks, according to the report. It’s clear that AI is a double-edged sword, and organisations must implement processes to reduce their risk and increase their resilience to it.

Source: [ITPro]

Cyber Risk Management: Bring Security to the Boardroom

Organisations are facing the dual challenge of managing business risk and aligning with ever-expanding cyber security goals; as such, the need for a robust cyber risk management strategy is more critical than ever. This calls for organisations to effectively communicate their security posture to the board with relevant metrics.

Engaging the board requires a strategic approach, emphasising clear communication and contextual visibility. Board members are already increasingly recognising the impact of poor security on an organisation’s reputation, budget, and overall well-being; it is essential to translate security concerns into tangible metrics that resonate with the board. Real-time metrics, alignment with business goals, and educating the board on cyber security nuances can help build the foundation for such a strategy.

Source: [Trend Micro]

Trustees Open to Cyber Risks by Not Responding to NCSC Reporting Changes

Recent changes in the National Cyber Security Centre's (NCSC) threat reporting framework have prompted a call to action for pension scheme advisors.

Cyber security has fast become one of the biggest threats to pension schemes. Data breeches, scamming, ransomware, fraud: these have all become the stuff of trustee nightmares. And the sophistication of those threats is evolving rapidly, so it is important that schemes stay as far ahead of them as possible with comprehensive and proactive defence measures. It’s also imperative to check-in regularly with advisors that their measures are robust, and ensure that reports are undertaken frequently to demonstrate progression of mitigation of all vulnerabilities. A onetime spot check is simply not enough in this environment.

Source: [The HR Director]

Nation State Actors Intensify Focus on NATO Member States

The head of threat research and analysis at Google Cloud has highlighted that nation state actors consider cyber warfare as another tool in their box, noting the current ongoing cyber warfare between Russia and Ukraine. Separate reports have found that the cyber war has extended to NATO member states, with initial access brokers (individuals who sell credentials to organisations) increasingly targeting entities within NATO member states.

Sources: [Help Net Security] [World Economic Forum ] [Inforisktoday] [Help Net Security]

---

Governance, Risk and Compliance

• The ROI of Investing in Cyber Security - Security Boulevard

• Leveraging threat intelligence for regulatory compliance (betanews.com)

• Getting a grip on cyber resilience – PublicTechnology

• It's Time to Rethink Third-Party Risk Assessment (darkreading.com)

• Cyber Risk Management: Bring Security to the Boardroom (trendmicro.com)

• A changing world requires CISOs to rethink cyber preparedness | CSO Online

• Cyber Security teams recognized as key enablers of business goals - Help Net Security

• 26 Cyber Security Stats Every User Should Be Aware Of in 2024 (securityaffairs.com)

• Cyber Security's Transformative Shift (darkreading.com)

• Fortifying Businesses Against Modern Information Threats (forbes.com)

• Executives must face down state-sponsored hacking groups targeting firmware | Computer Weekly

• Do you have a cyber security comms plan? | PR Week

• Cyber Security is your defensive strategy, cyber resilience is your business (securitybrief.co.nz)

• Gmail & Yahoo DMARC rollout: When cyber compliance gives a competitive edge - Help Net Security

---

Threats

Ransomware, Extortion and Destructive Attacks

• New macOS Backdoor Linked to Prominent Ransomware Groups - SecurityWeek

• Ransomware tactics evolve, become scrappier - Help Net Security

• Rhysida Ransomware Cracked, Free Decryption Tool Released (thehackernews.com)

• Resiliency to ransomware | Professional Security

• Dual Ransomware Attacks: A Quicker Route to Extortion - Security Boulevard

• How To Prepare For A Ransomware Attack (forbes.com)

• 2023 Ransomware Attack Report - Security Boulevard

• The State of Ransomware in 2023 | BlackFog

• Cyber Security firm Check Point reports an increase in wiper-ware attacks amid geopolitical uncertainty - The Economic Times (indiatimes.com)

Ransomware Victims

• Ransomware Groups Claim Hits on Hyundai Motor Europe and a California Union (darkreading.com)

• Cyber Attack hits Swedish cloud provider Advania, healthcare services impacted | Cybernews

• Ransomware Attack Takes 100 Hospitals Offline (forbes.com)

• PR industry affected as media monitoring firm Onclusive hit by cyber attack | PR Week

• German battery maker Varta says five plants hit by cyber attack - CNA (channelnewsasia.com)

• UK utility giant Southern Water says hackers stole personal data of hundreds of thousands of customers | TechCrunch

• The Southern Water cyber attack highlights the wave of threats faced by utilities companies | ITPro

Phishing & Email Based Attacks

• 91.1% of Organisations Impacted by AI-Enhanced Phishing Attacks, Acronis Reports | The Fintech Times

• VIPRE Security Group's Annual Email Threat Landscape Shows Advanced Methods Needed for Security (prnewswire.com)

• Corporate users getting tricked into downloading AnyDesk - Help Net Security

• Phishing attacks increased 106% year over year | Security Magazine

• Gmail & Yahoo DMARC rollout: When cyber compliance gives a competitive edge - Help Net Security

• Remote Monitoring & Management software used in phishing attacks | Malwarebytes

• What Is Phishing? Understanding Cyber Attacks (forbes.com)

• How are attackers using QR codes in phishing emails and lure documents? (talosintelligence.com)

• Threat actors in phishing campaign targeted at Office 365 (verdict.co.uk)

• 2023 Year in Review: Phishing Attacks and Trends (vadesecure.com)

• London police block 43 crypto phishing web domains (cointelegraph.com)

• This new Android feature could help save you from phishing and malware – here's how | TechRadar

Other Social Engineering

• The War for Headspace: NextGen cyberattacks aim to manipulate people’s minds  | SC Media (scmagazine.com)

• 4 Ways Hackers use Social Engineering to Bypass MFA (thehackernews.com)

• QR code attacks target organizations in ways they least expect - Help Net Security

• QR Phishing. Fact or Fiction? | Pen Test Partners

• The Risks of Quishing and How Enterprises Can Stay Secure - Zimperium

Artificial Intelligence

• Deepfake CFO Video Calls Result in $25MM in Damages (trendmicro.com)

• 91.1% of Organisations Impacted by AI-Enhanced Phishing Attacks, Acronis Reports | The Fintech Times

• Russia And China Use OpenAI Tools To Hack, Microsoft Warns (forbes.com)

• Microsoft and OpenAI warn state-backed threat actors are using generative AI en masse to wage cyber attacks | ITPro

• 55% of Generative AI Inputs Include Sensitive Data: Menlo Security - Security Boulevard

• We're at a Pivotal Moment for AI and Cyber Security (darkreading.com)

• Deepfake Democracy: AI Technology Complicates Election Security (darkreading.com)

• Tech Companies Turned Ukraine Into an AI War Lab | TIME

• Deepfake threats are on the rise - new research shows worrying rise in dangerous new scams | TechRadar

• Cyber criminals get productivity boost with AI - Help Net Security

• Stolen Face ID scans used to break into bank accounts • The Register

• AI outsourcing: A strategic guide to managing third-party risks - Help Net Security

• The Coming End of Biometrics Hastens AI-Driven Security - Security Boulevard

• Rental scams could soar as AI spreads, warns industry... (lettingagenttoday.co.uk)

• Cyber Security Threats: How To Fight AI With AI (forbes.com)

• The rise of AI threats and cyber security: predictions for 2024 | World Economic Forum (weforum.org)

2FA/MFA

• MFA isn't always keeping businesses safe from cyber attack | TechRadar

• 4 Ways Hackers use Social Engineering to Bypass MFA (thehackernews.com)

• Ongoing campaign compromises senior execs’ Azure accounts, locks them using MFA | Ars Technica

Malware

• RustDoor malware targets macOS users by posing as a Visual Studio Update - gHacks Tech News

• Kimsuky's New Golang Stealer 'Troll' and 'GoBear' Backdoor Target South Korea (thehackernews.com)

• VexTrio network of hijacked websites used to spread malware • The Register

• Raspberry Robin Jumps on 1-Day Bugs to Nest Deep in Windows Networks (darkreading.com)

• Suspected Warzone RAT hackers arrested | SC Media (scmagazine.com)

• From Cracked to Hacked: Malware Spread via YouTube Videos (cybereason.com)

• Apple Mac computers are not virus proof: The myth (qz.com)

• Bumblebee malware attacks are back after 4-month break (bleepingcomputer.com)

• Hackers used new Windows Defender zero-day to drop DarkMe malware (bleepingcomputer.com)

• Glupteba Botnet Adds UEFI Bootkit to Cyber Attack Toolbox (darkreading.com)

• Understanding the tactics of stealthy hunter-killer malware - Help Net Security

• Water Hydra’s Zero-Day Attack Chain Targets Financial Traders - Infosecurity Magazine (infosecurity-magazine.com)

• Miscreants turn to ad tech to measure malware metrics • The Register

• New Qbot malware variant uses fake Adobe installer popup for evasion (bleepingcomputer.com)

• “TicTacToe Dropper” Malware Distribution Tactics Revealed - Infosecurity Magazine (infosecurity-magazine.com)

• This new Android feature could help save you from phishing and malware – here's how | TechRadar

Mobile

• Stolen Face ID scans used to break into bank accounts • The Register

• Google Chrome Warning Suddenly Issued For All Android Users (forbes.com)

• Russian banks beat App Store Review using fake apps (appleinsider.com)

• Meta brushes off risk of account theft via number recycling • The Register

• This new Android feature could help save you from phishing and malware – here's how | TechRadar

Denial of Service/DoS/DDOS

• Cyber Security sectors adjust as DDoS attacks reach new heights - Help Net Security

• How it works: The novel HTTP/2 ‘Rapid Reset’ DDoS attack | Google Cloud Blog

• Telecoms was the most targeted sector for DDoS attacks in 2023

• Average DDoS Attack Cost Businesses Nearly Half a Million Dollars in 2023, According to New Zayo Data | Business Wire

• DDoS Hacktivism is Back With a Geopolitical Vengeance - SecurityWeek

Internet of Things – IoT

• Canada to ban the Flipper Zero to stop surge in car thefts (bleepingcomputer.com)

• How secure is your security camera? Hackers can spy on cameras through walls, new research finds (techxplore.com)

Data Breaches/Leaks

• Bank of America warns customers of data breach after vendor hack (bleepingcomputer.com)

• Caravan club admits members' personal data possibly accessed • The Register

• DOD notifying people who may be impacted by a year-old data breach | DefenseScoop

• Southern Water Notifies Customers and Employees of Data Breach - Infosecurity Magazine (infosecurity-magazine.com)

• The Southern Water cyber attack highlights the wave of threats faced by utilities companies | ITPro

• 200,000 Facebook Marketplace user records leaked on hacking forum (bleepingcomputer.com)

• Prudential says hackers gained access to its computer systems | The Star

• Verizon Breach – Malicious Insider or Innocuous Click? - IT Security Guru

• Thousands of DoD personnel may have had their private data leaked — US government admits 20,000 could be affected | TechRadar

• Hackers got nearly 7 million people’s data from 23andMe. The firm blamed users in ‘very dumb’ move | Hacking | The Guardian

• DNA testing: What happens if your genetic data is hacked? - BBC Future

• BMW security error left valuable private company data exposed online | TechRadar

Organised Crime & Criminal Actors

• 5 Things Movies Always Get Wrong About Computer Hackers (slashgear.com)

• 9 Possible Ways Hackers Can Use Public Wi-Fi to Steal Your Sensitive Data (securityaffairs.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• London police block 43 crypto phishing web domains (cointelegraph.com)

Insider Risk and Insider Threats

• Verizon Breach – Malicious Insider or Innocuous Click? - IT Security Guru

• Insider threat greatest mid-market cyber security concern - CIR Magazine

Supply Chain and Third Parties

• Bank of America warns customers of data breach after vendor hack (bleepingcomputer.com)

• It's Time to Rethink Third-Party Risk Assessment (darkreading.com)

• Jet engine dealer to major airlines discloses cyber snafu • The Register

• AI outsourcing: A strategic guide to managing third-party risks - Help Net Security

• 6 best practices for third-party risk management | CSO Online

• Software security debt piles up for organisations even as critical flaws drop | CSO Online

Cloud/SaaS

• Threat actors in phishing campaign targeted at Office 365 (verdict.co.uk)

• Ongoing campaign compromises senior execs’ Azure accounts, locks them using MFA | Ars Technica

• Benefits and challenges of managed cloud security services | TechTarget

• How Nation-State Actors Target Your Business: New Research Exposes Major SaaS Vulnerabilities (thehackernews.com)

Encryption

• Beating Bitlocker In 43 Seconds | Hackaday

Social Media

• Inside X's content moderation dilemma | Fortune

• 20 Years of Facebook, but Trust in Social Media Remains Rock Bottom - Infosecurity Magazine (infosecurity-magazine.com)

• Meta brushes off risk of account theft via number recycling • The Register

• 200,000 Facebook Marketplace user records leaked on hacking forum (bleepingcomputer.com)

Malvertising

• Hackers Exploit Ad Tools to Track Victims, Boosting Scam Efforts (bloomberglaw.com)

Training, Education and Awareness

• The importance of security training in the zero trust era (betanews.com)

Regulations, Fines and Legislation

• Security experts: Investigatory powers plans will delay security updates | Computer Weekly

• FCC orders telecom carriers to report PII data breaches within 30 days (bleepingcomputer.com)

• When it comes to the new SEC ‘materiality’ rules, assume that OT and IoT breaches qualify | SC Media (scmagazine.com)

• A Quick Roadmap to NIS2 Directives - Security Boulevard

Models, Frameworks and Standards

• Benefits And Cautions Of Aligning With Cyber Security Frameworks (forbes.com)

• Key strategies for ISO 27001 compliance adoption - Help Net Security

• A Quick Roadmap to NIS2 Directives - Security Boulevard

Data Protection

• PII Input Sparks Cyber Security Alarm in 55% of DLP Events - Infosecurity Magazine (infosecurity-magazine.com)

• How companies are misjudging their data privacy preparedness - Help Net Security

Careers, Working in Cyber and Information Security

• UK cyber skills gap risk to businesses and national security | TechRadar

• Higher education offers limited benefit to many infosec pros | SC Media (scmagazine.com)

• We can’t risk losing staff to alert fatigue - Help Net Security

Law Enforcement Action and Take Downs

• London Underground Is Testing Real-Time AI Surveillance Tools to Spot Crime | WIRED

Misinformation, Disinformation and Propaganda

• Why we fall for fake news and how can we change that? - Help Net Security

• France uncovers a vast Russian disinformation campaign in Europe (economist.com)

• Deepfake Democracy: AI Technology Complicates Election Security (darkreading.com)

• Kremlin dismisses Europe's warnings about 'Russian propaganda' | Reuters

• Cyber threats cast shadow over 2024 elections - Help Net Security

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• How 'Big 4' Nations' Cyber Capabilities Threaten the West (darkreading.com)

• Microsoft and OpenAI warn state-backed threat actors are using generative AI en masse to wage cyber attacks | ITPro

• Stealthy Cyberespionage Campaign Remained Undiscovered for Two Years - SecurityWeek

• Cyber Arms Control and Global Security (greydynamics.com)

• Rise in cyberwarfare tactics fueled by geopolitical tensions - Help Net Security

• Threat actors intensify focus on NATO member states - Help Net Security

Nation State Actors

China

• Russia And China Use OpenAI Tools To Hack, Microsoft Warns (forbes.com)

• Ukraine claims Russia uses its cooperation with China to carry out cyber attacks | International | EL PAÍS English (elpais.com)

• Microsoft and OpenAI warn state-backed threat actors are using generative AI en masse to wage cyber attacks | ITPro

• US Official Warns of China’s Growing Offensive Cyber Power – The Diplomat

• China Targets US Hacking Ops in Media Offensive - Infosecurity Magazine (infosecurity-magazine.com)

• Explainer: what is Volt Typhoon and why is it the ‘defining threat of our generation’? | Hacking | The Guardian

• Hackers are lying low in networks to wage critical infrastructure attacks - here’s how they do it | ITPro

• Threat actors intensify focus on NATO member states - Help Net Security

• Stealthy Cyberespionage Campaign Remained Undiscovered for Two Years - SecurityWeek

• Top US Venture Firms Funded Blacklisted Chinese Companies, House Committee Says | Mint

Russia

• Microsoft and OpenAI thwart AI use by state-affiliated hackers (geekwire.com)

• Russia And China Use OpenAI Tools To Hack, Microsoft Warns (forbes.com)

• Russia Continues to Focus on Cyber Operations and Espionage (inforisktoday.com)

• Russian banks beat App Store Review using fake apps (appleinsider.com)

• Ukraine claims Russia uses its cooperation with China to carry out cyber attacks | International | EL PAÍS English (elpais.com)

• France uncovers a vast Russian disinformation campaign in Europe (economist.com)

• Kremlin dismisses Europe's warnings about 'Russian propaganda' | Reuters

• The methods of Russian interference in Scottish politics (ukdefencejournal.org.uk)

• Russian Turla Hackers Target Polish NGOs with New TinyTurla-NG Backdoor (thehackernews.com)

• Tech Companies Turned Ukraine Into an AI War Lab | TIME

Iran

• How 'Big 4' Nations' Cyber Capabilities Threaten the West (darkreading.com)

• Iranian cyber attacks targeting US and Israeli entities | TechTarget

North Korea

• How 'Big 4' Nations' Cyber Capabilities Threaten the West (darkreading.com)

• Kimsuky's New Golang Stealer 'Troll' and 'GoBear' Backdoor Target South Korea (thehackernews.com)

• North Korea turns to designing gambling websites for cash • The Register

• North Korea successfully hacks email of South Korean President's aide, gains access to sensitive information (bitdefender.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Striking the Right Balance: How to Publicly Attribute a Cyber Operation to Another State | directions blog

• How Nation-State Actors Target Your Business: New Research Exposes Major SaaS Vulnerabilities (thehackernews.com)

---

Vulnerability Management

• Security experts: Investigatory powers plans will delay security updates | Computer Weekly

• Seeing is Believing… and Securing - SecurityWeek

• Three critical application security flaws scanners can’t detect (bleepingcomputer.com)

Vulnerabilities

• Over 13,000 Ivanti gateways vulnerable to actively exploited bugs (bleepingcomputer.com)

• Zoom stomps critical privilege escalation bug, 6 other flaws • The Register

• Alert: New Stealthy "RustDoor" Backdoor Targeting Apple macOS Devices (thehackernews.com)

• Some Canon printers have seven critical security vulnerabilities — i-Sensys printer vulns rank at 9.8 severity | Tom's Hardware (tomshardware.com)

• Hackers used new Windows Defender zero-day to drop DarkMe malware (bleepingcomputer.com)

• ESET Patches High-Severity Privilege Escalation Vulnerability - SecurityWeek

• CISA: Roundcube email server bug now exploited in attacks (bleepingcomputer.com)

• Urgent patches available for QNAP vulnerabilities, one 0-day • The Register

Tools and Controls

• The ROI of Investing in Cyber Security - Security Boulevard

• Leveraging threat intelligence for regulatory compliance (betanews.com)

• Serious Vulnerability in the Internet Infrastructure / Fundamental design flaw in DNSSEC discovered (prleap.com)

• Remote Monitoring & Management software used in phishing attacks | Malwarebytes

• Getting a grip on cyber resilience – PublicTechnology

• It's Time to Rethink Third-Party Risk Assessment (darkreading.com)

• Do you have a cyber security comms plan? | PR Week

• MFA isn't always keeping businesses safe from cyber attack | TechRadar

• Understand the pros and cons of enterprise password managers | TechTarget

• Beating Bitlocker In 43 Seconds | Hackaday

• 4 Ways Hackers use Social Engineering to Bypass MFA (thehackernews.com)

• This botched migration shows why you need to deal with legacy tech | ZDNET

• How purple teaming enhances inter-team collaboration and effectiveness in cyber security - Help Net Security

• Benefits and challenges of managed cloud security services | TechTarget

• PII Input Sparks Cyber Security Alarm in 55% of DLP Events - Infosecurity Magazine (infosecurity-magazine.com)

• 5 Steps to Improve Your Security Posture in Microsoft Teams (bleepingcomputer.com)

• No Security Scrutiny for Half of Major Code Changes: AppSec Survey - SecurityWeek

• 10 Security Metrics Categories CISOs Should Present to the Board (darkreading.com)

• Three critical application security flaws scanners can’t detect (bleepingcomputer.com)

• What is Threat Detection and Incident Response? - Security Boulevard

---

Reports Published in the Last Week

• VIPRE Security Group’s Annual Email Threat Landscape Research Shines Light on the Advanced Methods Needed to Secure Corporate Email Environment in 2024 - VIPRE

• 2023 Year in Review: Phishing Attacks and Trends (vadesecure.com)

• HP Wolf Security Threat Insights Report Q4 2023 | HP Wolf Security

• The State of Ransomware in 2023 | BlackFog

---

Other News

• Trustees open to cyber risks by not responding to NCSC reporting changes | theHRD (thehrdirector.com)

• Top 5 Cyber security Concerns for HR Professionals: How to Safeguard Your Organisation | The HR World

• This botched migration shows why you need to deal with legacy tech | ZDNET

• Cyber attacks on Hospitals Are Likely to Increase, Putting Lives at Risk, Experts Warn - SecurityWeek

• What is Threat Detection and Incident Response? - Security Boulevard

• Hackers are lying low in networks to wage critical infrastructure attacks - here’s how they do it | ITPro

• How Non-Profits and NGOs Deal with Cyber Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Here's how we get young people to rally for cyber security | World Economic Forum (weforum.org)

• Types of Cyber security Threats and Vulnerabilities - Security Boulevard

• Hacking the flow: The consequences of compromised water systems - Help Net Security

• Dutch insurers still requiring nudes from cancer patients • The Register

• Cyber threats to marketing | Kaspersky official blog

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling·        

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 14 February 2024 – Microsoft Patch Tuesday (inc 2 exploited zero-days), Adobe, and SAP Security Updates

Executive summary

It is Valentine’s, and what better way to spend it than reading about Microsoft’s latest patch Tuesday. In this months patch Tuesday, Microsoft has provided updates to address 73 security issues across its product range, including two exploited zero-day vulnerabilities (CVE-2024-21351and CVE-2024-21412). Microsoft is classifying these as a flaw that is publicly disclosed or actively exploited with no official fix available. The two exploited vulnerabilities affect Windows Smart Screen and Internet Shortcut File, allowing security bypasses. They have both been added to the known ‘exploited vulnerabilities catalog’ by the Cybersecurity and Infrastructure Agency (CISA).

In addition to the updates from Microsoft, this week also saw Adobe fixing 38 vulnerabilities and SAP issued 13 new patches for its range of products, in which three of the patches were rated as critical.

What’s the risk to me or my business?

The vulnerabilities, if actively exploited could allow an attacker to bypass security features and inject malicious code, impacting the confidentiality, integrity and availability of data.

Microsoft

There is no official fix for the exploited vulnerabilities, however they both require a user to interact with a malicious file. As such, it is important to make sure users remain vigilant when interacting with their emails. Organisations should follow the vulnerabilities closely, so that they can apply any patches immediately. Other available updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating. Other patches should be applied in a reasonable time frame.

Technical Summary

CVE-2024-21351: This vulnerability if actively exploited, allows an attacker to bypass Windows SmartScreen. It relies on an authorised attacker sending a malicious file and convincing a user to open it.

CVE-2024-21412: This vulnerability if actively exploited, allows an attacker bypass Windows security features and send malicious files to users. The attacker would still need to user to interact with the file.

Adobe

This month, Adobe has released fixes vulnerabilities impacting Adobe Acrobat and Reader (13, of which 5 are critical), Commerce (9, of which 6 are critical), Substance 3D Painter (13, of which 5 are critical), FrameMaker Publishing Server (1 critical), Audition (1 critical) and Substance 3D Designer (1 critical). Currently, Adobe is not aware of any active exploitation of these vulnerabilities. The vulnerabilities include issues such as arbitrary code execution and memory leaks.

SAP

This month, SAP has released 13 patches, which include 10 new releases and 3 updates from previous releases. These patches address 8 critical vulnerabilities affecting a variety of SAP products. The vulnerabilities encompass a range of issues, including Privilege Escalation, Code Injection, Denial of Service, Information Disclosure, and Improper Authorisation.

---

Microsoft

Further details on other specific updates within this patch Tuesday can be found here:

https://www.bleepingcomputer.com/news/microsoft/microsoft-february-2024-patch-tuesday-fixes-2-zero-days-73-flaws/

https://www.ghacks.net/2024/02/13/the-windows-security-updates-for-february-2024-are-here/

Adobe

Further details of the vulnerabilities addressed in Adobe Acrobat and Reader be found here:

https://helpx.adobe.com/security/products/acrobat/apsb24-07.html

Further details of the vulnerabilities addressed in Adobe Substance 3D Painter be found here:

https://helpx.adobe.com/security/products/substance3d_painter/apsb24-04.html

Further details of the vulnerabilities addressed in Adobe FrameMaker be found here:

https://helpx.adobe.com/security/products/acrobat/apsb24-07.html

Further details of the vulnerabilities addressed in Adobe Audition be found here:

https://helpx.adobe.com/security/products/audition/apsb24-11.html

Further details of the vulnerabilities addressed in Adobe Substance 3D Designer be found here:

https://helpx.adobe.com/security/products/substance3d_designer/apsb24-13.html

SAP

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2024.html

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity.

Black Arrow Cyber Advisory 12 February 2024 – Fortinet FortiOS Vulnerability in SSL VPN

Executive Summary

Fortinet have released a patch to fix a critical vulnerability in their FortiOS product, stating that is potentially being exploited in the wild. Successful exploitation of the vulnerability could allow a remote unauthorised attacker to execute code or commands.

What’s the risk to me or my business?

There is a risk that organisations using vulnerable versions of FortiOS are leaving themselves at risk of allowing an unauthenticated remote attacker to perform arbitrary code execution. This means an attacker could potentially gain unauthorised access and perform actions that could impact the confidentiality, integrity, and availability of the organisations data. This vulnerability only impacts organisations who have SSL VPN enabled.

The affected versions of FortiOS and FortiProxy are:

FortiOS

FortiOS 7.4 (7.4.0 through 7.4.2) – upgrade to 7.4.3 or above.

FortiOS 7.2 (7.2.0 through 7.2.6) – upgrade to 7.2.7 or above.

FortiOS 7.0 (7.0.0 through 7.0.13) – upgrade to 7.0.14 or above.

FortiOS 6.4 (6.4.0 through 6.4.14) – upgrade to 6.4.15 or above.

FortiOS 6.2 (6.2.0 through 6.2.15) – upgrade to 6.4.15 or above.

FortiOS 6.0 (all versions) - migrate to fixed release.

FortiProxy

FortiProxy 7.4 (7.4.0 through 7.4.2) - upgrade to 7.4.3 or above.

FortiProxy 7.2 (7.2.0 through 7.2.8) - upgrade to 7.2.9 or above.

FortiProxy 7.0 (7.0.0 through 7.0.14) - upgrade to 7.0.15 or above.

FortiProxy 2.0 (2.0.0 through 2.0.13) - upgrade to 2.0.14 or above.

FortiProxy 1.2 (all versions) - migrate to fixed release.

FortiProxy 1.1 (all versions) - migrate to fixed release.

FortiProxy 1.0 (all versions) - migrate to fixed release.

What can I do?

Black Arrow recommends applying the available patches for the vulnerability immediately due its severity. Further information can be found in the Fortigaurd security update below. Organisations have also been advised to disable SSL VPN if they cannot apply patches immediately, however this is not a long term solution.

Technical Summary

CVE-2024-2176 – This is a out-of-bound write vulnerability in the sslvpnd which may allow a remote unauthenticated attacker to execute arbitrary code or commands using  specifically crafted HTTP requests. 

Further information on the FortiOS vulnerability can be found here:

https://www.fortiguard.com/psirt/FG-IR-24-015

Further information on upgrading can be found here:

https://docs.fortinet.com/upgrade-tool

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 09 February 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Over Half of Companies Experienced Cyber Security Incidents Last Year

According to a recent global survey, over half of the participating companies faced major security incidents in the past year, necessitating additional resources to tackle these challenges. Despite these incidents, many organisations claim improved performance on key cyber security indicators and express confidence in their threat detection capabilities. The research highlights a concerning discrepancy between perceived security measures and the actual state of security operations, underscoring a lack of comprehensive visibility and effective response mechanisms within companies. Particularly concerning is the finding that organisations can typically monitor only two-thirds of their IT environments, exposing significant vulnerabilities. Furthermore, the study points to a greater need for greater automation and third-party assistance in threat detection and response, suggesting that while companies are aware of their shortcomings, the path to enhanced security involves embracing AI-driven solutions to close these gaps. This insight highlights to leadership the importance of investing in advanced cyber security technologies and expertise to safeguard the organisation’s digital assets effectively.

Sources: [Beta News] [Verdict]

Deepfake Video Conference Costs Business $25 Million

There has been a surge in the number of artificial intelligence deepfake attacks where technology is being used to impersonate individuals. In one case, a finance professional at a multinational was reportedly swindled out of $25 million (HK$200 million) of company money when scammers created a deepfake of his London-based chief financial officer in a video conference call, faking both the CFO’s look and voice. The scam involved the fake CFO making increasingly urgent demands to execute money transfers, resulting in 15 transfers from the victim employee. The reality of the attack was only discovered by the victim after he had contacted the company’s corporate head office.

Sources: [The Register] [Help Net Security] [TechCentral ] [Tripwire]

Watershed Year for Ransomware as Victims Rose by Almost 50% And Payments Hit $1 Billion All-Time High

Even with enforcers shutting down some ransomware gangs, the business of ransomware is booming. A recent report from Palo Alto Networks Unit 42 found a 49% increase in the number of victims reported on ransomware leak sites; this does not include those who were victims but did not appear on sites. This comes as ransomware hit an all time high, with over $1b made in ransomware payments. Of note, this is just ransom payments; this does not take in to account reputational damage, recovery costs and loss in share value. The real effects of a ransomware attack may take months or even years to materialise. As ransomware remains a constant threat, it is important for organisations to be prepared.

Sources: [The Verge ] [Malwarebytes] [Infosecurity Magazine] [CSO Online] [ITPro] [TechRadar]

Malware-as-a-Service Now the Top Threat to Organisations

Recent studies have underscored a significant shift in the cyber threat landscape, with Malware-as-a-Service (MaaS) and Ransomware-as-a-Service (RaaS) now dominating. These ‘as-a-service’ tools are particularly concerning as they lower the barrier to entry for cyber criminals, enabling even those with limited technical knowledge to launch sophisticated attacks. The report found that the most common as-a-Service tools were Malware loaders (77% of investigated threats), crypto-miners (52% of investigated threats) and botnets (39% of investigated threats). These findings underscore the adaptability of these threats, with malware strains being developed with multiple functions to maximise damage. Despite these trends, traditional methods like phishing continue to pose significant challenges for security teams. It’s clear that staying ahead of these evolving threats requires a proactive and comprehensive approach to cyber security.

