Black Arrow Cyber Advisory 10 July 2024 – Microsoft Patch Tuesday, Adobe and Citrix Updates

Executive summary

Microsoft’s July Patch Tuesday provides updates to address 143 security issues across its product range, including two actively exploited zero-day vulnerabilities (CVE-2024-38080 and CVE-2024-38112). The exploited zero-day vulnerabilities are a privilege escalation vulnerability in Hypervisor (CVE-2024-38080) and a spoofing vulnerability (CVE-2024-38112), both of which have been added the US Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities Catalog. Also, among the updates provided by Microsoft were 5 critical vulnerabilities.

In addition to the Microsoft updates this week also saw Adobe fix 7 vulnerabilities across various products, Citrix have also addressed multiple vulnerabilities including a critical in NetScaler Console.

---

What’s the risk to me or my business?

The actively exploited vulnerabilities could allow an attacker with access, to gain SYSTEM privileges or use malicious sites and spoof them to appear trusted. Both vulnerabilities if exploited could have a high impact on the confidentiality, integrity and availability of the organisations data on affected systems.

---

What can I do?

Black Arrow recommends applying the available security updates for all supported versions of Windows and Adobe products impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have a critical severity rating.

---

Technical Summary

Microsoft

CVE-2024-38080 – This vulnerability is an integer overflow affecting Hyper-V. If successfully exploited it allows an attacker to gain SYSTEM privileges on the host machine, however initial access to the local machine is required to exploit the flaw.  

CVE-2024-38112 – This vulnerability is a spoofing vulnerability which affects Windows MSHTML Platform and can be exploited with a specially crafted HTML file. If successfully exploited it will allow an attacker to  render malicious content as trusted, misleading users to divulge sensitive information like login credentials or to install malware.

Adobe

This month, Adobe released fixes for a total of 7 vulnerabilities across several of its products. Out of these, 6 were rated as critical. The affected products and their respective vulnerabilities are as follows: Adobe Premier Pro had 1 critical vulnerability, Adobe Bridge also had 1 critical vulnerability, and Adobe InDesign had 4 critical vulnerabilities. Currently, Adobe is not aware of any active exploitation of these vulnerabilities. The types of vulnerabilities addressed include arbitrary code execution and memory leaks.

Citrix

Citrix have released patches to fix multiple security vulnerabilities including a critical and high vulnerability in the NetScaler Console and Agent product. The critical vulnerability (CVE-2024-6235) if successfully exploited is an improper authorisation bug that could allow attackers to access sensitive information.

While Citrix has not stated that any of these vulnerabilities are being exploited in the wild, Black Arrow advises that organisations update the affected appliances as soon as possible. The affected products can be found below in the further information section.

Further details on Windows specific updates within this patch Tuesday can be found here:

https://www.securityweek.com/microsoft-warns-of-windows-hyper-v-zero-day-being-exploited/

Further details of the vulnerabilities addressed in Adobe Premiere Pro can be found here: https://helpx.adobe.com/security/products/premiere_pro/apsb24-46.html

Further details of the vulnerabilities addressed in Adobe Bridge can be found here:

https://helpx.adobe.com/security/products/bridge/apsb24-51.html

Further details of the vulnerabilities addressed in Adobe InDesign can be found here:

https://helpx.adobe.com/security/products/indesign/apsb24-48.html

Further details of the vulnerabilities addressed in Citrix NetScaler can be found here:

https://support.citrix.com/article/CTX677998/netscaler-console-agent-and-svm-security-bulletin-for-cve20246235-and-cve20246236

Further information on US Cybersecurity and Infrastructure Security Agency’s (CISA) “Known Exploited Vulnerabilities Catalog can be found here:

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

---

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 05 June 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Nearly 10 billion Passwords Leaked in the Largest Compilation of All-time

A recent discovery by Cybernews researchers has revealed the largest password compilation to date, containing 9.9 billion unique plaintext passwords in a file named rockyou2024.txt, posted by forum user ObamaCare. This dataset, sourced from both old and new breaches, poses a significant threat by heightening the risk of credential stuffing attacks. Previous incidents have shown such attacks can severely impact organisations, as seen with recent breaches at Santander and Ticketmaster. To mitigate risks, users should avoid using the same passwords across different sites and services, immediately reset exposed passwords, enable multi-factor authentication, and use password managers to generate and store complex passwords securely.

Half of Employees Fear Punishment for Reporting Security Mistakes

A recent report by ThinkCyber, based on a survey conducted at Infosecurity Europe 2024, reveals that half of employees fear repercussions if they report a security mistake. Only 51% believe that most colleagues are focused on security, with 39% feeling this concern is limited to executives and security teams. Key risky behaviours include clicking on phishing links (53%), sharing corporate data (53%), and sharing credentials (51%). The report highlights the ineffectiveness of current security awareness training, with 42% unable to prove its impact on behaviour.

New RUSI Report Exposes Psychological Toll of Ransomware

A recent report by the UK’s Royal United Services Institute (RUSI) reveals the severe psychological toll that ransomware attacks inflict on victims. The study, titled 'Your Data is Stolen and Encrypted: The Ransomware Victim Experience’, highlights that beyond service disruptions, line managers should be mindful of workloads and the psychological and physical impact of ransomware attacks on the organisation and its staff.

Recommendations include prioritising psychological support in cyber resilience strategies and enhancing public funding for mental health services tailored to ransomware victims. Additionally, the report underscores the need for clearer support roles from UK agencies like the NCSC and ICO, and calls for comprehensive improvements in organisational cyber security practices.

Cyber Extortion Soars: SMBs Hit Four Times Harder

A recent report by Orange Cyberdefense has revealed a 77% year-on-year growth in cyber extortion victims, with 60 distinct ransomware groups responsible for 4,374 attacks from Q1 2023 to Q1 2024. Small and medium-sized businesses were hit 4.2 times more often than larger enterprises. The healthcare sector saw a staggering 160% increase in cyber extortion attacks, placing it among the top three most targeted industries. Additionally, the actual victim numbers are likely 50-60% higher than reported due to unaccounted ransom payments. A new trend of "re-victimisation" was also observed, where organisations faced repeated attacks.

2024 Is Already the Year of the Cyber Attack

A recent wave of cyber breaches has underscored the urgent need for robust cyber security measures, as highlighted by the CDK Global hack that disrupted auto dealership management systems for well over two weeks. Data extortion and ransomware attacks have surged, with high-profile incidents affecting UnitedHealth Group’s Change Healthcare, Dell, Microsoft, and others. Notable breaches included Evolve Bank & Trust, which had a knock on effect on a number of high profile FinTechs, and Neiman Marcus. The UK’s Synnovis attack severely impacted London hospitals, further exemplifying the critical threat. A report by PYMNTS Intelligence found 82% of eCommerce merchants experienced cyber attacks in the past year, with nearly half suffering revenue and customer losses, emphasising the growing cyber security challenge in the digital age.

Survey Reveals Growing Lack of Cyber Security Confidence

A recent survey by Ivanti highlights half of IT and security professionals lacking confidence in preventing a damaging security incident in the next 12 months. Data silos between cyber security and IT teams are a significant barrier, causing slow incident response for 40% of respondents and reduced productivity for 82%. The survey reveals it takes an average of 33.8 hours to restore services after an incident. Despite these challenges, organisations are investing in emerging technologies like identity threat detection (47%) and cyber asset management (46%). However, only 46% have identified vulnerable third-party components in their supply chains.

Cyber Security is Worth the Spend

A recent report highlights that businesses face a constant balancing act between growth and cost, particularly regarding IT and security budgets. Despite significant cyber security investments, few organisations can accurately gauge the return on these expenditures. Companies spend millions annually, with the cyber security market projected to reach $300 billion. Effective cyber security remains critical, with CISOs needing to demonstrate risk management, validate controls, and rationalise spend. As cyber threats grow, organisations must integrate cyber security into overall risk management, ensuring data visibility and compliance to safeguard assets and maintain operational integrity.

Only 13% of Organisations are Cyber Mature

A recent survey by Commvault reveals that 83% of respondents had experienced a material security incident, with over half occurring in the past year. To combat this, five key cyber recovery markers were identified: early warning tools, clean dark sites or secondary system in place, isolated immutable data storage, defined incident response plans, and specific recovery readiness measures. Organisations deploying at least four markers recover 41% faster and report fewer breaches. Only 13% of respondents were categorised as cyber mature, with 54% confident in their recovery ability, highlighting the need for comprehensive resilience strategies.

Full-Blown Cyber War: a Hollywood Worthy Scenario

A recent analysis highlights the growing threat of cyber warfare, which could destabilise critical infrastructure and disrupt daily life more covertly than other warfare. Experts warn that strategic cyber attacks could target power, water, communications, and banking systems, causing societal chaos. Recent incidents, such as attacks on Microsoft's communication systems and Denmark's power grid, demonstrate the persistent threat. Despite the potential for massive damage, mutually assured destruction in cyber space remains complex due to the diverse actors involved. Effective cyber deterrence and robust defences are essential to mitigate these emerging threats.

Rising Risks Set to Drive Huge Investment in Cyber Security

A recent report by Stocklytics.com predicts that cyber security spending will soar to $272 billion by 2029, reflecting a 50% increase as businesses combat escalating cyber threats. Despite a significant rise in cyber security budgets, cyber attacks remain a major concern, with the annual cost of cyber crime projected to reach $9.2 trillion in 2024 and $13.8 trillion by 2028. Statista's survey indicates cyber security spending has already grown by 60% from 2018 to 2024, with annual spending expected to increase by $17 billion per year. Over the next decade, global spending on cyber solutions and security measures is forecasted to exceed $2.5 trillion.

Authorised Push Payment Fraud Singled Out as Biggest Financial Crime Threat

A recent study by The Payments Association reveals that 65% of payments professionals consider fraud their most pressing financial crime threat, with authorised push payment (APP) scams being the most concerning, as identified by 27% of respondents. APP fraud, where scammers trick victims into transferring money, predominantly stems from online sources (76%) and telecoms (16%). Despite a 12% rise in APP fraud cases in 2023, losses fell by 5% to £460 million. However, new rules will soon hold payment service providers liable for these losses, prompting concerns about the financial impact on smaller fintech firms.

Setting the Tone at the Top to Manage Enterprise Risk

A recent report highlights the critical need for comprehensive risk management in today's business landscape, emphasising that cyber threats are ubiquitous and not just Black Swan events. High-profile cases like Uber, SolarWinds, and Wells Fargo demonstrate the catastrophic impact a single cyber incident can have on an organisation’s reputation, operations, and financial stability. The evolving role of CISOs, who are now facing personal liability for breaches, underscores the importance of strong corporate governance and a clear "tone at the top." Effective cyber security must be prioritised at all levels, with a proactive, enterprise-wide approach to managing operational risk.

Cyber Criminals are Free to Exploit Vulnerabilities Without Fear

A recent report highlights the infuriatingly low enforcement against cyber crime, with only 0.3% of reported incidents resulting in prosecution. This has emboldened cyber criminals, allowing them to exploit vulnerabilities with impunity, often raking in up to $2 million annually. Despite the astronomical financial and human costs, underreporting and outdated legal frameworks contribute to a pitiful conviction rate. The dark web further complicates efforts to catch these criminals, who often operate across borders, exploiting legal loopholes. Urgent reforms in cyber security laws and increased global cooperation are crucial to addressing this rampant issue effectively.

Sources:

https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/

https://www.infosecurity-magazine.com/news/employees-fear-punishment-reporting/

https://www.infosecurity-magazine.com/news/report-exposes-psychological-toll/

https://www.infosecurity-magazine.com/news/cyber-extortion-soars-smb-hit/

https://www.pymnts.com/cybersecurity/2024/2024-is-already-the-year-of-the-cyberattack/

https://securityboulevard.com/2024/07/survey-surfaces-growing-lack-of-cybersecurity-confidence/

https://www.techradar.com/pro/cybersecurity-is-worth-the-spend

https://www.helpnetsecurity.com/2024/07/04/organizations-cyber-recovery-plans/

https://cybernews.com/editorial/cyberwar-hollywood-worthy-scenario/

https://www.emergingrisks.co.uk/rising-risks-set-to-drive-huge-investment-in-cyber-security/

https://www.infosecurity-magazine.com/news/app-fraud-biggest-financial-crime/

https://www.infosecurity-magazine.com/opinions/tone-top-enterprise-risk/

https://hackernoon.com/cyber-scum-are-free-to-exploit-vulnerabilities-without-fear

---

Governance, Risk and Compliance

Survey Surfaces Growing Lack of Cyber Security Confidence - Security Boulevard

Half of employees afraid to report security errors (betanews.com)

Half of Employees Fear Punishment for Reporting Security Mistakes - Infosecurity Magazine (infosecurity-magazine.com)

Rising risks set to drive huge investment in cyber security (emergingrisks.co.uk)

Cyber security is worth the spend | TechRadar

Only 13% of organisations are cyber mature - Help Net Security

76% of companies enhance cyber defences to secure insurance: Sophos - Reinsurance News

Adapting cyber security strategies to the escalating threat landscape (securitybrief.co.nz)

Cyber Workforce Grows 15% at Large Organisations - Infosecurity Magazine (infosecurity-magazine.com)

Cyber crime rises putting organisations under significant stress, report reveals (holyrood.com)

Navigating the cyber security tempest in the UK organisations (thehrdirector.com)

Setting the Tone at the Top to Manage Enterprise Risk - Infosecurity Magazine (infosecurity-magazine.com)

The impossibility of “getting ahead” in cyber defence - Help Net Security

Cyber resilience - how to achieve it when most businesses – and CISOs – don’t care (diginomica.com)

Boardroom Blindspot: How New Frameworks for Cyber Metrics are Reshaping Boardroom Conversations - Security Boulevard

Companies spend more on cyber security but struggle to track expenses - Help Net Security

Cyber Crime vs. Cyber Security: Learning the Tactics of Criminals to Protect Your Interests | J.S. Held - JDSupra

Waging war on cyber criminals: should cyber strategies be active or passive? - Verdict

Cyber insurance rates drop as businesses bolster cyber security measures - FStech Financial Sector Technology

Cyber insurance rates fall as businesses improve security, report says By Reuters (investing.com)

Inside the minds of CISOs - Help Net Security

Enterprise hits and misses - cyber security is out; cyber resilience is in. Gen AI is being overestimated, and trust matters in a deep fake world (diginomica.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Attack Demands Reach a Staggering $5.2m in 2024 - Infosecurity Magazine (infosecurity-magazine.com)

New RUSI Report Exposes Psychological Toll of Ransomware, Urges Action - Infosecurity Magazine (infosecurity-magazine.com)

New ransomware group uses phone calls to pressure victims, researchers say (therecord.media)

Cyber Extortion Soars: SMBs Hit Four Times Harder - Infosecurity Magazine (infosecurity-magazine.com)

2024 Is Already the Year of the Cyber Attack (pymnts.com)

‘I don’t see it happening’: CISA chief dismisses ban on ransomware payments (therecord.media)

Meet Brain Cipher — The new ransomware behind Indonesia's data center attack (bleepingcomputer.com)

Never assume the end of an attack infrastructure | TechRadar

Cyber attacks on healthcare organisations are surging – here's why | ITPro

Home Office was warned about NHS cyber hacks months before Kremlin-backed attack (inews.co.uk)

How MFA Failures are Fueling a 500% Surge in Ransomware Losses (thehackernews.com)

Ransomware payouts hit all-time high, but that’s not the whole story (securityintelligence.com)

This new ransomware group has been calling up victims to pressure them into paying – and it could be their downfall | ITPro

New Ransomware Group Phones Execs to Extort Payment - Infosecurity Magazine (infosecurity-magazine.com)

Businesses bolster defences against evolving ransomware (devx.com)

Ransomware Victims

Cyber attacks on London's hospitals continue to disrupt services - BBC News

Vladimir Putin's latest escalation has hit far too close to home (telegraph.co.uk)

cyber attack: Indonesia data hit by cyber attack not backed up, officials say - The Economic Times (indiatimes.com)

Insurance Software Vendor Notifies 6.1 Million of 2023 Hack (govinfosecurity.com)

Infosys McCamish says LockBit stole data of 6 million people (bleepingcomputer.com)

Hundreds of Thousands Impacted in Children's Hospital Cyber Attack (darkreading.com)

Evolve Bank & Trust Confirms Reports of Cyber Attack and Subsequent Data Breach | Console and Associates, P.C. - JDSupra

Leading claimant firm hit in latest 'targeted cyber campaign' | Law Gazette

Evolve Bank & Trust Faces Wave of Suits Following Cyber Attack (bloomberglaw.com)

Wise confirms impact from Evolve Bank breach | SC Media (scmagazine.com)

Evolve Bank Shares Data Breach Details as Fintech Firms Report Being Hit - Security Week

Croatia’s largest hospital KBC-Zagreb claimed by LockBit | Cybernews

Meet Brain Cipher — The new ransomware behind Indonesia's data center attack (bleepingcomputer.com)

Fintech company Wise says some customers affected by Evolve Bank data breach | TechCrunch

Fintech Frenzy: Affirm & Others Emerge as Victims in Evolve Breach (darkreading.com)

Indonesia struggles to recover after cyber attack hits 282 agencies - Nikkei Asia

NHS data in cyber breach includes names and test details as patients warned recovery ‘will take some time’ – PublicTechnology

Lockbit Ransomware Attack Exposes Affirm Customers' Data (pcmag.com)

Home Office was warned about NHS cyber hacks months before Kremlin-backed attack (inews.co.uk)

Hackers of Indonesian government apologize and give key • The Register

US new-vehicle sales growth slows after CDK cyber attack | Reuters

A cyber attack shutdown the University Hospital Centre Zagreb in Croatia (securityaffairs.com)

Striking NHS doctors to return to support cancer surgery at hospitals hit by cyber attacks (telegraph.co.uk)

Patelco shuts down banking systems following ransomware attack (bleepingcomputer.com)

“Everything’s frozen”: Ransomware locks credit union users out of bank accounts | Ars Technica

Affirm to SEC: Customer info feared stolen in Evolve breach • The Register

Cambridge University Press & Assessment hit by cyber attack (timeshighereducation.com)

Phishing & Email Based Attacks

Escalating global cyber threats require robust layered security measures | TechRadar

Formula 1 governing body discloses data breach after email hacks (bleepingcomputer.com)

Router maker's support portal hacked, replies with MetaMask phishing (bleepingcomputer.com)

Other Social Engineering

Fake SMS – many fall victim to old scam – DW – 06/28/2024

Dozens of Arrests Disrupt €2.5m Vishing Gang - Infosecurity Magazine (infosecurity-magazine.com)

APP Fraud Singled Out as Biggest Financial Crime Threat - Infosecurity Magazine (infosecurity-magazine.com)

Artificial Intelligence

Generative AI is new attack vector endangering enterprises, says CrowdStrike CTO | ZDNET

AI will ‘turbocharge’ cyber crime, auditors warn - CIR Magazine

Getting the balance right between business innovation, security and AI (securitybrief.co.nz)

Deepfakes: Distorted Reality And The Growing Threat (informationsecuritybuzz.com)

The Future Of The Cyber Security Profession With The Rise Of AI (forbes.com)

Rethinking Cyber Security in the Age of AI - Security Boulevard

Friend or Foe? AI's Complicated Role in Cyber Security (darkreading.com)

How the rush to regulate AI could bring new cyber security challenges (betanews.com)

Organisations weigh the risks and rewards of using AI - Help Net Security

Financial services shun AI over job and regulatory fears

California Advances Unique Safety Regulations for AI Companies Despite Tech Firm opposition - Security Week

How Enterprises Can Safely Use Unstructured Data With LLMs (forbes.com)

Photos of Australian children found in AI training dataset, create deepfake risk | Biometric Update

Infostealing malware masquerading as generative AI tools - Help Net Security

Brazil data protection authority bans Meta from training AI models with data originating in the country (securityaffairs.com)

2FA/MFA

How MFA Failures are Fueling a 500% Surge in Ransomware Losses (thehackernews.com)

3 Ways to Chill Attacks on Snowflake (darkreading.com)

Twilio's Authy App Breach Exposes Millions of Phone Numbers (thehackernews.com)

Twilio urges users to update Authy apps after hack (siliconrepublic.com)

2FA hack exposes millions of phone numbers to hackers - Android Authority

Malware

This new threat infects devices with a dozen malware at once | TechRadar

Multi-Malware 'Cluster Bomb' Campaign Drops Widespread Cyber Havoc (darkreading.com)

Kimsuky Using TRANSLATEXT Chrome Extension to Steal Sensitive Data (thehackernews.com)

This Malware Targets Those Looking for Work: Here's How (makeuseof.com)

Unmasking Rafel RAT: Understanding the Threat - Zimperium

CapraRAT Spyware Disguised as Popular Apps Threatens Android Users (thehackernews.com)

How cyber criminals are using free IT tools, YouTube videos to spread malware   - The Hindu

Fake IT support sites push malicious PowerShell scripts as Windows fixes (bleepingcomputer.com)

Chinese Hackers Exploiting Cisco Switches Zero-Day to Deliver Malware (thehackernews.com)

China-linked APT exploited Cisco NX-OS zero-day to deploy custom malware (securityaffairs.com)

Indian Software Firm's Products Hacked to Spread Data-Stealing Malware (thehackernews.com)

FakeBat Loader Malware Spreads Widely Through Drive-by Download Attacks (thehackernews.com)

South Korean ERP Vendor's Server Hacked to Spread Xctdoor Malware (thehackernews.com)

Thousands of child abuse site users potentially exposed by infostealer logs | SC Media (scmagazine.com)

Global Police Operation Shuts Down 600 Cyber Crime Servers Linked to Cobalt Strike (thehackernews.com)

NCA’s Operation Morpheus targets illicit Cobalt Strike use | Computer Weekly

Europol shuts down Cobalt Strike servers used by hackers (stackdiary.com)

Infostealing malware masquerading as generative AI tools - Help Net Security

Infostealer malware logs used to identify child abuse website members (bleepingcomputer.com)

Hackers attack HFS servers to drop malware and Monero miners (bleepingcomputer.com)

Software Productivity Tools Hijacked to Deliver Infostealers (darkreading.com)

Mobile

Security experts issue warning over new spyware variant targeting Android users | ITPro

Google Patches 25 Android Flaws, Including Critical Privilege Escalation Bug - Security Week

Phones are more like PCs than ever — here’s how to protect them from viruses and malware | Tom's Guide (tomsguide.com)

Stop Using Your Face or Thumb to Unlock Your Phone (gizmodo.com)

Denial of Service/DoS/DDOS

Source: Ukrainian cyber attack leaves at least 250,000 consumers without connection in Russian-occupied territories (kyivindependent.com)

HUR’s massive DDoS attack left 250,000 without communication in occupied territories / The New Voice of Ukraine (nv.ua)

Why every company needs a DDoS response plan - Help Net Security

Beware DDoS attacks - the raid which flies under the radar - BusinessCloud

New Golang-Based Zergeca Botnet Capable of Powerful DDoS Attacks (thehackernews.com)

Internet of Things – IoT

Are smart home security systems more of a security risk than a benefit? | TechRadar

99% of IoT exploitation attempts rely on previously known CVEs - Help Net Security

Any IoT Device Can Be Hacked, Even Grills (darkreading.com)

Data Breaches/Leaks

The biggest data breaches in 2024: 1B stolen records and rising | TechCrunch

Russia's Midnight Blizzard stole email of more Microsoft customers (securityaffairs.com)

TeamViewer links corporate cyber attack to Russian state hackers (bleepingcomputer.com)

Ticketmaster Confirms User Email Addresses, Phone Numbers Stolen in Hack (pcmag.com)

Insurance Software Vendor Notifies 6.1 Million of 2023 Hack (govinfosecurity.com)

Infosys McCamish says LockBit stole data of 6 million people (bleepingcomputer.com)

Hundreds of Thousands Impacted in Children's Hospital Cyber Attack (darkreading.com)

Network Segmentation Saved TeamViewer From APT29 Attack (darkreading.com)

Panama Papers: Court acquits all 28 charged with money laundering - BBC News

Landmark Admin Discloses Data Breach Impacting Personal, Medical Information - Security Week

‘Russia’ Breaches TeamViewer — ‘No Evidence’ Billions of Devices at Risk - Security Boulevard

NHS data in cyber breach includes names and test details as patients warned recovery ‘will take some time’ – PublicTechnology

Prudential said 36,000 people were affected in a February data breach – it just revised that number to 2.5 million | ITPro

3 Ways to Chill Attacks on Snowflake (darkreading.com)

Formula 1 governing body discloses data breach after email hacks (bleepingcomputer.com)

Twilio's Authy App Breach Exposes Millions of Phone Numbers (thehackernews.com)

Ethereum mailing list breach exposes 35,000 to crypto draining attack (bleepingcomputer.com)

2FA hack exposes millions of phone numbers to hackers - Android Authority

Dairy giant Agropur says data breach exposed customer info (bleepingcomputer.com)

300k Affected by Year-Old Data Breach at Florida Community Health Centers - Security Week

Healthcare fintech firm HealthEquity disclosed a data breach (securityaffairs.com)

Offshore vessel firm fined $18k after health and financial info of seamen affected in data breach | The Straits Times

Cambridge University Press & Assessment hit by cyber attack (timeshighereducation.com)

Gamers’ Data Exposed in RPG Platform Roll20 Breach - Infosecurity Magazine (infosecurity-magazine.com)

Organised Crime & Criminal Actors

Cyber criminals Are Free To Exploit Vulnerabilities Without Fear | HackerNoon

Cyber crime rises putting organisations under significant stress, report reveals (holyrood.com)

Cyber Crime vs. Cyber Security: Learning the Tactics of Criminals to Protect Your Interests | J.S. Held - JDSupra

Waging war on cyber criminals: should cyber strategies be active or passive? - Verdict

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

8220 Gang Exploits Oracle WebLogic Server Flaws for Cryptocurrency Mining (thehackernews.com)

Ethereum mailing list breach exposes 35,000 to crypto draining attack (bleepingcomputer.com)

Insider Risk and Insider Threats

Half of Employees Fear Punishment for Reporting Security Mistakes - Infosecurity Magazine (infosecurity-magazine.com)

A fifth of office workers have access to data from a previous employer - Business Plus

Insurance

Cyber insurance Premiums are Going Down: Here’s Why and What to Expect - Security Week

76% of companies enhance cyber defences to secure insurance: Sophos - Reinsurance News

Insurers told they need to get active in cyber risk response (emergingrisks.co.uk)

Cyber insurance Bedevils Law Firms - Above the Law

Cyber insurance rates drop as businesses bolster cyber security measures - FStech Financial Sector Technology

Cyber insurance rates fall as businesses improve security, report says By Reuters (investing.com)

Supply Chain and Third Parties

Cyber attacks on London's hospitals continue to disrupt services - BBC News

Ticketmaster Confirms User Email Addresses, Phone Numbers Stolen in Hack (pcmag.com)

Evolve Bank & Trust Faces Wave of Suits Following Cyber Attack (bloomberglaw.com)

Wise confirms impact from Evolve Bank breach | SC Media (scmagazine.com)

Evolve Bank Shares Data Breach Details as Fintech Firms Report Being Hit - Security Week

Fintech company Wise says some customers affected by Evolve Bank data breach | TechCrunch

Fintech Frenzy: Affirm & Others Emerge as Victims in Evolve Breach (darkreading.com)

Cloud/SaaS

Ticketmaster sends notifications about recent massive data breach (bleepingcomputer.com)

Security in the public cloud explained: A guide for IT and security admins | Computer Weekly

Man-In-The-Middle Attacks are Still a Serious Security Threat - Security Boulevard

Ensuring data security in an uncertain world | TechRadar

47% of corporate data stored in the cloud is sensitive - Help Net Security

Bare metal can come back, says Gartner, citing VMware prices • The Register

Identity and Access Management

Man-In-The-Middle Attacks are Still a Serious Security Threat - Security Boulevard

3 Ways to Chill Attacks on Snowflake (darkreading.com)

Compliance, Security and the Role of Identity - Security Boulevard

Encryption

Modern Cryptographic Attacks: A Guide for the Perplexed - Check Point Research

Linux and Open Source

New OpenSSH Vulnerability Could Lead to RCE as Root on Linux Systems (thehackernews.com)

PoC Exploit Published for Linux Kernel Privilege Escalation Flaw (cybersecuritynews.com)

Passwords, Credential Stuffing & Brute Force Attacks

Police allege ‘evil twin’ in-flight Wi-Fi used to steal info • The Register

RockYou2024: 10 billion passwords leaked in the largest compilation of all time | Cybernews

Nearly 10 billion passwords stolen by hackers — how to protect yourself | Tom's Guide (tomsguide.com)

Hackers exploit critical D-Link DIR-859 router flaw to steal passwords (bleepingcomputer.com)

Social Media

Meta’s ‘Pay or Consent’ Data Model Breaches EU Law - Infosecurity Magazine (infosecurity-magazine.com)

Cyber security researchers uncover disproportionate rise in investment scams on social media – Firstpost

Brazil data protection authority bans Meta from training AI models with data originating in the country (securityaffairs.com)

Training, Education and Awareness

Cyber security training needs a human touch (betanews.com)

Fortinet annual skills gap report - more security training needed - Verdict

Want to scale cyber defenders? Focus on AI-enabled security and organisation-wide training | CyberScoop

Regulations, Fines and Legislation

Newly Proposed Rule Expanding Cyber Incident Reporting to Affect Financial Services Companies | ArentFox Schiff - JDSupra

Banking groups balk at proposed cyber incident reporting rule | American Banker

Meta’s ‘Pay or Consent’ Data Model Breaches EU Law - Infosecurity Magazine (infosecurity-magazine.com)

European Commission consults on draft Implementing Regulation on requirements for cyber security risk management measures and significant incidents under NIS 2 Directive | Practical Law (thomsonreuters.com)

Ensuring data security in an uncertain world | TechRadar

The Critical Role of Governments in EU Cyber Resilience - IDC Europe Blog (blog-idceurope.com)

California Advances Unique Safety Regulations for AI Companies Despite Tech Firm opposition - Security Week

How the rush to regulate AI could bring new cyber security challenges (betanews.com)

Financial services shun AI over job and regulatory fears

Models, Frameworks and Standards

Cyber Essentials at 10: Success or failure? | Computer Weekly

Boardroom Blindspot: How New Frameworks for Cyber Metrics are Reshaping Boardroom Conversations - Security Boulevard

Backup and Recovery

Cyber attack: Indonesia data hit by cyber attack not backed up, officials say - The Economic Times (indiatimes.com)

Data Protection

47% of corporate data stored in the cloud is sensitive - Help Net Security

Brazil data protection authority bans Meta from training AI models with data originating in the country (securityaffairs.com)

Careers, Working in Cyber and Information Security

Fortinet annual skills gap report - more security training needed - Verdict

Finance sector facing multiple skills shortages amid wider disruption - Business Plus

The Future Of The Cyber Security Profession With The Rise Of AI (forbes.com)

Cyber Workforce Grows 15% at Large Organisations - Infosecurity Magazine (infosecurity-magazine.com)

Cyber Workforce Numbers Rise for Larger Organisations (darkreading.com)

Here are 5 of the highest-paying cyber security jobs | Fortune Education

Law Enforcement Action and Take Downs

Global Police Operation Shuts Down 600 Cyber Crime Servers Linked to Cobalt Strike (thehackernews.com)

NCA’s Operation Morpheus targets illicit Cobalt Strike use | Computer Weekly

Europol shuts down Cobalt Strike servers used by hackers (stackdiary.com)

Dozens of Arrests Disrupt €2.5m Vishing Gang - Infosecurity Magazine (infosecurity-magazine.com)

Indonesia detains 103 foreigners in a raid in Bali involving suspected cyber crime - ABC News (go.com)

Misinformation, Disinformation and Propaganda

Google Thwarts Over 10,000 Attempts by Chinese Influence Operator - Infosecurity Magazine (infosecurity-magazine.com)

Cyber hacktivists issue “call to arms” to target elections in Europe, UK (verdict.co.uk)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Full-blown cyberwar: a Hollywood worthy scenario | Cybernews

The US Wants to Integrate the Commercial Space Industry With Its Military to Prevent Cyber Attacks | WIRED

Major bank raises alarm bell on cyber 'warfare': Claims 'entire community is at risk' - ABC News

Nation State Actors

China

Google Thwarts Over 10,000 Attempts by Chinese Influence Operator - Infosecurity Magazine (infosecurity-magazine.com)

China is turning to private firms for offensive cyber operations - Defense One

Chinese Hackers Exploiting Cisco Switches Zero-Day to Deliver Malware (thehackernews.com)

Taiwan reports over 100 cyber security incidents in May | Taiwan News | Jun. 29, 2024 14:22

Russia

Russia's Midnight Blizzard stole email of more Microsoft customers (securityaffairs.com)

Ukraine war briefing: US charges Russian with conspiring to destroy Kyiv computer systems | Ukraine | The Guardian

Russian hackers behind NHS attack are part of Kremlin-protected cyber army (inews.co.uk)

Microsoft reveals even more emails to customers were accessed by Russia-based hackers - Neowin

Vladimir Putin's latest escalation has hit far too close to home (telegraph.co.uk)

US charges Russian civilian for allegedly helping GRU spies target Ukrainian government systems with data-destroying malware | TechCrunch

Network Segmentation Saved TeamViewer From APT29 Attack (darkreading.com)

TeamViewer attributes security incident to Russian APT group Midnight Blizzard | SC Media (scmagazine.com)

Major bank raises alarm bell on cyber 'warfare': Claims 'entire community is at risk' - ABC News

Home Office was warned about NHS cyber hacks months before Kremlin-backed attack (inews.co.uk)

‘Russia’ Breaches TeamViewer — ‘No Evidence’ Billions of Devices at Risk - Security Boulevard

Poland to probe Russia-linked cyber attack on state news agency (therecord.media)

US Announces $10 Mln Bounty for Russian Hacker Behind 2022 Hack Targeting Ukraine (kyivpost.com)

Source: Ukrainian cyber attack leaves at least 250,000 consumers without connection in Russian-occupied territories (kyivindependent.com)

HUR’s massive DDoS attack left 250,000 without communication in occupied territories / The New Voice of Ukraine (nv.ua)

Alert: French Diplomats Targeted By Russian Cyber Attacks - Security Boulevard

North Korea

Kimsuky Using TRANSLATEXT Chrome Extension to Steal Sensitive Data (thehackernews.com)

Major bank raises alarm bell on cyber 'warfare': Claims 'entire community is at risk' - ABC News

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

Cyber hacktivists issue “call to arms” to target elections in Europe, UK (verdict.co.uk)

---

Tools and Controls

Cyber security training needs a human touch (betanews.com)

Rising risks set to drive huge investment in cyber security (emergingrisks.co.uk)

Cyber security is worth the spend | TechRadar

Network Segmentation Saved TeamViewer From APT29 Attack (darkreading.com)

Half of IT pros think there are devices on their network they don't know about (betanews.com)

Fortinet annual skills gap report - more security training needed - Verdict

A fifth of office workers have access to data from a previous employer - Business Plus

Escalating global cyber threats require robust layered security measures | TechRadar

Fake IT support sites push malicious PowerShell scripts as Windows fixes (bleepingcomputer.com)

Reduce security risk with 3 edge-securing steps | CSO Online

76% of companies enhance cyber defences to secure insurance: Sophos - Reinsurance News

The Future Of The Cyber Security Profession With The Rise Of AI (forbes.com)

Adapting cyber security strategies to the escalating threat landscape (securitybrief.co.nz)

Navigating the cyber security tempest in the UK organisations (thehrdirector.com)

Insurers told they need to get active in cyber risk response (emergingrisks.co.uk)

Cyber insurance Bedevils Law Firms - Above the Law

Setting the Tone at the Top to Manage Enterprise Risk - Infosecurity Magazine (infosecurity-magazine.com)

How MFA Failures are Fueling a 500% Surge in Ransomware Losses (thehackernews.com)

Boardroom Blindspot: How New Frameworks for Cyber Metrics are Reshaping Boardroom Conversations - Security Boulevard