Sources:[Infosecurity Magazine] [Beta News] [Help Net Security]

Over 9 in 10 UK Firms Who Fell Victim to Ransomware Paid the Ransom, Despite Alleged “No Pay” Stances

A recent report has found that over 97% of UK firms have paid a ransom in the last two years, finding even more reason to operate in a when-not-if environment. When asked about their recovery in an event, 38% said they could recover in four to six days, and 34% need one to two weeks to recover; almost one in four (24%) need over three weeks to recover data and restore business processes. Only 12% said their company had stress-tested their data security, data management, and data recovery processes or solutions in the six months prior to being surveyed, and 46% had not tested their processes or solutions in over 12 months.

Sources: [The FinTech Times] [ Help Net Security]

Chinese State Hackers Hid in National Infrastructure for at Least 5 Years

US cyber officials have said that they discovered China-sponsored hackers lurking in American computer networks, positioning themselves to disrupt communications, energy, transportation and water systems; and this had been going on for at least 5 years. This has led to a joint warning from the US FBI, National Security Agency and Cyber Infrastructure and Security Agency, which has been cosigned by Britain, Canada, Australia and New Zealand. This dwell time isn’t just something that is encountered in critical infrastructure networks; attackers lurk on networks, undiscovered often for years, allowing them to see everything going on in the corporate environment.

Sources: [NTD] [Washington Times]

Email Attacks on Businesses Tripled and AI is a Huge Contributing Factor

Email attacks against businesses have increased dramatically as hackers continually use generative AI tools to optimise their content and streamline malicious campaigns, new research has claimed.

The report from Acronis is based on data collected from more than a million unique endpoints across 15 countries, and found AI-powered phishing affected more than 90% of organisations last year. AI helped has email attacks grow by 222% since the second half of 2023.

Sources: [New Electronics] [TechRadar]

Security Leaders, C-Suite Unite to Tackle Cyber Threats

A recent survey found that CEOs are taking a more hands-on approach and prioritising cyber resilience in 2024, leading to the breakdown of traditional silos between IT operations and security teams. The survey polled over 200 C-Suite and senior-level IT executives globally, and revealed a growing recognition of the importance of collaboration in combating sophisticated cyber threats, with 99% of respondents observing increased connectivity between the teams over the past year. While progress has been made, challenges remain, with only 48% of organisations establishing joint protocols for incident mitigation or recovery. Looking ahead, respondents anticipate a significant role for artificial intelligence (AI) in enhancing security efforts, with 68% expecting AI to streamline threat detection and response. Despite advancements, fragmented data protection solutions persist as a challenge, impacting over 90% of organisations' cyber resiliency. This underscores the need for a top-down approach to cyber security, with CEOs and boards driving collaboration between IT operations and security teams to optimise cyber preparedness initiatives and mitigate cyber risks effectively.

Source: [Security Boulevard]

UN Experts Investigate Cyber Attacks by North Korea that Raked in $3 Billion to Build Nuclear Weapons

UN sanction monitors are investigating dozens of suspected cyber attacks by North Korea that have raked in $3 billion to help North Korea further its nuclear weapons programme, according to excerpts of an unpublished UN report. “The panel is investigating 58 suspected DPRK cyber attacks on cryptocurrency-related companies between 2017 and 2023, valued at approximately $3 billion, which reportedly help fund DPRK’s WMD development,” according to the monitors, who report twice a year to the 15-member security council.

Source: [The Guardian]

What Does a ‘Cyber Security Culture’ Actually Entail?

Fostering a robust cyber security culture emerges as a critical imperative for organisations in 2023, as revealed by ITPro Today's "State of Cybersecurity in 2023" study. Despite this recognition, organisations grapple with various challenges, including budget constraints, staffing shortages, and the failure to implement fundamental security practices like the principle of least privilege and zero trust. Insufficient staffing and constrained budgets elevate the risk of breaches, emphasising the need for a collective effort to bolster security measures.

Cultivating a cyber security culture entails educating every employee on security risks and holding them accountable for risk reduction efforts. While security teams play a pivotal role in setting expectations and providing guidance, a culture of cyber security necessitates continuous training, integration of security into everyday work, and clear delineation of risk ownership throughout the organisation. By prioritising proactive measures and fostering individual responsibility, organisations can fortify their defences against evolving cyber threats and mitigate risks effectively.

Source: [ITPro Today]

Beyond Checkboxes: Security Compliance as a Business Enabler

In today's complex business landscape, regulatory requirements are increasingly intricate, especially concerning cyber security compliance. While compliance might evoke images of stringent regulations and time-consuming audits, reframing our perspective reveals its potential as a vital business enabler. Security leaders, in collaboration with senior management, must cultivate a culture where commitment to cyber security compliance permeates the organisation, emphasising its role in fostering trust, facilitating global market access, and even serving as a competitive advantage. Moreover, robust compliance programs drive operational efficiency, innovation, and cost savings in the long run. Embracing cyber security compliance as a strategic enabler, rather than a regulatory burden, positions businesses for success, innovation, and resilience in an ever-evolving digital landscape.

Source: [Forbes]

No One in Cyber Security Is Ready for the SolarWinds Prosecution

The concept of "materiality" has taken centre stage for Chief Information Security Officers (CISOs) in light of new SEC regulations, requiring US public companies to disclose "material cyber security incidents" within four days. The SolarWinds breach and subsequent SEC charges against the company and its CISO highlight the seriousness of these regulations. This shift necessitates a deeper understanding of what constitutes "material" risk in cyber security and a more transparent approach to risk communication. However, many CISOs face challenges in quantifying and communicating cyber risks effectively to boards and executives, who often lack familiarity with cyber security terminology. This regulatory change underscores the need for CISOs to bridge the gap between cyber security and financial reporting, ensuring accurate and precise risk communication at the C-Suite level. Additionally, policymakers should incentivise C-Suite accountability for cyber risk management, fostering a culture where cyber risks are addressed proactively and transparently.

Source:[Council on Foreign Relations]

---

Governance, Risk and Compliance

• Over half of companies experienced cyber security incidents last year (betanews.com)

• Beyond Checkboxes: Security Compliance As Business Enabler (forbes.com)

• What Goes Into a Strong Cyber Security Culture? | ITPro Today: IT News, How-Tos, Trends, Case Studies, Career Tips, More

• Why an HR-IT Partnership is Critical for Managing Cyber Security Risk - Security Boulevard

• The Cyber Threats Every C-Level Exec Should Care About In 2024 (forbes.com)

• Never Mind the Buzz; Here's the Consequences: No One in Cyber Security Is Ready for the SolarWinds Prosecution | Council on Foreign Relations (cfr.org)

• Security Leaders, C-Suite Unite to Tackle Cyberthreats - Security Boulevard

• Cyber Security, Hybrid Workforce Management Among Top 2024 Business Challenges (allwork.space)

• How CISOs navigate policies and access across enterprises - Help Net Security

• Resisting Hindsight Bias: A Proposed Framework for CISO Liability - Infosecurity Magazine (infosecurity-magazine.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• The ransomware business is booming, even as enforcers shut down some players - The Verge

• Ransomware victim numbers rose by 50% in 2023 | CSO Online

• Known ransomware attacks up 68% in 2023 | Malwarebytes

• Paying ransoms is becoming a cost of doing business for many - Help Net Security

• Ransomware Payments Hit $1bn All-Time High Last Year - Infosecurity Magazine (infosecurity-magazine.com)

• Chainalysis: 2023 a 'watershed' year for ransomware | TechTarget

• The hidden cost of ransomware is more painful than many realize | ITPro

• Cohesity Reveals over 9 in 10 UK Firms Have Paid Ransoms Despite Alleged "No Pay" Stances | The Fintech Times

• Is critical infrastructure prepared for OT ransomware? • The Register

• Akira and 8Base are the ransomware gangs to watch in 2024 • The Register

• Crypto-related ransomware attacks made 'major comeback' in 2023 (verdict.co.uk)

• ‘These are threat-to-life crimes’: How hospitals are responding to a rise in ransomware attacks – NBC4 Washington (nbcwashington.com)

• NCC Group records the most ransomware victims ever in 2023 | TechTarget

• LockBit Reigns Supreme in Soaring Ransomware Landscape - Infosecurity Magazine (infosecurity-magazine.com)

• How security experts unravel ransomware (engadget.com)

• Cyber Attacks by North Korea raked in $3bn to build nuclear weapons, UN monitors suspect | North Korea | The Guardian

• US govt ups bounty on Hive ransomware gang members to $15M • The Register

Ransomware Victims

• Industry giants Clorox and Johnson Controls report financial losses from cyber attacks (therecord.media)

• Clorox says cyber attack caused $49 million in expenses (bleepingcomputer.com)

• Blackbaud blasted for failing to prevent customer breaches | Computer Weekly

• Lurie Children's Hospital cyber attack forces systems offline • The Register

• Blackbaud settles FTC data security probe into 2020 ransomware attack | K-12 Dive (k12dive.com)

• Thanks to a shadowy hacker group, the British Library is still on its knees. Is there any way to stop them? | Lamorna Ash | The Guardian

• California union confirms ransomware attack following LockBit claims (therecord.media)

• Another Chicago hospital announces cyber attack (therecord.media)

• Scots care charity target of huge cyber attack - TFN

• Funerals reportedly canceled due to ransomware attack on Austrian town (therecord.media)

Phishing & Email Based Attacks

• Fake board meeting nets cyber criminals more than €28m - TechCentral.ie

• QR Code 'Quishing' Attacks on Execs Surge, Evading Email Security (darkreading.com)

• 222% surge in email attacks during 2023

• Email attacks on business tripled in 2023 — and ChatGPT was often the culprit | TechRadar

• South African Railways Lost Over $1M in Phishing Scam (darkreading.com)

• These were the most common phishing emails of 2023 — make sure you don't get caught out as well | TechRadar

Artificial Intelligence

• Fake board meeting nets cyber criminals more than €28m - TechCentral.ie

• Surge in deepfake "Face Swap" attacks puts remote identity verification at risk | Tripwire

• Email attacks on business tripled in 2023 — and ChatGPT was often the culprit | TechRadar

• Meta’s Oversight Board Urges a Policy Change After a Fake Biden Video - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft uncovers extensive Iranian AI-based cyber ops against Israel amid Gaza war | Ctech (calcalistech.com)

• Could a threat actor socially engineer ChatGPT? (securityintelligence.com)

• Current approaches can’t mitigate the AI cyber security threat. What can? (networkingplus.co.uk)

Malware

• Malware-as-a-Service Now the Top Threat to Organisations - Infosecurity Magazine (infosecurity-magazine.com)

• Malware-riddled Android apps spotted on Google Play Store — here's what to avoid | TechRadar

• Google Play Used to Spread 'Patchwork' APT's Espionage Apps (darkreading.com)

• macOS Malware Campaign Showcases Novel Delivery Technique (darkreading.com)

• China Caught Dropping RAT Designed for FortiGate Devices (darkreading.com)

• FritzFrog Returns with Log4Shell and PwnKit, Spreading Malware Inside Your Network (thehackernews.com)

• Netherlands accuses China of cyber spying after security service makes malware discovery | NL Times

• Beware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and Credentials (thehackernews.com)

• Fresh 'Mispadu Stealer' Variant Emerges (darkreading.com)

• Mini PC maker ships systems with factory-installed spyware — AceMagic says issue was contained to the 'first shipment' | Tom's Hardware (tomshardware.com)

• Raspberry Robin Evolves With Stealth Tactics, New Exploits - Infosecurity Magazine (infosecurity-magazine.com)

Mobile

• Malware-riddled Android apps spotted on Google Play Store — here's what to avoid | TechRadar

• Google Links Over 60 Zero-Days to Commercial Spyware Vendors - SecurityWeek

• 'Coyote' Malware Begins Its Hunt, Preying on 61 Banking Apps (darkreading.com)US insurance firms sound alarm after 66,000 individuals impacted by SIM swap attack (bitdefender.com)

• Google Play Used to Spread 'Patchwork' APT's Espionage Apps (darkreading.com)

• Government hackers targeted iPhones owners with zero-days, Google says | TechCrunchWizz Removed from Apple and Google Stores for Sextortion Concerns - Infosecurity Magazine (infosecurity-magazine.com)

• Top Mobile App Security Risks | MSSP Alert

• February 2024 Android security patch here for Pixels - Android Authority

• Google fixed an Android critical remote code execution flaw (securityaffairs.com)

• Warning from LastPass as fake app found on Apple App Store | Malwarebytes

• Android XLoader malware can now auto-execute after installation (bleepingcomputer.com)

• This Android malware can steal all your photos and texts without being opened — how to stay safe | Tom's Guide (tomsguide.com)

Denial of Service/DoS/DDOS

• That electric toothbrush DDoS story you saw might have been a case of mistranslation | ITPro

Internet of Things – IoT

• The toothbrush DDoS attack: How misinformation spreads in the cyber security world • Graham Cluley

• Global cities unprepared for emerging risks warns study

• Understanding the Connection Between IoT Vulnerabilities and Home Network Intrusions - Security Boulevard

• As Smart Cities Expand, So Do the Threats (darkreading.com)

Data Breaches/Leaks

• AnyDesk forces password reset for customers as 18k credentials go up for sale online | SC Media (scmagazine.com)

• Cloudflare hacked — company reveals details of November 2023 cyber attack, blames previous Okta breach | TechRadar

• HPE investigates new breach after data for sale on hacking forum (bleepingcomputer.com)

• Alleged data breach sees names, addresses and phone numbers of serving police staff shared on email - North Wales Live (dailypost.co.uk)

• Blackbaud Comments on FTC Settlement, Continues to Strengthen Cyber Security - MarketWatch

• FTC orders Blackbaud to overhaul ‘reckless’ security practices in wake of 2020 breach | TechCrunch

• Looted RIPE Credentials for Sale on the Dark Web (darkreading.com)

• Millions of User Records Stolen From 65 Websites via SQL Injection Attacks - SecurityWeek

• 'ResumeLooters' Attackers Steal Millions of Career Records (darkreading.com)

• Data breach at French healthcare services firm puts millions at risk (bleepingcomputer.com)

• Verizon Says Data Breach Impacted 63,000 Employees - SecurityWeek

• Data breaches at Viamedis and Almerys impact 33 million in France (bleepingcomputer.com)

• Report: More Than Half of Americans Have Had Their Data Exposed (govtech.com)

• Data of half the population of France stolen in its largest ever cyber attack. This is what we know | Euronews

• HopSkipDrive says personal data of 155,000 drivers stolen in data breach | TechCrunch

Organised Crime & Criminal Actors

• Over half of companies experienced cyber security incidents last year (betanews.com)

• Malware-as-a-Service Now the Top Threat to Organisations - Infosecurity Magazine (infosecurity-magazine.com)

• As-a-Service tools empower criminals with limited tech skills - Help Net Security

• Teens Committing Scary Cyber Crimes, What's Behind the Trend? (darkreading.com)

• Nigerian President Dismisses Nation's 'Cyber Crime Haven' Image (darkreading.com)

• Lessons Learned From Tracing Cyber Crime’s Evolution On The Dark Web (forbes.com)

• US must ratchet up its response in pursuing hackers, MITRE CTO argues - Nextgov/FCW

• Report: Blocked IP addresses increased by 116.42% | Security Magazine

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Pig-butchering scams morph into DeFi threats (cointelegraph.com)

• Crypto-related ransomware attacks made 'major comeback' in 2023 (verdict.co.uk)

Insider Risk and Insider Threats

• Former CIA worker spilled to WikiLeaks, jailed for 40 years • The Register

• How bias can undermine insider threat monitoring | TechRadar

• What is a Behavioral Risk Indicator? Demystifying Insider Risk Indicators - Security Boulevard

• Engineer accused of stealing secret US government tech used to detect nuclear missile launches (nbcnews.com)

Supply Chain and Third Parties

• Cloudflare hacked — company reveals details of November 2023 cyber attack, blames previous Okta breach | TechRadar

• Blackbaud blasted for failing to prevent customer breaches | Computer Weekly

• Removing the weakest link: Strengthen the security of your supply chain (techuk.org)

Cloud/SaaS

• Stop chasing shadow IT: Tackle the root causes of cloud breaches | SC Media (scmagazine.com)

• Midnight Blizzard and Cloudflare-Atlassian Cyber Security Incidents - Security Boulevard

• Organisations Left Grappling for Solutions Amid Alarming Cloud Security Gaps | Network Computing

Identity and Access Management

• Surge in deepfake "Face Swap" attacks puts remote identity verification at risk | Tripwire

Encryption

• Raspberry Pi Pico cracks BitLocker in under a minute • The Register

Linux and Open Source

• Critical vulnerability affecting most Linux distros allows for bootkits | Ars Technica

Passwords, Credential Stuffing & Brute Force Attacks

• Credential Harvesting Vs. Credential Stuffing Attacks: What’s the Difference? - Security Boulevard

• Looted RIPE Credentials for Sale on the Dark Web (darkreading.com)

• AnyDesk downplays impact of cyber attack | SC Media (scmagazine.com)

• Midnight Blizzard and Cloudflare-Atlassian Cyber Security Incidents - Security Boulevard

Social Media

• Beware: Fake Facebook Job Ads Spreading 'Ov3r_Stealer' to Steal Crypto and Credentials (thehackernews.com)

• Meta’s Oversight Board Urges a Policy Change After a Fake Biden Video - Infosecurity Magazine (infosecurity-magazine.com)

• Facebook fatal accident scam still rages on | Malwarebytes

Regulations, Fines and Legislation

• Never Mind the Buzz; Here's the Consequences: No One in Cyber Security Is Ready for the SolarWinds Prosecution | Council on Foreign Relations (cfr.org)

• How the SEC's Rules on Cyber Security Incident Disclosure Are Exploited (darkreading.com)

• Proposed contractor cyber reporting rule sets a ‘significantly problematic’ bar, industry groups say (databreaches.net)

• No one's happy with latest US cyber incident reporting plan • The Register

• 2023 Cyber Security Regulation Recap (Part 3): Privacy Protection - Security Boulevard

Models, Frameworks and Standards

• Exploring NIST Cyber Security Framework 2.0 - Help Net Security

Careers, Working in Cyber and Information Security

• Combatting Stress In The Cyber Security Industry (forbes.com)

• IT Security Hiring Must Adapt to Skills Shortages (informationweek.com)

Law Enforcement Action and Take Downs

• Former CIA worker spilled to WikiLeaks, jailed for 40 years • The Register

• Romance fraudster jailed after conning women out of £300k - BBC News

• Cops arrest 17-year-old suspected of hundreds of swattings nationwide | Ars Technica

• How security experts unravel ransomware (engadget.com)

• US must ratchet up its response in pursuing hackers, MITRE CTO argues - Nextgov/FCW

• Report: Blocked IP addresses increased by 116.42% | Security Magazine

Misinformation, Disinformation and Propaganda

• The toothbrush DDoS attack: How misinformation spreads in the cyber security world • Graham Cluley

• Report Details Scope of Global Threat to Elections - Security Boulevard

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Google Play Used to Spread 'Patchwork' APT's Espionage Apps (darkreading.com)

• Cyber security remains the top risk for European banks, as heightened geopolitics increases the perceived threat of cyber warfare | EY - Global

• How to Win a Cyberwar: Use a Combined Intelligence Strategy (inforisktoday.com)

• NCSC and partners issue warning about state-sponsored attackers hiding out in critical infrastructure networks... - NCSC.GOV.UK

Nation State Actors

China

• Chinese Hackers Preparing ‘Destructive Attacks,’ CISA Warns (govinfosecurity.com)

• Chinese Hackers Hid in US Infrastructure for 5 Years | Newsmax.com

• China's Cyber Attackers Target US and Allied Militaries (newsweek.com)

• FBI Issues Ominous Warning of Imminent Cyber Attack on Critical Infrastructure - Security Boulevard

• Dutch intelligence finds Chinese hackers spying on secret Defence Ministry network (therecord.media)

• Shutting Down the Grid: Possible Cyber Attacks From Chinese Hackers | NTD

• China Caught Dropping RAT Designed for FortiGate Devices (darkreading.com)

• Top US venture capitalists invest in China tech for big returns (nypost.com)

• Classified Japanese diplomatic info leaked after Chinese cyber attacks - The Japan Times

• Philippines Says Hacker in China Behind Foiled Attack on Government Website - Bloomberg

• Chinese hackers fail to rebuild botnet after FBI takedown (bleepingcomputer.com)

Russia

• EU capitals fear Russian retaliation and cyber attacks after asset freezes – POLITICO

• The Kremlin threatens the West with years of trials and cyber attacks for trying to use its assets for Ukraine. - UBN

• Russia’s Countervalue Cyber Approach: Utility or Futility? - Carnegie Endowment for International Peace

Iran

• Designating Iranian Cyber Officials - United States Department of State

• Microsoft: Iran is refining its cyber operations | CyberScoop

• Microsoft uncovers extensive Iranian AI-based cyber ops against Israel amid Gaza war | Ctech (calcalistech.com)

• US sanctions Iranian officials over cyber attacks on water plants - BBC News

North Korea

• Cyber attacks by North Korea raked in $3bn to build nuclear weapons, UN monitors suspect | North Korea | The Guardian

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Cyber security remains the top risk for European banks, as heightened geopolitics increases the perceived threat of cyber warfare | EY - Global

• Government hackers targeted iPhones owners with zero-days, Google says | TechCrunch

• Google: Half of all zero-days used against our products are developed by spyware vendors (therecord.media)

• Spyware business booming despite government crackdowns • The Register

---

Vulnerability Management

• How To Address OT And ICS Cyber Attack Vulnerabilities (forbes.com)

Vulnerabilities

• Fortinet FortiSIEM hit by two 10/10 severity vulns • The Register

• Fortinet warns of new FortiSIEM RCE bugs in confusing disclosure (bleepingcomputer.com)

• Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services (thehackernews.com)

• Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products (thehackernews.com)

• Ivanti: Patch new Connect Secure auth bypass bug immediately (bleepingcomputer.com)

• Newest Ivanti SSRF zero-day now under mass exploitation (bleepingcomputer.com)

• Critical vulnerability in Mastodon sparks patching frenzy • The Register

• Mastodon Vulnerability Allows Hackers to Hijack Any Decentralized Account (thehackernews.com)

• February 2024 Android security patch here for Pixels - Android Authority

• Google: Half of all zero-days used against our products are developed by spyware vendors (therecord.media)

• Government hackers targeted iPhones owners with zero-days, Google says | TechCrunch

• JetBrains warns of new TeamCity auth bypass vulnerability (bleepingcomputer.com)

• Critical vulnerability affecting most Linux distros allows for bootkits | Ars Technica

• Google fixed an Android critical remote code execution flaw (securityaffairs.com)

• Cisco fixes critical Expressway Series CSRF vulnerabilities (securityaffairs.com)

• QNAP Patches High-Severity Bugs in QTS, Qsync Central - SecurityWeek

---

Tools and Controls

• What is a Behavioral Risk Indicator? Demystifying Insider Risk Indicators - Security Boulevard

• How to Win a Cyberwar: Use a Combined Intelligence Strategy (inforisktoday.com)

• Surge in deepfake "Face Swap" attacks puts remote identity verification at risk | Tripwire

• Close security gaps with attack path analysis and management | TechTarget

• Using Proactive Intelligence Against Adversary Infrastructure - Security Boulevard

• A Hacker’s Perspective For Building Proactive Organisational Defences (forbes.com)

---

Reports Published in the Last Week

• Acronis Cyber Threats Report H2 2023 | Acronis Resource Center

---

Other News

• Report: Mac security threats on the rise, here’s what to watch out for - 9to5Mac

• Trustees urged to review cyber incident frameworks following NCSC changes - Pensions Age Magazine

• Airbus App Vulnerability Introduced Aircraft Safety Risk: Security Firm - SecurityWeek

• ‘Elevated’ risk of hackers targeting UK drinking water, says credit agency | Cyber Crime | The Guardian

• What Will the Future of Cyber Security Bring? - Security Boulevard

• Cyber security remains the top risk for European banks, as heightened geopolitics increases the perceived threat of cyber warfare | EY - Global

• Cyber attacks on knowledge institutions are increasing: what can be done? (nature.com)

• McPartland Review - Driving Economic Growth through Cyber Security (techuk.org)

• A view from Brussels: ENISA celebrates 20th anniversary amid 'grim times' (iapp.org)

• Revealed – top 10 cyber incidents of 2023 | Insurance Business America (insurancebusinessmag.com)

• NCSC warns CNI operators over ‘living-off-the-land’ attacks | Computer Weekly

• Serious threats, unserious responses (reason.com)

• Super Bowl LVIII Presents a Vast Attack Surface for Threat Actors (darkreading.com)

• We Need Cyber Security in Space to Protect Satellites | Scientific American

• Inquiry to explore cyber risk to Sunak-Starmer showdown | Computer Weekly

• Three predictions for responding to the cyber threat landscape in 2024 | Computer Weekly

• How Hospitals Can Help Improve Medical Device Data Security (darkreading.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 09 February 2024 – Cisco, Fortinet, Ivanti and VMware Security Updates

Executive Summary

Cisco, Fortinet, Ivanti and VMware have addressed multiple vulnerabilities across their product range. All of the vendors have a security patch available to address the vulnerabilities and due to the active exploitation of some of the vulnerabilities, it is recommended to apply them immediately.

---

Cisco

Cisco have released security updates for three flaws affecting the Cisco Expressway Series that could allow an unauthenticated remote attacker to conduct cross-site request forgery attacks. Two of the flaws are rated critical (CVE-2024-20252 and CVE-2024-20254) and can be exploited in the impacted devices default configuration, however the third flaw (CVE-2024-20255) can only be exploited if the cluster database API feature has been enabled, which is disabled by default.

Cisco have released patches for the affected products and are available in Cisco Expressway Series Release versions 14.3.4 and 15.0.0.

---

Fortinet
Fortinet have released a second round of updates addressing two previously disclosed critical flaws in the FortiSIEM supervisor. The two flaws (CVE-2024-23108 and CVE-02024-23109) allows a remote unauthenticated attacker to perform arbitrary code execution.

Impacted products are:
FortiSIEM version 7.1.0 through 7.1.1 fixed in 7.1.2
FortiSIEM version 7.0.0 through 7.0.2 fixed in 7.0.3
FortiSIEM version 6.7.0 through 6.7.8 fixed in 6.7.9
FortiSIEM version 6.6.0 through 6.6.3 fixed in 6.6.5
FortiSIEM version 6.5.0 through 6.5.2 fixed in 6.5.3
FortiSIEM version 6.4.0 through 6.4.2 fixed in 6.4.4

---

Ivanti
Another critical security patch has been released by Ivanti for their Connect Secure product, Policy Secure and ZTA gateways. The flaw (CVE-2024-22024) allows remote attackers to gain access to restricted resources without requiring user interaction or authentication. While Ivanti have stated that this vulnerability is not currently being actively exploited they urge affected users to patch immediately.

To mitigate the risks, it is recommended that all users of the impacted devices running version 6.x upgrade to version 6.12.0.

---

VMware
VMware have warned of five vulnerabilities in the Aria Operations for Networks. The vulnerabilities encompass a range of issues, including local privilege escalation, cross-site scripting and local file read (requires admin privileges).

To mitigate the risks, it is recommended that all users of the impacted devices running version 6.x upgrade to version 6.12.0

---

Further Information

Cisco
Further details on the Cisco vulnerabilities can be found here:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-expressway-csrf-KnnZDMj3

Fortinet

Further details on the Fortinet vulnerabilities can be found here:

https://www.fortiguard.com/psirt/FG-IR-23-130

Ivanti

Further details on the Ivanti vulnerabilities can be found here:

https://forums.ivanti.com/s/article/CVE-2024-22024-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure?language=en_US

VMware

Further details on the VMware vulnerabilities can be found here:

https://kb.vmware.com/s/article/96450

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 02 February 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

The Financial Sector is Plagued by Increasingly Sophisticated Cyber Attacks That Demand a Defensive Paradigm Shift

A series of interviews with senior cyber executives and decision makers around the world gave insights into the attacks seen in the financial sector. The findings include 77% of financial organisations detecting campaigns to steal non-public market information, 48% falling victim to attacks solely focused on destroying data and 45% of organisations believing they were a victim of an attack which they were unable to detect. The financial sector remains a valuable target for cyber criminals and as such, organisations within this sector must proactively protect themselves.

Source: [PR News Wire]

The $10 Billion Cyber Insurance Industry Sees a Dangerous Year in Cyber Crime Ahead. AI, Ransomware, and War are its Biggest Concerns

A recent report by insurance broker Woodruff Sawyer sheds light on pressing concerns from the perspective of the insurance industry. Amidst ongoing global conflicts and the rise of AI-driven cyber threats, the boundaries between war and cyber attacks are blurring. Insurers are increasingly wary, with many opting not to provide coverage, particularly against war-related risks. The survey reveals a grim outlook, with 56% of clients anticipating a significant increase in cyber risks in 2024, primarily driven by ransomware and war associated threats. The challenge lies in defining and navigating these evolving risks, leaving clients uncertain about their cyber security strategies. Additionally, updated US Securities and Exchange Commission (SEC) rules mandating rapid disclosure of cyber breaches add further complexity to the cyber security landscape, warranting close monitoring by insurers. As cyber threats continue to evolve in a turbulent world, the insurance industry faces unprecedented challenges in safeguarding against cyber risks.

Source: [Fortune]

Microsoft Says Russian Hackers Used Known Identified Tactics to Breach Senior Exec Emails

Hackers allegedly linked to Russia’s Foreign Intelligence Service (SVR) breached a legacy non-production test tenant account in Microsoft last November, before pivoting into their senior executives’ email accounts. Microsoft only discovered the incident on 12 January. In a blog post, Microsoft said that the attackers had used a password spray attack on a limited number of accounts. One of these accounts was a legacy, non-production test account that had elevated access to the Microsoft corporate environment, and the ability to create malicious OAuth applications with access to other corporate mailboxes, leading to them accessing senior executives’ emails. Microsoft has since confirmed that multi-factor authentication was not enabled. Microsoft has previously warned the public about this exact scenario, writing that attackers “compromise user accounts to create, modify, and grant high privileges to OAuth applications that they can misuse to hide malicious activity.”