Companies spend more on cyber security but struggle to track expenses - Help Net Security

Stress-Testing Security Assumptions in a World of New & Novel Risks (darkreading.com)

Organisations use outdated approaches to secure APIs - Help Net Security

Kaspersky software ban: CISOs must move quickly, experts say | CSO Online

Rethinking Cyber Security in the Age of AI - Security Boulevard

Friend or Foe? AI's Complicated Role in Cyber Security (darkreading.com)

Blurred lines: Securing the physical and digital sides of business - IT Security Guru

Understanding collective defence as a route to better cyber security | TechRadar

Waging war on cyber criminals: should cyber strategies be active or passive? - Verdict

Staying Ahead of Adversarial AI with Incident Response Automation - Security Boulevard

Embracing Automation: The Key to Proactive Security  | MSSP Alert

SIEM-Apocalypse: Protecting Your Security Team in a Time of Turmoil | MSSP Alert

Want to scale cyber defenders? Focus on AI-enabled security and organisation-wide training | CyberScoop

US folk still buying in 3rd-party antivirus, more so the old • The Register

Four Reasons Why You Should Evaluate Your Cyber Security System (forbes.com)

Cyber insurance rates fall as businesses improve security, report says By Reuters (investing.com)

Compliance, Security and the Role of Identity - Security Boulevard

Why AI is essential to securing software and data supply chains (betanews.com)

4 key steps to building an incident response plan - Help Net Security

---

Reports Published in the Last Week

2024 Cyber Threat Report | Huntress

---

Other News

Cyber Criminals Are Free To Exploit Vulnerabilities Without Fear | HackerNoon

Google is cracking down on internet security in this big way | Digital Trends

Water supplies remain ‘too weak’ when it comes to cyber security - Digital Journal

Man-In-The-Middle Attacks are Still a Serious Security Threat - Security Boulevard

Hackers Are Hiding in Plain Sight: Insights from Our 2024 Cyber Threat Report | Huntress

Blurred lines: Securing the physical and digital sides of business - IT Security Guru

Understanding collective defence as a route to better cyber security | TechRadar

Over 380k Hosts Still Referencing Malicious Polyfill Domain: Censys - Security Week

Polyfill[.]io Attack Impacts Over 380,000 Hosts, Including Major Companies (thehackernews.com)

Cyber attack handling ‘staggeringly incompetent’ | Guernsey Press

Paris Olympics 2024: The rising threat of cyber attacks (yahoo.com)

States of Guernsey hit by attempted cyber attack on emails - BBC News

Food Security: Mitigating the Dangers of Digital Poison | AFCEA International

CISA director: US 'not afraid' to probe holes in Big Tech • The Register

Stress-Testing Security Assumptions in a World of New & Novel Risks (darkreading.com)

Kaspersky software ban: CISOs must move quickly, experts say | CSO Online

Space: The Final Frontier for Cyber Attacks (informationweek.com)

IT Security Responsibilities for Online Start-Ups - IT Security Guru

To guard against cyber attacks in space, researchers ask ‘what if?’ (theconversation.com)

Protecting our data in a world of rising cyber attacks - IT Security Guru

States hit back at deputies’ IT security criticism | Bailiwick Express

OPINION: Why cyber security urgently needs updating in transportation | Traffic Technology Today

---

Vulnerability Management

Stress-Testing Security Assumptions in a World of New & Novel Risks (darkreading.com)

Embracing the Absurd: Finding Freedom in Cyber Security  - Security Boulevard

The Great Overcomplication | AFCEA International

99% of IoT exploitation attempts rely on previously known CVEs - Help Net Security

Smashing Silos With a Vulnerability Operations Center (VOC) - Security Boulevard

Vulnerabilities

First OpenSSH vulnerability in nearly two decades leaves over 14 million servers potentially at risk | ITPro

Over 14M servers may be vulnerable to OpenSSH's regreSSHion RCE flaw. Here's what you need to do | ZDNET

PoC Exploit Published for Linux Kernel Privilege Escalation Flaw (cybersecuritynews.com)

3 million iOS and macOS apps were exposed to potent supply-chain attacks | Ars Technica

'Almost every Apple device' vulnerable to CocoaPods • The Register

8220 Gang Exploits Oracle WebLogic Server Flaws for Cryptocurrency Mining (thehackernews.com)

Critical GitLab Bug Threatens Software Development Pipelines (darkreading.com)

Juniper releases out-of-cycle fix for max severity auth bypass flaw (bleepingcomputer.com)

This Windows 11 bug may break Windows Security (xda-developers.com)

Splunk Patches High-Severity Vulnerabilities in Enterprise Product - Security Week

New Intel CPU Vulnerability 'Indirector' Exposes Sensitive Data (thehackernews.com)

Google Patches 25 Android Flaws, Including Critical Privilege Escalation Bug - Security Week

Gogs vulnerabilities may put your source code at risk | SC Media (scmagazine.com)

Hackers exploit critical D-Link DIR-859 router flaw to steal passwords (bleepingcomputer.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 02 July 2024 – Critical Vulnerabilities identified in OpenSSH, Juniper, and Apple App Development Supply Chain

Executive Summary

A critical security flaw that could allow unauthenticated remote code execution with root privileges has been discovered in the OpenSSH Server component when deployed in its default configuration. Critical vulnerabilities have also been discovered in Juniper Networks' ‘Session Smart Router (SSR), Session Smart Conductor, and WAN Assurance Router’ product line. Additionally, vulnerabilities have been found within the CocoaPods dependency manager, which is used to manage library dependencies for many popular iOS and macOS applications. These vulnerabilities could allow attackers to claim ownership of thousands of unclaimed ‘pods’, enabling them to modify and insert malicious code into these dependencies.

Security updates have been released for the OpenSSH and Juniper vulnerabilities. Although the CocoaPods vulnerabilities have now been patched, developers are encouraged to verify the integrity of any open-source dependencies used previously within their applications, as these vulnerabilities have been present since a migration took place in 2014.

What’s the risk to me or my business?

If exploited, these vulnerabilities could compromise the confidentiality, integrity, and availability of data stored by an organisation. Specific information on each vulnerability is provided in the technical summary below.

What can I do?

Security updates are available for OpenSSH and affected Juniper products. These updates should be applied as soon as possible, especially for actively exploited vulnerabilities. It should be noted that where OpenSSH has been deployed into products managed by a hardware vendor, such as a firewall, security updates will need to be applied once released by the vendor. Software developers who rely on the CocoaPods dependency manager should verify the integrity of any dependencies, look to remove orphaned dependencies and should also conduct scans for malicious or suspicious code as part of secure development practices.

Technical Summary

OpenSSH

CVE-2024-6387: A critical race condition vulnerability may allow remote code execution with root privileges. This has been demonstrated in lab conditions to be successful after an average of 6-8 hours of continuous connections on 32-bit Linux systems. While 64-bit systems are believed to be exploitable, this was not demonstrated during testing. As OpenSSH is an included dependency for many different products, vendors will need to release their own security patches for these dependencies. Mitigation advice includes restricting SSH services to only be accessible from trusted sources or disabling the functionality if not required until a patch is available.

Further details on the OpenSSH vulnerabilities and individual vendor responses can be found here: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-6387.

Juniper

CVE-2024-2973: An Authentication Bypass Using an Alternate Path or Channel vulnerability with a CVSS 4.0 rating of 10.0 is present in Juniper Networks' Session Smart Router or Conductor running with a redundant peer. This allows a network-based attacker to bypass authentication and take full control of the device. The vendor advises that only Routers or Conductors running in high-availability redundant configurations are affected by this vulnerability and recommends that affected products be patched as soon as possible.

Further details on the vulnerabilities addressed can be found here:  https://supportportal.juniper.net/s/article/2024-06-Out-Of-Cycle-Security-Bulletin-Session-Smart-Router-SSR-On-redundant-router-deployments-API-authentication-can-be-bypassed-CVE-2024-2973?language=en_US.

CocoaPods

E.V.A Information Security conducted research into the CocoaPods dependency manager, often used in the development of iOS and macOS applications that rely on Swift or Objective-C languages. Over 3 million applications have used the dependency manager, and thousands of packages have been left exposed in a state where they could have been maliciously taken over since a migration in 2014 left these in an orphaned state, where the original owner was not confirmed. Malicious actors could use a public API and an email address to claim ownership over these packages, allowing them to alter or replace the source code with their own malicious code. Developers are advised to review the dependency lists and package managers used within their applications, validate checksums, perform scans for malicious code, and limit the use of orphaned or unmaintained packages.

Further details on the vulnerabilities can be found here: https://www.evasec.io/blog/eva-discovered-supply-chain-vulnerabities-in-cocoapods

Black Arrow Cyber Threat Briefing 28 June 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Cyber Attacks on The Rise with Financial Sector a Top Target, Report Reveals

A recent report from BlackBerry reveals the financial sector faces significant cyber threats, with 40% of attacks on critical infrastructure targeting financial firms. In Q1 2024 alone, BlackBerry's cyber security solutions intercepted 3.1 million attacks, averaging 37,000 daily. Commercial enterprises saw a 3% rise in threats, now constituting 36% of all attacks. Unique malware is increasing, highlighting the need for updated defences. The report underscores the high motivation of threat actors, particularly in a year marked by geopolitical tensions and major global events like the Olympics.

Cloud Resources Have Become Biggest Targets for Cyber Attacks, Finds Thales

A recent report indicates that cloud security spending has surpassed all other security categories, driven by the sensitivity of nearly 47% of corporate data stored in the cloud. With 44% of participating organisations experiencing a cloud data breach, including 14% experiencing one in the past year, protecting cloud environments has become a top priority. Human error and misconfiguration are the leading causes of these breaches, accounting for 31%. Exploitation of known vulnerabilities accounts for 28% of breaches, while zero-day vulnerabilities account for 24%. The report also highlights that 66% of organisations use over 25 software as a service (SaaS) applications, yet less than 10% encrypt the majority of their sensitive cloud data. Digital sovereignty initiatives are recognised by 31% of organisations as crucial for future-proofing cloud environments.

Hackers Grow More Sinister and Brazen in Hunt for Bigger Ransoms

A recent surge in aggressive extortion tactics by cybercrime groups has led to severe disruptions, with a London hospital hack exposing hundreds of millions of health records and causing critical cancer treatment delays. In North America, attackers attempted to auction customer data of LendingTree Inc., gained by leveraging credentials from another breach. Meanwhile, car-dealership software provider CDK Global faced repeated attacks. These incidents illustrate the growing boldness of cyber criminals, who are increasingly using advanced technology to pressure major companies.

1 Out of 3 Breaches Go Undetected

A recent report by Gigamon highlights the increasing challenge organisations face in detecting breaches, with over 65% of respondents indicating that current security solutions are ineffective. Complexity in hybrid cloud environments is a significant factor, with 83% of IT leaders acknowledging it raises cyber risks. Despite a projected global information security spend of $215 billion in 2024, only 54% feel well-prepared for unauthorised access. Notably, 31% of breaches were only detected after receiving extortion threats, and 25% of organisations failed to identify the breach's root cause.

Optiv Report Shows Nearly 60% Increase in Security Budgets as Most Organisations Experience Cyber Breaches and Incidents

A recent report by Optiv, based on a Ponemon Institute survey, reveals a 59% increase in cyber budgets year-over-year, with organisations with over 5,000 users allocating an average of $26 million to cyber security in 2024. Despite these investments, 61% of respondents experienced a data breach or cyber security incident in the past two years. The report highlights that 40% of organisations feel overwhelmed by too many security tools, suggesting a need for streamlined technology integration. Key investment areas include internal security assessments (60%) and identity and access management (58%). The adoption of security orchestration technology is on the rise, with 73% using it to automate incident responses.

Why Are Threat Actors Faking Data Breaches?

A recent incident involving Europcar revealed hackers selling fake data on its 50 million customers, likely generated using AI. This trend of faking data breaches is driven by financial gain, notoriety, and attempts to distract or harm a company's reputation. For example, a Russian hacking group falsely claimed to have breached Epic Games to gain visibility, and a ransomware group falsely claimed to have breached Sony, causing reputational damage. Companies are advised to proactively monitor the dark web, compare leaked datasets with previous breaches, and deploy canary tokens to authenticate breach claims, while adopting integrated security models to enhance threat detection.

China-Sponsored Attackers Target 40K Corporate Users in 90 Days

A recent report by Menlo Security has identified three sophisticated credential-phishing campaigns, compromising over 40,000 corporate users, including executives, in just three months. Named LegalQloud, Eqooqp, and Boomer, these state-sponsored attacks use advanced techniques to bypass security controls like MFA and URL filtering. The campaigns have targeted more than 3,000 domains across various industries, with six out of ten malicious links evading detection. Researchers link these campaigns to China-sponsored threat actors, highlighting the evolving and aggressive tactics used in cyber espionage. This underscores the need for organisations to continually adapt their cyber security strategies.

Cyber Security Neglect: The Silent Killer of Businesses

A recent report underscores the hidden dangers of cyber security neglect, highlighting that such oversight can lead to catastrophic data breaches and financial ruin. IBM's 2023 Cost of a Data Breach Report indicates an average cost of $4.45 million per breach, impacting legal fees, lost business, and increased insurance premiums. Common red flags include outdated security protocols, lack of employee training, and inadequate incident response plans. Businesses must adopt a proactive approach with regular security audits, updated security measures, and comprehensive incident response plans to mitigate these risks and safeguard their operations.

Third of Organisations Have Suffered Three or More Data Breaches in the Last 24 Months

New research reveals that 50% of IT professionals are unaware of all devices connected to their network, despite nearly 60% acknowledging these insecure devices pose a significant risk. The survey of 250 IT professionals also found that over two-thirds of organisations experienced three or more data breaches in the past 24 months, with 20% taking more than five days to detect a breach. This delay increases potential damage from attacks. The report underscores the need for robust security protocols, automated network scanning tools, and continuous investment in security solutions to mitigate cyber threats and protect critical assets.

75% of New Vulnerabilities Exploited Within 19 Days

A recent report by Skybox Security highlights the urgent need for improved vulnerability management, revealing over 30,000 new vulnerabilities were published last year, averaging one every 17 minutes. Despite this surge, the average time to patch vulnerabilities exceeds 100 days, while 75% of new vulnerabilities are exploited within just 19 days. The United States National Vulnerability Database recorded a 17% increase in vulnerabilities year-over-year, with half classified as high or critical. The report underscores the necessity for continuous exposure management and modern mitigation strategies to protect against the rapid exploitation of vulnerabilities, with 25% being exploited on the same day of discovery.

It’s a Hard Time to Be a CISO. Transformational Leadership is More Important Than Ever.

A recent report highlights the challenging landscape for modern CISOs, exacerbated by evolving cyber threats and a global shortage of staff and skills. Heightened regulatory pressures and landmark cases, such as those involving Uber and SolarWinds, underscore the critical need for robust cyber security strategies and compliance across the c-suite and board. Stress and burnout are significant issues, with 94% of CISOs reporting work-related stress and 74% leaving their jobs in 2022 due to it. Gartner predicts up to 50% of security leaders will change jobs by 2025. To mitigate these challenges, CISOs must adopt transformational leadership to enhance organisational and personal resilience.

Tackling The Role Human Error Plays in Data Breaches

A recent report by Thales reveals that human error remains a significant cause of cloud data breaches, with 22% of IT professionals identifying it as the most concerning threat and 74% considering it a key priority. Over the past three years, human error has consistently ranked as a leading source of cyber attacks for enterprises.

Given the likelihood of cyber attacks, businesses must prioritise mitigating human-related risks. This includes comprehensive employee training, robust security protocols, and continuous monitoring to safeguard IT infrastructure and ensure organisational resilience against cyber threats.

Sources:

https://www.investmentnews.com/industry-news/news/cyberattacks-on-the-rise-with-financial-sector-a-top-target-report-reveals-254752

https://www.thalesgroup.com/en/worldwide/defence-and-security/press_release/cloud-resources-have-become-biggest-targets

https://www.infosecurity-magazine.com/news/cloud-breaches-half-organizations/

https://www.bloomberg.com/news/articles/2024-06-26/hackers-grow-more-sinister-and-brazen-in-hunt-for-bigger-ransoms

https://www.helpnetsecurity.com/2024/06/24/detecting-breaches-struggle-in-organizations/

https://www.darkreading.com/cybersecurity-operations/optiv-report-shows-nearly-60-increase-in-security-budgets-as-most-organizations-report-cyber-breaches-and-incidents

https://www.helpnetsecurity.com/2024/06/24/faking-data-breaches/

https://www.darkreading.com/threat-intelligence/china-sponsored-attackers-40k-corporate-users

https://hackernoon.com/cybersecurity-neglect-the-silent-killer-of-businesses

https://www.itsecurityguru.org/2024/06/27/third-of-organisations-have-suffered-three-or-more-data-breaches-in-the-last-24-months/

https://www.helpnetsecurity.com/2024/06/27/nvd-vulnerabilities/

https://securityboulevard.com/2024/06/its-a-hard-time-to-be-a-ciso-transformational-leadership-is-more-important-than-ever/

https://www.techradar.com/pro/tackling-the-role-human-error-plays-in-data-breaches

---

Governance, Risk and Compliance

It’s a Hard Time to Be a CISO. Transformational Leadership is More Important Than Ever. - Security Boulevard

The NYSE's $10M Wake-up Call (darkreading.com)

Cyber Attacks on the rise with financial sector a top target, report reveals (investmentnews.com)

Cyber security Neglect: The Silent Killer of Businesses | HackerNoon

Organisations with outdated security approaches getting hammered: Cloudflare | CSO Online

Today's Most Overlooked Mergers and Acquisitions Cyber Security and Compliance Risks | Inc.com

New cyber threat research for SMB in 2024 | Securelist

Nearly half of cyber professionals do not have the budget for adequate protection – Coalition | Insurance Times

Optiv Report Shows Nearly 60% Increase in Security Budgets as Most Organisations Report Cyber Breaches and Incidents (darkreading.com)

Building a culture of security is everyone’s responsibility - Raconteur

Small Businesses Taking Proactive Steps to Prevent Cyber Attacks (smallbiztrends.com)

Is Defence Winning? A Look at Decades of Playing Catch Up (darkreading.com)

Working with a cyber security committee of the board | Microsoft Security Blog

CISOs Reveal Firms Prioritize Savings Over Long-Term Security - Infosecurity Magazine (infosecurity-magazine.com)

CISOs becoming more comfortable with risk levels - Help Net Security

Inside the Mind of a CISO: Survey and Analysis - SecurityWeek

CISOs Growing More Comfortable With Risk, But Better C-Suite Alignment Needed (darkreading.com)

Some strategies for CISOs freaked out by the specter of federal indictments | CSO Online

The challenges in maintaining effective cyber security (securitybrief.co.nz)

A proactive cyber security policy is not just smart — it’s essential (securityintelligence.com)

The cyber attacks which could wipe your business out | BelfastTelegraph.co.uk

Global business leaders are optimistic about growth and focused on cyber security, AI, sustainability, brand image and international outlook (cnn.com)

Evaluating crisis experience in CISO hiring: What to look for and look out for | CSO Online

---

Threats

Ransomware, Extortion and Destructive Attacks

The State of Ransomware 2024 | SC Media (scmagazine.com)

Ransomware threat landscape Jan-Apr 2024: insights and challenges (securityaffairs.com)

UK and US cops put Qilin ransomware crims in the crosshairs • The Register

Key Takeaways From the British Library Cyber Attack (darkreading.com)

Chinese and N. Korean Hackers Target Global Infrastructure with Ransomware (thehackernews.com)

Hackers Grow More Sinister and Brazen in Hunt for Bigger Ransoms - Bloomberg

Research Reveals Two-Thirds of Organisations Infected with Ransomware Multiple Times, with One-in-Five Infected More than Ten Times | Business Wire

Ratel RAT targets outdated Android phones in ransomware attacks (bleepingcomputer.com)

Red Tape Is Making Hospital Ransomware Attacks Worse | WIRED

Cyber Attacks: An Unseen State Of Emergency In Healthcare (forbes.com)

Chinese Cyber Spies Employ Ransomware in Attacks for Diversion (bleepingcomputer.com)

Cyber attacks on healthcare: Russia’s tool for mass disruption - Medical Device Network (medicaldevice-network.com)

New ransomware, infostealers pose growing risk in 2024 - Help Net Security

Best practices for protection from ransomware in cloud storage | TechTarget

Meet the Ransomware Negotiators (darkreading.com)

Ransomware Victims

Hackers Publish 400GB Of Data After London Hospital Cyber Attack (forbes.com)

UK government weighs action against Russian hackers over NHS records theft | NHS | The Guardian

It Happened Again; A Major Cyber Attack On The NHS. Why Are Health Organisations A Prime Target? (forbes.com)

Lockbit 3.0 Claims Attack on Federal Reserve: 33 Terabytes of Sensitive Data Allegedly Compromised (redhotcyber.com)

LockBit lied: Stolen data is from a bank, not US Federal Reserve (bleepingcomputer.com)

UK and US cops put Qilin ransomware crims in the crosshairs • The Register

NHS data breach: Over 3,000 appointments and operations cancelled amid reports of potential counteraction against attackers – PublicTechnology

Key Takeaways From the British Library Cyber Attack (darkreading.com)

Security firm Accenture breached, claim cybercriminals | Cybernews

Here's what ransomware crims stole from Change Healthcare • The Register

NHS patients affected by cyber-attack may face six-month wait for blood test (yahoo.com)

Investigation of Russian Hack on London Hospitals May Take Weeks Amid Worries Over Online Data Dump - SecurityWeek

CDK Cyber Attack: What Is It, Who Is Responsible and What’s the Fallout? - Bloomberg

Hacked UK Trove Includes Data on Newborns, Cancer Patients (1) (bloomberglaw.com)

Crisis-hit firm behind vital NHS services faces uncertain future | Technology sector | The Guardian

Evolve Bank caught up in latest Russia-linked cyber attacks (paymentexpert.com)

Expert Reveals Cyber Attack ‘Paralyzed’ Over 15K US Car Dealerships (dailydot.com)

Startups scramble to assess fallout from Evolve Bank data breach | TechCrunch

Indonesia Says a Cyber Attack Has Compromised Its Data Centre but It Won't Pay the $8 Million Ransom - SecurityWeek

NHS officials warned over patients data exposed in ‘hackers honey pot’ | The Independent

CDK cyber attacks show need for world offensive against criminals | Automotive News (autonews.com)

Shoe Zone hit by cyber attack (drapersonline.com)

Phishing & Email Based Attacks

Widespread phishing attack impacts many LA County departments | SC Media (scmagazine.com)

400 million Outlook users at risk from security bug — what you need to know | Tom's Guide (tomsguide.com)

The Rising Threat of Mobile Phishing and How to Avoid It | MSSP Alert

Warning in Guernsey after phishing scam increase - BBC News

Expert Reveals Cyber Attack ‘Paralyzed’ Over 15K Dealerships (dailydot.com)

Malware Sandbox Any.Run Targeted in Phishing Attack - SecurityWeek

BEC

Australian gov supplier bank details altered in cyber attacks - Security - iTnews

Other Social Engineering

Mark Cuban claims his Gmail was hacked after receiving hoax call (cointelegraph.com)

What is shoulder surfing and how to prevent it? | Proton

Artificial Intelligence

Cloud security faces pressure from AI growth, multicloud use | CSO Online

91% of Security Leaders Believe AI Set to Outpace Security Teams, Bugcrowd Report Finds (prnewswire.com)

How are CISOs and organisations navigating AI cyber attacks? | TechFinitive

Political Deepfakes Are the Top Use of Malicious AI (pcmag.com)

Future trends in cyber warfare: Predictions for AI integration and space-based operations - Help Net Security

Dangerous AI Workaround: 'Skeleton Key' Unlocks Malicious Content (darkreading.com)

Cyber Security is a ‘team sport’ amid new gen AI–based cyber attacks | Fortune Asia

Microsoft: 'Skeleton Key' attack unlocks the worst of AI • The Register

Hackers expose deep cyber security vulnerabilities in AI | BBC News - YouTube

Security pros grade Apple Intelligence data privacy measures | TechTarget

Apple delays launch of AI-powered features in Europe, blaming EU rules | Apple | The Guardian

How to construct a cyber security policy that sits alongside AI (architecture.com)

2FA/MFA

The Snowflake breach tells us that passwords aren't enough | TechRadar

Multifactor Authentication Is Not Enough to Protect Cloud Data (darkreading.com)

Push Notification Fatigue Leads to LA County Health Department Data Breach - SecurityWeek

Malware

Cyber Attackers Turn to Cloud Services to Deploy Malware - Infosecurity Magazine (infosecurity-magazine.com)

Use of novel malware jumps 40% in 3 months, new report finds (techmonitor.ai)

New Unfurling Hemlock threat actor floods systems with malware (bleepingcomputer.com)

Telcos Hit Hardest by Cloud Malware, Report Finds - IT Security Guru

Oyster Backdoor Spreading via Trojanized Popular Software Downloads (thehackernews.com)

Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign (thehackernews.com)

Google Chrome Web Store still has security work to do • The Register

280 Million Google Chrome Users Installed Dangerous Extensions, Study Says (forbes.com)

'Mirai-like' botnet observed attacking EOL Zyxel NAS devices • The Register

New Cyber threat 'Boolka' Deploying BMANAGER Trojan via SQLi Attacks (thehackernews.com)

Experts observed approximately 120 malicious campaigns using the Rafel RAT - Security Affairs

New Medusa malware variants target Android users in seven countries (bleepingcomputer.com)

Snowblind malware abuses Android security feature to bypass security (bleepingcomputer.com)

Novel Banking Malware Targets Customers in Southeast Asia - Infosecurity Magazine (infosecurity-magazine.com)

WordPress Fights Off Malware Attack, 5 Plugins Infected | MSSP Alert

New ransomware, infostealers pose growing risk in 2024 - Help Net Security

Mac users served info-stealer malware through Google ads | Ars Technica

Cyber attackers are using more new malware, attacking critical infrastructure | CSO Online

Korean telco allegedly infected its P2P users with malware • The Register

ISP accused of installing malware on 600,000 customer PCs to interfere with torrent traffic | TechSpot

Mobile

Forget privacy, young internet users want to be tracked (ft.com)

Here's how to keep your data private on your phone, PC, and tablet (xda-developers.com)

US government tells some Pixel users to update their phones in 10 days or stop using them - PhoneArena

The Rising Threat of Mobile Phishing and How to Avoid It | MSSP Alert

Ratel RAT targets outdated Android phones in ransomware attacks (bleepingcomputer.com)

Apple Patches AirPods Bluetooth Vulnerability That Could Allow Eavesdropping (thehackernews.com)

New Medusa malware variants target Android users in seven countries (bleepingcomputer.com)

Snowblind malware abuses Android security feature to bypass security (bleepingcomputer.com)

Your Phone's 5G Connection is Vulnerable to Bypass, DoS Attacks (darkreading.com)

Denial of Service/DoS/DDOS

Don’t fall for these DDoS myths | TechFinitive

Your Phone's 5G Connection is Vulnerable to Bypass, DoS Attacks (darkreading.com)

Largest Croatian hospital under cyber attack - Help Net Security

Data Breaches/Leaks

1 out of 3 breaches go undetected - Help Net Security

Why are threat actors faking data breaches? - Help Net Security

Third of Organisations Have Suffered Three or More Data Breaches in the Last 24 Months - IT Security Guru

Microsoft Tells More Clients Russian Hackers Viewed Emails (2) (bloomberglaw.com)

All 150,000 residents of Dumfries and Galloway warned to assume data loss in NHS cyber attack – PublicTechnology

Santander Employee Data Breach Linked to Snowflake Attack - SecurityWeek

Post Office accidentally leaks names of sub-postmasters - BBC News

Sir Alan Bates hits out at Post Office ‘incompetence’ after data breach | Computer Weekly

First million breached Ticketmaster records released for free | Malwarebytes

The Snowflake latest: New victims, ShinyHunters takes credit • The Register

Security firm Accenture breached, claim cybercriminals | Cybernews

Push Notification Fatigue Leads to LA County Health Department Data Breach - SecurityWeek

Optus database compromised in 2022 by simple coding error - Mobile World Live

CISA confirms hackers may have accessed data from chemical facilities during January incident (therecord.media)

Microsoft blamed for million-record theft from Geisinger • The Register

Tackling the role human error plays in data breaches | TechRadar

NHS officials warned over patients data exposed in ‘hackers honey pot’ | The Independent

NYPD officer database had security flaws that could have let hackers covertly modify officer data - Nextgov/FCW

Driving licences and other official documents leaked by authentication service used by Uber, TikTok, X, and more | Malwarebytes

TeamViewer Detects Security Breach in Corporate IT Environment (thehackernews.com)

Authenticator for X, TikTok Exposes Personal User Info for 18 Months (darkreading.com)

Five things security teams need to know about the latest MOVEit Transfer bug | SC Media (scmagazine.com)

Hacker claims to have 30 million customer records from Australian ticket seller giant TEG | TechCrunch

Los Angeles Unified confirms student data stolen in Snowflake account hack (bleepingcomputer.com)

Neiman Marcus Data Breach Disclosed as Hacker Offers to Sell Stolen Information - SecurityWeek

Credential Stuffing Attack Hits 72,000 Levi’s Accounts - Infosecurity Magazine (infosecurity-magazine.com)

Designed Receivable Solutions Data Breach Impacts 585,000 People - SecurityWeek

Web scraping is not just a security or fraud problem - Help Net Security

Japan's space agency struck by multiple cyber attacks, but officials say no sensitive data was taken - Washington Times

Organised Crime & Criminal Actors

Why are threat actors faking data breaches? - Help Net Security

Why Russia Is Facing a Crime Wave When War on Ukraine Ends - Bloomberg

Russian soldiers returning home are sending crime higher | Fortune

18,000 cyber security attacks reported to Hong Kong police in 3 months | South China Morning Post (scmp.com)

Four FIN9 hackers indicted for cyber attacks causing $71M in losses (bleepingcomputer.com)

Organised crime and domestic violence perps buy trackers • The Register

Wikileaks' Julian Assange Released from UK Prison, Heads to Australia (thehackernews.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

50 Cent got hacked by someone shilling memecoins and it seemed to work | Mashable

Predators steal additional $10M from crypto scam victims • The Register

Feds put $5m bounty on 'CryptoQueen' Ignatova's whereabouts • The Register

Crypto-gang leader convicted of vicious kidnaps, robbery • The Register

Suspected North Korean Attack Drains $2m from CoinStats Wallets - Infosecurity Magazine (infosecurity-magazine.com)

Hackers Steal Over $2 Million in Cryptocurrency From CoinStats Wallets - SecurityWeek

CoinStats says North Korean hackers breached 1,590 crypto wallets (bleepingcomputer.com)

Insider Risk and Insider Threats

Tackling the role human error plays in data breaches | TechRadar

JPMorgan Hacker May Have Built New Fraud Empire While Working With FBI - Bloomberg

Insurance

Recovery costs of cyber attacks outpacing insurance – Sophos | Insurance Times

Cyber warfare is not insurable: Munich Re's Kreuzer - Reinsurance News

Cyber cover still seen as “nice to have” despite threats (emergingrisks.co.uk)

76% of Companies Improved Their Cyber Defences to Qualify (globenewswire.com)

UK midsize firms wary of cyber insurance: Coalition - Reinsurance News

Surge in cyber insurance market fuelled by regulatory shifts and global tensions: Morningstar DBRS - Reinsurance News

How are cyber insurance claims shaping up for 2024? | Insurance Business America (insurancebusinessmag.com)

US businesses struggle to obtain cyber insurance, lawmakers are told | CyberScoop

Supply Chain and Third Parties

It Happened Again; A Major Cyber Attack On The NHS. Why Are Health Organisations A Prime Target? (forbes.com)

Santander Employee Data Breach Linked to Snowflake Attack - SecurityWeek

The Snowflake latest: New victims, ShinyHunters takes credit • The Register

NHS patients affected by cyber-attack may face six-month wait for blood test (yahoo.com)

Investigation of Russian Hack on London Hospitals May Take Weeks Amid Worries Over Online Data Dump - SecurityWeek

Microsoft blamed for million-record theft from Geisinger • The Register

How to Respond When Your Service Provider Suffers a Cyber Attack - Dear Mary – Incidents + Investigations Cyber Security Advice Column | Troutman Pepper - JDSupra

Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack (thehackernews.com)

Remove Polyfill.io code from your website immediately • The Register

Cloud/SaaS

Cyber Attackers Turn to Cloud Services to Deploy Malware - Infosecurity Magazine (infosecurity-magazine.com)

Cloud security faces pressure from AI growth, multicloud use | CSO Online

The Snowflake breach tells us that passwords aren't enough | TechRadar

Multifactor Authentication Is Not Enough to Protect Cloud Data (darkreading.com)

Cloud Resources have Become Biggest Targets for Cyber Attacks, finds Thales | Thales Group

Cloud Breaches Impact Nearly Half of Organisations - Infosecurity Magazine (infosecurity-magazine.com)

Santander Employee Data Breach Linked to Snowflake Attack - SecurityWeek

Telcos Hit Hardest by Cloud Malware, Report Finds - IT Security Guru

The Snowflake latest: New victims, ShinyHunters takes credit • The Register

UK government’s M365 use under scrutiny after Microsoft’s ‘no guarantee of sovereignty’ disclosure | Computer Weekly

Police Scotland did not consult ICO about high-risk cloud system | Computer Weekly

SAP customers warned on risks in unofficial route to cloud • The Register

Best practices for protection from ransomware in cloud storage | TechTarget

Crafting a Robust Cloud Security Strategy in 2024 | MSSP Alert

Are rainy days ahead for cloud computing? - BBC News

Encryption

Europe and Australia both back down on CSAM scanning (9to5mac.com)

Telegram says it has 'about 30 engineers'; security experts say that's a red flag | TechCrunch

Passwords, Credential Stuffing & Brute Force Attacks

The Snowflake breach tells us that passwords aren't enough | TechRadar

Credential Stuffing Attack Hits 72,000 Levi’s Accounts - Infosecurity Magazine (infosecurity-magazine.com)

Levi's Data Breach: 72,000+ Customers' Data Exposed (cybersecuritynews.com)

Social Media

50 Cent got hacked by someone shilling memecoins and it seemed to work | Mashable

Authenticator for X, TikTok Exposes Personal User Info for 18 Months (darkreading.com)

Malvertising

Mac users served info-stealer malware through Google ads | Ars Technica

Regulations, Fines and Legislation

The NYSE's $10M Wake-up Call (darkreading.com)

A New Cyber Security Executive Order Puts the Heat on Critical Infrastructure Suppliers (securityintelligence.com)

Cyber Security | UK Regulatory Outlook June 2024 - Osborne Clarke | Osborne Clarke

Police Scotland did not consult ICO about high-risk cloud system | Computer Weekly

Surge in cyber insurance market fuelled by regulatory shifts and global tensions: Morningstar DBRS - Reinsurance News

What qualifies as a material cyber security incident? | TechTarget

Apple delays launch of AI-powered features in Europe, blaming EU rules | Apple | The Guardian

Latest Cyber-Related FCA Settlement Underscores the Breadth of DOJ’s Civil Cyber-Fraud Focus | Sheppard Mullin Richter & Hampton LLP - JDSupra

Some strategies for CISOs freaked out by the specter of federal indictments | CSO Online

Consulting firms settle $11.3M cyber security case (devx.com)

CMM 2.0 - What UK-Based Contractors Need to Know (techuk.org)

American Privacy Rights Act is now weak sauce, critics warn • The Register

The UK Government Announces Ambitious Proposals to Improve Software Security and Resilience | Pillsbury - Global Sourcing Practice - JDSupra

Models, Frameworks and Standards

Catching Up on Innovation With NIST CSF 2.0

Implementing CIS Controls in Small and Medium Enterprises | UpGuard

PCI DSS 4.0.1: New Clarifications on Client-Side Security – What You Need to Know - Security Boulevard