Sources: [The Record] [Bleeping Computer]

Old Methods, New Tricks: Cyber Criminals Are Still Using Social Engineering to Steal Your Credentials

2023 showed us that despite all the advancements in cyber security, most threat actors are simply just logging in. To do this an attacker needs credentials, often gained through phishing, the most common social engineering tactic. The emergence and utilisation of artificial intelligence has only made this easier, the point being that now virtually anyone can conduct a sophisticated phishing campaign, and with huge success. But what can organisations do? Focus on their human firewall. Social engineering will remain, and organisations need to ensure that their staff are consistently trained to be vigilant, as well as regular updated training on current trends. Users should ensure that they don’t reuse passwords across accounts, nor use easy to guess passwords or patterns. Users should be encouraged to use password managers to enable better, and more manageable, password hygiene. Where possible, multi factor authentication should be enforced.

Sources: [Security Boulevard] [Beta News] [Security Intelligence]

UK Government Unveils New Cyber Threat Guidelines as 32% of Firms Suffer Attacks in Past Year

The UK government is urging organisations to prioritise cyber threats as a key business risk, on par with financial and legal challenges. They have released new guidelines, the Cyber Governance Code of Practice, aimed at directors and senior leaders to elevate cyber security as a focal point in business operations. The code recommends clear roles and responsibilities, customer protection, and plans to respond to cyber attacks. It also emphasises the need for employees to possess adequate cyber awareness and skills. As cyber security incidents rise, a report found that 77% of financial services organisations have experienced a cyber attack. Other figures also show that 32% of firms have suffered a cyber breach or attack in the past year alone. These guidelines align with the UK Government’s National Cyber Strategy, aiming to protect and promote online security in the country. With the financial sector experiencing underperforming cyber security providers, organisations need to strengthen their anti-fraud defences, possibly incorporating cyber risk ratings for a more robust security posture.

Source: [The Fintech Times]

94% of Organisations Would Pay a Ransom, Despite Having ‘Do Not Pay’ Policies, as 79% Faced an Attack in 2023

A recent study has found that 94% of organisations would pay a ransomware demand, even if they had a ‘do not pay’ policy, in the event of an attack. The study found that 79% had suffered a ransomware related attack in the second half of 2023. When it came to resilience, only 21% had full confidence in their organisation’s cyber resilience and ability to address today’s escalating cyber challenges and threats, and 23% reported that they would need over three weeks to recover data and restore business processes. A common theme in the study was the belief that senior and executive management do not fully understand the serious risks, with only 35% of respondents believing risks were fully understood.

Sources: [Beta News] [ Security Magazine] [MSSP Alert]

Interpol Arrests More than 30 Cyber Criminals in Global Operation

This week, international law enforcement announced that it detained 31 suspected cyber criminals and identified 1,300 malicious servers which were used to conduct phishing attacks and distribute malware. The operation, labelled “Synergia” was in response to “the clear growth, escalation and professionalisation of transnational cyber crime and the need for coordinated action against new cyber threats” Interpol said. Nearly 60 law enforcement agencies and several private companies were involved in the operation.

Sources: [The Record]

Divide and Succeed: Splitting IT and Security Makes Business Sense

Maintaining year-round security hygiene is important to protect both consumers and organisations. Cyber attacks, like the recent one on 23andMe, often exploit vulnerabilities that persist due to incomplete patching and compromised credentials. Many organisations cite time constraints as the primary reason for not updating security features. Ideally, in any organisation, and indeed in all organisations that have reached a level of maturity in this space, security and IT teams should be separate; however, this is not really achievable in many organisations and hence the responsibility to protect ultimately falls on IT teams. Overburdened IT teams, and IT teams whose primary focus is on operational IT, further compound the issue, spending significant time managing data requests and analysing data, leading to cyber security risks. As consumers become more privacy-conscious, businesses must review and adapt their data privacy policies to build trust. Additionally, the growing use of artificial intelligence poses new risks, necessitating the development of company-wide AI policies to protect data privacy. While privacy legislation remains fragmented, staying proactive by updating data privacy policies, understanding data usage, and fortifying cyber security defences is crucial for organisations.

Source: [Digital Journal]

Ransomware Groups Gain Clout with False Attack Claims

A concerning trend is on the rise: fake breach claims by ransomware groups. Cyber criminals are leveraging the dark web and social media to spread misinformation about alleged breaches, triggering unwarranted cyber investigations and generating unwanted, and unwarranted, negative publicity for the alleged victim. Recent incidents involving Technica Corp and Europcar exemplify this growing threat. While these claims often lack credible evidence, they serve as a means for ransomware operators to gain attention and clout in the cyber criminal world. These groups resort to false claims to maintain relevance. Cyber security teams must adapt to this new ransomware misinformation communication strategy and exercise caution when evaluating breach claims.

Source: [Dark Reading]

Payment Fraud is Hitting Organisations Harder Than Ever Before

According to research, 96% of companies in the US were targeted with at least one fraud attempt in the past year. 36% who suffered said the average loss they experienced was more than $1 million and for 25%, this was more than $5 million. The study found misaligned perception as despite the number falling victim, only 5% believed they could not keep up with fraud. Of concern, 75% of C-level finance leaders said they would stop doing business with an organisation that fell victim to payment fraud.

Source: [Help Net Security]

Chinese Hacking Operations Have Entered a Far More Dangerous Phase, US Warns

In the US, the directors of the FBI, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA), have stated that China’s cyber activity is moving beyond the last decade’s spying and data theft toward direct attacks on critical infrastructure. It was identified that Chinese nation-state actors were planting malware on network routers and other internet-connected devices that, if triggered, could disrupt water, power, rail and other critical services, possibly causing widespread chaos, or even injury or deaths as a result.

Source: [Defense One]

---

Governance, Risk and Compliance

• $10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune

• Recognizing Security as a Strategic Component of Business (darkreading.com)

• Top Five Risks Facing Corporate Boards | The Volkov Law Group - JDSupra

• Despite awareness, small businesses still highly vulnerable to cyber attacks | Insurance Business America (insurancebusinessmag.com)

• Improving cyber security culture: A priority in the year of the CISO | CSO Online

• UK Government Unveils New Cyber Threat Guidelines as 32% of Firms Suffer Attacks in Past Year | The Fintech Times

• Top 3 Cyber Security Trends for SME Business Leaders | MSSP Alert

• Building good cyber security posture doesn't have to be expensive – NCA | Insurance Business America (insurancebusinessmag.com)

• What the Charges Against the SolarWinds CISO Mean for Security in 2024 - Security Boulevard

• Divide and succeed: Splitting IT and Security makes business sense - Digital Journal

• Prioritizing cyber crime intelligence for effective decision-making in cyber security - Help Net Security

• Strengthening Cyber Security: The rise of the Security Assurance Officer (securitybrief.co.nz)

• Proactive Cyber Security: A strategic approach to cost efficiency and crisis management - Help Net Security

• 5 Cyber Security Strategies You Must Embrace to Protect Your Business | Inc.com

---

Threats

Ransomware, Extortion and Destructive Attacks

• Ransomware Survey Shows 94% of Companies Would Pay | MSSP Alert

• $10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune

• Ransomware's Impact May Include Heart Attacks, Strokes & PTSD (techrepublic.com)

• 79% of organisations faced a ransomware attack in H2 2023 | Security Magazine

• Ransomware Groups Gain Clout With False Attack Claims (darkreading.com)

• LockBit remorseless in latest children's hospital attack • The Register

• Alpha Ransomware Group Launches Data Leak Site on the Dark Web - Infosecurity Magazine (infosecurity-magazine.com)

• The Ransomware Threat in 2024 is Growing: Report - Security Week

• Akira ransomware attacks linked to Cisco vuln fixed in 2020 • The Register

• “More Groups, More Problems”: Searchlight Cyber Report Reveals Ransomware Groups to Watch in 2024 | Business Wire

• OpenText Cyber Security Global Ransomware Survey: The Risk Perception Gap | MSSP Alert

• The State of Ransomware 2024 - Security Boulevard

• The evolution of ransomware: Lessons for the future (securityintelligence.com)

• New strain of the Phobos ransomware discovered in VBA script | SC Media (scmagazine.com)

• Canadian Man Sentenced to Prison for Ransomware Attacks - Security Week

• Ransomware Research Reveals Millions Spent Despite Do Not Pay Policies - IT Security Guru

• A Cyber Insurer's Perspective on How to Avoid Ransomware (darkreading.com)

• Online ransomware decryptor helps recover partially encrypted files (bleepingcomputer.com)

• Higher cyber defences lead to higher ransoms, study finds | Cybernews

• ICS Ransomware Danger Rages Despite Fewer Attacks (darkreading.com)

Ransomware Victims

• ICO confirms data breach probe as UK councils remain downed by cyber attack | TechCrunch

• Pentagon investigating theft of sensitive files by ransomware group | CyberScoop

• Johnson Controls says ransomware attack cost $27 million, data stolen (bleepingcomputer.com)

• "Cyber security matter" prompted network outage at Lurie Children's Hospital - CBS Chicago (cbsnews.com)

• New Jersey School District Shut Down by Cyber Attack (darkreading.com)

• Cactus ransomware gang claims the Schneider Electric hack (securityaffairs.com)

• Schneider Electric Responding to Ransomware Attack, Data Breach  - Security Week

• Akira ransomware gang says it stole passport scans from Lush • The Register

• Kansas public transportation authority hit by ransomware (bleepingcomputer.com)

Phishing & Email Based Attacks

• Microsoft says Russian hackers used previously identified tactic to breach senior exec emails (therecord.media)

• In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technica

• Microsoft 365 users need to be on their guard — new phishing campaign could cause some serious damage, and it's being offered for sale for barely nothing to lure new criminals in | TechRadar

• In 2023, Cyber Criminals Were Still Using Social Engineering to Steal Your Credentials - Security Boulevard

• The top phishing themes of 2023 (betanews.com)

• AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)

Artificial Intelligence

• $10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune

• AI-Powered Attacks and Deepfake Technology Fuel Cyber Attack Concern - IT Security Guru

• ChatGPT bug leaked conversations from others in your history (bgr.com)

• AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)

• Expect ‘AI versus AI’ conflict soon, Pentagon cyber leader says - Defense One

• AI Companies Will Need to Start Reporting Their Safety Tests to the US Government - Security Week

• AI-generated code leads to security issues for most businesses: report | CIO Dive

• Poisoned AI went rogue during training and couldn't be taught to behave again in 'legitimately scary' study | Live Science

• Assessing and quantifying AI risk: A challenge for enterprises | CSO Online

• AI And 5G are Defining a New Era of Cyber Security: The Industry Must Collectively Adapt - Infosecurity Magazine (infosecurity-magazine.com)

• Identity verification systems need hybrid liveness detection to protect against AI spoofs, say experts | ITPro

• Worried About AI Voice Clone Scams? Create a Family Password | Electronic Frontier Foundation (eff.org)

2FA/MFA

• Microsoft says Russian hackers used previously identified tactic to breach senior exec emails (therecord.media)

Malware

• It's true — Microsoft Teams group chat requests can be bad for you, as hackers hijack them to spread malware | TechRadar

• One of the world's biggest web hosting companies revealed that it eradicated nearly 500 million malware threats in 2023 - a staggering 250 instances per customer | TechRadar

• How the ZeuS Trojan Info Stealer Changed Cyber Security (securityintelligence.com)

• FBI disrupts Chinese botnet by wiping malware from infected routers (bleepingcomputer.com)

• AllaKore RAT Malware Targeting Mexican Firms with Financial Fraud Tricks (thehackernews.com)

• Windows PCs are now being hit by dangerous malware — here's the steps you need to take to stay safe | TechRadar

• Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines (thehackernews.com)

• Fake Google ads are trying to trick users into downloading nasty malware — here's how you can fight back | TechRadar

• Police disrupt Grandoreiro banking malware operation, make arrests (bleepingcomputer.com)

• Threat Actors Using Adult Games To Launch Remcos RAT Attack - Security Boulevard

• Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware (thehackernews.com)

• More Android apps riddled with malware spotted on Google Play (bleepingcomputer.com)

• Don't believe everything you read - hackers are pushing malware via media, news sites | TechRadar

Mobile

• Man Sentenced to Prison for Stealing Millions in Cryptocurrency via SIM Swapping  - Security Week

• More Android apps riddled with malware spotted on Google Play (bleepingcomputer.com)

Denial of Service/DoS/DDOS

• DDoS attack power skyrockets to 1.6 Tbps - Help Net Security

Internet of Things – IoT

• FBI disrupts Chinese botnet by wiping malware from infected routers (bleepingcomputer.com)

• The many ways electric cars are vulnerable to hacks, and whether that matters in a real-world (talosintelligence.com)

Data Breaches/Leaks

• There was a 39% surge in data exfiltration cyber attacks in 2023 | Security Magazine

• Europcar denies data breach of 50 million users, says data is fake (bleepingcomputer.com)

• 3.5M exposed in COVID-19 e-passport leak (securityaffairs.com)

• Mercedes-Benz accidentally exposed sensitive data, including source code (securityaffairs.com)

• FTC orders Blackbaud to boost security after massive data breach (bleepingcomputer.com)

• 23andMe confirms last year's massive data breach went unnoticed for five months, hackers stole raw genotype data | TechSpot

• 23andMe admits it didn’t detect cyber attacks for months | TechCrunch

• Millions of corporate messages leaked by Miracle Software's unsecured MongoDB instance | SC Media (scmagazine.com)

• Football Australia investigating 'critical data' leak - ESPN

• Top 3 Data Breaches of 2023, and What Lies Ahead in 2024 (darkreading.com)

• A Look Back at the Biggest Data Breaches in 2023: a Cautionary Tale for All Businesses - Hayes Connor

• DHS employees jailed for stealing data of 200K US govt workers (bleepingcomputer.com)

• Cyber criminals replace familiar tactics to exfiltrate sensitive data - Help Net Security

• Data leak at fintech giant Direct Trading Technologies (securityaffairs.com)

• Timex breach leaks employee Social Security numbers | SC Media (scmagazine.com)

• Cloudflare hacked using auth tokens stolen in Okta attack (bleepingcomputer.com)

• Keenan warns 1.5 million people of data breach after summer cyber attack (bleepingcomputer.com)

Organised Crime & Criminal Actors

• Dark Web Drugs Vendor Forfeits $150m After Guilty Plea - Infosecurity Magazine (infosecurity-magazine.com)

• ReasonLabs Releases Annual "State of Consumer Cyber Security Report" for 2024 (prnewswire.com)

• Cyber criminals replace familiar tactics to exfiltrate sensitive data - Help Net Security

• ‘Extremely heinous’: Myanmar hands over 10 leading cyber scam suspects to China | South China Morning Post (scmp.com)

• Smarter, Meaner, Sneakier: Security Trends for 2024 (trendmicro.com)

• How businesses can tackle the cyber crime economy (siliconrepublic.com)

• Expert explains the alarming creativity of today's cyber attacks, and five unlikely places you're vulnerable (techxplore.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Bitcoin worth £1.4bn seized after ex-takeaway worker tried to buy £23m mansion, court hears | UK News | Sky News

• Pump-and-Dump Schemes Make Crypto Fraudsters $240m - Infosecurity Magazine (infosecurity-magazine.com)

• Man Sentenced to Prison for Stealing Millions in Cryptocurrency via SIM Swapping  - Security Week

• Police seized 50,000 Bitcoin from operator of the now-defunct piracy site movie2k (securityaffairs.com)

Insider Risk and Insider Threats

• Top-tier IT talent doesn't stick around in 'mid-market' organisations - which could also be a major security risk | TechRadar

• DHS employees jailed for stealing data of 200K US govt workers (bleepingcomputer.com)

• Put People First When Facing Sophisticated Cyber Threats (forbes.com)

Insurance

• A Cyber Insurer's Perspective on How to Avoid Ransomware (darkreading.com)

• $10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune

Supply Chain and Third Parties

• Supply Chain Security and NIS2: What You Need to Know - Security Boulevard

• Third-party risk management best practices and why they matter - Help Net Security

• Cloudflare hacked using auth tokens stolen in Okta attack (bleepingcomputer.com)

• Cyber criminals embrace smarter strategies, less effort - Help Net Security

• Expert explains the alarming creativity of today's cyber attacks, and five unlikely places you're vulnerable (techxplore.com)

Cloud/SaaS

• Microsoft 365 users need to be on their guard — new phishing campaign could cause some serious damage, and it's being offered for sale for barely nothing to lure new criminals in | TechRadar

• Microsoft Teams phishing pushes DarkGate malware via group chats (bleepingcomputer.com)

• Why adversaries have their heads in the cloud - Red Canary

• 'Leaky Vessels' Cloud Bugs Allow Container Escapes Globally (darkreading.com)

• Cyber Attacks, AI and Multicloud Hit Cyber Security in 2023 - The New Stack

• Why DNS protection should be the first step in hybrid cloud security | TechRadar

Identity and Access Management

• Microsoft tells how Russia's Cozy Bear broke into its email • The Register

• In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technica

• Microsoft Shares New Guidance in the Wake of 'Midnight Blizzard' Cyber Attack (darkreading.com)

Linux and Open Source

• Cyber Security in Review: The Alarming Trend of Unsupported Systems - Security Boulevard

• New Glibc Flaw Grants Attackers Root Access on Major Linux Distros (thehackernews.com)

• White House releases report on securing open-source software | CyberScoop

Passwords, Credential Stuffing & Brute Force Attacks

• Microsoft says Russian hackers used previously identified tactic to breach senior exec emails (therecord.media)

• ‘Credential stuffing’ attacks set to rise (theage.com.au)

• Hundreds of network operators’ credentials found circulating in Dark Web (securityaffairs.com)

• US charges two more suspects with DraftKing account hacks (bleepingcomputer.com)

Social Media

• A tangled mess: Government rules for social media security lack clarity | CyberScoop

• Defending Against Corporate Social Media Account Takeovers (databreachtoday.co.uk)

Malvertising

• Fake Google ads are trying to trick users into downloading nasty malware — here's how you can fight back | TechRadar

Regulations, Fines and Legislation

• ICO confirms data breach probe as UK councils remain downed by cyber attack | TechCrunch

• Thе Cyber Resilience Act: What Startups Should Know About Hardware and Software Transparency in 2024 - TheRecursive.com

• SolarWinds Files Motion to Dismiss SEC Lawsuit (darkreading.com)

• What the Charges Against the SolarWinds CISO Mean for Security in 2024 - Security Boulevard

• A tangled mess: Government rules for social media security lack clarity | CyberScoop

• AI Companies Will Need to Start Reporting Their Safety Tests to the US Government - Security Week

• The SEC Won't Let CISOs Be: Understanding New SaaS Cyber Security Rules (thehackernews.com)

• How to Align Your Incident Response Practices With the New SEC Disclosure Rules - Security Week

• UK law could ban Apple security updates across the world in an 'unprecedented overreach' | TechRadar

Models, Frameworks and Standards

• Supply Chain Security and NIS2: What You Need to Know - Security Boulevard

• NIS2 Directive raises stakes for security leaders - Help Net Security

• Complete Guide To PCI DSS Compliance - Security Boulevard

• CMMC Is the Starting Line, Not the Finish (darkreading.com)

Data Protection

• ICO confirms data breach probe as UK councils remain downed by cyber attack | TechCrunch

Careers, Working in Cyber and Information Security

• Wait, infosec isn't a computer science degree requirement? • The Register

• The Future Of Cyber Security Is More Human Than You Think (forbes.com)

Law Enforcement Action and Take Downs

• Interpol arrests more than 30 cyber criminals in global ‘Synergia’ operation (therecord.media)

• Interpol-Led Initiative Targets 1300 Suspicious IPs - Infosecurity Magazine (infosecurity-magazine.com)

• Dark Web Drugs Vendor Forfeits $150m After Guilty Plea - Infosecurity Magazine (infosecurity-magazine.com)

• Bitcoin worth £1.4bn seized after ex-takeaway worker tried to buy £23m mansion, court hears | UK News | Sky News

• US charges two more suspects with DraftKing account hacks (bleepingcomputer.com)

• US sanctions 3 for supporting ISIS with cyber security expertise, money transfers - UPI.com

• Canada's 'most prolific hacker' jailed for two years (bitdefender.com)

• FBI disrupts Chinese botnet by wiping malware from infected routers (bleepingcomputer.com)

• Linux users beware — this security flaw could allow attackers to get root on major distros, so take extra care | TechRadar

• Police seized 50,000 Bitcoin from operator of the now-defunct piracy site movie2k (securityaffairs.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• $10 billion cyber insurance sector fears war, AI, ransomware ahead | Fortune

• Cyber attacks as war crimes | International Bar Association (ibanet.org)

• What Are State-Sponsored Cyber Attacks? - Security Boulevard

• Satya Nadella Worries About Hackers Causing 'Breakdown of World Order' (businessinsider.com)

• Expect ‘AI versus AI’ conflict soon, Pentagon cyber leader says - Defense One

• The Cyber Warfare Option Against Hostile States and Groups | National Review

Nation State Actors

China

• Chinese hacking operations have entered a far more dangerous phase, US warns - Defense One

• Chinese hackers preparing to 'wreak havoc' on US, warns FBI chief Christopher Wray | US News | Sky News

• FBI disrupts Chinese botnet by wiping malware from infected routers (bleepingcomputer.com)

• Wray’s stunning warning points to a new age of US vulnerability | CNN Politics

• Cyber attacks as war crimes | International Bar Association (ibanet.org)

• EU economic security plan eyes China with more defence than offense (qz.com)

Russia

• Microsoft says Russian hackers used previously identified tactic to breach senior exec emails (therecord.media)

• In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technicac

• Microsoft Shares New Guidance in the Wake of 'Midnight Blizzard' Cyber Attack (darkreading.com)

• Russia hacks Microsoft: It’s worse than you think | Computerworld

• Microsoft Threat Report: How Russia’s War on Ukraine Is Impacting the Global Cyber Security Community (darkreading.com)

• Series of Cyber Attacks Hit Ukrainian Critical Infrastructure Organisations (darkreading.com)

• Russian 'cyber war' could exploit divisions in Scotland | The Herald (heraldscotland.com)

• Pawn Storm Uses Brute Force and Stealth Against High-Value Targets (trendmicro.com)

• Russian threat actors dig in, prepare to seize on war fatigue | Security Insider (microsoft.com)

• Russian spies impersonating Western researchers in ongoing hacking campaign (therecord.media)

• Ukranian Military intelligence claims cyber attack on IT company providing services to Russian defence industry (kyivindependent.com)

• Ukraine's POW Coordination Headquarters restores services after cyber attack (kyivindependent.com)

• Ukraine Military Targeted With Russian APT PowerShell Attack (darkreading.com)

Iran

• New Leaks Expose Web of Iranian Intelligence and Cyber Companies - Infosecurity Magazine (infosecurity-magazine.com)

• Iran's 'Cyber Centers' Dodge Sanctions to Sell Cyber Operations (darkreading.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• US sanctions 3 for supporting ISIS with cyber security expertise, money transfers - UPI.com

---

Vulnerability Management

• Does CVSS 4.0 solve the exploitability problem? - Help Net Security

• Why the Right Metrics Matter When it Comes to Vulnerability Management (thehackernews.com)

• Cyber Security in Review: The Alarming Trend of Unsupported Systems - Security Boulevard

• Why organisations need risk-based vulnerability management | TechTarget

Vulnerabilities

• Akira ransomware attacks linked to Cisco vuln fixed in 2020 • The Register

• Ivanti Struggling to Hit Zero-Day Patch Release Schedule - Security Week

• Ivanti releases patches for old and new VPN zero-days • The Register

• A zero-day vulnerability (and PoC) to blind defences relying on Windows event logs - Help Net Security

• 45k Jenkins servers exposed to RCE attacks using public exploits (bleepingcomputer.com)

• Juniper Networks Releases Urgent Junos OS Updates for High-Severity Flaws (thehackernews.com)

• New Glibc Flaw Grants Attackers Root Access on Major Linux Distros (thehackernews.com)

• CISA Warns of Active Exploitation of Critical Flaws in Apple iOS and macOS (thehackernews.com)

• If you’re using this router brand, you may want to disconnect now — security researchers found more vulnerabilities and a hardcoded password in Totolink hardware | TechRadar

• Linux users beware — this security flaw could allow attackers to get root on major distros, so take extra care | TechRadar

• Tor Code Audit Finds 17 Vulnerabilities - Security Week

---

Tools and Controls

• Microsoft tells how Russia's Cozy Bear broke into its email • The Register

• In major gaffe, hacked Microsoft test account was assigned admin privileges | Ars Technica

• Microsoft Shares New Guidance in the Wake of 'Midnight Blizzard' Cyber Attack (darkreading.com)

• Building good cyber security posture doesn't have to be expensive – NCA | Insurance Business America (insurancebusinessmag.com)

• Prioritizing cyber crime intelligence for effective decision-making in cyber security - Help Net Security

• What is DMARC? - Security Boulevard

• Multi-factor authentication suffers from three major weaknesses | TechRadar

• AI-generated code leads to security issues for most businesses: report | CIO Dive

• 3 Best Practices to Improve Threat Hunting - Security Boulevard

• How to make developers accept DevSecOps - Help Net Security

• Assessing and quantifying AI risk: A challenge for enterprises | CSO Online

• How to Align Your Incident Response Practices With the New SEC Disclosure Rules - Security Week

• Why DNS protection should be the first step in hybrid cloud security | TechRadar

• What Is Cyber Threat Hunting? (Definition & How it Works) (techrepublic.com)

• Proactive cyber security: A strategic approach to cost efficiency and crisis management - Help Net Security

• The Future Of Cyber Security Is More Human Than You Think (forbes.com)

• Managing the hidden risks of shadow APIs • The Register

---

Reports Published in the Last Week

• Cyber Bank Heists | Cyber Security Threats Facing Financial Sector | Contrast Security

• ReasonLabs Releases Annual "State of Consumer Cyber Security Report" for 2024 (prnewswire.com)

• Gartner Report: Innovation Insight for Application Security Posture Management (legitsecurity.com)

---

Other News

• The Financial Sector Is Plagued by Increasingly Sophisticated Cyber Attacks That Demand a Defensive Paradigm Shift, According to the Modern Bank Heists Report From Contrast Security (prnewswire.com)

• How SMBs can lower their risk of cyber attacks and data breaches (bleepingcomputer.com)

• FTC orders Blackbaud to boost security after massive data breach (bleepingcomputer.com)

• Global critical infrastructure faces relentless cyber activity - Help Net Security

• Why the healthcare industry must prioritize cyber resilience | World Economic Forum (weforum.org)

• UK says Emirates-backed stake in Vodafone poses national security risk | Vodafone | The Guardian

• Cyber attacks soar to 13 per second – with OT a key target - Drives and Controls Magazine (drivesncontrols.com)

• Israeli Government: Smallest of SMBs Hit Hardest in Cyber Attacks (darkreading.com)

• How to prepare for the increasing cyber attacks on critical infrastructure - Data Centre & Network News (dcnnmagazine.com)

• CISA: Vendors must secure SOHO routers against Volt Typhoon attacks (bleepingcomputer.com)

• Firmware remains the soft underbelly of banking cyber defence (techmonitor.ai)

• Cyber attacks on state and local governments rose in 2023, says CIS report | StateScoop

• City Cyber Taskforce Launches to Secure Corporate Finance - Infosecurity Magazine (infosecurity-magazine.com)

• Fulton County Suffers Power Outages as Cyber Attack Continues (darkreading.com)

• How to Prepare for a Cyber Attack - Security Boulevard

• The Imperative for Robust Security Design in the Health Industry (darkreading.com)

• National cyber security plans lack performance measures and estimated costs, GAO says | CyberScoop

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Intelligence Briefing 26 January 2024

Black Arrow Cyber Threat Briefing 26 January 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Russian Hackers’ Breach of Microsoft and Hewlett Packard Corporate Mailboxes is an Identity Threat Detection Wake-up Call

Just recently, it was publicly disclosed that Microsoft and Hewlett Packard Enterprise (HPE) had their corporate mailboxes breached by threat actors. In the Microsoft breach, a hacking group had used a password spray attack to compromise a non-production test account, and leverage that to access corporate accounts. In the HPE breach, corporate access was gained through unauthorised access to SharePoint files. Both attacks highlight the need for identity threat detection: the ability to identify malicious activity from trusted identities before more sophisticated damage is caused. Cyber incidents are a matter of when, not if, and it is important to have detection capabilities, even for trusted accounts.

Sources: [Help Net Security] [Security Boulevard]

94% of CISOs are Concerned About Third-Party Cyber Threats, Yet Only 3% Have Started Implementing Security Measures

A recent study found that while 94% of CISOs are concerned with third-party cyber security threats,  including 17% who view it as a top priority, only 3% have implemented a third -party cyber risk management solution and 33% have noted plans to implement this year. Small and medium sized businesses may not have the resources of a larger organisation yet will have a similar level of third-party risk. This makes the need for an effective solution even more important, and in some cases this may include outsourcing to cyber experts.

Sources: [Dark Reading]

Cyber Risks Needs to be Prioritised as a Key Business Risk, Says UK Government, as New Cyber Security Governance Code Puts Cyber Risks on Boardroom Agenda

The UK Government has proposed a new Code of Practice on cyber security governance, aimed at directors and senior business leaders. The draft document emphasises the need to prioritise cyber security on par with financial and legal risks. It outlines several key areas for focus, including risk management, cyber strategy, fostering a cyber security culture among employees, incident planning and response, and establishing clear governance structures. With digital technologies playing a crucial role in business resilience, the code calls for greater involvement of executive and non-executive directors in technology governance strategies. The UK Minister for AI and Intellectual Property has highlighted that cyber attacks are as damaging to organisations as financial and legal pitfalls. It is crucial that directors take a firm grip of their organisation’s cyber security regimes to protect their customers, workforce, business operations and the wider economy. This initiative reinforces the importance of a holistic approach to cyber security, including robust incident response plans and regular practice to enhance cyber resilience. It’s a timely reminder that cyber threats are as detrimental to organisations as financial and legal challenges, and this code aims to empower leaders to navigate these threats effectively.

Sources: [Computer Weekly] [Electronics Specifier] [GOV UK] [TechRadar] [Infosecurity Magazine]

81% of Security Professionals Say Phishing Is Top Threat

A recent study found 81% of organisations anticipated phishing as their top security risk over the coming months. In a separate report, it was found that 94% of organisations globally had experienced an email security incident in the past 12 months, with a 10% rise in phishing. It is not just emails where phishing attacks are occurring: in another report, the second half of 2023 saw a 198% increase in browser based phishing attacks. It is clear that phishing is a threat to organisations, and it is important to be prepared.

Sources: [ITPro] [Beta News] [Security Magazine]

Ransomware Attacks Cause Significant Psychological Harm

One area of ransomware that often gets overlooked, is the psychological impact. A recent report by the Royal United Services Institute found that some attacks had caused so much impact that organisations hired post-traumatic stress disorder support teams. A significant number of respondents experienced sleep deprivation, resulting in them developing extreme fatigue and falling asleep at work. Various levels of stress were experienced by security workers, with one interviewee citing the stress of a ransomware attack as a potential cause for a heart attack that required surgery. This highlights that, as with the wider subject of cyber and information security, consideration needs to be given to more than just IT and IT controls: it shows the need for a holistic approach to include people, operations and technology.