Backup and Recovery

Why immutable data storage is key to cyber security strategy | TechRadar

Data Protection

Apple delays launch of AI-powered features in Europe, blaming EU rules | Apple | The Guardian

American Privacy Rights Act is now weak sauce, critics warn • The Register

Careers, Working in Cyber and Information Security

12 hottest IT security certs for higher pay today | CSO Online

Gaining and Retaining Security Talent: A Cheat Sheet for CISOs - SecurityWeek

Fortinet report highlights global cyber security skills shortage (securitybrief.co.nz)

Employers urged to find cyber security talent differently (devx.com)

Evaluating crisis experience in CISO hiring: What to look for and look out for | CSO Online

Removal of Certain Degree Requirements To Boost Federal Cyber Workforce | AFCEA International

How to become a cyber security architect | TechTarget

Law Enforcement Action and Take Downs

UK's largest nuclear site denies being hacked but pleads guilty over cyber security failures (therecord.media)

Five men convicted for operating illegal streaming site Jetflicks (bleepingcomputer.com)

UK and US cops put Qilin ransomware crims in the crosshairs • The Register

Sellafield Pleads Guilty to Historic Cyber Security Offenses - Infosecurity Magazine (infosecurity-magazine.com)

Sellafield pleads guilty to criminal charges over cyber security | Computer Weekly

Four FIN9 hackers indicted for cyber attacks causing $71M in losses (bleepingcomputer.com)

Crypto-gang leader convicted of vicious kidnaps, robbery • The Register

Russian national indicted for role in cyber attacks on Ukraine | CyberScoop

Russian Charged With Ukrainian Cyber Attack Before Invasion - Law360

Ukraine war briefing: US charges Russian with conspiring to destroy Kyiv computer systems | Ukraine | The Guardian

War Crime Prosecutions Enter a New Digital Age | WIRED

Operation First Light Seizes $257m in Global Scam Bust - Infosecurity Magazine (infosecurity-magazine.com)

Misinformation, Disinformation and Propaganda

The inside view of spyware’s 'dirty interference,' from two recent Pegasus victims (therecord.media)

Political Deepfakes Are the Top Use of Malicious AI (pcmag.com)

Supreme Court rejects effort to limit government communication on misinformation  | CyberScoop

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Cyber operations create additional risks for people’s security and well-being | ICRC

Cyber warfare is not insurable: Munich Re's Kreuzer - Reinsurance News

Future trends in cyber warfare: Predictions for AI integration and space-based operations - Help Net Security

US military project aims to prevent hackers targeting satellites and recognises rising threat of cyber attacks in space (theconversation.com)

Nation State Actors

China

China-Sponsored Attackers Target 40K Corporate Users in 90 Days (darkreading.com)

China-Russia alignment: a threat to Europe's security | Merics

Cyber warfare is not insurable: Munich Re's Kreuzer - Reinsurance News

'SneakyChef' APT Slices Up Foreign Affairs With SugarGh0st (darkreading.com)

Chinese hackers have stepped up attacks on Taiwanese organisations, cyber security firm says (yahoo.com)

Chinese Hackers Deploy SpiceRAT and SugarGh0st in Global Espionage Campaign (thehackernews.com)

Protecting America’s cyber security demands showing our teeth | CyberScoop

Chinese Cyber Spies Employ Ransomware in Attacks for Diversion (bleepingcomputer.com)

Beyond TikTok: Navigating the cyber security landscape of tomorrow (federaltimes.com)

China-Linked Espionage Groups Target Asian Telecoms (darkreading.com)

Chinese Hackers Have Stepped Up Attacks on Taiwanese Organisations, Cyber Security Firm Says - SecurityWeek

18,000 cyber security attacks reported to Hong Kong police in 3 months | South China Morning Post (scmp.com)

Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack (thehackernews.com)

Russia

Microsoft Tells More Clients Russian Hackers Viewed Emails (2) (bloomberglaw.com)

China-Russia alignment: a threat to Europe's security | Merics

Cyber warfare is not insurable: Munich Re's Kreuzer - Reinsurance News

US Treasury Sanctions 12 Kaspersky Executives Amid Software Ban (thehackernews.com)

Why Russia Is Facing a Crime Wave When War on Ukraine Ends - Bloomberg

Russian soldiers returning home are sending crime higher | Fortune

Chinese and N. Korean Hackers Target Global Infrastructure with Ransomware (thehackernews.com)

European Union Sanctions Russian State Hackers (govinfosecurity.com)

Protecting America’s cyber security demands showing our teeth | CyberScoop

Russian used US systems for pre-invasion attack on Ukraine, US says - Defense One

UK government weighs action against Russian hackers over NHS records theft | NHS | The Guardian

Evolve Bank & Trust Confirms Data Was Stolen in Cyber Attack (claimsjournal.com)

Cyber attacks on healthcare: Russia’s tool for mass disruption - Medical Device Network (medicaldevice-network.com)

Russian national indicted for role in cyber attacks on Ukraine | CyberScoop

Russian Charged With Ukrainian Cyber Attack Before Invasion - Law360

Ukraine war briefing: US charges Russian with conspiring to destroy Kyiv computer systems | Ukraine | The Guardian

Kaspersky Denies Security Risk, After US Sales Ban | Silicon UK

The US bans Kaspersky products, citing security risks - what this means for you | ZDNET

US Bans Kaspersky Over Alleged Kremlin Links - Infosecurity Magazine (infosecurity-magazine.com)

ExCobalt Cyber Gang Targets Russian Sectors with New GoRed Backdoor (thehackernews.com)

FBI joins hunt for hackers who stole NHS records (thetimes.com)

HUR Cyber Attack Hits Russian Internet Providers in Occupied Crimea (kyivpost.com)

Evolve Bank caught up in latest Russia-linked cyber attacks (paymentexpert.com)

North Korea

Cyber warfare is not insurable: Munich Re's Kreuzer - Reinsurance News

Chinese and N. Korean Hackers Target Global Infrastructure with Ransomware (thehackernews.com)

Protecting America’s cyber security demands showing our teeth | CyberScoop

Cyber operations create additional risks for people’s security and well-being | ICRC

Suspected North Korean Attack Drains $2m from CoinStats Wallets - Infosecurity Magazine (infosecurity-magazine.com)

Hackers Steal Over $2 Million in Cryptocurrency From CoinStats Wallets - SecurityWeek

CoinStats says North Korean hackers breached 1,590 crypto wallets (bleepingcomputer.com)

---

Tools and Controls

Cyber warfare is not insurable: Munich Re's Kreuzer - Reinsurance News

Recovery costs of cyber attacks outpacing insurance – Sophos | Insurance Times

Four steps to build cyber resilience in the public sector | TechRadar

US bans Kaspersky and hands out sanctions to execs — 100 days until class-leading antivirus ban takes effect | Tom's Hardware (tomshardware.com)

Conditional Access - The ultimate starter guide (oceanleaf.ch)

Hybrid work prompts spike in network security threats | Computer Weekly

Why immutable data storage is key to cyber security strategy | TechRadar

What Application Security Within Shadow IT Looks Like (darkreading.com)

Cyber cover still seen as “nice to have” despite threats (emergingrisks.co.uk)

76% of Companies Improved Their Cyber Defences to Qualify (globenewswire.com)

Nearly half of cyber professionals do not have the budget for adequate protection – Coalition | Insurance Times

DMARC: Why It's Moving from a Best Practice to Must-Have | Proofpoint US

UK midsize firms wary of cyber insurance: Coalition - Reinsurance News

IT Leaders Are Fifty-Fifty on Using GenAI For Cyber Security - Infosecurity Magazine (infosecurity-magazine.com)

Optiv Report Shows Nearly 60% Increase in Security Budgets as Most Organisations Report Cyber Breaches and Incidents (darkreading.com)

The four phases of emergency management | TechTarget

CISOs Reveal Firms Prioritize Savings Over Long-Term Security - Infosecurity Magazine (infosecurity-magazine.com)

How are cyber insurance claims shaping up for 2024? | Insurance Business America (insurancebusinessmag.com)

CISOs becoming more comfortable with risk levels - Help Net Security

CISOs Growing More Comfortable With Risk, But Better C-Suite Alignment Needed (darkreading.com)

Crafting a Robust Cloud Security Strategy in 2024 | MSSP Alert

US businesses struggle to obtain cyber insurance, lawmakers are told | CyberScoop

Cisco's enterprise firewall receives ‘caution’ rating from CyberRatings - SDxCentral

A proactive cyber security policy is not just smart — it’s essential (securityintelligence.com)

The dos and don’ts of gamified cyber security training - Security Boulevard

Benefits of dark web monitoring (techtarget.com)

Google's Naptime Framework to Boost Vulnerability Research with AI - Infosecurity Magazine (infosecurity-magazine.com)

A Watershed Moment for Threat Detection and Response (darkreading.com)

Creating a proactive incident response plan | Microsoft Security Blog

Building an incident response strategy in 2024 | ITPro

Conducting a Comprehensive Security Posture Assessment in 2024 (att.com)

Best practices for protection from ransomware in cloud storage | TechTarget

How to construct a cyber security policy that sits alongside AI (architecture.com)

Meet the Ransomware Negotiators (darkreading.com)

Cyber Security Report Examples (3 Common Styles) | UpGuard

---

Other News

We analysed the entire web and found a cyber security threat lurking in plain sight (theconversation.com)

UK's largest nuclear site denies being hacked but pleads guilty over cyber security failures (therecord.media)

Post Office expert IT witness Gareth Jenkins resigns BCS membership | Computer Weekly

Cyber Attacks: An Unseen State Of Emergency In Healthcare (forbes.com)

New cyber threat research for SMB in 2024 | Securelist

Is Defence Winning? A Look at Decades of Playing Catch Up (darkreading.com)

Beat the Heat and Cyber Threats this Summer | MSSP Alert

Cyber Europe 2024 tests resilience of EU Energy Sector (techmonitor.ai)

Hijacked spacecraft, hacked life support systems: the cyber risks of space | Cybernews

New Trends in Maritime Cyber Security in 2024 (maritime-executive.com)

Estimated cyber crime up almost 120 per cent in four years | The Herald (heraldscotland.com)

Japan's space agency struck by multiple cyber attacks, but officials say no sensitive data was taken - Washington Times

Windows 10 will get five years of additional support thanks to 0patch - Neowin

Cracking down on cybercrime: Who you gonna call? - Help Net Security

Inmarsat Maritime Whitepaper Recommends Holistic Approach To Cyber Security Ahead Of New Iacs Requirements (gcaptain.com)

Chemical Facilities Told of Possible Data Exfiltration in CISA Breach - Infosecurity Magazine (infosecurity-magazine.com)

Why cyber attack cases against journalists are increasing | WKMS

Securing the skies: IBS Software’s Alex Haynes on cyber security in air travel - Airport Technology (airport-technology.com)

Japan's Space Agency Was Hit by Multiple Cyber Attacks, but Officials Say No Sensitive Data Was Taken - SecurityWeek

How to navigate retail’s changing cyber threats | Retail Technology Review

Cyber Threats in Construction and Manufacturing: Securing your Organisation (att.com)

Cyber security for schools: What you need to know | Edexec

Nine ways construction companies can modernize and mitigate cyber risks | SC Media (scmagazine.com)

---

Vulnerability Management

75% of new vulnerabilities exploited within 19 days - Help Net Security

Google's Naptime Framework to Boost Vulnerability Research with AI - Infosecurity Magazine (infosecurity-magazine.com)

Vulnerabilities

MOVEit Transfer Flaws Push Security Defence Into a Race With Attackers (darkreading.com)

Phoenix UEFI bug affects long list of Intel chip families • The Register

New attack uses MSC files and Windows XSS flaw to breach networks (bleepingcomputer.com)

Fresh MOVEit Bug Under Attack Mere Hours After Disclosure (darkreading.com)

VMware ESXi Flaw Allows Attackers to Bypass Authentication (cybersecuritynews.com)

MoveIt Transfer vulnerability targeted amid disclosure drama | TechTarget

New MOVEit Transfer critical bug is actively exploited (securityaffairs.com)

ESET Security Products - Windows Vulnerable Privilege Escalation (cybersecuritynews.com)

Chrome 126 Update Patches Memory Safety Bugs - SecurityWeek

Multiple WordPress Plugins Compromised: Hackers Create Rogue Admin Accounts (thehackernews.com)

US government tells some Pixel users to update their phones in 10 days or stop using them - PhoneArena

Plugins on WordPress.org backdoored in supply chain attack (bleepingcomputer.com)

Apple Patches AirPods Bluetooth Vulnerability That Could Allow Eavesdropping (thehackernews.com)

Exploit for critical Fortra FileCatalyst Workflow SQLi flaw released (bleepingcomputer.com)

WordPress Fights Off Malware Attack, 5 Plugins Infected | MSSP Alert

GitLab Security Updates Patch 14 Vulnerabilities - SecurityWeek

Windows 10 will get five years of additional support thanks to 0patch - Neowin

'Mirai-like' botnet observed attacking EOL Zyxel NAS devices • The Register

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 21 June 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Hackers Switch Focus to Cloud Apps for Data Theft, as Cloud Services Increasingly Seen as Huge Soft Target by Attackers

A recent report by Google’s Mandiant reveals that the Scattered Spider gang, also known as UNC3944, has escalated its tactics to target software-as-a-service (SaaS) applications and cloud infrastructure, focusing on data theft for extortion without using ransomware. They exploit genuine tools and permissions, then create new virtual machines and exfiltrate data to other cloud platforms they have under their control. Additionally, other reports this week highlight a rise in the exploitation of legitimate cloud services, with over half of all malware in March 2024 delivered via these services. Notably, 59% of cloud-based malware originated from 235 distinct apps. Sophisticated attacks, such as North Korea’s targeting of South Korean security professionals, underscore the urgent need for enhanced cloud security measures and a proactive defence strategy.

The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe, 1 in 10 Email-Based Attacks are Now Business Email Compromise

Recent reports highlight a significant shift in phishing tactics due to advancements in generative AI (GenAI). Historically, phishing relied on high-volume, low-effort strategies, but improved security measures have led to more sophisticated, targeted attacks such as Business Email Compromise (BEC). The advent of GenAI tools like ChatGPT has drastically reduced the time and effort required to craft convincing phishing emails, resulting in a 21% increase in BEC attempts from Q2 2022 to Q2 2023. BEC now accounts for 10.6% of social engineering attacks, up from 8% in 2022. Conversation hijacking has surged by 70% since 2022, despite its complexity.

Analysis of 69 million attacks on 4.5 million mailboxes highlights new tactics, such as using QR codes and URL shorteners, which evade traditional email filters. Gmail was the most exploited webmail service, used in 22% of social engineering attacks.

Furthermore, image-based phishing attacks, which evade natural language processing defences, have surged by 175% over the past year, illustrating the growing global threat posed by AI-enhanced phishing.

Regulatory Changes Are on the Horizon. Are Companies Ready?

A recent report highlights the increasing complexity of cyber security compliance across Europe, America, and Asia. European organisations face over 100 pieces of legislation, creating significant challenges in determining applicable laws, especially those with extraterritorial effects. This emphasises the importance of bespoke internal management and governance programmes tailored to specific business risks and data handling practices. The upcoming NIS 2 Directive in the EU is expected to further impact compliance requirements, as DORA will for financial services firms operating within the EU or those outside the EU providing critical services to EU organisations. Additionally, robust incident response plans and ensuring third-party compliance are crucial for effective cyber security management.

How Hackers Can Crack Your Password in an Hour

A recent analysis of 193 million leaked passwords by Kaspersky revealed alarming security weaknesses. 59% of these passwords could be cracked in under an hour using modern GPUs and advanced algorithms. The study found that 45% of passwords were vulnerable to cracking within a minute, highlighting the risks of predictable patterns and common phrases. Despite the increased threat, many users continue to use easily guessable passwords. To mitigate these risks, it is recommended to use strong, unique passwords, employ a password manager, and enable two-factor authentication (2FA) where possible.

US Bans Kaspersky Software, Citing National Security Risks

A recent announcement by the US Department of Commerce's Bureau of Industry and Security (BIS) has imposed a ban on Kaspersky Lab's US subsidiary from selling its security software due to national security risks. The ban, effective from July 20, stems from concerns over Kaspersky’s ties to the Russian government, which could potentially exploit the software for espionage and data theft. Existing customers have until September 29 to find alternatives. This decision follows previous restrictions, with Kaspersky added to the Federal Communications Commission's (FCC) "Covered List" and similar actions by Germany and Canada.

Quarter of Firms Suffer an API-Related Breach

A recent State of Application Programming Interfaces (API) Security Report by Salt Security reveals that nearly a quarter (23%) of organisations experienced breaches via production APIs last year. An API can be thought of as a set of rules and tools that allow different software applications to communicate with each other and exchange data.

The report, based on a survey of 250 respondents globally, found that 95% had encountered API security issues, including vulnerabilities (37%) and sensitive data exposure (38%). Despite a 167% increase in API counts, only 8% of companies consider their API security strategy to be advanced, and 37% lack a strategy entirely. Furthermore, just 58% have processes to discover all APIs, even though 46% discuss API security at the C-level. This highlights the urgent need for sophisticated API security measures.

More than 70% of Companies Increased Spending on Proactive Security

A recent study reveals that over 70% of organisations are boosting their spending on proactive security solutions, prioritising attack surface management and risk-based vulnerability management. Key investments focus on enhanced attack surface visibility (65%), security control optimisation (60%), and improved manpower productivity (54%). The research highlights that 47% of organisations aim to reduce threats using proactive security within the next 12 to 24 months, while 48% anticipate disruption from these new solutions. Confidence remains high in firewalls and routers, with only 6% of financial institutions proactively assessing firewalls and 4% assessing routers.

The Resurgence of Major Data Breaches?

A recent surge in data breaches has seen millions of records exposed and shared on dark web forums, predominantly driven by the hacker group ShinyHunters. This resurgence mirrors the "golden age" of data breaches from 2019 to 2021, where ShinyHunters notoriously targeted companies like Tokopedia and Microsoft’s GitHub. Recent breaches include a massive attack on Santander Bank, affecting 30 million customers, and Ticketmaster, compromising 560 million customer records. Organisations need to take appropriate steps to prevent breaches from happening in the first place, and ensure they have plans in place for what to do when something goes wrong.