Sources: [The Record Media] [TechRadar]

Breached Password Report Reveals Two Million Compromised Cloud Credentials Used '123456' as Password

A recent report has revealed that two million compromised cloud credentials used ‘123456’ as a password. This alarming trend underscores the ongoing issue of weak passwords, which are easily exploited by hackers. Despite the availability of advanced password creation and storage tools, a significant number of individuals and organisations continue to use weak passwords. Furthermore, the report found that 88% of organisations still rely on passwords as their primary authentication method. Despite the focus on password security, nearly every organisation has had risk management lapses. The report highlights the urgent need for stronger password policies and the adoption of more secure authentication methods. Equally, the attacks highlight that simply moving to the cloud does not solve security challenges, and poor cyber hygiene in the cloud will lead to problems.

Sources: [ITPro] [Business Wire] [Security Magazine]

NCSC: UK Intelligence Fears AI will Fuel Ransomware and Exacerbate Cyber Crime

An article published by the UK’s National Cyber Security Centre (NCSC) states that AI is already being used to increase the efficacy of cyber attacks, and that AI will continue to significantly increase the odds of a successful attack. AI models will build capability as they are informed by data describing previous successful attacks. The NCSC noted that “It is likely that highly capable unfriendly nation states have repositories of malware that are large enough to effectively train an AI model for this purpose”. The message from the NCSC is clear: AI will propel cyber incidents and organisation must take this into consideration as part of their wider cyber risk management strategy.

Sources: [The Register] [PC Mag] [The Messenger ] [Silicon UK]

Cyber Attacks More than Doubled in 2023, so Why Are So Many Firms Still Not Taking Security Seriously, or Why Firms Ignore Vulnerabilities at Their Own Risk

Cyber attacks soared again last year, and attackers are increasingly taking advantage of software vulnerabilities to breach organisations. This is due to the continuous discovery of new vulnerabilities, and with that, a constant challenge for firms to apply patches. A report found many organisations lack an effective vulnerability management programme and are leaving themselves open to attacks; and in some cases they are left vulnerable for years.

One key hindrance found by the report is the sheer volume of vulnerabilities identified and patched by vendors, leaving organisations with the perpetual challenge of timely patching. This complication is made worse for small and medium sized businesses where they have less resources. The report found that legacy systems are a large risk for many organisations;  in fact, older Windows server OS versions - 2012 and earlier – were found to be 77% more likely to experience attack attempts than newer versions. Many firms are still not taking this danger seriously enough and as a result, blind spots and critical vulnerabilities are worsening, creating more opportunities for attackers.

Sources: [ITPro] [Help Net Security] [ITPro]

Historic Data Leak Reveals 26 billion Records: Check What is Exposed

In what has been described as the ‘mother of all breaches’, 26 billion records have been exposed. These aren’t all new, as a lot of the records are from numerous breaches, however they are all in one location, compiled and index for use. With the emergence of this, there is will likely be a surge in attacks and if you haven’t changed your credentials, or are reusing these same credentials, you may find yourself a victim. To check if your email has been compromised in a breach, you can check on the website www.HaveIBeenPwned.com

Source: [Security Affairs]

Boardroom Cyber Expertise Comes Under Scrutiny

Cyber security concerns continue to be a critical issue for organisations, driven by factors such as data protection, compliance, risk management, and business continuity. However, a recent report reveals a concerning trend where only 5% of Chief Information Security Officers (CISOs) report directly to the CEO, down from 11% in 2021. This gap between cyber security leadership and board-level involvement is a challenge. A report emphasises that many board members lack the technical expertise to understand cyber security, while CISOs often communicate in technical jargon, making it difficult for boards to grasp the significance of security issues. To bridge this gap, it's crucial to educate board members on the real-world risks and costs associated with cyber incidents. Sharing simple metrics like the global average cost of a data breach, which is $4.45 million, can help them understand the financial impact. Moreover, CISOs should learn to convey cyber security matters in business terms and quantify the organisation's cyber risk exposure. By providing boards with information to understand and engaging in informed discussions, they can enhance their cyber security strategy and ensure that these vital issues are prioritised appropriately.

Source: [Security Intelligence]

“It is a whole new bar”: Months Left for Applicable Firms to Prepare for New EU Cyber Security Rules

The landscape of cyber security is evolving rapidly, with two significant EU regulations: the Network and Information Security Directive (NIS2) and the Digital Operational Resilience Act (DORA), set to take effect in the coming months. NIS2 expands cyber security standards to include critical services like transportation, water services, and health services, while DORA focuses on the financial services sector and aims to ensure resilience against cyber threats.

These regulations necessitate strong cyber security testing, incident reporting processes, and comprehensive assessments of third-party providers' security. Compliance with these regulations will introduce complexity and costs, requiring organisations to prepare comprehensively for the evolving cyber security landscape, including the implications of artificial intelligence. Transparency and understanding are key, as boards must fully comprehend data processing and technology usage within their organisations, ushering in a new era of cyber security governance.

Source: [The Currency]

Ransomware Attacks Break Records In 2023: The Number of Victims Rose By 128%

In 2023, there was a significant surge in ransomware attacks globally. The number of attack attempts more than doubled, increasing by 104%. A report shows that there were 1,900 total ransomware attacks within just four countries: the US, UK, Germany, and France. The use of double extortion techniques, where hackers not only encrypt the data but also steal confidential data beforehand and threaten to release it if their demands are not fulfilled, are becoming increasingly common, with now triple and quadruple extortion techniques also being increasingly deployed. It was also found that data exfiltration was present in approximately 91% of all publicly recorded ransomware attacks in 2023. These figures underscore the growing threat of ransomware and the need for robust cyber security measures.

Sources: [Security Boulevard] [Security Affairs] [Security Brief] [Business Wire]

Governance, Risk and Compliance

• Treat cyber risk like financial or legal issue, says UK government | Computer Weekly

• New Cyber Security Governance Code Puts Cyber Risks on Boardroom Agenda - Infosecurity Magazine (infosecurity-magazine.com)

• Business leaders urged to toughen up cyber attack protections - GOV.UK (www.gov.uk)

• Organisations face devastating financial consequences from cyber attacks (betanews.com)

• Cyber attacks more than doubled in 2023, so why are so many firms still not taking security seriously? | ITPro

• Cyber Security Attack Attempts More Than Doubled, Increasing 104% in 2023 | Business Wire

• “It is a whole new bar”: Months left to prepare for new EU cyber security rules - The Currency :The Currency

• The growing role of CISOs in cyber security governance - APDR (asiapacificdefencereporter.com)

• Boardroom cyber expertise comes under scrutiny (securityintelligence.com)

• Resilience: The New Priority for Your Security Model (inforisktoday.com)

• 10 must-have security tips for digital nomads | Computerworld

• Top 3 Priorities for CISOs in 2024 (darkreading.com)

• CISOs Struggle for C-Suite Status Even as Expectations Skyrocket (darkreading.com)

• Navigating The 'Fog Of A Cyber Attack' (forbes.com)

• The cost of cyber crime to reach over $12tn by 2025

• Why cyber attacks mustn’t be kept secret - Help Net Security

• Business continuity vs. disaster recovery vs. incident response | TechTarget

• Why resilience leaders must prepare for polycrises - Help Net Security

• The best cyber defence needs more than tech - eCampus News

• The CISO Role Undergoes a Major Evolution (darkreading.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Ransomware attacks break records in 2023: the number of victims rose by 128% (securityaffairs.com)

• Impact of Ransomware attacks take mental health toll on small business owners, report says (therecord.media)

• UK Intelligence Fears AI Will Fuel Ransomware, Exacerbate Cyber Crime (pcmag.com)

• Britons must 'strengthen defences' against growing threat of AI-assisted ransomware, cyber security chief warns | UK News | Sky News

• The rise of cyber extortion and 'Hacktivism' - Verdict

• Ransomware recovery – the need for speed | TechRadar

• Medibank hack: Russian sanctioned over Australia's worst data breach - BBC News

• UK gov tells SMBs to get better at protecting themselves from cyber attacks | TechRadar

• Researchers link 3AM ransomware to Conti, Royal cyber crime gangs (bleepingcomputer.com)

• Kasseika ransomware uses antivirus driver to kill other antiviruses (bleepingcomputer.com)

• Akira ransomware attack on Tietoevry disrupted the services of many Swedish organisations (securityaffairs.com)

• Organisations invest more in data protection but recover less - Help Net Security

• Evolving BianLian ransomware attack strategies detailed | SC Media (scmagazine.com)

• Hackers target TeamViewer to try and get access to your company's network | TechRadar

• Ransomware Victims

• Major US, UK Water Companies Hit by Ransomware - SecurityWeek

• Sweden’s Riksbank Turns to Police as Cyber Attack Hits IT Firm - BNN Bloomberg

• Owner of The North Face, Supreme, Vans, Reports Breach Affecting 35M Users (pcmag.com)

• Primary Health & Wellness Center, LLC’s public notice of ransomware incident (databreaches.net)

• Akira ransomware attack on Tietoevry disrupted the services of many Swedish organisations (securityaffairs.com)

• LockBit gang claims the attack on the sandwich chain Subway (securityaffairs.com)

• loanDepot says ransomware gang stole data of 16.6 million people (bleepingcomputer.com)

• Aviation Leasing Giant AerCap Hit by Ransomware Attack - SecurityWeek

• Global fintech firm EquiLend offline after recent cyber attack (bleepingcomputer.com)

• Ransomware Group Offers Hacked Serbian Electricity Provider's Data For Download (rferl.org)

• Cyber attack in Merseyside as 'immediate steps taken' (msn.com)

• Housing association confirms 'cyber security incident' but can't confirm if tenants' data was lost | Shropshire Star

Phishing & Email Based Attacks

• Four-in-ten employees sacked over email security breaches as firms tackle “truly staggering” increase in attacks | ITPro

• 81 percent of security pros say phishing is the top threat (betanews.com)

• Browser Phishing Threats Grew 198% Last Year - Infosecurity Magazine (infosecurity-magazine.com)

• Invoice Phishing Alert: TA866 Deploys WasabiSeed & Screenshotter Malware (thehackernews.com)

• Organisations need to switch gears in their approach to email security - Help Net Security

• HPE Says Russian Government Hackers Had Access to Emails for 6 Months - SecurityWeek

• Russian hackers breached Microsoft, HPE corporate maliboxes - Help Net Security

• Don’t Take The Bait: How To Prevent A Phishing Attack | Kohrman Jackson & Krantz LLP - JDSupra

• Trezor reveals 66,000 users could face phishing attack (coinjournal.net)

• Is This a Phishing Email? 8 Warning Signs to Look Out For

• PHP-less phishing kits that can run on any website | Netcraft

• New KnowBe4 Report Shows Major Spike in Public Sector Attacks in 2023 | Business Wire

Artificial Intelligence

• AI Will ‘Almost Certainly’ Turbocharge Cyber attacks, UK Warns - The Messenger

• The near-term impact of AI on the cyber threat - NCSC.GOV.UK

• NCSC: AI to boost nation-states’ malware potency • The Register

• AI’s Efficacy is Limitless in Cyber Crime | MSSP Alert

• Top 4 LLM threats to the enterprise | CSO Online

• The rise of cyber extortion and 'Hacktivism' - Verdict

• Battling Misinformation During Election Season (darkreading.com)

• Unmasking Deceptive Behaviour: Risks and Challenges in Large Language Models (azoai.com)

• AI-driven cyber attacks and defences to create a battle of algorithms in 2024 (securitybrief.co.nz)

• Researchers Map AI Threat Landscape, Risks (darkreading.com)

• Misinformation and irresponsible AI: Experts forecast how technology may shape our near future (techxplore.com)

• ChatGPT Cyber Crime Surge Revealed in 3000 Dark Web Posts - Infosecurity Magazine (infosecurity-magazine.com)

• More than 1 in 4 Organisations Banned Use of GenAI Over Privacy and Data Security Risks - New Cisco Study (prnewswire.com)

• The Cyber Security Horizon: AI, Resilience and Collaboration in 2024 - Security Boulevard

Malware

• NCSC: AI to boost nation-states’ malware potency • The Register

• MacOS devices are being targeted by pirated apps that want to hijack your machine | TechRadar

• Invoice Phishing Alert: TA866 Deploys WasabiSeed & Screenshotter Malware (thehackernews.com)

• 'Inhospitality' malspam campaign targets hotel industry | SC Media (scmagazine.com)

• Blackwood APT delivers malware by hijacking legitimate software update requests - Help Net Security

• SystemBC Malware's C2 Server Analysis Exposes Payload Delivery Tricks (thehackernews.com)

• HP CEO justifies blocking third-party ink cartridges by claiming they can inject malware | Tom's Hardware (tomshardware.com)

Mobile

• Apple Issues Patch for Critical Zero-Day in iPhones, Macs - Update Now (thehackernews.com)

• iPhone, Android Ambient Light Sensors Allow Stealthy Spying (darkreading.com)

• New method to safeguard against mobile account takeovers - Help Net Security

• Bluetooth Flaw Let Hackers Takeover of iOS & Android Devices (cybersecuritynews.com)

• SEC confirms X account was hacked in SIM swapping attack (bleepingcomputer.com)

• Zero-Click Bluetooth Attack: A Growing Threat for Unpatched Android Phones - gHacks Tech News

Denial of Service/DoS/DDOS

• Ukrainian mobile bank sees a spike in ‘non-stop’ DDoS pressure (therecord.media)

Internet of Things – IoT

• Ring Will No Longer Allow Police to Request Doorbell Camera Footage From Users - SecurityWeek

• HP CEO justifies blocking third-party ink cartridges by claiming they can inject malware | Tom's Hardware (tomshardware.com)

Data Breaches/Leaks

• Historic data leak reveals 26 billion records: check what's exposed (securityaffairs.com)

• Data of 15 million Trello users scraped and offered for sale - Help Net Security

• Personal details of 6,000 people leaked in Greater Manchester council data breach (msn.com)

• BreachForums hacking forum admin sentenced to 20 years supervised release (bleepingcomputer.com)

• Healthtech firm's cyber attack victim list keeps growing - Digital Journal

• VF Corp Says Data Breach Resulting From Ransomware Attack Impacts 35 Million - SecurityWeek

• Class Actions Filed Over Builders Mutual, Progressive’s Own Data Breaches (claimsjournal.com)

• loanDepot cyber attack causes data breach for 16.6 million people (bleepingcomputer.com)

• Jason’s Deli says customer data exposed in credential stuffing attack (bleepingcomputer.com)

• The growing threat of data breaches in the age of AI and data privacy | TechRadar

• Data Privacy Week: US Data Breaches Surge, 2023 Sees 78% Increase - Infosecurity Magazine (infosecurity-magazine.com)

• 23andMe data breach: Hackers stole raw genotype data, health reports (bleepingcomputer.com)

• Coventry school reprimanded for data breach after IT system 'hacked three times' - CoventryLive (coventrytelegraph.net)

Organised Crime & Criminal Actors

• Winter is coming and so are the hackers (betanews.com)

• Grooming, radicalization and cyber attacks: INTERPOL warns of ‘Metacrime’

• Bulletproof Hosting: A Critical Cyber Criminal Service | Intel471

• 'VexTrio' TDS: The Biggest Cyber Crime Operation on the Web? (darkreading.com)

• The cost of cyber crime to reach over $12tn by 2025

• Researchers link 3AM ransomware to Conti, Royal cyber crime gangs (bleepingcomputer.com)

• ChatGPT Cyber Crime Surge Revealed in 3000 Dark Web Posts - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber criminal malice shifts away from Russia and Ukraine | Insurance Times

• The sophistication of cyber criminals intensifies with emerging strategies for cashing in or causing chaos - IT Security Guru

• Barracuda's new Cybernomics 101 report uncovers the financial forces driving cyber attacks (prnewswire.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Cyber criminals stole $1.7 billion from crypto funds in 2023 as attacks proliferated (therecord.media)

• US regulator admits cyber security lapse before rogue Bitcoin post - BBC News

• Trezor reveals 66,000 users could face phishing attack (coinjournal.net)

Insider Risk and Insider Threats

• Majority of companies not prepared for insider threats (betanews.com)

• Amid Rising Insider Threats, Most Companies are Vulnerable and Lack the Strategies to Protect Themselves, New Research Finds | Business Wire

• Fighting insider threats is tricky but essential work - Help Net Security

Insurance

• Insurance industry responds to evolving risks with innovation and collaboration: Allianz - Reinsurance News

• Cyber Insurance Industry Suggests Cyber Security Best Practices (networkcomputing.com)

Supply Chain and Third Parties

• Panorays Study Finds 94% of CISOs Are Concerned About Third-party Cyber Threats, Yet Only 3% Have Implemented Security Measures (darkreading.com)

• From vulnerability to vigilance: strategies for ensuring supply chain security (techuk.org)

• Bolstering global supply chains: Enhancing resilience, digital logistics, and national security harmony (techuk.org)

• Supply chain security: Responding to emerging cyber threats (techuk.org)

• CISOs' role in identifying tech components and managing supply chains - Help Net Security

• Rethinking supply chain resilience as cyber attacks get more disruptive (techuk.org)

Cloud/SaaS

• On premises vs. cloud pros and cons, key differences | TechTarget

• The 2024 Specops Breached Password Report Reveals Two Million Compromised Cloud Credentials Used ‘123456’ as Password | Business Wire

• The biggest cloud security risk in 2024 will be stolen and exposed credentials | ITPro

Identity and Access Management

• Why Microsoft’s Latest Breach is an Identity Threat Detection Wake-Up Call - Security Boulevard

Encryption

• Cryptographers Are Getting Closer to Enabling Fully Private Internet Searches | WIRED

Passwords, Credential Stuffing & Brute Force Attacks

• Why Microsoft’s Latest Breach is an Identity Threat Detection Wake-Up Call - Security Boulevard

• Accepting a calendar invite in Outlook could leak your password | SC Media (scmagazine.com)

• There's no excuse for having a weak password in 2024

• The 2024 Specops Breached Password Report Reveals Two Million Compromised Cloud Credentials Used ‘123456’ as Password | Business Wire

• Jason’s Deli says customer data exposed in credential stuffing attack (bleepingcomputer.com)

• 88% of organisations use passwords as primary authentication method | Security Magazine

• The biggest cloud security risk in 2024 will be stolen and exposed credentials | ITPro

Social Media

• Meta won't remove fake Instagram profiles that are clearly catfishing (bleepingcomputer.com)

• Watch out for "I can't believe he is gone" Facebook phishing posts (bleepingcomputer.com)

• SEC confirms X account was hacked in SIM swapping attack (bleepingcomputer.com)

Malvertising

• Intro to Digital Fingerprints: Understanding, Manipulating, and Defending Against Online Tracking | HackerNoon

• Google Updates Chrome's Incognito Warning to Admit It Tracks Users in ‘Private’ Mode | WIRED

• Cryptographers Are Getting Closer to Enabling Fully Private Internet Searches | WIRED

Regulations, Fines and Legislation

• “It is a whole new bar”: Months left to prepare for new EU cyber security rules - The Currency :The Currency

• Without clear guidance, SEC’s new rule on incident reporting may be detrimental - Help Net Security

• SEC confirms X account was hacked in SIM swapping attack (bleepingcomputer.com)

• Navigating The 'Fog Of A Cyber Attack' (forbes.com)

• US regulator admits cyber security lapse before rogue Bitcoin post - BBC News

• The CISO Role Undergoes a Major Evolution (darkreading.com)

• Coventry school reprimanded for data breach after IT system 'hacked three times' - CoventryLive (coventrytelegraph.net)

• Countdown for businesses to comply with leaked EU AI Act draft begins | Biometric Update

Models, Frameworks and Standards

• “It is a whole new bar”: Months left to prepare for new EU cyber security rules - The Currency :The Currency

• Prioritising CIS Controls for effective cyber security across organisations - Help Net Security

Careers, Working in Cyber and Information Security

• Top 3 Priorities for CISOs in 2024 (darkreading.com)

• CISOs Struggle for C-Suite Status Even as Expectations Skyrocket (darkreading.com)

• Why we need more continuous hands-on training and fewer cyber security certifications | SC Media (scmagazine.com)

Law Enforcement Action and Take Downs

• BreachForums hacking forum admin sentenced to 20 years supervised release (bleepingcomputer.com)

• Ring Will No Longer Allow Police to Request Doorbell Camera Footage From Users - SecurityWeek

• Secret Service to revive the Cyber Investigations Advisory Board | CyberScoop

• Court charges dev with hacking after cyber security issue disclosure (bleepingcomputer.com)

• Ukrainian Security Service Nabs Russian Hacker Planning Cyber Attacks on Government Websites - Militarnyi

Misinformation, Disinformation and Propaganda

• Battling Misinformation During Election Season (darkreading.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Nation State Actors

• NCSC: AI to boost nation-states’ malware potency • The Register

China

• Chinese Spies Exploited VMware vCenter Server Vulnerability Since 2021 - SecurityWeek

• The small print leaving UK plc exposed to ‘nuclear level’ cyber attacks (telegraph.co.uk)

• Michael Rogers on China's Cyber Threat - The Wire China

• China’s feared spy agency steps out of the shadows

• Cyber criminal malice shifts away from Russia and Ukraine | Insurance Times

Russia

• Microsoft's Top Execs' Emails Breached in Sophisticated Russia-Linked APT Attack (thehackernews.com)

• Why Microsoft’s Latest Breach is an Identity Threat Detection Wake-Up Call - Security Boulevard

• Microsoft Says Russians Hacked It to Find Information About Themselves (businessinsider.com)

• Sneak-and-peek Midnight Blizzard attack highlights “worrying flaws” in Microsoft security processes | ITPro

• Microsoft Warns of Widening APT29 Espionage Attacks Targeting Global Orgs (thehackernews.com)

• HP Enterprise was hacked by the same Russian state-sponsored group that targeted Microsoft (engadget.com)

• HPE Says Russian Government Hackers Had Access to Emails for 6 Months - SecurityWeek

• Russian hackers shift to new malware tactics, Google says (siliconrepublic.com)

• Massive cyber attack targets Ukrainian online bank (kyivindependent.com)

• Learning From Ukraine's Pioneering Approaches to Cyber Security (darkreading.com)

• Cyber criminal malice shifts away from Russia and Ukraine | Insurance Times

• Ukrainian energy giant, postal service, transportation agencies hit by cyber attacks (therecord.media)

• Ukraine’s Largest Gas and Oil Company Under Cyber Attack (kyivpost.com)

• Ukrainian Security Service Nabs Russian Hacker Planning Cyber Attacks on Government Websites - Militarnyi

• Medibank hack: Russian sanctioned over Australia's worst data breach - BBC News

• Hundreds of Russian sites breached by Ukrainian hackers | SC Media (scmagazine.com)

• Akira ransomware attack on Tietoevry disrupted the services of many Swedish organisations (securityaffairs.com)

• Apple Pays $13 Million Russian Fine, Goes Directly Into Federal Budget (businessinsider.com)

Iran

• Microsoft: Iran's Mint Sandstorm APT Blasts Educators, Researchers (darkreading.com)

• With Iran's cyber attacks on rise since Gaza war, Israel looks to private industry - Al-Monitor: Independent, trusted coverage of the Middle East

North Korea

• North Korea's ScarCruft Attackers Gear Up to Target Cyber Security Pros (darkreading.com)

---

Vulnerability Management

• 45% of critical CVEs left unpatched in 2023 - Help Net Security

• Patch management: Why firms ignore vulnerabilities at their own risk | ITPro

• What Is Vulnerability Management? Definition, Process Steps, Benefits and More - Security Boulevard

• Security vendors are accused of bending CVE assignment rules • The Register

• German IT Consultant Fined Thousands for Reporting Security Failing (darkreading.com)

• The effect of omission bias on vulnerability management - Help Net Security

• 52% of Serious Vulnerabilities We Find are Related to Windows 10 (thehackernews.com)

Vulnerabilities

• Cisco warns of critical RCE flaw in communications software (bleepingcomputer.com)

• CISA emergency directive: Mitigate Ivanti zero-days immediately (bleepingcomputer.com)

• Third Ivanti Vulnerability Exploited in the Wild, CISA Reports (darkreading.com)

• Ivanti: VPN appliances vulnerable if pushing configs after mitigation (bleepingcomputer.com)

• Chrome 121 ships with security updates and new AI tools - gHacks Tech News

• Apple Issues Patch for Critical Zero-Day in iPhones, Macs - Update Now (thehackernews.com)

• Accepting a calendar invite in Outlook could leak your password | SC Media (scmagazine.com)

• Hackers Targeting Critical Atlassian Confluence Vulnerability Days After Disclosure - SecurityWeek

• Chinese Spies Exploited VMware vCenter Server Vulnerability Since 2021 - SecurityWeek

• Critical Vulnerabilities Found in Open Source AI/ML Platforms - SecurityWeek

• Threat actors exploit Apache ActiveMQ flaw to deliver the Godzilla Web Shell (securityaffairs.com)

• Bluetooth Flaw Let Hackers Takeover of iOS & Android Devices (cybersecuritynews.com)

• High-Severity Vulnerability Patched in Splunk Enterprise - SecurityWeek

• Patch Your Fortra GoAnywhere MFT Immediately - Critical Flaw Lets Anyone Be Admin (thehackernews.com)

• Millions at Risk As 'Parrot' Web Server Compromises Take Flight (darkreading.com)

• Security vendors are accused of bending CVE assignment rules • The Register

• Mozilla Releases Security Updates for Thunderbird and Firefox | CISA

• 5379 GitLab servers vulnerable to zero-click account takeover attacks (securityaffairs.com)

• Hackers target WordPress database plugin active on 1 million sites (bleepingcomputer.com)

---

Tools and Controls

• Why Microsoft’s Latest Breach is an Identity Threat Detection Wake-Up Call - Security Boulevard

• Ransomware recovery – the need for speed | TechRadar

• Resilience: The New Priority for Your Security Model (inforisktoday.com)

• With so much data at hand, should cyber defences be more effective? | TechRadar

• Password Manager Statistics 2024 (coolest-gadgets.com)

• How to Shine in Your Next Cyber Security Audit - Security Boulevard

• AI-driven cyber attacks and defences to create a battle of algorithms in 2024 (securitybrief.co.nz)

• Business continuity vs. disaster recovery vs. incident response | TechTarget

• Why resilience leaders must prepare for polycrises - Help Net Security

• Court charges dev with hacking after cyber security issue disclosure (bleepingcomputer.com)

• German IT Consultant Fined Thousands for Reporting Security Failing (darkreading.com)

• The 9 best incident response metrics and how to use them | TechTarget

• The Cyber Security Horizon: AI, Resilience and Collaboration in 2024 - Security Boulevard

• We Must Consider Software Developers a Key Part of the Cyber Security Workforce | CISA

• Cyber Insurance Industry Suggests Cyber Security Best Practices (networkcomputing.com)

• Emerging trends and strategies in digital forensics - Help Net Security

• Cyber Security Risk Management: Frameworks, Plans, & Best Practices - Security Boulevard

• IT and Security Teams Increasingly United in Battle Against Sophisticated Cyberthreats, Research Finds (prnewswire.com)

• HP CEO justifies blocking third-party ink cartridges by claiming they can inject malware | Tom's Hardware (tomshardware.com)

---

Reports Published in the Last Week

• Cloudflare Releases 2024 API Security and Management Report (infoq.com)

• The 2024 Specops Breached Password Report Reveals Two Million Compromised Cloud Credentials Used ‘123456’ as Password | Business Wire

• Barracuda's new Cybernomics 101 report uncovers the financial forces driving cyber attacks (prnewswire.com)

---

Other News

• With so much data at hand, should cyber defences be more effective? | TechRadar

• Threat actors are exploiting web applications - Security Boulevard

• Public Sector Cyber Attacks Rise By 40% in 2023 - IT Security Guru

• Cyber Security Challenges at the World Economic Forum (govtech.com)

• Much-Needed Cyber Security Help for Hospitals May Have Strings Attached | Corporate Counsel (law.com)

• The Threat Landscape Is Always Changing: What to Expect in 2024  | Proofpoint US

• What is Lateral Movement in Cyber Security? - Security Boulevard

• Cyber Security and Trends in 2024 Based on WEF 2024 Outcomes | HackerNoon

• IT and Security Teams Increasingly United in Battle Against Sophisticated Cyberthreats, Research Finds (prnewswire.com)

• US suffered cyber attacks from 168 threat actors in 2023 | Security Magazine

• US continues to be leading cyber threat target | SC Media (scmagazine.com)

• Rise in cyber crime attacks against Industrial IoT sparks alarm (securitybrief.co.nz)

• Offshore wind farms are vulnerable to cyber attacks, study shows (techxplore.com)

• Government Security Vulnerabilities Surge By 151%, Report Finds - Infosecurity Magazine (infosecurity-magazine.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 23 January 2024 – Apple, Atlassian, Ivanti and VMware Vulnerabilities Under Active Exploitation

Executive Summary

Vulnerabilities in Apple, Atlassian, Ivanti and VMware are currently being actively exploited in the wild. All of the vendors have a security patch available to address the vulnerabilities and due to the active exploitation of the vulnerabilities, it is recommended to apply them immediately.

---

Apple

Following  a report that Chinese authorities revealed they have used previously known vulnerabilities in Apple's AirDrop functionality to help law enforcement, Apple have released a patch for an actively exploited critical Zero-day in iOS, iPadOS, macOS, tvOS and Safari web browser,. The zero-day vulnerability is a type confusion exploit that allows an attacker to perform arbitrary code execution.

Impacted Versions:

iOS 17.3 and iPadOS 17.3 - iPhone XS and later, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later, and iPad mini 5th generation and later

iOS 16.7.5 and iPadOS 16.7.5 - iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation

macOS Sonoma 14.3 - Macs running macOS Sonoma

macOS Ventura 13.6.4 - Macs running macOS Ventura

macOS Monterey 12.7.3 - Macs running macOS Monterey

Safari 17.3 - Macs running macOS Monterey and macOS Ventura

What can I do?

Updates to vulnerable devices should be applied immediately due to this vulnerability being under active exploitation.

---

Atlassian

Following the disclosure of the Atlassian Confluence vulnerability, it has become a target for active exploitation. Researchers have observed attackers attempting to exploit this vulnerability. At present, there are 11,000 Confluence instances exposed on the internet, and Shadowserver has recorded nearly 40,000 exploitation attempts. For further information on the vulnerability see our advisory posted linked below.

---

Ivanti

Following the public disclosure of two Ivanti vulnerabilities being actively exploited, a third vulnerability has now been added to the CISA’s Known Exploited Vulnerabilities (KEV) Catalog.

CVE-2023-35082 - This vulnerability enables a remote unauthorised attacker to access users’ personally identifiable information and make limited modifications to the server.

Impacted versions:

his vulnerability impacts all versions of Ivanti Endpoint Manager Mobile (EPMM) 11.10, 11.9, and 11.8. MobileIron Core 11.7 and earlier versions are also affected by this vulnerability.

What can I do?

Ivanti released a patch for this vulnerability in August 2023. It is recommended to update any impacted products to version 11.11.0.0 or later to safeguard them from this vulnerability.

---

VMware

A critical vulnerability in VMware vCenter Server Management has been exploited in the wild by a Chinese hacking group since 2021. The vulnerability (CVE-2023-34048) allows an attacker to write out of bounds potentially leading to remote code execution. VMware released a patch in October 2023 stating that it was not under active exploitation. VMware have recommend customers update to the latest version, which is 9.0U2.

Further Information

---

For further information on Ivanti and Atlassian see our previous advisory:

https://www.blackarrowcyber.com/blog/advisory-17-january-2024-citrix-ivanti-atlassian-oracle-sonicwall-vmware-security-updates

Apple

Further details on the Apple vulnerabilities can be found here:

https://support.apple.com/en-gb/HT201222

Ivanti

Further details on the Ivanti vulnerabilities can be found here:

https://forums.ivanti.com/s/article/KB-Remote-Unauthenticated-API-Access-Vulnerability-CVE-2023-35082?language=en_US

https://www.cisa.gov/news-events/alerts/2024/01/18/cisa-adds-one-known-exploited-vulnerability-catalog

VMware

Further details on the VMware  vCenter Server Management vulnerability can be found here:

https://www.vmware.com/security/advisories/VMSA-2023-0023.html

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity 

Black Arrow Cyber Threat Briefing 19 January 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

World Economic Forum and UN Warn of Growing ‘Cyber Insecurity’ Amid Heightened Threat Landscape

The World Economic Forum (WEF) and the United Nations (UN) have highlighted “cyber insecurity” as one of the most critical challenges facing organisations worldwide. A recent report reveals that over 80% of surveyed organisations feel more exposed to cyber crime than in the previous year, leading to calls for increased collaboration across sectors and borders to enhance business resilience. The study shows a growing gap in cyber resilience between organisations, with small and medium-sized enterprises facing declines of 30% in cyber resilience. Moreover, the cyber skills shortage continues to widen, with only 15% of organisations optimistic about improvements in cyber education and skills.

The report also underscores the impact of generative AI on cyber security, emphasising the need for ongoing innovation in digital security efforts. According to a separate report by the United Nations Office on Drugs and Crime, there has been a significant uptick in the use of large language model-based chatbots, deepfake technology, and automation tools in cyber fraud operations. These technologies pose a significant threat to the formal banking industry and require focused attention from authorities to counter their impact. The convergence of these trends underscores the urgency and complexity of the cyber security landscape.

Sources: [ITPro] [The Debrief]

Cyber Attacks Reveal Fragility of Financial Markets as Attacks on Financial Services Sector Surge

The financial sector is facing an increased risk from cyber attacks, with cyber security now being listed as the top systemic risk according to a Bank of England survey. Cyber attacks rose by 64% in 2023, with a shift towards AI-facilitated ransomware attacks and Vendor Email Compromise (VEC), which rose 137%, and Business Email Compromise (BEC) attacks, which rose by 71%, both of which exploit human error and pose a severe threat to the industry.

However, there is a lack of readiness by financial organisations to manage cyber attacks due to sophisticated attacks, talent shortages, and insufficient cyber defence investments. Ransomware incidents reported to the UK’s Financial Conduct Authority doubled in 2023, making up 31% of cyber incidents, up from 11% in 2022. The financial sector remains a prime target for cyber criminals, especially ransomware groups.

Sources: [ITPro] [Law Society] [Security Brief] [Financial Times]  [Infosecurity Magazine]

Researcher Uncovers One of The Biggest Password Dumps in Recent History

Researchers have found that nearly 71 million unique stolen credentials for logging into websites such as Facebook, Roblox, eBay, Coinbase and Yahoo have been circulating on the Internet for at least four months. The massive amount of data was posted to a well-known underground market that brokers sales of compromised credentials.

Whilst there is a large number of re-used passwords in the data dump, it appears to contain roughly 25 million new passwords and 70 million unique email addresses. This serves as a crucial reminder about properly securing accounts, such as not reusing passwords, using a password manager and securing accounts with multi factor authentication.

Source: [Ars Technica]

Email Nightmare: 94% of Firms Hit by Phishing Attacks in 2023

Email security remained at the forefront of cyber related issues for decision-makers, with over nine in ten (94%) having to deal with a phishing attack, according to email security provider Egress. The top three phishing techniques used in 2023 were malicious URLs, malware or ransomware attachments, and attacks sent from compromised accounts. 96% of targeted organisations were negatively impacted by these attacks, up 10% from the previous year.

Source: [Infosecurity Magazine]

75% of Organisations Hit by Ransomware in 2023

A recent report found that 75% of participants suffered at least one ransomware attack last year, and 26% were hit four or more times. The report noted that of the 25% who claimed to not have been hit, some could have been a victim but may not have the facilities to detect and therefore be aware as such. Ransomware remains a security threat and no organisation is immune.

Source: [Infosecurity Magazine]

The Dangers of Quadruple Blow Ransomware Attacks

With the introduction of new regulatory requirements like NIS 2.0 and changes to US Securities and Exchange Commission (SEC) statutes, organisations are now mandated to promptly report cyber incidents, sometimes with deadlines as tight as four days. However, attackers are evolving their tactics to exploit these regulations. They add a new level of coercion by threatening to report non-compliant organisations to the regulator, thereby increasing the pressure on their victims. This was first seen last year as a ransomware gang AlphV reported one of its victims, MeridianLink, to the SEC for failing to report a successful cyber attack.

This coercive strategy places immense pressure on companies, especially as they grapple with data encryption, data exfiltration, and public exposure threats. In response to these evolving threats and regulatory pressures, organisations must invest in cyber resilience. This enables them to effectively respond to attacks, communicate with regulators, and recover services promptly, ultimately fortifying their defences against future threats.

Source: [TechRadar]

Human Error and Insiders Expose Millions in UK Law Firm Data Breaches

UK law firms are falling victim to data breaches primarily because of insiders and human error, according to an analysis of data from the Information Commissioner’s Office (ICO). According to research, 60% of data breaches in the UK legal sector where the result of insider actions. In total, breaches led to the exposure of information of 4.2 million people. Often, even those organisations that implement measures to prevent breaches will still miss insider risk. Insider risk is not always malicious; it can also be negligence or due to a lack of knowledge, and it is important to protect against it.

Source: [Infosecurity Magazine]

It’s a New Year and a Good Time for a Cyber Security Checkup

2023 brought a slew of high-profile vulnerabilities and data breaches impacting various sectors, including healthcare, government, and education. Notable incidents included ransomware attacks, such as the MOVEit, GoAnywhere, and casino operator breaches, along with the exploitation of unpatched legacy vulnerabilities like Log4j and Microsoft Exchange. Furthermore, new regulatory requirements from the likes of the US Securities Exchange Commission (SEC), and state security and privacy laws, added to the complexity. As we enter 2024, it is crucial for organisations, regardless of size, to reassess their cyber security strategies, incorporating lessons learned and adapting to new requirements. Comprehensive cyber security programs encompass people, operations and technology, addressing the confidentiality, integrity, and availability of information.

Black Arrow can help with comprehensive and impartial assessments including gap analyses and security testing. These provide you with the objective assurance you need to understand whether your controls are providing you with your intended security and risk management.

Source: [JDSupra]

Applying the Tyson Principle to Cyber Security: Why Attack Simulations are Key to Avoiding Disaster

Mike Tyson’s famous adage “Everyone has a plan until they get punched in the face," is something we too often see in the world of security. When it comes to cyber security, preparedness is not just a luxury but a necessity. Far too often, unrealistic expectations in cyber defences create a false sense of security, leading to dire consequences when the reality of an attack hits. No-one wants to be testing their defences and implementing their response plan for the first time during a real incident.

In comes the benefit of incident and attack simulations: a reality check of your defences in a safe environment. Regular tabletop war-gaming exercises that simulate the fall out of an attack for senior leadership, can help to build muscle memory for when something does happen. They make sure everyone knows what to do, and crucially also not to do, when such an event happens for real. A deeper exercise would be a simulated attack that can be systematic and controlled, to mimic a real attacker and then adapted as attackers change their tactics, techniques, and procedures. From simulations, organisations can assess how their defences performed, applying insights and measuring and refining their defences for the event of a real attack.

Source: [The Hacker News]

Cyber Threats Top Global Business Risk Concern for 2024

Cyber related incidents, including ransomware attacks, data breaches and IT disruptions are the biggest concern for companies globally in 2024, according to a recent report by Allianz. The report highlights that these risks are a concern for businesses of all sizes, but the resilience gap between large and small companies is widening, “as risk awareness among larger organisations has grown since the pandemic with a notable drive to upgrade resilience.” Smaller businesses lack the time and resources that larger organisations have available, and as such need to carefully select and prioritise their resilience efforts.

Source: [Insurance Journal]

Generative AI has CEOs Worried About Cyber Security, PwC Survey Says

A recent PwC global survey found that when it comes to generative AI risks, 64% of CEOs said they are most concerned about its impact on cyber security, with over half of the total interviewed stating concerns about generative AI spreading misinformation in their company.  When we think of generative AI, we often worry about outside risk and the impact it can have for attackers, but the risk can also be internal, with things such as accidental disclosure by employees to unregulated generative AI. There is a necessity for organisations to govern the usage of AI in their corporate environment, to prevent such risks.

Source: [Quartz]

With Attacks on the Upswing, Cyber Insurance Premiums Poised to Rise Too

As the threat landscape continues to evolve, the cyber insurance market is experiencing significant changes that will impact businesses in the coming months with experts predicting that cyber insurance costs are on the verge of an upward trend. The COVID-19 pandemic and the shift to remote work and the cloud disrupted the cyber insurance market, leading to rising costs and reduced coverage options. In 2022, a temporary respite saw lower premiums, but 2023 has seen a resurgence in attacker activity, making it a challenging year for insurers. Cyber insurance remains a critical component of risk management, with the industry expected to continue growing despite higher rates. For businesses, understanding the evolving landscape of cyber insurance and ensuring adequate coverage is crucial in the face of escalating cyber threats.

Source: [Dark Reading]

Digital Resilience: a Step Up from Cyber Security

In today's digital landscape, the focus on digital resilience is paramount for organisations. While cyber security has garnered attention, digital resilience is the new frontier. Digital resilience involves an organisation's ability to maintain, adapt, and recover technology-dependent operations. As we increasingly rely on digital technology and the internet of things, understanding the critical role of technology in core business processes is vital. It goes beyond cyber security, encompassing change management, business resilience, operational risk, and competitiveness. Digital resilience means being ready to adopt new technology and swiftly recover from disruptions. Recognising its value and managing it at the senior level is crucial for long-term success in our rapidly evolving digital world. Moreover, amid a rising number of cyber attacks, addressing the statistic that only 18% of UK businesses provided cyber security training to employees last year is essential. Bridging this knowledge gap through cyber hygiene, a culture of cyber security, and robust safety measures will strengthen an organisation's cyber resilience against evolving threats.

Black Arrow supports organisations of all sizes in designing and delivering proportionate user education and awareness programmes, including in-person and online training as well as simulated phishing campaigns. Our programmes help secure employee engagement and build a cyber security culture to protect the organisation. 

Sources: [CSO Online] [Financial Times]

---

Governance, Risk and Compliance

• World Economic Forum warns of growing ‘cyber insecurity’ amid heightened threat landscape | ITPro

• Cyber Threats Top Global Business Risk Concern for 2024: Allianz (insurancejournal.com)

• Geopolitical tensions combined with technology will drive new security risks - Help Net Security

• JPMorgan suffers 45bn cyber attacks a day (ft.com)

• Improving Supply Chain Security, Resiliency (informationweek.com)

• Generative AI has CEOs worried about cyber security, PwC survey says (qz.com)

• As hacks worsen, SEC turns up the heat on CISOs | TechCrunch

• It’s a New Year and a Good Time for a Cyber Security Checkup | Clark Hill PLC - JDSupra

• Over 90 percent of organisations set to increase data protection spending (betanews.com)

• Financial organisations remain in cyber criminals' crosshairs (emergingrisks.co.uk)

• With Attacks on the Upswing, Cyber Insurance Premiums Poised to Rise Too (darkreading.com)

• Digital resilience – a step up from cyber security | CSO Online

• How to Recover After Failing a Cyber Security Audit - Security Boulevard

• Businesses Lack Confidence Overcome Cyber Attacks | Silicon UK

• Cyber incident response impaired by stress | SC Media (scmagazine.com)

• Key Considerations for Successful Cyber Security Supply Chain Risk Management (C-SCRM) - Security Boulevard

• Security considerations during layoffs: Advice from an MSSP - Help Net Security

• Effective Incident Response Relies on Internal and External Partnerships (darkreading.com)

• InfoSec 101: Why Data Loss Prevention is Important to Enterprise Defence (darkreading.com)

• Norton Rose Fulbright’s 19th Annual Litigation Trends Survey reveals heightened risk around cyber security and data protection amid AI boom (globenewswire.com)

• Applying the Tyson Principle to Cyber Security: Why Attack Simulation is Key to Avoiding a KO (thehackernews.com)

• How to improve cyber resilience across your workforce (ft.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• 75% of Organisations Hit by Ransomware in 2023 - Infosecurity Magazine (infosecurity-magazine.com)

• UK finance firms faced a torrent of ransomware attacks in 2023 as threat actors ramped up activities | ITPro

• Veeam Data Protection Trends Report 2024 Finds Cyber Attacks the #1 Cause of Business Outages | Business Wire

• Underwriters concerned about ransomware and supply-chain attacks: Woodruff Sawyer - Reinsurance News

• Akira ransomware attackers are wiping NAS and tape backups - Help Net Security

• Medusa Ransomware on the Rise: From Data Leaks to Multi-Extortion (thehackernews.com)

• The Top 10 Ransomware Groups of 2023 - Security Boulevard

• 3 Ransomware Group Newcomers to Watch in 2024 (thehackernews.com)

• Ransomware causes mental, physical trauma to security pros • The Register

• The dangers of quadruple blow ransomware attacks | TechRadar

• Ransomware: how financial institutions can prepare to react quickly through regulatory compliance (finextra.com)

• Ransomware: To Pay or Not to Pay — What the Experts Say | MSSP Alert

• Poorly secured PostgreSQL, MySQL servers targeted by ransomware bot - Help Net Security

• Outsmarting Ransomware’s New Playbook - SecurityWeek

• TeamViewer abused to breach networks in new ransomware attacks (bleepingcomputer.com)

• Ransomware negotiation: When cyber security meets crisis management - Help Net Security

Ransomware Victims

• Ransomware gang targets nonprofit providing clean water to world’s poorest (therecord.media)

• Capita hits back as pension holders look to sue over Russian-linked cyber attack (yahoo.com)

• British Library to share learning from cyber attack - Museums Association

• British Library starts restoring services online after hack - BBC News

• British cosmetics firm Lush confirms cyber attack (therecord.media)

• Delay to Manx Care dental services after cyber attack - BBC News

• Email threats to patients escalate after Fred Hutch cyber attack | The Seattle Times

• Majorca city Calvià extorted for $11M in ransomware attack (bleepingcomputer.com)

• A key part of Foxconn has been hit by the Lockbit ransomware | TechRadar

• Kansas State University cyber attack disrupts IT network and services (bleepingcomputer.com)

Phishing & Email Based Attacks

• Microsoft warns of new spearphishing attack targeting workers at top companies | TechRadar

• Email Nightmare: 94% of Firms Hit by Phishing Attacks in 2023 - Infosecurity Magazine (infosecurity-magazine.com)

• Vendor Email Attacks Surged by 137% in Financial Sector in 2023 - Infosecurity Magazine (infosecurity-magazine.com)

• Modular laptop maker Framework contacts customers after phishing scheme hooks internal spreadsheet packed with personal data | Tom's Hardware (tomshardware.com)

• US Secret Service court documents reveal new tactics in antivirus renewal phishing scam | TechRadar

• Threat Actors Team Up for Post-Holiday Phishing Email Surge (darkreading.com)

• Waiting for Your Pay Raise? Cofense Warns Against HR-Related Scams - Infosecurity Magazine (infosecurity-magazine.com)

• Flipping the BEC funnel: Phishing in the age of GenAI - Help Net Security

• US court docs expose fake antivirus renewal phishing tactics (bleepingcomputer.com)

• Email threats to patients escalate after Fred Hutch cyber attack | The Seattle Times

• Shipping-Themed Emails: Not Just for The Holidays - Security Boulevard

Artificial Intelligence

• AI driven cyber threats loom over business in the year ahead says report (emergingrisks.co.uk)

• Organised Crime is Leveraging Artificial Intelligence and Cryptocurrencies, Concerning New UN Report Says - The Debrief

• How cyber criminals are using AI to attack targets faster - Insurance Post (postonline.co.uk)

• Adversaries exploit trends, target popular GenAI apps - Help Net Security

• The Dual Role AI Plays in Cyber Security: How to Stay Ahead (bleepingcomputer.com)

• The power of AI in cyber security - Help Net Security

• Flipping the BEC funnel: Phishing in the age of GenAI - Help Net Security

• AI Could Make Cyber Threats Harder to Detect (newswise.com)

• If you don’t already have a generative AI security policy, there’s no time to lose | CSO Online

• Norton Rose Fulbright’s 19th Annual Litigation Trends Survey reveals heightened risk around cyber security and data protection amid AI boom (globenewswire.com)

2FA/MFA

• Senators want to know why the SEC’s X account wasn’t secured with MFA (engadget.com)

• Out with the old and in with the improved: MFA needs a revamp - Help Net Security

• MFA Spamming and Fatigue: When Security Measures Go Wrong (thehackernews.com)

Malware

• GitLab Releases Updates to Address Critical Vulnerabilities (darkreading.com)

• Updated Atomic Stealer malware emerges | SC Media (scmagazine.com)

• Data-theft malware exploits Windows Defender SmartScreen • The Register

• Windows PCs targeted by dangerous new threat that even gets around Defender - and even though there's a fix, you could still be at risk | TechRadar

• MacOS info-stealers quickly evolve to evade XProtect detection (bleepingcomputer.com)Balada Injector continues to infect thousands of WordPress sites (securityaffairs.com)

• 5 malware mistakes most people make while traveling and trying to charge (nypost.com)

• Inferno Drainer Spoofs Over 100 Crypto Brands to Steal $80m+ - Infosecurity Magazine (infosecurity-magazine.com)

• Remcos RAT Spreading Through Adult Games in New Attack Wave (thehackernews.com)

• Botnet activity surges as criminals get braver - can your business stand strong? | TechRadar

• JinxLoader Malware: Next-Stage Payload Threats Revealed - Security Boulevard

• $80M in Crypto Disappears Into Drainer-as-a-Service Malware Hell (darkreading.com)

• Bigpanzi botnet infects 170,000 Android TV boxes with malware (bleepingcomputer.com)

• Stealthy New macOS Backdoor Hides on Chinese Websites (darkreading.com)

• Securing Public Sector Against IoT Malware in 2024 - Security Boulevard

Mobile

• 5 malware mistakes most people make while traveling and trying to charge (nypost.com)

• New Tool Identifies Pegasus and Other iOS Spyware - Infosecurity Magazine (infosecurity-magazine.com)

Denial of Service/DoS/DDOS

• Environmental Websites Hit by DDoS Surge in COP28 Crossfire - Infosecurity Magazine (infosecurity-magazine.com)

Internet of Things – IoT

• Vulnerability Puts Bosch Smart Thermostats at Risk of Compromise - Infosecurity Magazine (infosecurity-magazine.com)

• Your washing machine could be sending 3.7 GB of data a day — LG washing machine owner disconnected his device from Wi-Fi after noticing excessive outgoing daily data traffic | Tom's Hardware (tomshardware.com)

• Bigpanzi botnet infects 170,000 Android TV boxes with malware (bleepingcomputer.com)

• Modernising print security for today’s working world | TechRadar

• Securing Public Sector Against IoT Malware in 2024 - Security Boulevard

Data Breaches/Leaks

• Human Error and Insiders Expose Millions in UK Law Firm Data Breaches - Infosecurity Magazine (infosecurity-magazine.com)

• Israeli civil servants' personal data latest casualty Iranian cyber war - The Jerusalem Post (jpost.com)

• Insufficient cyber security caused PSNI data breach  (iapp.org)

• Cyber Attack On Insurer Compromised Over 64K, Suit Says - Law360

• Modular laptop maker Framework contacts customers after phishing scheme hooks internal spreadsheet packed with personal data | Tom's Hardware (tomshardware.com)

• Email threats to patients escalate after Fred Hutch cyber attack | The Seattle Times

Organised Crime & Criminal Actors

• Just ten groups were responsible for nearly half of all cyber attacks last year | TechRadar

• Organised Crime is Leveraging Artificial Intelligence and Cryptocurrencies, Concerning New UN Report Says - The Debrief

• Threat Actors Team Up for Post-Holiday Phishing Email Surge (darkreading.com)

• GitLab Releases Updates to Address Critical Vulnerabilities (darkreading.com)

• Stupid Human Tricks: Top 10 Cyber Crime Cases of 2023 - Security Boulevard

• Illegal online casinos spread crypto-crime across Asia • The Register

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Senators Demand Probe into SEC Hack After Bitcoin Price Spike - Infosecurity Magazine (infosecurity-magazine.com)

• Organised Crime is Leveraging Artificial Intelligence and Cryptocurrencies, Concerning New UN Report Says - The Debrief

• Hacker spins up 1 million virtual servers to illegally mine crypto (bleepingcomputer.com)

• Inferno Drainer Spoofs Over 100 Crypto Brands to Steal $80m+ - Infosecurity Magazine (infosecurity-magazine.com)

• 29-Year-Old Ukrainian Cryptojacking Kingpin Arrested for Exploiting Cloud Services (thehackernews.com)

• Crypto Heists Surge in 2023, $16.93m Already Stolen in 2024 - Infosecurity Magazine (infosecurity-magazine.com)

• Illegal online casinos spread crypto-crime across Asia • The Register

Insider Risk and Insider Threats

• Human Error and Insiders Expose Millions in UK Law Firm Data Breaches - Infosecurity Magazine (infosecurity-magazine.com)

• Preventing insider access from leaking to malicious actors - Help Net Security

Insurance

• Underwriters concerned about ransomware and supply-chain attacks: Woodruff Sawyer - Reinsurance News

• Munich Re secures cyber war exclusions at 1.1 as wording tension dissipates | Insurance Insider

• With Attacks on the Upswing, Cyber Insurance Premiums Poised to Rise Too (darkreading.com)

• Re-writing the underwriting story: How to navigate the complexities of modern risks (allianz.com)

• Fighting ransomware: A guide to getting the right cyber security insurance | SC Media (scmagazine.com)

Supply Chain and Third Parties

• Underwriters concerned about ransomware and supply-chain attacks: Woodruff Sawyer - Reinsurance News

• Capita hits back as pension holders look to sue over Russian-linked cyber attack (yahoo.com)

• Improving Supply Chain Security, Resiliency (informationweek.com)

• Key Considerations for Successful Cyber Security Supply Chain Risk Management (C-SCRM) - Security Boulevard

Cloud/SaaS

• Insurance website's buggy API leaked Office 365 password • The Register

• As Enterprise Cloud Grows, So Do Challenges (darkreading.com)

• 29-Year-Old Ukrainian Cryptojacking Kingpin Arrested for Exploiting Cloud Services (thehackernews.com)

• 3 ways to combat rising OAuth SaaS attacks - Help Net Security

• FBI: Beware of cloud-credential thieves building botnets • The Register

• Weaponised AWS SES Accounts Anchor Massive Stealth Attack (darkreading.com)

Identity and Access Management

• Digital nomads amplify identity fraud risks - Help Net Security

Encryption

• New Report Charts Roadmap To A Quantum-Secure Financial System – Eurasia Review

Passwords, Credential Stuffing & Brute Force Attacks

• Researcher uncovers one of the biggest password dumps in recent history | Ars Technica

• GitHub scrambles to rotate keys after credentials in production containers were potentially exposed | ITPro

• Insurance website's buggy API leaked Office 365 password • The Register

• FBI: Beware of cloud-credential thieves building botnets • The Register

Social Media

• Senators Demand Probe into SEC Hack After Bitcoin Price Spike - Infosecurity Magazine (infosecurity-magazine.com)

Malvertising

• Latest Adblock update causes massive YouTube performance hit (bleepingcomputer.com)

Training, Education and Awareness

• The right strategy for effective cyber security awareness - Help Net Security

• Before starting your 2024 security awareness program, ask these 10 questions - Security Boulevard

• How to improve cyber resilience across your workforce (ft.com)

Regulations, Fines and Legislation

• Senators Demand Probe into SEC Hack After Bitcoin Price Spike - Infosecurity Magazine (infosecurity-magazine.com)

• As hacks worsen, SEC turns up the heat on CISOs | TechCrunch

• IT consultant in Germany fined for exposing shoddy security • The Register

• Data regulator fines HelloFresh £140K for sending 80M+ spams • The Register

• A Look at UK Domain and IP Address Seizures in the Criminal Justice Bill - ISPreview UK

• Why the US Needs Comprehensive Cyber Security Legislation - Security Boulevard

• Home improvement marketers dial up trouble from regulator • The Register

Models, Frameworks and Standards

• 10 cyber security frameworks you need to know about - Help Net Security

• NIST Offers Guidance on Measuring and Improving Your Company’s Cyber Security Program | NIST

Backup and Recovery

• Akira ransomware attackers are wiping NAS and tape backups - Help Net Security

Data Protection

• Over 90 percent of organisations set to increase data protection spending (betanews.com)

• Data regulator fines HelloFresh £140K for sending 80M+ spams • The Register

• Norton Rose Fulbright’s 19th Annual Litigation Trends Survey reveals heightened risk around cyber security and data protection amid AI boom (globenewswire.com)

Careers, Working in Cyber and Information Security

• Ransomware causes mental, physical trauma to security pros • The Register

• Protecting the protectors: combating stress in the cyber security industry | The Independent

• Best practices to mitigate alert fatigue - Help Net Security

• Universities not delivering the right skills for cyber security (betanews.com)

Law Enforcement Action and Take Downs

• 29-Year-Old Ukrainian Cryptojacking Kingpin Arrested for Exploiting Cloud Services (thehackernews.com)

• A Look at UK Domain and IP Address Seizures in the Criminal Justice Bill - ISPreview UK

Misinformation, Disinformation and Propaganda

• Staying cyber secure in the age of misdirection | The Independent

• FBI Warns of More Election Chaos in 2024 (darkreading.com)

• Election Security 2024: Biggest Cyber Threats and Practical Solutions - Infosecurity Magazine (infosecurity-magazine.com)

• OODA Loop - Elections Are Coming: Time to Sound Misinformation’s Clarion Call… Again

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• World Economic Forum warns of growing ‘cyber insecurity’ amid heightened threat landscape | ITPro

• Geopolitical tensions combined with technology will drive new security risks - Help Net Security

• Munich Re secures cyber war exclusions at 1.1 as wording tension dissipates | Insurance Insider

• Cyberwar continues to underperform (reason.com)

Nation State Actors

China

• End-of-life Cisco routers targeted by China’s Volt Typhoon group (therecord.media)

• Stealthy New macOS Backdoor Hides on Chinese Websites (darkreading.com)

• Feds warn China-made drones pose risk to US critical infrastructure | SC Media (scmagazine.com)

• China warns of AirDrop de-anonymisation flaw • The Register

Russia

• FBI Warns of More Election Chaos in 2024 (darkreading.com)

• Pro-Russia group hit Swiss govt sites after Zelensky visit in Davos (securityaffairs.com)

• Cyber Attack on Ukraine’s largest telecom provider will cost it about $100 million (therecord.media)

• Russia finds way around sanctions on battlefield tech: report – POLITICO

• Moscow imports a third of battlefield tech from western companies (ft.com)

• Prolific Russian hacking unit using custom backdoor for the first time | CyberScoop

• Ukrainian hackers successfully attack payment website of one of Russia's regional energy companies (yahoo.com)

Iran

• Israeli civil servants' personal data latest casualty Iranian cyber war - The Jerusalem Post (jpost.com)

• Threat-hunter says Iran is stepping up the sophistication of its cyber attacks (therecord.media)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• World Economic Forum warns of growing ‘cyber insecurity’ amid heightened threat landscape | ITPro

• Geopolitical tensions combined with technology will drive new security risks - Help Net Security

• Ukrainian hackers successfully attack payment website of one of Russia's regional energy companies (yahoo.com)

• Israeli civil servants' personal data latest casualty Iranian cyber war - The Jerusalem Post (jpost.com)

• Pro-Russia group hit Swiss govt sites after Zelensky visit in Davos (securityaffairs.com)

• New Tool Identifies Pegasus and Other iOS Spyware - Infosecurity Magazine (infosecurity-magazine.com)

---

Vulnerability Management

• Why we must bring order to cyber vulnerability chaos | TechRadar

Vulnerabilities

• CISA: Critical SharePoint vuln is under active exploitation • The Register

• Ivanti Connect Secure zero-days now under mass exploitation (bleepingcomputer.com)

• Juniper warns of critical RCE bug in its firewalls and switches (bleepingcomputer.com)

• Over 178,000 SonicWall next-generation firewalls (NGFW) online exposed to hack (securityaffairs.com)

• VMware Urges Customers to Patch Critical Aria Automation Vulnerability  - SecurityWeek

• Zero-Day Alert: Update Chrome Now to Fix New Actively Exploited Vulnerability (thehackernews.com)

• Two more Citrix NetScaler bugs exploited in the wild • The Register

• Atlassian warns of critical RCE flaw in older Confluence versions (bleepingcomputer.com)

• Millions of GPUs from Apple, AMD and Qualcomm have a serious security flaw — and it could put literally all your data at risk if it isn't fixed | TechRadar

• End-of-life Cisco routers targeted by China’s Volt Typhoon group (therecord.media)

• Apple Magic Keyboards are at risk from security attacks – update now to protect your Mac or iPad | TechRadar

• Windows 10 security update requires some major changes - experts only need apply | TechRadar

• GitLab Patches Critical Password Reset Vulnerability - SecurityWeek

• Balada Injector continues to infect thousands of WordPress sites (securityaffairs.com)

• Vulnerabilities Expose PAX Payment Terminals to Hacking - SecurityWeek

• Government, Military Targeted as Widespread Exploitation of Ivanti Zero-Days Begins - SecurityWeek

• Most older iPhones, Macs, and iPads are vulnerable to GPU flaw (appleinsider.com)

• New UEFI vulnerabilities send firmware devs across an entire ecosystem scrambling | Ars Technica

• China warns of AirDrop de-anonymisation flaw • The Register

• Drupal Releases Security Advisory for Drupal Core | CISA

• Vulnerability Puts Bosch Smart Thermostats at Risk of Compromise - Infosecurity Magazine (infosecurity-magazine.com)

• Opera MyFlaw Bug Could Let Hackers Run ANY File on Your Mac or Windows (thehackernews.com)

---

Tools and Controls

• Akira ransomware attackers are wiping NAS and tape backups - Help Net Security

• Underwriters concerned about ransomware and supply-chain attacks: Woodruff Sawyer - Reinsurance News

• Munich Re secures cyber war exclusions at 1.1 as wording tension dissipates | Insurance Insider

• How to improve your organisation's cyber hygiene score | World Economic Forum (weforum.org)

• With Attacks on the Upswing, Cyber Insurance Premiums Poised to Rise Too (darkreading.com)

• Digital resilience – a step up from cyber security | CSO Online

• If you don’t already have a generative AI security policy, there’s no time to lose | CSO Online

• Key elements for a successful cyber risk management strategy - Help Net Security

• Preventing insider access from leaking to malicious actors - Help Net Security

• Applying the Tyson Principle to Cyber Security: Why Attack Simulation is Key to Avoiding a KO (thehackernews.com)

• Over 90 percent of organisations set to increase data protection spending (betanews.com)

• As Enterprise Cloud Grows, So Do Challenges (darkreading.com)

• Best practices to mitigate alert fatigue - Help Net Security

• Modernising print security for today’s working world | TechRadar

• APIs in peril: Wallarm's latest report exposes uptick in API attacks and highlights security predictions for 2024 | Business Wire

• MFA Spamming and Fatigue: When Security Measures Go Wrong (thehackernews.com)

• Cyber incident response impaired by stress | SC Media (scmagazine.com)

• Effective Incident Response Relies on Internal and External Partnerships (darkreading.com)

• InfoSec 101: Why Data Loss Prevention is Important to Enterprise Defence (darkreading.com)

• Digital nomads amplify identity fraud risks - Help Net Security

• Out with the old and in with the improved: MFA needs a revamp - Help Net Security

• The right strategy for effective cyber security awareness - Help Net Security

• SOC-as-a-Service: The Five Must-Have Features - Security Boulevard

---

Other News

• Post Office scandal latest: MPs 'shocked' by evidence from Fujitsu and Post Office boss - as victims Alan Bates and Jo Hamilton say they were 'gaslit' | UK News | Sky News

• Post Office syndrome: why we’re more vulnerable than ever to Horizon-like computer systems | The Independent

• What’s on the Smartest Cyber Security Minds for 2024? (cybereason.com)

• How news organisations became a prime target for cyber attacks (pressgazette.co.uk)

• UK doubles spending on overseas cyber security projects (ft.com)

• Huge boost for global security with almost £1 billion government investment - GOV.UK (www.gov.uk)

• NCSC Builds New “Cyber League” Threat Tracking Community - Infosecurity Magazine (infosecurity-magazine.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 17 January 2024 – Citrix and Ivanti Vulnerabilities Under Active Exploitation - Atlassian, Oracle, SonicWall, and VMware also Address Security Flaws

Executive Summary

This week Atlassian, Citrix, Ivanti, Oracle, SonicWall and VMware have addressed multiple vulnerabilities across their product range. Included in the vulnerabilities addressed are two actively exploited 0-days, impacting Ivanti and Citrix products. At the time of writing, over 1700 Ivanti devices have been compromised and over 15,000 devices remain exposed.