Is Cyber Becoming a Primary Domain of Warfare?

A recent analysis by Cyberint reveals that cyber operations in conflicts such as the Ukraine-Russia and Israel-Hamas wars now focus on critical infrastructure and supply chains, with wiper malware frequently used to disrupt organisations. Hacktivists, equipped with new tools and greater capabilities, pose a significant threat, blurring lines between nation-state actors and cyber criminals. This overlap complicates attack attribution and motive understanding. Cyber operations, even when unsuccessful, can have profound psychological impacts on public safety. Enhanced targeting of essential services highlights the urgent need for robust defence strategies in modern cyber warfare.

Cyber Threats Present Ever Greater Risks to International Peace and Security: UK Statement at UN Security Council

A recent statement by the UK at the UN Security Council highlights three critical trends in cyber threats impacting international peace and security.

Firstly, ransomware attacks disrupt government functions and public services, necessitating an international response for resilience. The UK, co-chairing the Counter Ransomware Initiative with Singapore, urges global participation.

Secondly, the rise of AI systems poses new cyber security challenges, with the UK advocating secure AI design having published "Guidelines for Secure AI System Development" with international partners.

Thirdly, the market for advanced cyber intrusion capabilities is growing, increasing threat unpredictability. The UK and France invite collaboration through the Pall Mall Process to address this concern. The UK also calls for stricter enforcement of North Korea sanctions due to their use of cyber activities to fund illegal weapons programmes.

Cyber Security and AI at Top of Risk List for UK Trustees

A recent report by LCP reveals that cyber threats and artificial intelligence (AI) are the top concerns for UK pension trustees, with 23% identifying these as their primary worry. Over half of the respondents (61%) rated their concern about cyber risks as seven or higher on a scale of one to ten. Trustees from larger schemes felt marginally more prepared for cyber risks than those from smaller schemes.

Qilin: We Knew Our Synnovis Attack Would Cause a Healthcare Crisis at London Hospitals

A recent cyber attack by the ransomware gang Qilin has caused a healthcare crisis in London, targeting Synnovis, a partnership between Synlab and two NHS Trusts. The gang confirmed the attack was politically motivated, aiming to disrupt healthcare services. Qilin demanded a $50 million ransom, claiming to have stolen over one terabyte of data. The attack has led to the cancellation of more than 1,500 operations and appointments, significantly impacting patient care. Despite expressing token sympathy for the affected patients, Qilin remains unrepentant. The incident highlights the need for robust cyber security measures in critical infrastructure sectors.

Ransomware Attacks Are Getting Worse

A recent report highlights the escalating crisis of ransomware targeting schools, hospitals, and critical infrastructure, with over 1,200 data breaches reported by the UK Information Commissioner’s Office in 2023, a 25% increase from the previous year. The healthcare sector is notably affected, following a $44 million payout by Change Healthcare in March. 75% of organisations faced ransomware attacks, and 84% encountered phishing attempts, yet only 31% conducted a cyber security risk assessment. With the average cost of a breach at £3.4 million, the report underscores the urgent need for robust cyber security measures, including regular software updates, strong password policies, insider threat management, incident response plans, and multi-factor authentication. Increasing levels of regulation are coming in across Europe, US and Asia to try to enforce more resilience to these types of attacks.

Sources

https://www.bleepingcomputer.com/news/security/scattered-spider-hackers-switch-focus-to-cloud-apps-for-data-theft/

https://www.infosecurity-magazine.com/blogs/threat-targeting-cloud-services/

https://www.prnewswire.com/news-releases/conversation-hijacking-up-70-and-1-in-10-email-based-attacks-are-now-business-email-compromise-302174802.html

https://www.techradar.com/pro/security/email-threats-are-becoming-more-dangerous-than-ever-so-keep-an-eye-on-your-inbox

https://securityboulevard.com/2024/06/the-spammification-of-business-email-compromise-spells-trouble-for-businesses-around-the-globe/

https://www.govinfosecurity.com/regulatory-changes-are-on-horizon-are-companies-ready-a-25507

https://www.kaspersky.co.uk/blog/password-can-be-hacked-in-one-hour/27738/

https://thehackernews.com/2024/06/us-bans-kaspersky-software-citing.html

https://www.infosecurity-magazine.com/news/quarter-firms-suffer-api-related/

https://www.securitymagazine.com/articles/100796-more-than-70-of-companies-increased-spending-on-proactive-security

https://securityboulevard.com/2024/06/the-resurgence-of-major-data-breaches/

https://www.inforisktoday.com/cyber-becoming-primary-domain-warfare-a-25521

https://www.gov.uk/government/speeches/cyber-threats-will-present-an-ever-greater-number-of-risks-to-international-peace-and-security-uk-statement-at-the-un-security-council

https://www.europeanpensions.net/ep/Cyber-threats-take-top-spot-in-UK-trustee-risk-list.php

https://www.theregister.com/2024/06/20/qilin_our_plan_was_to/

https://www.wired.com/story/security-news-this-week-ransomware-attacks-are-getting-worse/

https://channeleye.co.uk/data-breaches-brought-on-by-ransomware-escalate/

---

Governance, Risk and Compliance

Cyber security and AI at top of risk list for trustees, LCP says (professionalpensions.com)

Regulatory Changes Are on the Horizon. Are Companies Ready? (govinfosecurity.com)

More than 70% of companies increased spending on proactive security | Security Magazine

Regulators urged to promote cyber security investment - Risk.net

The Perilous Role of the CISO: Navigating Modern Minefields - SecurityWeek

Cyber security Deserves the Proverbial Seat at the Table (govinfosecurity.com)

Pressure mounts on CISOs as SEC bares teeth with legal action - Help Net Security

Why Regulated Industries are Turning to Military-Grade Cyber Defenses (thehackernews.com)

Cyber Security Burnout Crisis: Burnout in Next 12 Months (thehrdirector.com)

9 ways CSOs lose their jobs | CSO Online

Why Resilience Is More Than Just Cyber Security (inforisktoday.com)

How will the Merck settlement affect the insurance industry? (securityintelligence.com)

How Cyber Security Can Steer Organisations Toward Sustainability (darkreading.com)

Your firm's reputation depends on strong data security. Don't undervalue it - spectator.sme.sk

Closing the Readiness Gap: How to Ensure a Fast Recovery From the Inevitable Cyber Attack - Security Boulevard

Why Your Business Needs To Level Up Its Defence Life Cycle Management (forbes.com)

The High Cost of Downtime and How to Reduce It | MSSP Alert

Is it time to split the CISO role? | CSO Online

Threats

Ransomware, Extortion and Destructive Attacks

Scattered Spider hackers switch focus to cloud apps for data theft (bleepingcomputer.com)

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica

Ransomware Attacks Are Getting Worse | WIRED

Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register

Why ransomware is still important to business resilience - IT Security Guru

UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week

What to do about the rise of unknown attack vectors in the ransomware playbook | SC Media (scmagazine.com)

Ransomware resurgence gives small businesses cause for concern | TechFinitive

The Financial Dynamics Behind Ransomware Attacks (securityaffairs.com)

Data breaches brought on by ransomware escalate. – Channel EYE

LockBit Ransomware Again Most Active - Real Attack Surge or Smokescreen? - Security Week

Ransomware attacks skyrocket, with LockBit 3.0 at the forefront - Exponential-e Blog

New ransomware over browser threat targets uploaded files (securityintelligence.com)

CISA warns of Windows bug exploited in ransomware attacks (bleepingcomputer.com)

Zero-Day Exploits and Ransomware Trends for 2024 (govinfosecurity.com)

How will the Merck settlement affect the insurance industry? (securityintelligence.com)

Qilin Ransomware: What You Need To Know | Tripwire

Linux version of RansomHub ransomware targets VMware ESXi VMs (bleepingcomputer.com)

Ransomware Victims

London hospitals postpone 1,600 operations and appointments after Russian cyber attack (newsbytesapp.com)

London Hospitals Knew of Cyber Vulnerabilities Years Before Hack (claimsjournal.com)

More than 100,000 patients ‘likely’ impacted by NHS cyber attack (holyrood.com)

London Ransomware Attack Led to 1500 Cancelled Ops and Appointments - Infosecurity Magazine (infosecurity-magazine.com)

Cyber criminals publish data from attack on NHS | UKAuthority

Change Healthcare to Start Notifying Customers Who Had Data Exposed in Cyber Attack - Security Week

512,000 radiology patient records accessed in cyber attack • The Register

Tally of victims reaches 100,000 in NHS cyber attack (thetimes.com)

Hackers demand $50M ransom payment from UK lab provider following hospital disruption - SiliconANGLE

Qilin has ‘no regrets’ over the healthcare crisis it caused • The Register

Don't blame us for people suffering - London hospital hackers - BBC News

Borders: NHS board warns patients over stolen personal details | The National

Cyber attack on a UK staffing company:  a 'war story' - Osborne Clarke | Osborne Clarke

Hospital cyber attack turns deadly as drugs given to wrong patients - Washington Times

British Library to renew entire IT system as it reveals £1.6m cyber attack loss (civilsociety.co.uk)

Panera Bread likely paid a ransom in March ransomware attack (bleepingcomputer.com)

NHS boss says Scottish trust didn't meet attackers' demands • The Register

Cyber attack shuts down Israeli pharma company's distribution | Ctech (calcalistech.com)

Phishing & Email Based Attacks

The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe - Security Boulevard

Nigerian national faces prison for $1.5M phishing scam • The Register

Conversation hijacking up 70%, and 1 in 10 email-based attacks are now business email compromise (prnewswire.com)

Email threats are becoming more dangerous than ever — so keep an eye on your inbox | TechRadar

Worldwide 2023 Email Phishing Statistics and Examples | Trend Micro (US)

Your company needs a BEC policy and five other email security trends (betanews.com)

Malicious emails trick consumers into false election contributions - Help Net Security

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Security bug allows anyone to spoof Microsoft employee emails | TechCrunch

Why You Shouldn't Unsubscribe From Spam Emails | HackerNoon

Cyber Criminals Target Trump Supporters with Donation Scams - Security Boulevard

Latest Cyber Insurance Policy Takes Aim at Phishing Attacks (inforisktoday.com)

BEC

The “Spammification” of Business Email Compromise Spells Trouble for Businesses Around the Globe - Security Boulevard

Conversation hijacking up 70%, and 1 in 10 email-based attacks are now business email compromise (prnewswire.com)

Your company needs a BEC policy and five other email security trends (betanews.com)

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Other Social Engineering

Cyber Criminals Turn to Multichannel Attacks—Alongside 'Quishing and 'Smishing'—to Dupe Targets | Corporate Counsel (law.com)

Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register

Malware peddlers love this one social engineering trick! - Help Net Security

Fake Google Chrome errors trick you into running malicious PowerShell scripts (bleepingcomputer.com)

92% of Orgs Hit by Credential Compromise from Social Engineering - Infosecurity Magazine (infosecurity-magazine.com)

Explained: Android overlays and how they are used to trick people | Malwarebytes

Cyber Criminals Target Trump Supporters with Donation Scams - Security Boulevard

Artificial Intelligence

Cyber threats will present an ever greater number of risks to international peace and security: UK statement at the UN Security Council - GOV.UK (www.gov.uk)

'Sleepy Pickle' Exploit Subtly Poisons ML Models (darkreading.com)

Tech Policy Expert Calls for Law Overhaul to Combat Deepfakes - Infosecurity Magazine (infosecurity-magazine.com)

Majority of cyber security professionals unable to identify deepfake attacks - Singapore News (theindependent.sg)

Criminals, too, see productivity gains from AI | CSO Online

AI’s impact on data privacy remains unclear - Help Net Security

Can governments turn AI safety talk into action? | ZDNET

Chinese firm sought to use UK university links to access AI for possible military use | Imperial College London | The Guardian

How to bypass ChatGPT restrictions (androidpolice.com)

Cyber Threat Intelligence Pros Assess AI Threats Readiness - Infosecurity Magazine (infosecurity-magazine.com)

Apple Intelligence Could Introduce Device Security Risks (darkreading.com)

How big is the AI threat to the cyber security of tech companies? | TechRadar

NIS2 Directive: Stronger EU Cyber Security in the AI era | News | GRC World Forums

Hallucinated Packages, Malicious AI Models, and Insecure AI-Generated Code - Security Boulevard

Microsoft's Recall changes might be too little, too late | TechTarget

Meta Pauses AI Training on EU User Data Amid Privacy Concerns (thehackernews.com)

CISA leads first tabletop exercise for AI cyber security | CyberScoop

AI is not a magic wand – it has built-in problems that are difficult to fix and can be dangerous (theconversation.com)

How AI lies, cheats, and grovels to succeed - and what we need to do about it | ZDNET

2FA/MFA

The absence of multi factor authentication led to the Medibank hack, regulator alleges - ABC News

Medibank breach: Security failures revealed (lack of MFA among them) - Help Net Security

Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)

'ONNX' MFA Bypass Targets Microsoft 365 Accounts (darkreading.com)

Malware

Hackers have found a clever way to use emojis in their attacks — but it’s not what you think | Tom's Guide (tomsguide.com)

Hackers Exploit Legitimate Websites to Deliver BadSpace Windows Backdoor (thehackernews.com)

The art of concealment: how hackers hide malware | Cybernews

New Malware Targets Exposed Docker APIs for Cryptocurrency Mining (thehackernews.com)

New ransomware over browser threat targets uploaded files (securityintelligence.com)

Clever macOS malware delivery campaign targets cryptocurrency users - Help Net Security

New Rust-based Fickle Malware Uses PowerShell for UAC Bypass and Data Exfiltration (thehackernews.com)

NiceRAT Malware Targets South Korean Users via Cracked Software (thehackernews.com)

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework | Trend Micro (US)

Mobile

Explained: Android overlays and how they are used to trick people | Malwarebytes

Internet of Things – IoT

IoT password ban a start, but admins can’t afford to wait for regulators | TechRadar

Data Breaches/Leaks

Blackbaud must pay $6.75 million, improve security after lying about scope of 2020 hack (therecord.media)

Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)

Cyber criminals publish data from attack on NHS | UKAuthority

Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)

The Resurgence of Major Data Breaches? - Security Boulevard

Insurance giant Globe Life investigating web portal breach (bleepingcomputer.com)

Truist Bank confirms breach after stolen data shows up on hacking forum (bleepingcomputer.com)

More than 100,000 patients ‘likely’ impacted by NHS cyber attack (holyrood.com)

Total Fitness database exposed 474k member and staff images • The Register

Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED

Dark-web kingpin puts 'stolen' internal AMD data up for sale • The Register

AMD Investigates Possible Breach Amid Hacker’s Sale of Company Data (pcmag.com)

Optus cyber attack could have been prevented four years prior, says telecoms watchdog - ABC News

T-Mobile denies it was hacked, links leaked data to vendor breach (bleepingcomputer.com)

Threat actor claims to have breached Apple, allegedly stealing source code of several internal tools - 9to5Mac

Threat Actor Claims AMD and Apple Breaches - Infosecurity Magazine (infosecurity-magazine.com)

Change Healthcare to Start Notifying Customers Who Had Data Exposed in Cyber Attack - Security Week

512,000 radiology patient records accessed in cyber attack • The Register

Coding error in forgotten API blamed for massive data breach • The Register

Panera Notifies Employees of Compromised Data (darkreading.com)

Los Angeles Public Health Department Discloses Large Data Breach - Infosecurity Magazine (infosecurity-magazine.com)

Cyber Attack Exposes Freelancer Personal Data - Freelance Informer

Hackers Derail Amtrak Guest Rewards Accounts in Breach (darkreading.com)

Organised Crime & Criminal Actors

UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week

Are We Turning the Corner in the Fight Against Cyber Crime? It’s Complicated. - Security Boulevard

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Microsoft hacker avoids jail over multiple cyber attacks - BBC News

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

New Malware Targets Exposed Docker APIs for Cryptocurrency Mining (thehackernews.com)

Clever macOS malware delivery campaign targets cryptocurrency users - Help Net Security

"Researchers" exploit Kraken exchange bug, steal $3 million in crypto (bleepingcomputer.com)

Insider Risk and Insider Threats

The Rise of the Outside Insider Threat | AFCEA International

Former IT employee gets 2.5 years for wiping 180 virtual servers (bleepingcomputer.com)

10 Ways Employees Are Sabotaging Your Cyber Security Stance (informationweek.com)

Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)

Insurance

Latest Cyber Insurance Policy Takes Aim at Phishing Attacks (inforisktoday.com)

How will the Merck settlement affect the insurance industry? (securityintelligence.com)

Supply Chain and Third Parties

Blackbaud must pay $6.75 million, improve security after lying about scope of 2020 hack (therecord.media)

Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)

Hackers demand $50M ransom payment from UK lab provider following hospital disruption - SiliconANGLE

London Hospitals Knew of Cyber Vulnerabilities Years Before Hack (claimsjournal.com)

Cyber attacks on London's hospitals affect 800 planned operations - BBC News

Tally of victims reaches 100,000 in NHS cyber attack (thetimes.com)

Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED

T-Mobile denies it was hacked, links leaked data to vendor breach (bleepingcomputer.com)

Cloud/SaaS

Cyber Criminals Turn to Multichannel Attacks—Alongside 'Quishing and 'Smishing'—to Dupe Targets | Corporate Counsel (law.com)

The Huge Threat Posed by Increased Targeting of Cloud Services - Infosecurity Magazine (infosecurity-magazine.com)

Scattered Spider hackers switch focus to cloud apps for data theft (bleepingcomputer.com)

Hackers Demand as Much as $5 Million From Snowflake Clients | Company Business News (livemint.com)

Notorious cyber gang UNC3944 attacks vSphere and Azure • The Register

Microsoft admits no guarantee of sovereignty for UK policing data | Computer Weekly

The rise of SaaS security teams - Help Net Security

The Annual SaaS Security Report: 2025 CISO Plans and Priorities (thehackernews.com)

Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake | WIRED

'ONNX' MFA Bypass Targets Microsoft 365 Accounts (darkreading.com)

The NCSC’s Take on SaaS - Adaptive Shield (adaptive-shield.com)