Atlassian

CVE-2023-22527 - This exploit is a template injection vulnerability which if successfully exploited, allows an unauthenticated attacker to perform remote code execution on an affected instance.

Impacted Versions:

This vulnerability affects versions 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0-8.5.3.

What can I do?

Atlassian has released patches for the affected products, and it is advised to patch immediately. The listed Fixed Versions are no longer the most up-to-date and do not protect your instance from other non-critical vulnerabilities as outlined in Atlassian’s January Security Bulletin.

---

Citrix NetScaler

CVE-2023-6548 – Allows authenticated (low privileged user) remote code execution on Management interface. Requires access to NSIP, CLIP or SNIP with management interface.

CVE-2023-6549 - If exploited allows an attacker to perform a denial of service attack. Appliance must be configured as a gateway or AAA virtual server.

Impacted Versions:

NetScaler ADC and NetScaler Gateway 14.1 before 14.1-12.35

NetScaler ADC and NetScaler Gateway 13.1 before 13.1-51.15

NetScaler ADC and NetScaler Gateway 13.0 before 13.0-92.21

NetScaler ADC 13.1-FIPS before 13.1-37.176

NetScaler ADC 12.1-FIPS before 12.1-55.302

NetScaler ADC 12.1-NDcPP before 12.1-55.302

NetScaler ADC and NetScaler Gateway version 12.1 (currently end-of-life)

What can I do?

Citrix have released patches for the impacted products. Citrix have reported that this is being actively exploited and seen in the wild so it is advised that the patches are applied immediately.

---

Ivanti

CVE-2023-46805 - This is an authentication bypass which enables an attacker to access restricted resources by circumventing control checks.

CVE-2024-21887 - This is a command injection that lets authenticated admins execute arbitrary commands on vulnerable appliances.

Impacted Versions:

These vulnerabilities impact all supported versions, 9.x and 22.x

What can I do?

Ivanti have released mitigation files which can be found below, it is advised to install immediately. Patches are being developed however they are being staggered with the first patches being released on January 22nd and the final patches released on February the 19th.

---

Oracle

In their first Critical Patch Update of 2024, Oracle hae released 389 security patches, addressing 200 vulnerabilities. Financial Services Applications were the most impacted, with 71 new security patches. Oracle have urged all customers to apply the patches as soon as possible, warning that it periodically receives reports of in-the-wild exploitation of issues for which it has released fixes.

---

SonicWall

CVE-2022-22274 - This is a buffer overflow which if exploited successfully allows a remote unauthenticated attacker to cause a denial of service or potentially result in a code execution in the firewall.

CVE-2023-0656 - This is a buffer overflow which if exploited successfully allows a remote unauthenticated attacker to cause a denial of service attack which could cause the impacted firewall to crash.

What can I do?

SonicWall have released patches for affected products and it is advised to update to the latest available version.

---

VMware

CVE-2023-34063 – The affected products contain a missing access control vulnerability, which if successfully exploited, this vulnerability may lead to unauthorised access to remote organisations and workflows.

VMware Aria Automation (8.11.x, 8.12.x, 8.13.x, and 8.14.x)

VMware Cloud Foundation (4.x and 5.x)

What can I do?

VMware have released patches which can be found in the Security Advisory. It is advised to update as soon as possible. There are no current workarounds.

---

Further Information

Atlassian

Further details on the Atlassian vulnerabilities can be found here:

https://confluence.atlassian.com/security/cve-2023-22527-rce-remote-code-execution-vulnerability-in-confluence-data-center-and-confluence-server-1333990257.html

https://confluence.atlassian.com/security/security-bulletin-january-16-2024-1333335615.html

Citrix NetScaler

Further details on the Citrix NetScaler vulnerabilities can be found here:

https://support.citrix.com/article/CTX584986/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20236548-and-cve20236549

Ivanti

Further details on the Ivanti vulnerabilities can be found here:

https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US 

Oracle

Further details on the Oracle vulnerabilities can be found here:

https://www.oracle.com/security-alerts/cpujan2024.html

SonicWall

Further details on the SonicWall vulnerabilities can be found here:

https://bishopfox.com/blog/its-2024-and-over-178-000-sonicwall-firewalls-are-publicly-exploitable

VMware

Further details on the VMware vulnerability can be found here:

https://www.vmware.com/security/advisories/VMSA-2024-0001.html

https://core.vmware.com/resource/vmsa-2024-0001-questions-answers

---

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 12 January 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Boardrooms on Notice: Cyber Security Oversight More Important Than Ever

In 2023, the rise in security breaches and cyber attacks caused cyber security to transcend its usual confines and emerge as a critical boardroom concern, prompting executives to recognise the need for proactive engagement. The current landscape has necessitated executive decision-makers to proactively engage in cyber security, instead of just passively observing. It is no surprise that in a survey from KMPG of over 300 CEO’s, dealing with cyber risk was designated as the top priority for the foreseeable three to five years.

When a company faces a substantial fine or penalty from a breach, it serves two crucial purposes. Firstly, it sets a precedent for ensuring companies across the board understand the repercussions of lax cyber security measures and secondly, it pushes organisations towards proactive investment in robust cyber security frameworks. Many organisations are beginning to realise that the cost of a breach, both financial and reputational, far outweighs that of prevention. Furthermore, many frameworks are now placing the board as directly responsible.

Sources: [Lexology] [Security Brief]

Ransomware Incidents Reported to UK Financial Regulator Doubled in 2023

Ransomware reported to the UK financial regulator in 2023 doubled, and the impact is clear. In a survey of CISOs based in the UK, one-third confessed to paying ransomware groups millions in recent years in a bid to alleviate the impact of an attack. The minimum ransom paid by UK businesses across a five year period stood at around $250,000, the study found. Ransomware is the dominant threat that continues to plague organisations, and it is important that your organisation is doing all it can to prevent such an attack, and has plans in place to recover when such an attack happens.

Sources: [Data Breaches] [UK mortgage news] [The Hacker News]

Businesses Can’t Survive Without Their IT Systems – and They’re Under Attack More Than Ever

As organisations find themselves more and more reliant on digital technology than ever before, the impact of not having it becomes greater and greater. As reliance on these systems grows, the level of cyber threat grows as well. A recent report found 68% of those surveyed believed they would not survive more than a single day without their IT systems, up from 46% in 2017. The report found that 54% of organisations said they experienced some form of cyber attack last year, with ransomware cited as the most disruptive.

Source: [TechRadar]

Cyber Insecurity and Misinformation Top WEF Global Risk List

In the latest report by the World Economic Forum, misinformation and disinformation have emerged as the most severe global risk anticipated over the next two years, with the risk becoming more likely as elections in several economies take place this year. As artificial intelligence models become easier to use and more accessible to the general population, this will enable an explosion of false information and synthetic content such as cloned voices and fake websites.

Another top concern identified in the report is the risk of cyber attacks and cyber insecurities. Currently the production of AI technologies is highly concentrated; this creates a significant supply chain risk, as the reliance of one or two models could give rise to systemic cyber vulnerabilities, paralysing critical infrastructure.

Source: [Infosecurity Magazine]

Why Effective Cyber Security and Risk Management are Crucial for Business Growth

Technology has changed, enhanced and transformed how business is conducted. However, these new advancements such as cloud, IoT and AI have introduced a range of new cyber security risks. It is crucial for leaders to grasp the accompanying risks to ensure the safety of their organisations, customers and products. Given the inevitability of business risk, particularly cyber risk, leaders should focus on managing it by identifying mission-critical aspects of their organisation and then determining how best to protect them. The first step to a proactive approach to cyber security is to devise a robust and tailored cyber security strategy aligned to the organisation’s risk profile. This not only improves the safety and security of the organisation, but also the trust of its customers and products in an increasingly digital world.

Source: [World Economic Forum]

The Cost of Dealing with a Cyber Attack Doubled Last Year

New research by Dell claims that the cost of global cyber attacks reached a new high in 2023, topping out at $1.41 million per attack, up $660,000 from the previous year. It was found that almost half (48%) of UK based organisations reported suffering either a cyber attack or incident that prevented access to company data.

Over half of global respondents report that malicious links in spam or phishing emails, hacked devices, and stolen credentials are the most common entry points for cyber attacks.

Source: [TechRadar]

Merck Settles NotPetya Insurance Claim – Leaving Cyber Warfare Definition Unresolved

Merck’s long legal battle with its insurers over the damage caused by the infamous NotPetya attack has finally come to an end, with the Merck agreeing to settle with their insurer providers who had refused to pay $699 million of the $1.4 million that was claimed in damages.

The legal battle began when Merck, who did not have cyber insurance, had made a claim under its ‘all-risks’ coverage. In 2022, it was stated that the NotPetya attack “is not sufficiently linked to a military action or objective as it was a non-military cyber attack against an accounting software provider” and in May 2023, this decision was upheld, forcing the insurers to settle.

Source: [Security Week] [Dark Reading]

Mandiant, SEC Lose Control of X Accounts Without 2FA

While security teams are focused on preventing the gamut of different levels of cyber attack sophistication, it can be easy for even the sharpest teams to overlook the simple stuff. This was recently seen when Google’s cyber security operation, Mandiant, temporarily lost control of its account on X (formerly known as Twitter) due to not having two-factor authentication (2FA). A separate high-profile incident also occurred this week, as the US Securities and Exchange Commission (SEC) account on X was hijacked to post a fake announcement about bitcoin, raising its value by 5%.

In March of 2023, X changed the way multi-factor authentication (MFA) worked, so that only premium subscribers have access to it. The two high-profile attacks, which were due to accounts not having MFA, show that cyber criminals are taking advantage of these changes. These incidents serve as a clear reminder that organisations must prioritise even the most fundamental security practices, such as MFA, to protect their digital assets.

Further, the attack on the SEC has opened them to criticism from firms such as SolarWinds who the SEC had previously reprimanded for cyber security failures.

Source: [Dark Reading]

If you Prepare, a Data Security Incident Should Not Cause an Existential Crisis

A question to ask is why, in the event of a data security incident, is there an overwhelming feeling that the company is doomed? Yet when there are other issues, such as internal investigations, the feeling is not as strong. For a lot of companies, these cyber incidents are the first time that their cyber response plan (if they have one at all) is enacted and it is this lack of preparation that causes such a feeling.  Companies looking to increase their cyber resilience should look to have and regularly test a cyber incident response plan; you do not want to be in the position of having to learn your plan and deal with a cyber incident at the same time.

Source: [Help Net Security]

82% of Companies Struggle to Manage Security Exposure, with 28,000 New Vulnerabilities Reported Last Year

A substantial 82% of companies have reported a widening gap between security exposures and their ability to manage them according to a recent report. For many, the issue is caused by a lack of proper remediation solutions; this formed part of the reason why 87% of surveyed organisations reported plans to enhance vulnerability and exposure remediation within the next year. The need increases when considering last year there were more than 28,000 new vulnerabilities; that is the equivalent of nearly 80 every day.

Sources: [Infosecurity Magazine] [SecurityWeek]

Cyber Security is the Number One Priority for the Financial Sector Again

In Softcat's annual Business Tech Priorities Report, the financial sector's tech investments for the coming year have been unveiled. Notably, cyber security remains the top priority for the sector with 55% prioritising cyber security before anything else, reflecting the critical need to protect against the escalating threat landscape. It's important to understand that cyber security is not merely an IT problem; it is a business imperative. As consumers increasingly embrace digital banking, the impact of digitalisation on the financial sector is evident. With cyber incidents on the rise, investment in cyber security, including zero-trust security and AI threat hunting, is imperative for safeguarding not only data but the entire business.

Sources: [The Fintech Times] [Islamic Finance News]

Cyber Crime Marketplaces Soar in 2024: All Threats Now Available ‘As-a-Service’

In 2024, cyber crime marketplaces are expected to surge even more, transitioning every cyber threat further into the “as-a-service” model. The term “as-a-service” refers to the provision of specific functionalities or tools as a service, typically offered on a subscription or pay-as-you-go basis. This allows malicious actors with limited technical skills to launch sophisticated attacks. This trend was already being spotted at the end of 2023 as a report found that 73% of all internet traffic is currently composed of malicious bots and related fraud farm activities. This highlights the need for organisations to have accurate threat intelligence and analysis to understand the digital terrain ahead of these continued and expanding “as-a-service” threats.

Source: [Security Boulevard]

---

Governance, Risk and Compliance

• Businesses can't survive without their IT systems - and they're under attack more than ever | TechRadar

• If you prepare, a data security incident will not cause an existential crisis - Help Net Security

• 82% of Companies Struggle to Manage Security Exposure - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber Insecurity and Misinformation Top WEF Global Risk List - Infosecurity Magazine (infosecurity-magazine.com)

• IFN – Cyber Security: Not an IT problem, but a business one (islamicfinancenews.com)

• Cyber incidents hit 15% of global firms (tribune.com.pk)

• The cost of dealing with a cyber attack doubled last year | TechRadar

• Board Priorities 2024: Cyber preparedness & resilience - Lexology

• Boardrooms on notice: Cyber security oversight more important than ever (securitybrief.co.nz)

• What the Board Needs to Know About Exponential Disruption, Cyber Security, Risk Management and Strategy - OODA Loop

• Why cyber security and risk management are crucial for growth | World Economic Forum (weforum.org)

• XM Cyber's 2024 Survey on the State of Security Posture Reveals Remediation Efforts Falling Behind Surging Exposures (prnewswire.com)

• How to Plan Your Security Budget Without Compromising Your Security Stack - Security Boulevard

• The expanding scope of CISO duties in 2024 - Help Net Security

• War or Cost of Doing Business? Cyber Insurers Hashing Out Exclusions (darkreading.com)

• 2023 was a big year for cyber crime – here’s how we can make our systems safer | World Economic Forum (weforum.org)

• The Reality Of Cyber In 2024: What Dangers Do Businesses Face? - Minutehack

• Lions and tigers and bears, oh my! Global legal risks in cyber security investigations (iapp.org)

• The power of basics in 2024's cyber security strategies - Help Net Security

• Here's how to build a more inclusive cyber security strategy | World Economic Forum (weforum.org)

• DSIT launches UK Cyber Governance Project | UKAuthority

---

Threats

Ransomware, Extortion and Destructive Attacks

• Merck Settles NotPetya Insurance Claim, Leaving Cyberwar Definition Unresolved - Security Week

• How the Merck Case Shapes the Future of Cyber Insurance (databreachtoday.co.uk)

• British Library ransomware cyber attack ‘set to cost £7million’ (yahoo.com)

• Richard Osman among authors missing royalties amid ongoing cyber attack on British Library | British Library | The Guardian

• There is a Ransomware Armageddon Coming for Us All (thehackernews.com)

• UK CISO’s are cowing to ransomware demands more than you think, here’s why they shouldn’t pay up (databreaches.net)

• Ransomware incidents reported to UK financial regulator doubled in 2023 - The Intermediary - Latest UK mortgage news

• Ransomware victims targeted in follow-on extortion attacks • The Register

• Swatting: The new normal in ransomware extortion tactics • The Register

• Another top US mortgage firm hit by major cyber attack | TechRadar

• Capital Health attack claimed by LockBit ransomware, risk of data leak (bleepingcomputer.com)

• Wiper malware found in analysis of Iran-linked attacks on Albanian institutions (therecord.media)

• Babuk ransomware decryptor updated with Tortilla support • The Register

• "Security researcher" offers to delete data stolen by ransomware attackers - Help Net Security

• Pikabot Malware Surfaces As Qakbot Replacement for Black Basta Attacks (darkreading.com)

• Finland warns of Akira ransomware wiping NAS and tape backup devices (bleepingcomputer.com)

• Diving deep into Phobos ransomware. (thecyberwire.com)

• Ransomware payment ban: Wrong idea at the wrong time • The Register

Ransomware Victims

• In $1.4B coverage over cyber attack, Merck settles with insurers (fiercepharma.com)

• Merck Settles NotPetya Insurance Claim, Leaving Cyberwar Definition Unresolved - Security Week

• British Library says final cost of cyber attack is ‘not confirmed’ | Evening Standard

• 'Totally and utterly bereft' — the devastating repercussions of the British Library cyber attack (yahoo.com)

• Ransomware attackers threaten to send SWAT teams to patients of hacked hospitals - Neowin

• Mortgage firm loanDepot cyber attack impacts IT systems, payment portal (bleepingcomputer.com)

• Toronto Zoo: Ransomware attack had no impact on animal wellbeing (bleepingcomputer.com)

• LockBit ransomware gang claims the attack on Capital Health (securityaffairs.com)

• Fidelity National Financial says hackers stole data on 1.3 million customers | TechCrunch

• ICO hits hacked firm with GDPR reprimand | AccountingWEB

• HMG Healthcare Says Data Breach Impacts 40 Facilities - Security Week

• Full reopening of Isle of Man dentist delayed by 'serious cyber attack' | iomtoday.co.im

• Ransomware wrecks Paraguay’s largest telco (databreaches.net)

Phishing & Email Based Attacks

• Uncovering the hidden dangers of email-based attacks - Help Net Security

• Inside a $20 Million Coinbase Phishing Ring (404media.co)

• Framework discloses data breach after accountant gets phished (bleepingcomputer.com)

• Female cyber pros group targeted in phishing scam | IT Business

Artificial Intelligence

• Hackers are deliberately "poisoning" AI systems to make them malfunction, and there's no way to defend against it | ITPro

• Adapting Security to Protect AI/ML Systems (darkreading.com)

• AI-Powered Misinformation is the World’s Biggest Short-Term Threat, Davos Report Says - Security Week

• NIST identifies AI cyber security vulnerabilities (iapp.org)

• NIST: No Silver Bullet Against Adversarial Machine Learning Attacks - Security Week

• Why Cyber Security Is Foundational To AI Safety (forbes.com)

• FTC offers $25,000 prize for detecting AI-enabled voice cloning (bleepingcomputer.com)

• The growing challenge of cyber risk in the age of synthetic media - Help Net Security

• Securing AI systems against evasion, poisoning, and abuse - Help Net Security

• Staying One Step Ahead of Hackers When It Comes to AI | WIRED

• New AI tools spawn fears of greater 2024 election threats, survey finds - Nextgov/FCW

• AI discovers that not every fingerprint is unique (techxplore.com)

• VW AI move is greeted with caution as risks still real says expert (emergingrisks.co.uk)

2FA/MFA

• Mandiant, SEC Lose Control of X Accounts Without 2FA (darkreading.com)

• Security firm Mandiant says it didn’t have 2FA enabled on its hacked Twitter account • Graham Cluley

Malware

• Malware Takedowns Show Progress, But Fight Against Cyber Crime Not Over - Infosecurity Magazine (infosecurity-magazine.com)

• This new macOS backdoor lets hackers take over your Mac remotely — how to stay safe | Tom's Guide (tomsguide.com)

• A new macOS backdoor could let hackers hijack your device without you knowing | TechRadar

• Stealthy AsyncRAT malware attacks targets US infrastructure for 11 months (bleepingcomputer.com)

• North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught (darkreading.com)

• SpectralBlur: New macOS Backdoor Threat from North Korean Hackers (thehackernews.com)

• Threat Group Using Rare Data Transfer Tactic in New RemcosRAT Campaign (darkreading.com)

• Stuxnet: The malware that cost a billion dollars to develop? • Graham Cluley

• Wiper malware found in analysis of Iran-linked attacks on Albanian institutions (therecord.media)

• Linux devices are under attack by a never-before-seen worm | Ars Technica

• Pikabot Malware Surfaces As Qakbot Replacement for Black Basta Attacks (darkreading.com)

• ‘Yet another Mirai-based botnet’ is spreading an illicit cryptominer (therecord.media)

• Atomic Stealer Gets an Upgrade - Targeting Mac Users with Encrypted Payload (thehackernews.com)

• Pro-Iranian Hacker Group Targeting Albania with No-Justice Wiper Malware (thehackernews.com)

Mobile

• CISA warns agencies of fourth flaw used in Triangulation spyware attacks (bleepingcomputer.com)

• Android's January 2024 Security Update Patches 58 Vulnerabilities - Security Week

Internet of Things – IoT

• Russia Hacked Residential Cameras in Ukraine to Spy on Air Defence, Critical Infrastructure - Security Week

• Coming Soon to a Network Near You: More Shadow IoT - Security Week

• The Connection Between Alaska Airlines, Blown Out Windows, and IoT Security - Security Boulevard

• Surveyed drivers prefer low-tech cars over data-sharing ones • The Register

• VW AI move is greeted with caution as risks still real says expert (emergingrisks.co.uk)

Data Breaches/Leaks

• Law Firm Orrick Reveals Extensive Data Breach, Over Half a Million Affected - Security Week

• Framework discloses data breach after accountant gets phished (bleepingcomputer.com)

• Swiss Air Force sensitive files stolen in the hack of Ultra Intelligence & Communications (securityaffairs.com)

• 2.2 billion records compromised by security incidents In Dec 2023 (itsecuritywire.com)

• Texas-based care provider HMG Healthcare says hackers stole unencrypted patient data | TechCrunch

• Midwives clinic takes nine months to deliver news of data breach (bitdefender.com)

Organised Crime & Criminal Actors

• Cyber Crime Marketplaces Soar in 2024: All Threats Now Available ‘As-a-Service’ - Security Boulevard

• 19 xDedic Cyber Crime Market Users and Admins Face Prison - Infosecurity Magazine (infosecurity-magazine.com)

• 2023 was a big year for cyber crime – here’s how we can make our systems safer | World Economic Forum (weforum.org)

• Cyber Attacks Drain $1.84bn from Web3 in 2023 - Infosecurity Magazine (infosecurity-magazine.com)

• BreachForums admin jailed again for using a VPN, unmonitored PC (bleepingcomputer.com)

• Nigerian Gets 10 Years For Laundering Scam Funds - Infosecurity Magazine (infosecurity-magazine.com)

• Move Over, APTs: Common Cyber Criminals Begin Critical Infrastructure Targeting (darkreading.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Inside a $20 Million Coinbase Phishing Ring (404media.co)

• What Is Cryptojacking, and Why Is Higher Education Being Targeted? | EdTech Magazine

• UK politician criticizes X (formerly Twitter) after account hijacked by crypto scam (therecord.media)

• X users fed up with constant stream of malicious crypto ads (bleepingcomputer.com)

• North Korea's Cyber Heist: DPRK Hackers Stole $600 Million in Cryptocurrency in 2023 (thehackernews.com)

• Iranian crypto exchange Bit24.cash leaks user passports and IDs (securityaffairs.com)

• Netgear, Hyundai latest X accounts hacked to push crypto drainers (bleepingcomputer.com)

• Cryptocurrency community lost over $100 million last week (coinpaper.com)

• ‘Yet another Mirai-based botnet’ is spreading an illicit cryptominer (therecord.media)

• Child Abusers Are Getting Better at Using Crypto to Cover Their Tracks | WIRED

• Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks (thehackernews.com)

Insider Risk and Insider Threats

• Bribed US Navy sailor sold secrets to China for just $14k • The Register

Insurance

• How the Merck Case Shapes the Future of Cyber Insurance (databreachtoday.co.uk)

• War or Cost of Doing Business? Cyber Insurers Hashing Out Exclusions (darkreading.com)

• 2024 Cyber Insurance Requirements Predictions (trendmicro.com)

Supply Chain and Third Parties

• Framework discloses data breach after accountant gets phished (bleepingcomputer.com)

• Major IT, Crypto Firms Exposed to Supply Chain Compromise via New Class of CI/CD Attack  - Security Week

Cloud/SaaS

• SaaS cyber crime levels are expected to rise this year - Digital Journal

• Widening Disparities and Growing Threats Cloud Global Cyber security Outlook for 2024 > Press releases | World Economic Forum (weforum.org)

• Microsoft Lets Cloud Users Keep Personal Data Within Europe to Ease Privacy Fears - Security Week

• Why Public Links Expose Your SaaS Attack Surface (thehackernews.com)

Identity and Access Management

• Authentication is more complicated than ever. 4 ways to improve cyber defences for our new reality | ZDNET

Linux and Open Source

• Linux devices are under attack by a never-before-seen worm | Ars Technica

Passwords, Credential Stuffing & Brute Force Attacks

• Mandiant's X Account Was Hacked Using Brute-Force Attack (thehackernews.com)

• Security firm Mandiant says it didn’t have 2FA enabled on its hacked Twitter account • Graham Cluley

• What is credential stuffing and how do you keep your accounts safe from it (engadget.com)

Social Media

• SEC's Twitter account hacked to say Bitcoin ETFs approved. Politicians and lawyers demand investigation into security breach (bitdefender.com)

• Mandiant's X Account Was Hacked Using Brute-Force Attack (thehackernews.com)

• Security firm Mandiant says it didn’t have 2FA enabled on its hacked Twitter account • Graham Cluley

• X users fed up with constant stream of malicious crypto ads (bleepingcomputer.com)

• Fake Recruiters Defraud Facebook Users via Remote Work Offers (darkreading.com)

• Sexual assault in the metaverse investigated by British police • Graham Cluley

• Netgear, Hyundai latest X accounts hacked to push crypto drainers (bleepingcomputer.com)

• UK politician criticizes X (formerly Twitter) after account hijacked by crypto scam (therecord.media)

• Serious New Facebook Warning For Apple iPhone and Google Android Users (forbes.com)

• Why You Shouldn't Opt In to Facebook's Link History Feature (makeuseof.com)

• Coinbase Offers SEC Security Assistance After X Account Hack (beincrypto.com)

Malvertising

• X users fed up with constant stream of malicious crypto ads (bleepingcomputer.com)

• Serious New Facebook Warning For Apple iPhone and Google Android Users (forbes.com)

• Why You Shouldn't Opt In to Facebook's Link History Feature (makeuseof.com)

Regulations, Fines and Legislation

• ICO hits hacked firm with GDPR reprimand | AccountingWEB

• US DOD’s CMMC 2.0 rules lift burdens on MSPs, manufacturers | CSO Online

• SEC Speech on Cyber Security Disclosure | Paul Hastings LLP - JDSupra

• What does the EU’s Cyber Security Regulation aim to achieve? (siliconrepublic.com)

• SEC Had a Fraught Cyber Record Long Before X Account Was Hacked (bloomberglaw.com)

• SolarWinds Hits Back at SEC After Agency’s X Account Was Hacked (bloomberglaw.com)

• Mandiant, SEC Lose Control of X Accounts Without 2FA (darkreading.com)

• Cyber Criminal Whistleblowers will Get Smarter - Security Boulevard

• Ofcom poaches Big Tech staff in push to enforce new internet curbs (ft.com)

• Cyber Security | UK Regulatory Outlook January 2024 - Osborne Clarke | Osborne Clarke

Models, Frameworks and Standards

• NIST Fortifies Chatbots and Self-Driving Cars Against Digital Threats - Infosecurity Magazine (infosecurity-magazine.com)

• NIST identifies AI cyber security vulnerabilities (iapp.org)

• NIST: No Silver Bullet Against Adversarial Machine Learning Attacks - Security Week

Data Protection

• ICO hits hacked firm with GDPR reprimand | AccountingWEB

Careers, Working in Cyber and Information Security

• 68% of organizations face risks due to cyber security skills shortage | Security Magazine

Law Enforcement Action and Take Downs

• Malware Takedowns Show Progress, But Fight Against Cyber Crime Not Over - Infosecurity Magazine (infosecurity-magazine.com)

• 19 xDedic Cyber Crime Market Users and Admins Face Prison - Infosecurity Magazine (infosecurity-magazine.com)

• BreachForums admin jailed again for using a VPN, unmonitored PC (bleepingcomputer.com)

• Watchdog finds ‘sufficient’ cyber threat sharing at agencies, but barriers remain - Government Executive (govexec.com)

• Nigerian Gets 10 Years For Laundering Scam Funds - Infosecurity Magazine (infosecurity-magazine.com)

Misinformation, Disinformation and Propaganda

• Cyber Insecurity and Misinformation Top WEF Global Risk List - Infosecurity Magazine (infosecurity-magazine.com)

• AI-Powered Misinformation is the World’s Biggest Short-Term Threat, Davos Report Says - Security Week

• Only 4% of US States Fully Prepared for Cyber Attacks Targeting Electi - Infosecurity Magazine (infosecurity-magazine.com)

• New AI tools spawn fears of greater 2024 election threats, survey finds - Nextgov/FCW

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• War or Cost of Doing Business? Cyber Insurers Hashing Out Exclusions (darkreading.com)

• Merck settles with insurers regarding a $1.4 billion claim (securityaffairs.com)

• Merck Settles NotPetya Insurance Claim, Leaving Cyberwar Definition Unresolved - Security Week

• How the Merck Case Shapes the Future of Cyber Insurance (databreachtoday.co.uk)

Nation State Actors

China

• AI is helping US spies catch stealthy Chinese hacking ops, NSA official says | CyberScoop

• Bribed US Navy sailor sold secrets to China for just $14k • The Register

• China Claims It Caught a Foreign Consultant Spying for UK’s MI6 | TIME

• Volexity Catches Chinese Hackers Exploiting Ivanti VPN Zero-Days - Security Week

• China-Linked Volt Typhoon Hackers Possibly Targeting Australian, UK Governments - Security Week

Russia

• Merck settles with insurers regarding a $1.4 billion claim (securityaffairs.com)

• Merck Settles NotPetya Insurance Claim, Leaving Cyberwar Definition Unresolved - Security Week

• Russia Hacked Residential Cameras in Ukraine to Spy on Air Defence, Critical Infrastructure - Security Week

• Threat Group Using Rare Data Transfer Tactic in New RemcosRAT Campaign (darkreading.com)

• Military briefing: Russia has the upper hand in electronic warfare with Ukraine (ft.com)

• Russia's Sandworm blamed for Kyivstar telecom cyber attack • The Register

• Media: Ukrainian hackers hit Russian internet provider, claim they are preparing 'revenge for Kyivstar' (kyivindependent.com)

• Ukraine is on the front lines of global cyber security - Atlantic Council

Iran

• Wiper malware found in analysis of Iran-linked attacks on Albanian institutions (therecord.media)

• Who Is Behind Pro-Ukrainian Cyber Attacks on Iran? (darkreading.com)

• Pro-Iranian Hacker Group Targeting Albania with No-Justice Wiper Malware (thehackernews.com)

• Iranian crypto exchange Bit24.cash leaks user passports and IDs (securityaffairs.com)

• Dutch Engineer Used Water Pump to Get Billion-Dollar Stuxnet Malware Into Iranian Nuclear Facility: Report - Security Week

• Investigation on Stuxnet malware triggers doubt | SC Media (scmagazine.com)

North Korea

• North Korea Debuts 'SpectralBlur' Malware Amid macOS Onslaught (darkreading.com)

• North Korea's Cyber Heist: DPRK Hackers Stole $600 Million in Cryptocurrency in 2023 (thehackernews.com)

• South Korea's technological superiority challenged by North Korea's cyber attacks - The Korea Times

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Sea Turtle Cyber Espionage Campaign Targets Dutch IT and Telecom Companies (thehackernews.com)

• Turkish Hackers Target Microsoft SQL Servers in Americas, Europe - Security Week

• Turkish Cyber Spies Targeting Netherlands - Security Week

• Young Britons exposed to online radicalisation following Hamas attack - BBC News

• Who Is Behind Pro-Ukrainian Cyber Attacks on Iran? (darkreading.com)

• Media: Ukrainian hackers hit Russian internet provider, claim they are preparing 'revenge for Kyivstar' (kyivindependent.com)

• Hackers Dox Lawmakers Behind North Carolina Age Verification (dailydot.com)

• CISA warns agencies of fourth flaw used in Triangulation spyware attacks (bleepingcomputer.com)

---

Vulnerability Management

• 82% of Companies Struggle to Manage Security Exposure - Infosecurity Magazine (infosecurity-magazine.com)

• Vulnerability Handling in 2023: 28,000 New CVEs, 84 New CNAs - Security Week

• Researchers develop technique to prevent software bugs - Help Net Security

• Best Practices for Vulnerability Scanning: When and How Often to Perform - Security Boulevard

Vulnerabilities

• Microsoft January 2024 Patch Tuesday fixes 49 flaws, 12 RCE bugs (bleepingcomputer.com)

• Microsoft Patch Tuesday for January 2024 fixed 2 critical flaws (securityaffairs.com)

• Patch Now: Critical Windows Kerberos Bug Bypasses Microsoft Security (darkreading.com)

• Ivanti warns of Connect Secure zero-days exploited in attacks (bleepingcomputer.com)

• Cisco Patches Critical Vulnerability in Unity Connection Product - Security Week

• This new macOS backdoor lets hackers take over your Mac remotely — how to stay safe | Tom's Guide (tomsguide.com)

• KyberSlash attacks put quantum encryption projects at risk (bleepingcomputer.com)

• QNAP Patches High-Severity Flaws in QTS, Video Station, QuMagie, Netatalk Products - Security Week

• CISA Adds Six Known Exploited Vulnerabilities to Catalog | CISA

• Attacks aimed at vulnerable Apache RocketMQ servers underway | SC Media (scmagazine.com)

• Flaw in AI Plugin Exposes 50,000 WordPress Sites to Remote Attack - Infosecurity Magazine (infosecurity-magazine.com)

• Fortinet Releases Security Updates for FortiOS and FortiProxy | CISA

• Alert: New Vulnerabilities Discovered in QNAP and Kyocera Device Manager (thehackernews.com)

• Android's January 2024 Security Update Patches 58 Vulnerabilities - Security Week

• SAP's First Patches of 2024 Resolve Critical Vulnerabilities - Security Week

• Volexity Catches Chinese Hackers Exploiting Ivanti VPN Zero-Days - Security Week

• CISA Flags 6 Vulnerabilities - Apple, Apache, Adobe, D-Link, Joomla Under Attack (thehackernews.com)

• CISA Urges Patching of Exploited SharePoint Server Vulnerability - Security Week

• Over 150k WordPress sites at takeover risk via vulnerable plugin (bleepingcomputer.com)

• SQLi vulnerability in Cacti could lead to RCE (CVE-2023-51448) - Help Net Security

• Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks (thehackernews.com)

---

Tools and Controls

• Why Red Teams Can't Answer Defenders' Most Important Questions (darkreading.com)

• Continuity in Chaos: Applying Time-Tested Incident Response to Modern Cyber Security - Security Week

• Why Public Links Expose Your SaaS Attack Surface (thehackernews.com)

• APIs are increasingly becoming attractive targets - Help Net Security

• Whodunit in Cyber Space: The Rocky Road from Attribution to Accountability • Stimson Center

• Insufficient Internal Network Monitoring in Cyber Security - Security Boulevard

• Threat Actors Increasingly Abusing GitHub for Malicious Purposes (thehackernews.com)

• 4 ways data and AI tip the cyber security scales towards the defenders | World Economic Forum (weforum.org)

• How to Plan Your Security Budget Without Compromising Your Security Stack - Security Boulevard

• Authentication is more complicated than ever. 4 ways to improve cyber defences for our new reality | ZDNET

• Embracing offensive cyber security tactics for defence against dynamic threats - Help Net Security

• Lions and tigers and bears, oh my! Global legal risks in cyber security investigations (iapp.org)

• Here's how to build a more inclusive cyber security strategy | World Economic Forum (weforum.org)

• 2024 Cyber Insurance Requirements Predictions (trendmicro.com)

• Exposed Secrets are Everywhere. Here's How to Tackle Them (thehackernews.com)

---

Other News

• SEC Had a Fraught Cyber Record Long Before X Account Was Hacked (bloomberglaw.com)

• SolarWinds Hits Back at SEC After Agency’s X Account Was Hacked (bloomberglaw.com)

• Cyber Security is the Number One Priority for the Financial Sector Again, Says Softcat | The Fintech Times

• Cyber Focused FBI Agents Deploy to Embassies Globally (darkreading.com)

• A cyber attack hit the Beirut International Airport (securityaffairs.com)

• Cyber attacks on Island ‘are mostly from Russia’ - Jersey Evening Post

• Whodunit in Cyber Space: The Rocky Road from Attribution to Accountability • Stimson Center

• Hackers Dox Lawmakers Behind North Carolina Age Verification (dailydot.com)

• Threat Actors Increasingly Abusing GitHub for Malicious Purposes (thehackernews.com)

• XM Cyber's 2024 Survey on the State of Security Posture Reveals Remediation Efforts Falling Behind Surging Exposures (prnewswire.com)

• It’s 2024. Time to Have Attribution Standards in Cyber Space - OODA Loop

• Protecting Critical Infrastructure Means Getting Back to Basics (darkreading.com)

• 6 of the biggest threats banks faced in 2023 | American Banker

• Study reveals cyber risks to US elections | Computer Weekly

• US to hospitals: Meet security standards or no federal money • The Register

• After Barrage of Hacks, Hospitals Will Face New Federal Cyber Security Rules Tied to Funding (databreaches.net)

• Hospitals Must Treat Patient Data and Health With Equal Care (darkreading.com)

• Softcat reveals cyber security is top IT priority for the retail sector in 2024 | Retail Technology Review

• Cyber Security Risk Mitigation for Law Firms in 2024 | US Legal Support - JDSupra

• Cyber security challenges escalate for renewable energy amidst geopolitical crises - NS Energy (nsenergybusiness.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 11 January 2024 – Microsoft Patch Tuesday, Adobe, Android, Cisco, and SAP Updates

Executive summary

In its first Patch Tuesday of 2024, Microsoft has provided updates to address 49 security issues across its product range, including two critical vulnerabilities (CVE-2024-20700 and CVE-2024-20674). None of these vulnerabilities are listed as publicly known or under active exploitation. The two critical vulnerabilities affect Hyper-V, allowing remote code execution, and Kerberos, enabling attackers to bypass security features.

In addition to the updates from Microsoft, this week also saw Adobe fixing 6 vulnerabilities, Cisco patching 2 vulnerabilities, and Android addressing 59 vulnerabilities, none of which were critical. SAP also issued 12 new patches for its range of products, three of the patches were rated as critical.

What’s the risk to me or my business?

The vulnerabilities, if actively exploited could allow an attacker to perform remote code execution, the other vulnerability allows an attacker to perform a man in the middle attack and send a malicious message to impersonate themselves as the Kerberos authentication server, bypassing security features.

What can I do?

Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the critical vulnerabilities. Other patches should be applied in a reasonable time frame.

Technical Summary

CVE-2024-20700: This vulnerability if actively exploited, allows an attacker to impersonate the Kerberos authentication server and bypass security features.

CVE -2024-20674: This vulnerability if actively exploited, allows an attacker to perform remote code execution. Successful exploitation requires an attacker to gain access to the restricted network before running an attack.

Adobe

This month, Adobe has released fixes for six vulnerabilities that affect Adobe Substance 3D Stage 2.1.3 and earlier versions. None of these vulnerabilities were rated as critical. Currently, Adobe is not aware of any active exploitation of these vulnerabilities. The vulnerabilities include issues such as arbitrary code execution and memory leaks.

Android

In Google’s January Security Bulletin for Android, 59 vulnerabilities are addressed, including three that are critical in the Qualcomm section. None of these vulnerabilities appear to have been discovered and exploited by criminals prior to the release of the patches. The vulnerabilities include issues such as elevation of privileges and information disclosure.

Cisco

Cisco has released an update to address two privilege escalation CVEs in its Identity Services Engine (ISE). These vulnerabilities, which were disclosed in September, necessitate administrator-level privileges for exploitation. At present, Cisco has provided patches to rectify these issues, and no other workaround is available.

SAP

This month, SAP has released 12 patches, which include 10 new releases and 2 updates from previous releases. These patches address 3 critical vulnerabilities affecting a variety of SAP products. The vulnerabilities encompass a range of issues, including Privilege Escalation, Code Injection, Denial of Service, Information Disclosure, and Improper Authorisation.

---

Microsoft

Further details on other specific updates within this patch Tuesday can be found here:

https://www.theregister.com/2024/01/09/january_patch_tuesday/

https://www.ghacks.net/2024/01/09/the-first-windows-security-updates-of-2024-are-here/

Adobe

Further details of the vulnerabilities addressed in Adobe Substance 3D Stager be found here: https://helpx.adobe.com/security/products/substance3d_stager/apsb24-06.html

Android

Further details on the Android patches can be found here:

https://source.android.com/docs/security/bulletin/2024-01-01

Cisco

Further details on the Cisco patch can be found here:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-priv-esc-KJLp2Aw

SAP

Further information of the vulnerabilities address by SAP can be found here:
https://dam.sap.com/mac/app/e/pdf/preview/embed/ucQrx6G?ltr=a&rc=10

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 05 January 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

A “Ridiculously Weak“ Password Causes Disaster for Spain’s Number 2 Mobile Carrier

Spain’s second largest mobile operator, Orange España, suffered a major outage after an unknown party obtained a “ridiculously weak” password and used it to access an account for managing the network that delivers the company’s internet traffic. The attacker had posted the account they had compromised, and researchers found that the associated system had been infected with a Raccoon type infostealer back in September of 2023. The compromised account was Orange’s RIPE administrator account, with the password “ripeadmin”. The incident led to a 50% drop in connections for a 4 hour period, and  underscores the critical importance of robust cyber security measures, including strong passwords, and serves as a stark reminder that even seemingly minor oversights can lead to significant disruptions.

Source: [Ars Technica]

Russia Kyivstar Hack Should Alarm the West, Ukraine Security Chief Warns

If Ukraine's core telephone network can be taken out, organisations in the West could easily be next, Ukraine's SBU chief says. December's cyber attack on Ukrainian telecommunications operator Kyivstar by Russian-backed threat actor ‘Sandworm’ dealt a catastrophic blow to the telecoms provider, according to Illia Vitiuk, head of the Security Service of Ukraine's (SBU) cyber security department. It is believed that although the attack took place in December 2023, the threat actors likely had access to Kyivstar systems since May 2023.

Source: [Dark Reading]

23andMe Tells Victims It’s Their Fault Their Data Was Breached

A cyber incident at DNA data firm 23andMe started with credential stuffing 14,000 user accounts. Credential stuffing is the process by which a malicious actor uses previously harvested usernames and passwords from earlier unrelated breaches to break into other sites and services. Many of the 14,000 accounts had opted-in for a feature whereby information is shared with relatives, which meant that once compromised, attackers had access to 6.9 million users: nearly half of the user base.

Facing over 30 lawsuits from victims, 23andMe is now blaming victims, according to letters seen by victims. 23andMe stated “users negligently recycled and failed to update their passwords following these past security incidents, which are unrelated to 23andMe”. This has caused divide in the cyber world; on one side, recycling and failing to update passwords is poor cyber hygiene and on the other hand, there are technical controls that could have better prevented this type of well known and common attack.

Source: [TechCrunch] [The Register]

Financial Sector Faces More Cyber Attacks Than Other Sectors

A recent study found that more than three-quarters (77%) of financial organisations detected an attack on their infrastructures in 2023, compared with around two-thirds (68%) of other sectors. In particular, the study found that financial workers were at a higher than average risk of phishing compared to other workers. Despite their target attractiveness, only three-quarters (73%) of the financial sector respondents said that they have a cyber security policy in place or will do so within the next year. A separate report from Kaspersky stated that the financial sector is poised to experience an influx of artificial intelligence based attacks 2024, adding to the fire.

Sources: [SC Media] [TechRadar ]

An Innocent-Looking Instagram Trend Could Be a Gift to Hackers

A recent trend that has picked up traction at the end of December on social media apps such as Instagram and TikTok, encourages their followers to “get to know them better”. This trend gets people to answer a popular template, freely giving away personal information such as their height, date of birth, and various details that they feel strongly about including favourite food and phobias. While these questions may seem harmless, these sorts of personal details are used by companies for security questions, for example when a person wants to reset their password. Hackers can use this information to easily social engineer victims or impersonate them to get access to their accounts.

Source: [Business Insider]

Cyber Criminals Shared Millions of Stolen Records During Holiday Break

While many people unwind and enjoy their time off during the festive season, cyber criminals remain active. In fact, they leaked approximately 50 million records containing sensitive personal information during this period. These data breaches were not limited to the West; they had a global impact, affecting individuals in various countries such as Peru, Australia, South Africa, and more. It is important to note that not all the data leaks were recent; some appeared to be remnants of older incidents. For instance, some of the leaked data belonged to customers of the credit company Klarna, which was rumoured to have experienced a breach back in 2022, although it was never publicly confirmed. This ‘Free Leaksmas’ event, as it’s been dubbed, underscores the extensive global reach and serious consequences of these cyber criminal activities.

Sources: [Security Affairs] [Dark Reading]

Law Firm that Handles Data Breaches was Itself Hit by Data Breach

Orrick, Herrington & Sutcliffe, a law firm specialising in managing security incidents for other companies, has disclosed more details of the cyber attack it itself experienced in March 2023. The breach compromised the sensitive health and personal information of over 637,000 individuals. The stolen data was linked to client organisations and included the names of individuals alongside their social security numbers, medical details, and financial information. Despite the firm's expertise in cyber security, the attack highlights the pervasive risk of data breaches, even among those who advise on such matters. Orrick's delayed response and subsequent legal settlements underscore the importance of proactive security measures and swift action in the wake of a breach. This incident serves as a stark reminder to all organisations of the need for robust cyber defences and transparent communication strategies in today's digital landscape. The law firm has recently settled in principle to resolve four class action lawsuits that accused Orrick of failing to inform victims of the breach until months after the incident.

Source: [TechCrunch]

Nigerian Hacker Arrested for Stealing Millions from Charities

A Nigerian national, Olusegun Samson Adejorin, has been arrested for charges relating to business email compromise attacks that caused a charitable organisation in the US to lose more than $7.5 million. Adejorin had purchased a credential harvesting tool to steal login credentials, which were used to send emails to the charity’s financial service provider. The emails requested and authorised a transfer of $7.5 million, which the investment services provider believed it was paying to the charity whereas it was paying into a bank account controlled by the attacker.

Source: [Bleeping Computer]

Cyber Criminals Implemented Artificial Intelligence for Invoice Fraud

A cyber criminal gang known as GXC Team has been seen selling an artificial intelligence tool for creating fraudulent invoices. The tool, known as Business Invoice Swapper, scrutinises compromised emails that are fed to it, looking for emails which mention invoices or include invoice attachments. It then alters the details of the intended recipient to details specified by the perpetrator. This altered invoice then either replaces the compromised one, or is sent to a predetermined set of contacts.

Source: [Security Affairs]

Shadow IT Threatens Corporate Cyber Security, Study Reveals

With remote working becoming more and more prevalent, organisations are finding themselves at risk of cyber threats due to what is known as shadow IT; this is any software, hardware or IT resource used without the IT department’s approval, knowledge or oversight. A study by Kaspersky found of the 77% of companies that had suffered from cyber incidents over the past two years, 11% of these were directly caused by the unauthorised use of shadow IT.

Source: [Security Brief]

Escalating Cyber Threats: Bots, Fraud Farms, and Cryptojacking Surge

In the constantly evolving cyber threat landscape, 2023 has witnessed a notable surge in the use of bots, fraud farms, and cryptojacking. A new report found that 73% of web and app traffic this year has been attributed to malicious bots and fraud farms, indicating a significant shift towards automated cyber attacks. This trend poses a heightened risk to the ecommerce sector, where cyber criminals exploit API connections and third-party dependencies.

Furthermore, the surge in cryptojacking, marked by a 399% increase, reveals a diversifying strategy among cyber criminals, targeting critical infrastructure with sophisticated methods. These developments serve as a crucial reminder for organisations to bolster their cyber defences and adopt a proactive stance against these emerging and increasingly automated threats.

Source: [Help Net Security]

Putin has Declared a Cyber War on Britain

This year over 2 billion people will vote for new governments across the world, and it is crucial to be aware of upcoming threats to these elections from foreign powers. In particular, Russia is notorious for deploying bots, trolls, and deepfakes, which are techniques used to manipulate information and influence public opinion. These malicious actors are adept at spreading misinformation and disinformation, often with the goal of interfering in elections. With the upcoming UK General Election in 2024 and the US Presidential Election also falling this year, it is imperative to exercise caution and discernment when consuming online content. Not everything we see can be taken at face value.

Source: [Telegraph]

---

Governance, Risk and Compliance

• Thoughts for Boards: Key Issues in Corporate Governance for 2024 (harvard.edu)

• Escalating cyber threats: Bots, fraud farms, and cryptojacking surge, urgently requiring attention - Help Net Security

• Legal, compliance and privacy leaders anxious about rapid GenAI adoption - Help Net Security

• Navigating the New Age of Cyber Security Enforcement (darkreading.com)

• Facts and misconceptions about cyber security budgets - Help Net Security

• Budget cuts take a toll on IT decision makers' mental health - Help Net Security

• Consumers prepared to ditch brands after cyber security issues - Help Net Security

---

Threats

Ransomware, Extortion and Destructive Attacks

• Firms urged to stop ransomware payments as attacks become “astronomical” (emergingrisks.co.uk)

• How ransomware could cripple countries, not just companies (economist.com)

• New Black Basta decryptor exploits ransomware flaw to recover files (bleepingcomputer.com)

• ChatGPT-aided ransomware in China results in four arrests as AI raises cyber security concerns | South China Morning Post (scmp.com)

• Sophos reports spike in ransomware groups using remote encryption (securitybrief.co.nz)

• Cactus RANSOMWARE gang hit the Swedish retail and grocery provider Coop (securityaffairs.com)

• Police locate missing Chinese student who was victim of ‘cyber kidnapping’ (msn.com)

• Kai Zhuang: Cyber kidnapping in US illustrates growing crime trend - BBC News

• Ban on ransomware payments? The alternative isn't working • The Register

• December ransomware attacks disrupt healthcare organisations | TechTarget

• Ransomware's deadly toll: Hacking is killing patient as errors and delays plague healthcare systems, as 2,200 hospitals, schools and government entities were hit in 2023 | Daily Mail Online

• Study: Ransomware Is Actually Killing One American Per Month (tech.co)

• Zeppelin ransomware source code sold for $500 on hacking forum (bleepingcomputer.com)

Ransomware Victims

• Cyber attack on Massachusetts hospital disrupted records system, emergency services (therecord.media)

• Hospitals ask courts to force cloud storage firm to return stolen data (bleepingcomputer.com)

• Ransomware's deadly toll: Hacking is killing patients as errors and delays plague healthcare systems, as 2,200 hospitals, schools and government entities were hit in 2023 | Daily Mail Online

• Software Used by Hundreds of Museums Taken Down by Ransomware Attack (pcmag.com)

• CTS cyber attack: Disruption to home sales now over - BBC News

• Xerox says subsidiary XBS US breached after ransomware gang leaks data (bleepingcomputer.com)

• Cyber attackers breach trove of Victoria court recordings • The Register

• Bitter Pill: Third-Party Pharmaceutical Vendor Linked to Pharmacy and Health Clinic Cyber Attack (huntress.com)

• Estes refuses to pay off ransomware crew, says data stolen • The Register

Phishing & Email Based Attacks

• Numerous backdoors deployed in new Kimsuky spear-phishing attacks | SC Media (scmagazine.com)

• Russia's APT28 used new malware in a recent phishing campaign (securityaffairs.com)

• SMTP Smuggling: New Flaw Lets Attackers Bypass Security and Spoof Emails (thehackernews.com)

• CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK (thehackernews.com)

• UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT (thehackernews.com)

• Crypto phishing scams took almost $300M from 324K victims in 2023: Report (cointelegraph.com)

Artificial Intelligence

• Cyber Criminals Implemented Artificial Intelligence (AI) for Invoice Fraud (securityaffairs.com)

• The Imperative of Cyber Security in the Era of AI (thefastmode.com)

• Finance orgs to face increasingly prevalent AI cyber attacks | SC Media (scmagazine.com)

• Enterprise cyber security in 2024: The AI play comes to the fore - Verdict

• Law Firms Taken Aback By The Impact Of AI And The Rise Of Exclusions On Their Cyber Insurance Policies - Above the Law

• NIST Identifies Types of Cyber Attacks That Manipulate Behaviour of AI Systems | NIST

• AI watermarking could be exploited by bad actors to spread misinformation. But experts say the tech still must be adopted quickly | FedScoop

• Use of generative AI in the legal profession accelerating despite accuracy concerns | ITPro

• A New Kind of AI Copy Can Fully Replicate Famous People. The Law Is Powerless. - POLITICO

• ChatGPT-aided ransomware in China results in four arrests as AI raises cyber security concerns | South China Morning Post (scmp.com)

• CISO Planning for 2024 May Struggle When It Comes to AI (darkreading.com)

• Reflecting on Defence and Security Strategies in the AI Era: A New Perspective for Modern Nations - Modern Diplomacy

• Cyber resilience in the age of AI | TechRadar

• Legal, compliance and privacy leaders anxious about rapid GenAI adoption - Help Net Security

• AI Is Driving a Silent Cyber Security Arms Race (govtech.com)

Malware

• Google accounts may be vulnerable to new hack, changing password won’t help | Cybernews

• Malware abuses Google OAuth endpoint to ‘revive’ cookies, hijack accounts (bleepingcomputer.com)

• Microsoft patches critical vulnerability used to install malware on Windows PCs - MSPoweruser

• Microsoft disables Windows app installation, again • The Register

• CISA warns of a nasty flaw abusing Excel | TechRadar

• New Version of Meduza Stealer Released in Dark Web (securityaffairs.com)

• Weak password and infostealer blamed for Orange Spain outage • The Register

• Russia's APT28 used new malware in a recent phishing campaign (securityaffairs.com)

• Russian Military Intelligence Blamed for Blitzkrieg Hacks (inforisktoday.com)

• CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK (thehackernews.com)

• Kimsuky Hackers Deploying AppleSeed, Meterpreter, and TinyNuke in Latest Attacks (thehackernews.com)

• Activity of Rugmi malware loader spikes | SC Media (scmagazine.com)

• Kronos Malware Reemerges with Increased Functionality (securityintelligence.com)

• Malware attacks exploiting app installation protocol prompt deactivation | SC Media (scmagazine.com)

• New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections (thehackernews.com)

• 29 malware families target 1,800 banking apps worldwide - Help Net Security

• Google password resets not enough to stop this malware • The Register

• 21 New Mac Malware Families Emerged in 2023 - Security Week

• UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT (thehackernews.com)

• New Bandook RAT Variant Resurfaces, Targeting Windows Machines (thehackernews.com)

Mobile

• Europe's Largest Parking App Provider Informs Customers of Data Breach - Security Week

• How to prevent hackers from breaking into your Android, stealing bank info (nypost.com)

• QR code hacking: How to protect yourself from rogue QR codes (androidpolice.com)

• 29 malware families target 1,800 banking apps worldwide - Help Net Security

Denial of Service/DoS/DDOS

• Guarding against DDoS attacks during high-traffic periods | CSO Online

• Busting three common DDoS myths (betanews.com)

Internet of Things – IoT

• Study Finds IoT Cyber Security Risk Increased 400 Percent Last Year - RFID JOURNAL

• 4 essential smart home cameras tips to protect your sensitive data

• Ukraine says Russia hacked web cameras to spy on targets in Kyiv (therecord.media)

Data Breaches/Leaks

• Cyber Criminals launched 'Leaksmas' event in the Dark Web exposing massive volumes of leaked PII and compromised data (securityaffairs.com)

• 23andMe tells victims it’s their fault that their data was breached | TechCrunch

• Law firm that handles data breaches was hit by data breach | TechCrunch

• Europe's Largest Parking App Provider Informs Customers of Data Breach - Security Week

• Here we go again: 2023’s badly handled data breaches | TechCrunch

• Over 900k Impacted by Data Breach at Defunct Boston Ambulance Service - Security Week

• Data breach at healthcare tech firm impacts 4.5 million patients (bleepingcomputer.com)

• Highlands Oncology Group Notifies Patients of September 2023 Data Breach | Console and Associates, P.C. - JDSupra

• 'Cyber Toufan' Hacktivists Leaked 100-Plus Israeli Orgs in One Month (darkreading.com)

• Cyber Attacks Are Back in Hollywood. Did Sony Hack Teach Us Nothing? (variety.com)

• Accounting Firm Battling Cyber Security Lawsuit Seeks Dismissal (bloomberglaw.com)

Organised Crime & Criminal Actors

• Nigerian hacker arrested for stealing $7.5M from charities (bleepingcomputer.com)

• Hackers employ nuanced tactics to evade detection - Help Net Security

• The law enforcement operations targeting cyber crime in 2023 (bleepingcomputer.com)

• What’s It Like to Be the Victim of Cyber Crimes? (govtech.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Escalating cyber threats: Bots, fraud farms, and cryptojacking surge, urgently requiring attention - Help Net Security

• Beware: Scam-as-a-Service Aiding Cyber Criminals in Crypto Wallet-Draining Attacks (thehackernews.com)

• Crypto phishing scams took almost $300M from 324K victims in 2023: Report (cointelegraph.com)

• Cryptocurrency wallet CEO loses $125,000 in wallet-draining scam | Tripwire

• Cyber criminals set their sights on crypto markets - Help Net Security

• Orbit Chain loses $86 million in the last fintech hack of 2023 (bleepingcomputer.com)

• Crypto-crook Sam Bankman-Fried spared a second trial • The Register

• Bitconned review — Netflix documentary about a fortune built on brazen lies

• Hackers hijack govt and business accounts on X for crypto scams (bleepingcomputer.com)

Insurance

• 6 Cyber Security Insurance Requirements | Proofpoint US

• Cyber insurance should go hand in hand with cyber resilience | Insurance Business America (insurancebusinessmag.com)