Encryption

Stop playing games with online security, Signal president warns EU lawmakers | TechCrunch

Signal, MEPs urge EU Council to drop encryption-eroding law • The Register

Linux and Open Source

New Linux malware is controlled through emojis sent from Discord (bleepingcomputer.com)

New ARM 'TIKTAG' attack impacts Google Chrome, Linux systems (bleepingcomputer.com)

Linux version of RansomHub ransomware targets VMware ESXi VMs (bleepingcomputer.com)

Passwords, Credential Stuffing & Brute Force Attacks

What is a password spraying attack? | Proton

Scathing report on Medibank cyber attack highlights unenforced MFA (bleepingcomputer.com)

Hackers can crack 59% of passwords in an hour | Kaspersky official blog

92% of Orgs Hit by Credential Compromise from Social Engineering - Infosecurity Magazine (infosecurity-magazine.com)

Criminals are Easily Bypassing Passkeys – How Organisations Can Stay Safe - Security Boulevard

Social Media

Why Trading Privacy for 'Free' Web Services Must End (darkreading.com)

4 ways oversharing on social media puts your privacy at risk | TechRadar

New Linux malware is controlled through emojis sent from Discord (bleepingcomputer.com)

Hackers have found a clever way to use emojis in their attacks — but it’s not what you think | Tom's Guide (tomsguide.com)

US surgeon general wants social media warning labels - BBC News

Meta Pauses AI Training on EU User Data Amid Privacy Concerns (thehackernews.com)

Malvertising

Google Chrome Will Track You For The Next 200 Days—Then It May Get Worse (forbes.com)

Training, Education and Awareness

Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)

Regulations, Fines and Legislation

Blackbaud must pay $6.75 million, improve security after lying about scope of 2020 hack (therecord.media)

Regulatory Changes Are on the Horizon. Are Companies Ready? (govinfosecurity.com)

Regulators urged to promote cyber security investment - Risk.net

UK organisations are confident they will meet the NIS 2 compliance timeline | The Independent

Pressure mounts on CISOs as SEC bares teeth with legal action - Help Net Security

Why Regulated Industries are Turning to Military-Grade Cyber Defences (thehackernews.com)

Can governments turn AI safety talk into action? | ZDNET

NIS2 Directive: Stronger EU Cyber Security in the AI era | News | GRC World Forums

The absence of multi factor authentication led to the Medibank hack, regulator alleges - ABC News

Signal, MEPs urge EU Council to drop encryption-eroding law • The Register

SEC cyber security filings on the rise as new reporting rules bite | ITPro

Models, Frameworks and Standards

Why NIS2 is set to become a ‘cornerstone’ of cyber security (siliconrepublic.com)

Careers, Working in Cyber and Information Security

Most cyber security pros took time off due to mental health issues - Help Net Security

The Perilous Role of the CISO: Navigating Modern Minefields - Security Week

Navigating the Cyber Security Hiring Trenches: Challenges, Realities, and Paths Forward | HackerNoon

To Address Burnout, Cyber Security Must Learn to Tolerate Failure (informationweek.com)

Cyber security burnout is costing US enterprises over $620 million a year (techinformed.com)

Effectively upskilling cyber security professionals to help close the skills gap | CSO Online

Cyber Security Burnout Crisis: Burnout in Next 12 Months (thehrdirector.com)

Cyber Security workers are increasingly working over the weekends — and many are ready to quit | TechRadar

9 ways CSOs lose their jobs | CSO Online

Making the Move From Tech Expert to Cyber Security Leader (inforisktoday.com)

Survey Finds Growing Number of Tech Tools Makes Cyber Security Professionals Feel “Out of Control” - IT Security Guru

Is it time to split the CISO role? | CSO Online

ISC2/CIISec Tips on Recruitment, Retention in Cyber Security (govinfosecurity.com)

Law Enforcement Action and Take Downs

Nigerian national faces prison for $1.5M phishing scam • The Register

Former IT employee gets 2.5 years for wiping 180 virtual servers (bleepingcomputer.com)

UK Man Suspected of Being 'Scattered Spider' Leader Arrested - Security Week

Suspected dark-web Empire Market admins charged in the US • The Register

Two Men Plead Guilty to Hacking Law Enforcement Database for Doxing - Security Week

Convicted BEC scammer could face over 100 years in prison (bitdefender.com)

Rogue IT director pleads guilty to $2.1M scam charges • The Register

Sellafield pleads guilty to criminal charges over cyber security failings (yahoo.com)

Microsoft hacker avoids jail over multiple cyber attacks - BBC News

Misinformation, Disinformation and Propaganda

Addressing Misinformation in Critical Infrastructure Security (darkreading.com)

ISIS Created Fake CNN and Al Jazeera Broadcasts | WIRED

US election official: ‘Whack-a-mole’ strategies less effective to combat disinfo | CyberScoop

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Is Cyber Becoming a Primary Domain of Warfare? (inforisktoday.com)

Nation State Actors

China

Chinese Threats Aim for Government Sector  - Security Boulevard

British army delays King Charles cap badges over China spying fears (ft.com)

Bug Bounty Programs, Hacking Contests Power China's Cyber Offense (darkreading.com)

Chinese firm sought to use UK university links to access AI for possible military use | Imperial College London | The Guardian

China's 'Velvet Ant' APT Nests Inside Multiyear Espionage Effort (darkreading.com)

China-Linked Hackers Infiltrate East Asian Firm for 3 Years Using F5 Devices (thehackernews.com)

Chinese Cyber Espionage Targets Telecom Operators in Asia Since 2021 (thehackernews.com)

Behind the Great Wall Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 CC Framework | Trend Micro (US)

Russia

ICC probes cyber attacks in Ukraine as possible war crimes, sources say | Reuters

Russia May Have Committed War Crimes by Hacking Ukraine's Critical Infrastructure, ICC Starts Probe | Tech Times

US Bans Kaspersky Software, Citing National Security Risks (thehackernews.com)

The Rise of the Outside Insider Threat | AFCEA International

Espionage and cyber attack threat reaches new dimension in Germany, interior minister warns – POLITICO

France wants to remind you of Russia’s threat to democracy • The Register

Poland points to Russian hackers in disruption of Euro 2024 broadcast (therecord.media)

Sweden says Russia is interfering with Nordic satellites • The Register

USA and G7 to increase cyber security of their energy sector / The New Voice of Ukraine (nv.ua)

Russians report some outages on bank apps after cyber attack, says Kommersant daily (yahoo.com)

Iran

Germany Warns of Growing Espionage, Cyber Threats from Iran | Iran International (iranintl.com)

North Korea

NiceRAT Malware Targets South Korean Users via Cracked Software (thehackernews.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

ISIS Created Fake CNN and Al Jazeera Broadcasts | WIRED

Hamas Hackers Sling Stealthy Spyware Across Egypt, Palestine (darkreading.com)

---

Tools and Controls

More than 70% of companies increased spending on proactive security | Security Magazine

Get your legal ducks in a row to contain a crisis - Katy MacAskill (scotsman.com)

The importance of collaborating AI with human expertise (securitybrief.co.nz)

Edge Devices: The New Frontier for Mass Exploitation Attacks - Security Week

Report Reveals Record Exploitation Rate For Load Balancers - Infosecurity Magazine (infosecurity-magazine.com)

Your company needs a BEC policy and five other email security trends (betanews.com)

The rise of SaaS security teams - Help Net Security

The Software Licensing Disease Infecting Our Nation's Cyber Security (darkreading.com)

Massachusetts 911 Outage Caused by Errant Firewall - Security Week

How Cyber Security Can Steer Organisations Toward Sustainability (darkreading.com)

How A Cyber Security Audit Can Identify Risk of Compromise | HealthLeaders Media

Defending your ever-changing attack surface - IT Security Guru

US, Allies Publish Guidance on Securing Network Access - Security Week

Want To Stop Cyber Attacks? Start With The Human Edge (forbes.com)

Closing the Readiness Gap: How to Ensure a Fast Recovery From the Inevitable Cyber Attack - Security Boulevard

Microsoft 365's Security Gaps: Logging and Beyond (govinfosecurity.com)

How to create your cyber security "Google Maps": A step-by-step guide for security teams - Help Net Security

A young cyber market has matured, but enhancing preparedness and resilience is key: Kreuzer, Munich Re - Reinsurance News

From Reactive to Proactive Threat Hunting - GovInfoSecurity

Cyber Security Practices For Remote Working - TechRound

Survey Finds Growing Number of Tech Tools Makes Cyber Security Professionals Feel “Out of Control” - IT Security Guru

Tabletop exercises are headed to the next frontier: Space (talosintelligence.com)

What Will the Next-Gen of Security Tools Look Like? | HackerNoon

The NCSC’s Take on SaaS - Adaptive Shield (adaptive-shield.com)

Tool Overload: Why MSPs Are Still Drowning with Countless Cyber Security Tools in 2024 (thehackernews.com)

---

Reports Published in the Last Week

Report urges extending scope of cyber security measures | UKAuthority

Stephen McPartland MP - Final report and 16 recommendations of the McPartland Review into Cyber Security as an enabler of Economic Growth below (stephen-mcpartland.com)

240528_McPartland_Review.pdf (stephen-mcpartland.com)

National Cyber Resilience Advisory Board (NCRAB) minutes: March 2024 - gov.scot (www.gov.scot)

The Annual SaaS Security Report: 2025 CISO Plans and Priorities (thehackernews.com)

---

Other News

Cyber threats will present an ever greater number of risks to international peace and security: UK statement at the UN Security Council - GOV.UK (www.gov.uk)

The importance of collaborating AI with human expertise (securitybrief.co.nz)

Report urges extending scope of cyber security measures | UKAuthority

What is the current state of Security Culture in Europe? | TechRadar

Cyber attack shuts down Israeli pharma company's distribution | Ctech (calcalistech.com)

Sellafield pleads guilty to criminal charges over cyber security failings (yahoo.com)

How resilient is UK Critical National Infrastructure to cyber attack? - Committees - UK Parliament

Microsoft 365's Security Gaps: Logging and Beyond (govinfosecurity.com)

Massachusetts 911 Outage Caused by Errant Firewall - Security Week

Cyber security - what GP practices need to know to protect themselves - Management In PracticeManagement In Practice

Microsoft 'accepts responsibility' for cyber security failures, top exec says (qz.com)

Microsoft was slammed for its lax cyber security practices after a series of breaches — now it plans to cut executive bonuses if they don't improve standards | ITPro

What Does the Future of Cyber Security in Space Look Like? (govtech.com)

Space: The Final Frontier for Cyber Attacks (darkreading.com)

A new fear for CSOs: The sky is falling | CSO Online

The Software Licensing Disease Infecting Our Nation's Cyber Security (darkreading.com)

Cyber Security Challenges For UK Private Bankers - TechRound

New maritime cyber security body launches - Port Technology International

Process and Control Today | New Study Finds Cyber Security as Top Concern Among Automotive Manufacturers (pandct.com)

Vietnam's internet again in trouble as 3/5 sub cables cut • The Register

Cyber Attack Hits Software Provider for Car Dealers Across the US (claimsjournal.com)

Improving OT cyber security remains a work in progress - Help Net Security

Microsoft is in trouble | Digital Trends

---

Vulnerability Management

The Ultimate Guide to Troubleshooting Vulnerability Scan Failures - Security Boulevard

Zero-Day Exploits and Ransomware Trends for 2024 (govinfosecurity.com)

Vulnerabilities

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating | Ars Technica

New Wi-Fi Takeover Attack—All Windows Users Warned To Update Now (forbes.com)

Arm Memory Tag Extensions broken by speculative execution • The Register

VMware by Broadcom warns of critical vCenter flaws • The Register

Critical VMware Bugs Open Swaths of VMs to RCE, Data Theft (darkreading.com)

Hundreds of PC, Server Models Possibly Affected by Serious Phoenix UEFI Vulnerability - Security Week

CISA warns of Windows bug exploited in ransomware attacks (bleepingcomputer.com)

Security Researchers Expose Critical Flaw in Ivanti Software (databreachtoday.co.uk)

New ARM 'TIKTAG' attack impacts Google Chrome, Linux systems (bleepingcomputer.com)

Dark-web kingpin puts 'stolen' internal AMD data up for sale • The Register

AMD Investigates Possible Breach Amid Hacker’s Sale of Company Data (pcmag.com)

Chrome 126 Update Patches Vulnerability Exploited at Hacking Competition - Security Week

Fortinet, Ivanti zero-day victims face evolved persistence by the espionage actor | CSO Online

SolarWinds Serv-U path traversal flaw actively exploited in attacks (bleepingcomputer.com)

Atlassian fixed six high-severity bugs in Confluence (securityaffairs.com)

ASUS fixed critical remote authentication bypass bug in several routers (securityaffairs.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 19 June 2024 – Critical VMware vCenter Remote Code Execution and Privilege Escalation Vulnerability

Executive summary

Broadcom have released patches addressing three vulnerabilities affecting VMware vCenter. Two of the vulnerabilities are critical severity, allowing remote code execution (CVE-2024-37079 and CVE-2024-37080) the other which allows an attacker to gain admin privileges (CVE-2024-37081).

What’s the risk to me or my business?

If the vulnerabilities are successfully exploited this will allow an attacker to perform arbitrary remote code execution, and the other will allow a local authenticated user to gain admin privileges. All of the vulnerabilities if exploited could have a high impact on the confidentiality, integrity and availability of the organisations data on affected systems.

What can I do?

There is no evidence that the vulnerabilities are being exploited in the wild, however Black Arrow recommends applying the available patches for the vulnerability as soon as possible, further information can be found in the Broadcast advisory below.

Technical Summary

CVE-2024-37039 and CVE-2024-37080 – vCenter Server contains a heap-overflow vulnerability in the Distributed Computing Environment/Remote Procedure Call (DCERPC) protocol. These vulnerabilities allow an attacker to potentially perform arbitrary remote code execution by sending specially crafted network packets.

CVE-2024-37081 – vCenter contains multi local privilege escalation vulnerabilities due to misconfigurations of sudo. This allows an authenticated local user with non-administrative privileges to elevate to root (admin) privileges on vCenter Server Appliance.

Further information on the VMware advisory can be found here:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453

https://core.vmware.com/resource/vmsa-2024-0012-questions-answers#introduction

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 14 June 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Phishing Attacks Targeting US and European Organisations Double

A recent report by Abnormal Security reveals a significant rise in phishing attacks targeting organisations, with Europe experiencing a 112.4% increase between April 2023 and April 2024, and the US seeing a 91.5% rise. The report, "Email Security Threats in Europe: Insights into Attack Trends," highlights that phishing, although not the most costly attack type, often serves as a gateway for further crimes. Additionally, business email compromise (BEC) attacks surged by 123.8% in Europe and 72.2% in the US, including vendor email compromise (VEC) schemes involving fraudulent payments and wire transfers.

78% of People Use the Same Password Across Multiple Accounts

A recent report from Forbes reveals troubling trends in password security. Based on a survey of 2,000 individuals, the survey found that 78% of individuals reuse passwords across multiple accounts, with 52% using the same password for at least three accounts. Notably, 22% of users do not use any safety measures to secure their passwords. Social media accounts are the most likely targets for password hacking at 29%, followed by email accounts at 15%. According to the survey respondents, the most common reason their passwords were hacked was due to weak passwords (35%) and repeated use of the same password (30%).

IT Downtime Cuts Enterprise Profit by 9%

A recent study by Splunk, titled “The Hidden Costs of Downtime,” reveals that eliminating downtime could save large enterprises $200 million annually, equivalent to a 9% increase in yearly profits. The study, conducted by Oxford Economics, found that nearly $49 million of downtime costs stem from lost revenue, with additional expenses from regulatory fines ($22 million), SLA penalties ($16 million), and legal costs ($15 million). While enterprises spend an average of $19 million on ransomware and data extortion payouts, they typically budget only $13.4 million for these incidents. Human error was identified as the leading cause of downtime, followed by malware and phishing attacks. Visibility is crucial in this context, as are risk-mitigation strategies that align with business risk objectives. Visibility serves as the basis for swift detection and response efforts, involving IT, security, and line-of-business leaders.

Financial Services, The Golden Target for Cyber Criminals

A recent IMF report highlights that the financial sector has faced over 20,000 cyber attacks, resulting in $12 billion in losses over the past 20 years. Despite being heavily regulated, the sector remains a prime target, with ransomware attacks increasing by 64% in 2023 compared to 2021. Digitalisation has introduced new vulnerabilities, particularly with unstructured data, which constitutes 80% of banks' data. Nearly 72% of businesses have over-provisioned access, leading to 78% experiencing security issues. With the average data breach costing $4.45 million and taking 204 days to detect, and only 54% of banking CEOs feeling well-prepared for cyber attacks, financial institutions must adopt stringent proven controls, foster a holistic security culture, and thoroughly test their systems, mitigate risks and protect critical data. It is essential too that financial services firms have rehearsed plans in place for what to do when incidents happen, as the even best technical controls in the world cannot stop every attack.

Forced-Labour Camps Fuel Billions of Dollars in Cyber Scams

A recent investigation revealed that Chinese crime syndicates, having shifted from illicit gambling to cyber fraud during the COVID-19 pandemic, have stolen over $64 billion through sophisticated scams, including a type of social engineering known as "pig butchering." Operating from cyber scam centres in Cambodia, Laos, and Myanmar, these syndicates exploit job seekers with the promise of well-paying jobs at reputable firms, but instead, force them into scamming roles. Despite regional government efforts, including China's law enforcement rescue of 45,000 workers, the scale of the operations remains vast. Financial institutions are urged to collaborate with law enforcement to combat these threats, as highlighted by Singapore's success in preventing $74 million in fraud through bank cooperation.

Why You Must Consider the Security Risks of BYOD

Research by the British Chambers of Commerce indicates that fewer than 30% of firms expect their workforce to be fully in-person over the next five years, prompting a shift towards hybrid and remote work models. This shift has led businesses to reduce in-office PCs, with employees often using their own laptops or devices, necessitating lightweight, powerful, and secure devices. The evolving security landscape is seeing increased phishing, quishing (tricking users with QR codes), and vishing (voice phishing) attacks targeting enterprise users, highlighting the critical need for robust security measures. While Bring Your Own Device (BYOD) policies may seem cost-effective, they pose significant security risks, including inadequate protection and potential data breaches, thus requiring careful consideration of long-term security and compliance costs. Employers are advised to invest in high-quality, secure devices to enhance employee satisfaction and maintain a secure work environment.