• Law Firms Taken Aback By The Impact Of AI And The Rise Of Exclusions On Their Cyber Insurance Policies - Above the Law

Supply Chain and Third Parties

• Online museum collections down after cyber attack on service provider (bleepingcomputer.com)

• A new framework for third-party risk in the European Union | ITPro

Cloud/SaaS

• This company made a significant Google Drive security error that could put a million users at risk | TechRadar

• 5 Ways to Reduce SaaS Security Risks (thehackernews.com)

• 8 Hybrid Cloud Security Challenges and How to Manage Them (techtarget.com)

Identity and Access Management

• The password identity crisis: Evolving authentication methods in 2024 and beyond | VentureBeat

• Active Directory Infiltration Methods Employed by Cyber Criminals (gbhackers.com)

Encryption

• Quantum Risks and Rewards: Forward-Defending Cyber Security (govinfosecurity.com)

• Saving Schrödinger’s Cat: Getting serious about post-quantum encryption in 2024 - Breaking Defence

• Nearly 11 million SSH servers vulnerable to new Terrapin attacks (bleepingcomputer.com)

Linux and Open Source

• 2023: The Year Open Source Security Supply Chain Grew Up - The New Stack

Passwords, Credential Stuffing & Brute Force Attacks

• A “ridiculously weak“ password causes disaster for Spain’s No. 2 mobile carrier | Ars Technica

• 23andMe tells victims it’s their fault that their data was breached | TechCrunch

• The password identity crisis: Evolving authentication methods in 2024 and beyond | VentureBeat

• Using Stronger Passwords Among Top 2024 Digital Resolutions - Infosecurity Magazine (infosecurity-magazine.com)

Social Media

• Instagram Trend Could Be a Gift to Hackers (businessinsider.com)

• Social media made $11 billion in US ad sales from minors and therefore has 'overwhelming financial incentives' to avoid protecting children, study finds | Fortune

• Cyber Attackers Target Nuclear Waste Company via LinkedIn (darkreading.com)

• Cyber Criminals Flood Dark Web with X (Twitter) Gold Accounts (darkreading.com)

• Hackers hijack govt and business accounts on X for crypto scams (bleepingcomputer.com)

• Mandiant's Twitter Account Restored After Six-Hour Crypto Scam Hack (thehackernews.com)

Malvertising

• Google Settles $5 Billion Privacy Lawsuit Over Tracking People Using ‘Incognito Mode’ - Security Week

• Google Just Disabled Cookies for 30 Million Chrome Users. Here’s How to Tell If You’re One of Them. (gizmodo.com)

• Social media made $11 billion in US ad sales from minors and therefore has 'overwhelming financial incentives' to avoid protecting children, study finds | Fortune

Regulations, Fines and Legislation

• New risk management framework helps with SEC mandate compliance | CSO Online

• A new framework for third-party risk in the European Union | ITPro

• Finding The Silver Lining In Cyber Regulations (forbes.com)

• Navigating the New Age of Cyber Security Enforcement (darkreading.com)

Models, Frameworks and Standards

• An Overview Of The Defence Department’s Long-awaited Proposed Regulations For Its Cyber Security Maturity Model Certification Program | Morrison & Foerster LLP - Government Contracts Insights - JDSupra

Careers, Working in Cyber and Information Security

• Cyber security skills gap poses threat to business protection measures (securitybrief.co.nz)

• Many cyber security workers feel burnt out and worry about understaffing | TechRadar

Law Enforcement Action and Take Downs

• Police investigate virtual sex assault on girl's avatar - BBC News

• The law enforcement operations targeting cyber crime in 2023 (bleepingcomputer.com)

• Additional cyber agents to be deployed by FBI | SC Media (scmagazine.com)

Misinformation, Disinformation and Propaganda

• Vladimir Putin has declared a cyber war on Britain (telegraph.co.uk)

• AI watermarking could be exploited by bad actors to spread misinformation. But experts say the tech still must be adopted quickly | FedScoop

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• The FBI is adding more cyber focused agents to US embassies | CyberScoop

Nation State Actors

China

• CISA warns of a nasty flaw abusing Excel | TechRadar

• BT Miss Deadline to Remove All Huawei Kit from UK Core Network UPDATE - ISPreview UK

• ChatGPT-aided ransomware in China results in four arrests as AI raises cyber security concerns | South China Morning Post (scmp.com)

• Three Chinese balloons float near Taiwanese airbase • The Register

Russia

• Russia Kyivstar Hack Should Alarm West, Ukraine Security Chief Warns (darkreading.com)

• Russian hackers were inside Ukraine telecoms giant for months – cyber spy chief – Euractiv

• Ukraine says Russia hacked web cameras to spy on targets in Kyiv (therecord.media)

• UK exposes Russia for attempted political interference (ukdefencejournal.org.uk)

• Vladimir Putin has declared a cyber war on Britain (telegraph.co.uk)

• Russia's APT28 used new malware in a recent phishing campaign (securityaffairs.com)

• Russian Military Intelligence Blamed for Blitzkrieg Hacks (inforisktoday.com)

• CERT-UA Uncovers New Malware Wave Distributing OCEANMAP, MASEPIE, STEELHOOK (thehackernews.com)

• Massive missile strike disrupts Kyiv's internet and power supply (therecord.media)

• The "Tallinn Mechanism" is Designed to Enhance Civilian Cyber Assistance to Ukraine

• UAC-0050 Group Using New Phishing Tactics to Distribute Remcos RAT (thehackernews.com)

Iran

• Cyber attacks hit the Assembly of the Republic of Albania and telecom company One Albania (securityaffairs.com)

• Multiple organisations in Iran breached by a mysterious hacker (securityaffairs.com)

• Israel Battles Spike in Wartime Hacktivist, OT Cyber Attacks (darkreading.com)

• Pilfered Data From Iranian Insurance and Food Delivery Firms Leaked Online (darkreading.com)

North Korea

• Kimsuky Hackers Deploying AppleSeed, Meterpreter, and TinyNuke in Latest Attacks (thehackernews.com)

• Numerous backdoors deployed in new Kimsuky spear-phishing attacks | SC Media (scmagazine.com)

• Analysing DPRK's SpectralBlur

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• 'Everything on the internet is monitored': Israel's cyber security head - The Week

• 'Cyber Toufan' Hacktivists Leaked 100-Plus Israeli Orgs in One Month (darkreading.com)

• Israel Battles Spike in Wartime Hacktivist, OT Cyber Attacks (darkreading.com)

• Field spy or electronic espionage: Lebanon’s cyber security challenge against Israeli security breach - Lebanon News (lbcgroup.tv)

---

Vulnerability Management

• Apache ERP Zero-Day Underscores Dangers of Incomplete Patches (darkreading.com)

• 10 of the biggest zero-day attacks of 2023 | TechTarget

• Vulnerability management remains a moving target | SC Media (scmagazine.com)

Vulnerabilities

• Microsoft patches critical vulnerability used to install malware on Windows PCs - MSPoweruser

• CISA warns of a nasty flaw abusing Excel | TechRadar

• Google Patches Six Vulnerabilities With First Chrome Update of 2024 - Security Week

• Apache ERP Zero-Day Underscores Dangers of Incomplete Patches (darkreading.com)

• Ivanti warns critical EPM bug lets hackers hijack enrolled devices (bleepingcomputer.com)

• 10 of the biggest zero-day attacks of 2023 | TechTarget

• Vulnerabilities in Google Kubernetes Engine Could Allow Cluster Takeover - Security Week

• Malware attacks exploiting app installation protocol prompt deactivation | SC Media (scmagazine.com)

• Qualcomm chip vulnerability enables remote attack by voice call | SC Media (scmagazine.com)

• Nearly 11 million SSH servers vulnerable to new Terrapin attacks (bleepingcomputer.com)

• WordPress Google Fonts Plugin Vulnerability Affects Up To +300,000 Sites (searchenginejournal.com)

• January Android Security Bulletin Arrives, So Does Pixel Update (droid-life.com)

---

Tools and Controls

• Why training LLMs with endpoint data will strengthen cyber security | VentureBeat

• Cyber security challenges emerge in the wake of API expansion - Help Net Security

• 6 Cyber Security Insurance Requirements | Proofpoint US

• Are Security Appliances fit for Purpose in a Decentralized Workplace? - Security Week

• Guarding against DDoS attacks during high-traffic periods | CSO Online

• Cyber resilience in the age of AI | TechRadar

• 8 Hybrid Cloud Security Challenges and How to Manage Them (techtarget.com)

• Active Directory Infiltration Methods Employed by Cyber Criminals (gbhackers.com)

---

Other News

• Over 100 European Banks Face Cyber Resilience Test - Infosecurity Magazine (infosecurity-magazine.com)

• Can We Protect the Ballot Box? Global Guide to Election Cyber Threats - Infosecurity Magazine (infosecurity-magazine.com)

• ‘Lazy’ broadband engineers blamed for exposing hospitals and banks to cyber attacks (telegraph.co.uk)

• IT and OT cyber security: A holistic approach (securityintelligence.com)

• The FBI is adding more cyber focused agents to US embassies | CyberScoop

• Hackers hit Australian state's court recording database | Reuters

• Cyber Attacks Are Back in Hollywood. Did Sony Hack Teach Us Nothing? (variety.com)

• Healthcare breach costs soar requiring new thinking for safeguarding data (securityintelligence.com)

• Firm responsible for burying the UK’s nuclear waste faces repeated cyber attacks | Engineering and Technology Magazine (theiet.org)

• Securing the Defence Industrial Base | AFCEA International

• Reflecting on Defence and Security Strategies in the AI Era: A New Perspective for Modern Nations - Modern Diplomacy

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 29 December 2023

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

UK Ministers Publicly State Fears of Potential Widescale Power Grid Disruptions

The UK’s power network has long been an attractive target for enemies of the state and that remains true today. In fact, according to the UK Government, the risk of the whole country’s electricity system being shut down is growing. So are the dangers to citizens if it happens.

The UK’s National Risk Register, the official document assessing 89 different possible threats to the country, explains that a cyber attack on the National Grid could be launched by culprits “encrypting, stealing or destroying data upon which critical systems depend, or via disruption to operational systems”.

Source: [iNews]

Countries Brace for Influence Operations, AI and Hacking Campaigns Ahead of Historic 2024 Election Year, Could Upset World Balance

Billions of people around the world are expected to go to the polls and vote in 2024, in what will be the most significant election year in recent memory, and cyber security and government officials have already warned about countries using technology to influence operations. This includes disinformation campaigns and hacking attempts. Officials have further warned that artificial intelligence will likely be used to fuel such campaigns.

Sources: [The Record] [Security Affairs]

The Most Popular Passwords of 2023 are Easy to Guess and Crack

NordPass released a list of the top 200 common passwords recently, which included “123456” and “admin” as the top two. Of particular note, the top 40 passwords were all deemed to take less than 12 seconds to crack, or could be determined by an actor with no knowledge of the password. Many people would argue that there are so many passwords needed these days that it becomes hard to remember, hence their choice of easier passwords, and often reusing or recycling them across multiple sites and services. The use of a password manager can greatly reduce this need, requiring the user to only remember one password whilst also allowing for more complex and harder to crack passwords.

Source: [gHacks]

Dangerous Malware Pretends to be Some of Your Most Used Business Software

Hackers are using an old form of banking malware, known as Carbanak, to launch damaging ransomware attacks. Hackers are using compromised websites to host the malware, impersonating popular business-related software such as HubSpot, Veeam, or Xero.

Source: [TechRadar]

MFA Helps You Stay Resilient, But Nothing is a Silver Bullet

Multi-factor authentication (MFA) is a great resource for improving your organisation’s cyber resilience, but no technology is 100% secure and the human element will nearly always remain. With notable security breaches bypassing MFA to compromise organisations including Uber, games company EA, and authentication business Okta, organisations need to be aware that it is a possibility. As such, organisations need to ensure they implement MFA effectively and educate their users in their implementation; even the strongest of controls are rendered useless if they can be bypassed with one social engineering phone call.

Source: [Help Net Security]

Ransomware Leak Site Victims Reached Record-High in November

Corvus Threat Intel observed 484 new ransomware victims posted to leak sites in November. This represents a 39% increase from October and a 110% increase compared with November 2022. Further, this is the eleventh consecutive month in which there has been a year-on-year increase in ransomware victims, and the ninth with a victim count over 300.

Source: [Infosecurity Magazine]

MOVEit, Capita, CitrixBleed and More: The Biggest Data Breaches of 2023

2023 was a colossal year for data breaches, with the likes of MOVEit, Capita, Citrix, Royal Mail, MGM resorts and 3CX among some of the most significant victims. Such attacks have involved a number of vectors, such as file transfer vulnerabilities, social engineering, supply chain attacks and zero-day exploits. The result? Millions of people’s data compromised, and hundreds of millions paid out to attackers; the attack on MGM resorts alone is reported to have costed upwards of $100 million.

Source: [TechCrunch]

Europol Warns 443 Online Shops Infected with Credit Card Stealers

Europol has notified over 400 websites that their online shop had been hacked, with malicious scripts that steal card information from paying customers. The scripts are designed to intercept and steal payment card numbers, expiration dates, verification numbers, names, and shipping addresses, which are then uploaded to an attacker. This information is then used, or sold on the dark web to be used. Unfortunately, some of these attacks can go undetected for weeks or even several months.

Source: [Bleeping Computer]

Physical Access Systems Open Door to IT Networks

Cyber attackers can exploit access control measures installed on supposedly secure facility doors to gain unauthorised building access to sensitive locations, as well as breach internal IP networks directly from these systems, research has shown. At a recent leading security conference, analysts demonstrated this is an attack. Assets such as these can often be forgotten about and therefore omitted from protections, highlighting the need for organisations to have an up to date and accurate asset register.

Source: [Dark Reading]

Simple Hacking Techniques Prove Successful in 2023 Cyber Attacks

Hacking can be sophisticated, but often it is not sophisticated at all. Some of the biggest hacks this year started with what seemed like an innocent phone call, but which in fact were fairly simple social engineering attacks. Additionally, hackers continued to target companies that failed to promptly update their systems, even after patches were released to fix critical vulnerabilities. The best first step to protect an organisation is to establish a culture of good cyber security hygiene across people, operations and technology.

Source: [Pymnts]

Daily Malicious Files Rise to 411,000 a day in 2023

Cyber criminals unleashed an average of 411,000 malicious files every day in 2023, representing a 3% increase from the previous year, according to Kaspersky. Malicious desktop files in particular rose by 53%. Cyber criminals favoured Microsoft Office services’ vulnerabilities, which represented 69% of all exploited vulnerabilities.

Source: [Infosecurity Magazine]

Android Malware Actively Infecting Devices to Take Full Control

Android Malware is actively being used to take control of devices for illicit purposes, such as stealing sensitive information and enabling remote attacks, and least 327,000 devices are reported to have been infected with such malware. Research has found that amongst the most targeted countries are the UK and US. Often, for the malware to work, users need to allow it access to information such as contacts, email. In some cases, the user would only be aware they have consented if they were to manually check the apps settings. For organisations, this can mean employees bringing personal or work phones into the corporate environment, with malware potentially along for the ride.

Source: [GBhackers]

---

Governance, Risk and Compliance

• Third-party issues disrupt 45% of firms despite cyber security spends (securitybrief.co.nz)

• Strengthening Resilience: Navigating the Cyber Security Landscape (darkreading.com)

• 8 big IT failures of 2023 | CIO

---

Threats

Ransomware, Extortion and Destructive Attacks

• Ransomware Leak Site Victims Reached Record-High in November - Infosecurity Magazine (infosecurity-magazine.com)

• Rethinking data security in the age of ransomware and AI - SiliconANGLE

• Carbanak Banking Malware Resurfaces with New Ransomware Tactics (thehackernews.com)

• Do the casino ransomware attacks make the case to pay? • The Register

• Windows CLFS and five exploits used by ransomware operators | Securelist

• Cyber crime experts reveal how to infiltrate ransomware gangs • The Register

• How ransomware operators try to stay under the radar | Malwarebytes

• How many times are you going to think about ransomware in 2024? (betanews.com)

• The Most Dangerous People on the Internet in 2023 | WIRED

Ransomware Victims

• MOVEit, Capita, CitrixBleed and more: The biggest data breaches of 2023 | TechCrunch

• Lockbit ransomware disrupts emergency care at German hospitals (bleepingcomputer.com)

• Integris Health patients get extortion emails after cyber attack (bleepingcomputer.com)

• Ransomware Group Claims 100 Gb of Data Stolen From Nissan Australia - Security Week

• Indian IT services giant HCL Technologies hit by ransomware | TechRadar

• LockBit gang claims to have breached accountancy firm Xeinadin (securityaffairs.com)

• Rockstar Employee Details Reportedly Leaked By Hackers (thegamer.com)

• Australia’s Largest Auto Dealer Group Hit By Massive Cyber Attack | Carscoops

• After cyber attack, New York hospitals find stolen patient info stored in Massachusetts, look for its return (databreaches.net)

Artificial Intelligence

• Elections 2024, Artificial Intelligence could upset world balances (securityaffairs.com)

• Justice Secretary in Deepfake General Election Warning - Infosecurity Magazine (infosecurity-magazine.com)

• H2 2023 Threat Landscape Dominated by AI and Android Spyware - Infosecurity Magazine (infosecurity-magazine.com)

• Malicious GPT Can Phish Credentials, Exfiltrate Them to External Server: Researcher - Security Week

• Rethinking data security in the age of ransomware and AI - SiliconANGLE

• Largest Dataset Powering AI Images Removed After Discovery of Child Sexual Abuse Material (404media.co)

• GenAI Tools Will Permeate All Areas of the Enterprise (darkreading.com)

• Why data, AI, and regulations top the threat list for 2024 - Help Net Security

• 5 Ways that AI Is Set To Transform Cyber Security (informationweek.com)

• The Emerging Landscape of AI-Driven Cyber Security Threats: A Look Ahead - Security Week

• Skynet Ahoy? What to Expect for Next-Gen AI Security Risks (darkreading.com)

• Ethical Implications of AI in Cyber Security | HackerNoon

2FA/MFA

• 3 main tactics attackers use to bypass MFA - Help Net Security

Malware

• Carbanak Banking Malware Resurfaces with New Ransomware Tactics (thehackernews.com)

• This dangerous malware pretends to be some of your most-used business software tools, so watch out | TechRadar

• Iran's 'Peach Sandstorm' Cyber Attackers Target Global Defence Network (darkreading.com)

• Decoy Microsoft Word Documents Used to Deliver Nim-Based Malware (thehackernews.com)

• This growing malware threat actor is set to unleash a surge of attacks, experts warn | TechRadar

• 'BattleRoyal' Hackers Deliver DarkGate RAT Using Every Trick (darkreading.com)

• Microsoft disables MSIX protocol handler abused in malware attacks (bleepingcomputer.com)

• UAC-0099 Using WinRAR Exploit to Target Ukrainian Firms with LONEPAGE Malware (thehackernews.com)

• New Sneaky Xamalicious Android Malware Hits Over 327,000 Devices (thehackernews.com)

• Russian military hackers target Ukraine with new MASEPIE malware (bleepingcomputer.com)

• Fake VPN Chrome extensions force-installed 1.5 million times (bleepingcomputer.com)

• Chinese Hackers Deliver Malware to Barracuda Email Security Appliances via New Zero-Day - Security Week

• Daily Malicious Files Soar 3% in 2023, Kaspersky Finds - Infosecurity Magazine (infosecurity-magazine.com)

• Kimsuky Group Using Weaponized file Deploy AppleSeed Malware (cybersecuritynews.com)

• New Rugmi Malware Loader Surges with Hundreds of Daily Detections (thehackernews.com)

• Game mod on Steam breached to push password-stealing malware (bleepingcomputer.com)

• How the new Instegogram threat creates liability for organisations | CSO Online

Mobile

• TikTok makes users give iPhone passwords, reasons unclear (nypost.com)

• 'Most sophisticated' iPhone attack chain 'ever seen' used four 0-days to create a 0-click exploit - 9to5Mac

• Android Malware Actively Infecting Devices to Take Full Control (gbhackers.com)

• Chameleon Android Malware Can Bypass Biometric Security - Security Week

• H2 2023 Threat Landscape Dominated by AI and Android Spyware - Infosecurity Magazine (infosecurity-magazine.com)

• Apple reportedly faces pressure in India after sending out warnings of state-sponsored hacking (engadget.com)

• SMS Scams Set to Peak on Saturday in UK - Infosecurity Magazine (infosecurity-magazine.com)

Denial of Service/DoS/DDOS

• Essential DDoS statistics for understanding attack impact - Help Net Security

• How to Prepare for DDoS Attacks During Peak Business Times (darkreading.com)

• In Cyber Security and Fashion, What's Old Is New Again (darkreading.com)

Internet of Things – IoT

• Tech gifts you shouldn’t buy your family and friends for the holidays | TechCrunch

• Physical Access Systems Open Door to IT Networks (darkreading.com)

• Ho Ho Home For Christmas? Tips For Avoiding Tech Terrors This Festive Season - IT Security Guru

Data Breaches/Leaks

• MOVEit, Capita, CitrixBleed and more: The biggest data breaches of 2023 | TechCrunch

• Mortgage firm LoanCare warns 1.3 million people of data breach (bleepingcomputer.com)

• Real estate agency exposes details of 690k customers (securityaffairs.com)

• First, Rockstar Games Got Hacked, Then Sony's Insomniac, and now Ubisoft… Who's Next? - autoevolution

• Insomniac Games Releases Statement Over Recent Cyber Attack - Gameranx

• Ubisoft says it's investigating reports of a new security breach (bleepingcomputer.com)

• Rockstar Employee Details Reportedly Leaked By Hackers (thegamer.com)

• Inmate, Staff Information Stolen in Rhode Island Prison Data Breach - Security Week

• Mint Mobile discloses new data breach exposing customer data (bleepingcomputer.com)

• Hackers steal customer data from Europe’s largest parking app operator | Hacking | The Guardian

• Yakult Australia confirms 'cyber incident' after 95 GB data leak (bleepingcomputer.com)

• CBS, Paramount owner National Amusements says it was hacked | TechCrunch

• Panasonic discloses data breach after December 2022 cyber attack (bleepingcomputer.com)

• Customers warned after major car dealership group Eagers Automotive hacked | The West Australian

• Cyber Attacks Impacts Two Major Australian Companies Including Leaked Passports | The Epoch Times

• After cyber attack, New York hospitals find stolen patient info stored in Massachusetts, look for its return (databreaches.net)

Organised Crime & Criminal Actors

• Simple Hacking Techniques Prove Successful in Cyber Attacks (pymnts.com)

• Hackers stole $2 billion in crypto in 2023, data shows | TechCrunch

• Convicted Thief Reveals Cyber Crime Tactics - DevX

• The Most Dangerous People on the Internet in 2023 | WIRED

• Meet the cyber criminals of 2023 | TechCrunch

• Hacking or Social Engineering? What You Need to Know to Keep Yourself Safe | HackerNoon

• 3 Clues That Hackers May Know More About Your Business Than You Do | Inc.com

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Hackers stole $2 billion in crypto in 2023, data shows | TechCrunch

• Biggest Crypto Exploits and Hacks of 2023 - Decrypt

• Kyber Network Forced to Slash Staff by 50% After $46,500,000 Exploit, According to CEO - The Daily Hodl

• Warning: Poorly Secured Linux SSH Servers Under Attack for Cryptocurrency Mining (thehackernews.com)

• Hacking group Pink Drainer strikes again, pilfering $4.4M from just 1 victim (cointelegraph.com)

Supply Chain and Third Parties

• Third-party issues disrupt 45% of firms despite cyber security spends (securitybrief.co.nz)

• MOVEit, Capita, CitrixBleed and more: The biggest data breaches of 2023 | TechCrunch

Cloud/SaaS

• Researchers uncover major security issue in Microsoft Azure - here's what we know | TechRadar

• Data security and cost are key cloud adoption challenges for financial industry - Help Net Security

• The Future of Hybrid Cloud: What to Expect in 2024 and Beyond (techtarget.com)

Encryption

• Warning: Poorly Secured Linux SSH Servers Under Attack for Cryptocurrency Mining (thehackernews.com)

Linux and Open Source

• Warning: Poorly Secured Linux SSH Servers Under Attack for Cryptocurrency Mining (thehackernews.com)

Passwords, Credential Stuffing & Brute Force Attacks

• US water utilities were hacked after leaving their default passwords set to ‘1111,’ cyber security officials say (databreaches.net)

• The most popular passwords of 2023 are easy to guess and crack - gHacks Tech News

• Malicious GPT Can Phish Credentials, Exfiltrate Them to External Server: Researcher - Security Week

Social Media

• The Most Dangerous People on the Internet in 2023 | WIRED

• How the new Instegogram threat creates liability for organisations | CSO Online

Regulations, Fines and Legislation

• Europe Sees More Hacktivism, GDPR Echoes, and New Security Laws Ahead for 2024 (darkreading.com)

• Why data, AI, and regulations top the threat list for 2024 - Help Net Security

• Europe classifies three adult sites as worthy of its toughest internet regulations • The Register

• Countering Cyber Mercenaries | directions blog

• 5 US cyber security compliance deadlines in 2024 | SC Media (scmagazine.com)

• EU updates product liability regime to include software, Artificial Intelligence – EURACTIV.com

Models, Frameworks and Standards

• The US Department of Defence Releases Proposed CMMC Rule | Blank Rome LLP - JDSupra

Backup and Recovery

• 8 big IT failures of 2023 | CIO

Data Protection

• Europe Sees More Hacktivism, GDPR Echoes, and New Security Laws Ahead for 2024 (darkreading.com)

Careers, Working in Cyber and Information Security

• Cyber Employment 2024: Sky-High Expectations Fail Businesses & Job Seekers (darkreading.com)

• Top Tips from CISOs for CISOs - Infosecurity Magazine (infosecurity-magazine.com)

• How leaders can look after information security professionals | ITPro

• Building Mental Resilience: A CISO's Journey - GovInfoSecurity

• What Does the Future Hold for Today’s Cyber Security Leaders? (huntress.com)

• Will the Cyber Skills Gap Continue to Grow in 2024? - Infosecurity Magazine (infosecurity-magazine.com)

Law Enforcement Action and Take Downs

• Countering Cyber Mercenaries | directions blog

• Cyber crime experts reveal how to infiltrate ransomware gangs • The Register

Misinformation, Disinformation and Propaganda

• Countries brace for influence operations, hacking campaigns ahead of historic 2024 election cycle (therecord.media)

• Justice Secretary in Deepfake General Election Warning - Infosecurity Magazine (infosecurity-magazine.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Ministers fear a cyber attack cutting all our electricity – this is why (inews.co.uk)

• Countries brace for influence operations, hacking campaigns ahead of historic 2024 election cycle (therecord.media)

• How Cyber Criminals Will Sway 2024 US Elections, Or Try To (darkreading.com)

• Justice Secretary in Deepfake General Election Warning - Infosecurity Magazine (infosecurity-magazine.com)

Nation State Actors

China

• Chinese Hackers Deliver Malware to Barracuda Email Security Appliances via New Zero-Day - Security Week

• Chinese Spy Agency Rising to Challenge the CIA - The New York Times (nytimes.com)

Russia

• Ukrainian remote workers targeted in new espionage campaign (therecord.media)

• UAC-0099 Using WinRAR Exploit to Target Ukrainian Firms with LONEPAGE Malware (thehackernews.com)

• Russian firms subjected to new cyber espionage campaign | SC Media (scmagazine.com)

• Cloud Atlas' Spear-Phishing Attacks Target Russian Agro and Research Companies (thehackernews.com)

• Moldova establishes National Cyber Security Agency with help of Estonia's e-Governance Academy (baltictimes.com)

• Inside the World of Deep-Cover Russian Spies Who Are Infiltrating the West (businessinsider.com)

• Russian military hackers target Ukraine with new MASEPIE malware (bleepingcomputer.com)

Iran

• Iran's 'Peach Sandstorm' Cyber Attackers Target Global Defence Network (darkreading.com)

• Israel and Iran are waging a cyber war in the shadows - opinion - The Jerusalem Post (jpost.com)

• A cyber attack targets Albanian Parliament’s data system, halting its work | Stars and Stripes

North Korea

• Kimsuky Group Using Weaponized file Deploy AppleSeed Malware (cybersecuritynews.com)

• Kim Jong Un Expected To Conduct Military, Cyber Attacks During US Elections - Benzinga

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Apple reportedly faces pressure in India after sending out warnings of state-sponsored hacking (engadget.com)

---

Vulnerability Management

• 'Tis the Season to Secure: How CVEs Are the Grinch for Cyber Security | HackerNoon

Vulnerabilities

• Researchers uncover major security issue in Microsoft Azure - here's what we know | TechRadar

• Barracuda fixed a new ESG zero-day exploited by Chinese group UNC4841 (securityaffairs.com)

• CISA Warns of FXC Router, QNAP NVR Vulnerabilities Exploited in the Wild - Security Week

• 'Most sophisticated' iPhone attack chain 'ever seen' used four 0-days to create a 0-click exploit - 9to5Mac

• Google Releases Eighth Zero-Day Patch of 2023 for Chrome (darkreading.com)

• Windows CLFS and five exploits used by ransomware operators | Securelist

• Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers (bleepingcomputer.com)

---

Tools and Controls

• Physical Access Systems Open Door to IT Networks (darkreading.com)

• Even cyber security pros don't fully trust AI just yet | TechRadar

• GenAI Tools Will Permeate All Areas of the Enterprise (darkreading.com)

• Verification roadblocks cause frustration for digital nomads - Help Net Security

• Can AI Protect Against Modern Cyber Attacks? | MSSP Alert

• Strengthening Resilience: Navigating the Cyber Security Landscape (darkreading.com)

• API security in 2024: Predictions and trends - Help Net Security

---

Other News

• Domain Name Security Challenges - DataBreachToday

• 5 Things You Can Do Today to Prepare for 2024’s Security Threats (informationweek.com)

• 8 big IT failures of 2023 | CIO

• Pensions Regulator publishes updated cyber security guidance for trustees | Mayer Brown - JDSupra

• All I really need to know about cyber security, I learned in kindergarten (venturebeat.com)

• New insights into the global industrial cyber security landscape - Help Net Security

• NASA Releases First Space Cyber Security Best Practices Guide (inforisktoday.com)

• Unveiling the true cost of healthcare cyber security incidents - Help Net Security

• NCSC highlights cyber risk to cultural sector | UKAuthority

• Hackers see wealth of information to steal in kids' school records (cnbc.com)

• A cyber attack targets Albanian Parliament’s data system, halting its work | Stars and Stripes

• How Cyber Criminals Will Sway 2024 US Elections, Or Try To (darkreading.com)

• Post-pandemic Cyber Security: Lessons from the global health crisis (att.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.