Cyber Criminals Work Faster Than Ever

Given the fast pace at which the threat landscape changes, it’s important to constantly monitor these changes if businesses are to have any chance of staying ahead of innovative cyber criminals. A recent report by Fortinet's FortiGuard Labs highlights the rapid evolution of the threat landscape, with cyber attacks commencing on average 4.76 days after new exploits are disclosed, a 43% increase in speed from early 2023. Notably, 98% of organisations detected vulnerabilities over five years old, emphasising the need for robust patching protocols. Additionally, 38 out of 143 Advanced Persistent Threat (APT) groups, including Lazarus and APT28, were noted as highly active. The report underscores the importance of collaboration and vigilance in cyber security efforts.

IoT Vulnerabilities Skyrocket, Becoming Key Entry Point for Attackers

A recent report by Forescout reveals a 136% surge in vulnerabilities within Internet of Things (IoT) devices, such as smart TVs, networking devices and printers, with 33% of nearly 19 million analysed devices found to be at risk, up from 14% in 2023. The riskiest devices include wireless access points, routers, printers, and IP cameras, which are frequently targeted by cyber criminals. The most vulnerable industries are technology, education, manufacturing, finance and healthcare.

Cyber Security Is a Boardroom Issue

A recent report highlights the increasing global momentum of cyber security regulations, driven by technologies such as cloud, containerisation, and artificial intelligence. These evolving regulatory initiatives in the US and EU are capturing the attention of boards of directors prompting them to prioritise cyber security, making it a central issue rather than just a CISO concern. Organisations must maintain a state of cyber readiness to prevent breaches, develop strategies to adapt to AI advancements, and balance compliance with security. This proactive approach is essential for mitigating threats and ensuring an integrated cyber security strategy. Being able to evidence that robust and appropriate controls are in place also puts Boards in a much more defensible position in the event of an incident when explaining actions to a regulator, customers or other stakeholders.

An Evolving Threat Landscape: A Battle Between Good and Evil, with Small Business Cyber Security Threats on the Rise

The recent Hiscox Cyber Readiness Report 2023 highlights that 41% of US small businesses experienced a cyber attack in the past year, often due to sophisticated digital tools like AI. Common threats include ransomware, phishing (53% of attacks), credential theft, and unpatched vulnerabilities. 43% of small businesses lack a network-based firewall, and 41% do not have data backup systems, indicating significant gaps in basic cyber security measures.

Further analysis by Sophos reveals that 75% of their 2023 cyber incident response cases involved small businesses, underscoring the urgent need for prudent cyber security investments. The commoditisation of advanced tools and the rise of 'cybercrime-as-a-service' have increased threats, with over 50% of organisations feeling outpaced by these dangers. Dark web marketplaces offer extensive tools, from ransomware to phishing kits, making cyber attacks accessible to low-skilled individuals. Organisations are urged to adopt actionable threat intelligence and robust solutions, including Managed Detection and Response (MDR), to stay ahead in the evolving cyber landscape.

Ransomware Gangs are Adopting “More Brutal” Tactics Amid Crackdowns

A recent report highlights the relentless rise of ransomware attacks, with 2023 witnessing record-breaking payments exceeding $1 billion globally. Healthcare and education sectors are frequently targeted, with 53% of ransomware attacks on small businesses originating from phishing. Despite increased police crackdowns, ransomware gangs are escalating their intimidation tactics, including direct threats and public data leaks. Notably, a 75% rise in data leak site posts was observed in 2023. Law enforcement operations like Operation Cronos and Operation Endgame are making strides in disrupting these operations, but any wins are unfortunately often short-lived. A large obstacle to reining in ransomware is the Hydra-esque nature of affiliates. After the LockBit disruption, analysts saw 10 new ransomware sites pop up almost immediately. The adaptable and proliferating nature of these gangs continues to challenge global cyber security efforts.

Sources

https://www.infosecurity-magazine.com/news/phishing-attacks-us-europe-double/

https://www.securitymagazine.com/articles/100765-78-of-people-use-the-same-password-across-multiple-accounts

https://www.cio.com/article/2142338/it-downtime-cuts-enterprise-profit-by-9-says-study-3.html

https://www.finextra.com/blogposting/26295/the-need-for-enhancing-cyber-preparedness-in-financial-institutions

https://www.finextra.com/blogposting/26288/financial-services-the-golden-target-for-cybercriminals

https://www.darkreading.com/cyber-risk/forced-labor-camps-fuel-billions-of-dollars-in-cyber-scams

https://www.infosecurity-magazine.com/opinions/security-risks-byod/

https://professionalsecurity.co.uk/products/cyber/cybercriminals-work-faster-than-ever/

https://www.infosecurity-magazine.com/news/iot-vulnerabilities-entry-point/

https://www.govinfosecurity.com/cybersecurity-now-boardroom-issue-a-25453

https://www.techradar.com/pro/an-evolving-threat-landscape-a-battle-between-good-and-evil

https://www.inc.com/hiscox/small-business-cybersecuritythreats-on-the-rise.html

https://www.wired.com/story/state-of-ransomware-2024/

---

Governance, Risk and Compliance

The CEO Is Next (darkreading.com)

Cyber Security Is Now a Boardroom Issue - GovInfoSecurity

The Need for Enhancing Cyber Preparedness in Financial Institutions (finextra.com)

Financial Services, the golden target for cyber criminals (finextra.com)

IT downtime cuts enterprise profit by 9%, says study | CIO

Cyber board-level reps | Professional Security

5 cyber security risks and challenges in supply chain | TechTarget

Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)

Small Business Cyber Security Threats on the Rise | Inc.com

CISO Strategies for Navigating Expanding Cyber Security Regulations (forbes.com)

What Tech Execs Can Learn From 2023’s Most Notable Cyber Security Breaches (forbes.com)

Assigning a Monetary Value to Cyber Risk | MSSP Alert

Cyber security governance: The reality of board member liability in cyber attacks, data breaches | ITWeb

4 Ways to Help a Security Culture Thrive (darkreading.com)

Cyber Security Crunch: Building Strong Data Security Programs with Limited Resources - Insights from Tech and Financial Services Sectors | Womble Bond Dickinson - JDSupra

Cloud migration expands the CISO role yet again - Help Net Security

Here’s how to create a security culture that adheres to the new SEC regs | SC Media (scmagazine.com)

How to Create a Cyber Risk Assessment Report (cybersaint.io)

Learning From Others' Gaps in the Wake of Major Attacks (inforisktoday.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Is ‘More Brutal’ Than Ever in 2024 | WIRED

Ransomware tracker: The latest figures [June 2024] (therecord.media)

Unpacking The Ten Most Dangerous Ransomware Gangs (informationsecuritybuzz.com)

Ransomware Group Exploits PHP Vulnerability Days After Disclosure - Security Week

Police arrest Conti and LockBit ransomware crypter specialist (bleepingcomputer.com)

Black Basta Actors Exploited Windows 0day Privilege Vulnerability (cybersecuritynews.com)

Scattered Spider Now Affiliated with RansomHub Following BlackCat Exit - Infosecurity Magazine (infosecurity-magazine.com)

7K LockBit decryptors offered as FBI seeks trust, cooperation from victims | SC Media (scmagazine.com)

Why Akira could be the next big thing in ransomware • The Register

Should there be a total ban on ransom payments? (securityintelligence.com)

What to Do When Your Business Associate Suffers a Ransomware Attack | Dentons - JDSupra

Medical-Targeted Ransomware Is Breaking Records After Change Healthcare’s $22M Payout | WIRED

NHS issues urgent blood donation appeal after IT cyber attack leaves hospitals struggling to match patients (yahoo.com)

What Makes Healthcare a Prime Target for Ransomware? (govinfosecurity.com)

New Fog ransomware targets schools via hacked VPNs | TechRadar

Ransomware Victims

Hundreds of cancer patients hit by NHS cyber attack as thousands of appointments cancelled | The Independent

Christie's Says Ransomware Attack Impacts 45,000 People - Security Week

Ransomware Attack Targets Canada’s Largest School Board (bloomberglaw.com)

Cyber attack means Japanese site Niconico needs total rebuild • The Register

Phishing & Email Based Attacks

Phishing Attacks Targeting US and European Organisations Double - Infosecurity Magazine (infosecurity-magazine.com)

Look before you scan – the QR code scammers are phishing for business | John Naughton | The Guardian

More eggs Malware Disguised as Resumes Targets Recruiters in Phishing Attack (thehackernews.com)

New phishing toolkit uses PWAs to steal login credentials (bleepingcomputer.com)

Phishing emails abuse Windows search protocol to push malicious scripts (bleepingcomputer.com)

Ascension Attack Caused by Employee Downloading Malicious File - Infosecurity Magazine (infosecurity-magazine.com)

Most impersonated sectors, brands in phishing examined | SC Media (scmagazine.com)

BEC

Massachusetts town loses $445,000 in email scam | StateScoop

BEC attack comment | Professional Security

Other Social Engineering

How to Spot a SIM-Swap Attack (and What to Do Next) | Lifehacker

Protecting identity in a world of deepfakes and social engineering - Help Net Security

Cyber security pros change strategies to combat AI-powered threats - Help Net Security

Are older adults more vulnerable to scams? What psychologists have learned about who’s most susceptible, and when (theconversation.com)

As 'swatting' attacks rise, feds win rare prison sentence for Ashton Connor Garcia - Washington Times

CISA Warns Phone Scammers Are Impersonating its Staff - Infosecurity Magazine (infosecurity-magazine.com)

Artificial Intelligence

Cyber security pros change strategies to combat AI-powered threats - Help Net Security

Multiple ChatGPT instances work together to find and exploit security flaws — teams of LLMs tested by UIUC beat single bots and dedicated software | Tom's Hardware (tomshardware.com)

EmailGPT Exposed to Prompt Injection Attacks - Infosecurity Magazine (infosecurity-magazine.com)

The Double-Edged Sword of Generative AI - Infosecurity Magazine (infosecurity-magazine.com)

Chatham House Cyber 2024 - how AI creates new cyber security dimensions (diginomica.com)

How to spot a deepfake - Raconteur

New Attack Technique 'Sleepy Pickle' Targets Machine Learning Models (thehackernews.com)

Easily Exploitable Critical Vulnerabilities Found in Open Source AI/ML Tools - Security Week

Urgently needed: AI governance in cyber warfare - Help Net Security

Protecting identity in a world of deepfakes and social engineering - Help Net Security

GDPR turns six: Expert discusses AI impact - Help Net Security

The Emerging Ecosystem Dedicated to AI Accountability | Decipher (duo.com)

Elon Musk threatens to ban iPhones over OpenAI integration | Digital Trends

Microsoft’s Recall puts the Biden administration’s cyber credibility on the line | CyberScoop

2FA/MFA

Snowflake Breach Exposes 165 Customers' Data in Ongoing Extortion Campaign (thehackernews.com)

How scammers bypass 2FA | Securelist

Hackers Using OTP bots To Bypass Two-Factor Authentication (cybersecuritynews.com)

How to meet evolving MFA demands in the current threat landscape (bleepingcomputer.com)

Malware

China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics (thehackernews.com)

One of Microsoft’s main markets is full of malware - Softonic

WarmCookie Gives Cyber Attackers New Backdoor for Initial Access (darkreading.com)

Why malware matters most: 6 ways to foil software threats faster - Security Boulevard

Cyber Criminals Employ PhantomLoader to Distribute SSLoad Malware (thehackernews.com)

Ascension Attack Caused by Employee Downloading Malicious File - Infosecurity Magazine (infosecurity-magazine.com)

Malicious VSCode extensions with millions of installs discovered (bleepingcomputer.com)

Hundreds of Russian organisations hit with infostealer campaign | SC Media (scmagazine.com)

Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (thehackernews.com)

Mobile

How to Spot a SIM-Swap Attack (and What to Do Next) | Lifehacker

Two arrested in UK over fake cell tower smishing campaign • The Register

Why You Should Delete These 100 Dangerous Google Play Store Apps (forbes.com)

Apple Says iPhones Will Get Security Updates for at Least 5 Years - Security Week

Google Will Track Your Location For The Next 180 Days—Then It Stops

Security and privacy strategies for CISOs in a mobile-first world - Help Net Security

Pakistan-linked Malware Campaign Evolves to Target Windows, Android, and macOS (thehackernews.com)

Security and privacy settings in WhatsApp | Kaspersky official blog

Denial of Service/DoS/DDOS

Hacktivists target Irish websites in EU-wide cyber attacks (rte.ie)

DDoS attacks target EU political parties as elections begin (bleepingcomputer.com)

Pro-Russian hacker group claims responsibility for attempted cyber attacks on Irish websites (irishexaminer.com)

Ireland Hit by Coordinated Cyber Attacks: NCSC Mobilises Response | Cork Safety Alerts

Second Australian Rare Earths Producer Suffers Cyber Attack (bloomberglaw.com)

Internet of Things – IoT

Report: Network equipment most at risk of cyber attacks | SC Media (scmagazine.com)

Dangerous Liaisons: The Interaction Between Threat Actors and High-Risk Devices - Security Week

What Devices Pose the Highest Security Risk? Forescout Answers in New Research: The Riskiest Connected Devices in 2024 | Business Wire

IoT Vulnerabilities Skyrocket, Becoming Key Entry Point for Attackers - Infosecurity Magazine (infosecurity-magazine.com)

Data Breaches/Leaks

Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica

Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)

Hotel Check-in Kiosks Expose Guest Data, Room Keys (darkreading.com)

Snowflake Is Working to Beef Up Security Controls as Firms Probe Breaches (yahoo.com)

23andMe data breach under investigation in UK and Canada (bleepingcomputer.com)

Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)

Cylance confirms the legitimacy of data offered for sale in the dark web (securityaffairs.com)

NYSE Parent Hit with $10M Fine for Failure to Report Cyber Breach | MSSP Alert

The mystery of an alleged data broker’s data breach | TechCrunch

Tile hacked: Customer data and internal tools accessed by hacker (bgr.com)

Student's flimsy bin bags blamed for latest NHS data breach • The Register

Frontier says 750,000 Social Security numbers accessed during April cyber attack (therecord.media)

'New York Times source code' leaks online via 4chan • The Register

Threat Actor Claims to Leak 270GB of New York Times Data - Infosecurity Magazine (infosecurity-magazine.com)

Christie's Says Ransomware Attack Impacts 45,000 People - Security Week

White House report details all of 2023’s major gov breaches • The Register

Organised Crime & Criminal Actors

How Cyber Crime Empires Are Built (darkreading.com)

Scattered Spider Now Affiliated with RansomHub Following BlackCat Exit - Infosecurity Magazine (infosecurity-magazine.com)

Cyber crime suspects often young, increasingly armed: Dutch police | NL Times

Forced-Labor Camps Fuel Billions of Dollars in Cyber Scams (darkreading.com)

Cyber criminals work faster than ever | Professional Security

16-year-old arrested in France in connection with high-profile Epsilon hacking group attacks (bitdefender.com)

22 Chinese nationals sentenced to long prison terms in Zambia for multinational cyber crimes | AP News

As 'swatting' attacks rise, feds win rare prison sentence for Ashton Connor Garcia - Washington Times

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Cryptojacking Campaign Targets Misconfigured Kubernetes Clusters (thehackernews.com)

Insurance

Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)

The Big Question: Is the cyber market becoming too soft for the risks it writes? - Emerging Risks Media Ltd

Supply Chain and Third Parties

Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica

Hundreds of cancer patients hit by NHS cyber attack as thousands of appointments cancelled | The Independent

5 cyber security risks and challenges in supply chain | TechTarget

A Third-Party Risk Management Lifecycle for Cyber Security | UpGuard

Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)

Ransomware attack on England's health system highlights life-threatening impact of cyber crime | CBC News

Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)

What to Do When Your Business Associate Suffers a Ransomware Attack | Dentons - JDSupra

Cloud/SaaS

Hackers steal “significant volume” of data from hundreds of Snowflake customers | Ars Technica

Snowflake Cloud Accounts Felled by Rampant Credential Issues (darkreading.com)

Snowflake Is Working to Beef Up Security Controls as Firms Probe Breaches (yahoo.com)

Pure Storage confirms data breach after Snowflake account hack (bleepingcomputer.com)

A CISO game plan for cloud security | InfoWorld

Why SaaS Security is Suddenly Hot: Racing to Defend and Comply (thehackernews.com)

Cloud migration expands the CISO role yet again - Help Net Security

Compatibility with UK laws and shared responsibility: MoD sets cloud security controls for suppliers – PublicTechnology

Identity and Access Management

Protecting identity in a world of deepfakes and social engineering - Help Net Security

Passwords, Credential Stuffing & Brute Force Attacks

78% of people use the same password across multiple accounts | Security Magazine

America’s Password Habits: 46% Report Having their Password Stolen Over the Last Year – Forbes Advisor

New phishing toolkit uses PWAs to steal login credentials (bleepingcomputer.com)

Regulations, Fines and Legislation

Is a US Nationwide Privacy Law Really Coming? (darkreading.com)

NYSE Parent Hit with $10M Fine for Failure to Report Cyber Breach | MSSP Alert

CISO Strategies For Navigating Expanding Cyber Security Regulations (forbes.com)

Google faces GDPR complaint over Privacy Sandbox • The Register

GDPR turns six: Expert discusses AI impact - Help Net Security

Here’s how to create a security culture that adheres to the new SEC regs | SC Media (scmagazine.com)

Data Protection

Is a US Nationwide Privacy Law Really Coming? (darkreading.com)

Careers, Working in Cyber and Information Security

Cyber Security Job Hunting May Come Down to Certifications (darkreading.com)

Cyber Security CPEs: Unraveling the What, Why & How (thehackernews.com)

The US cyber security industry needs an estimated 225,200 workers | Security Magazine

Preparing for a career in cyber security? Check out these statistics - Help Net Security

Strategies to Manage and Reduce Alert Fatigue in SOCs - IT Security Guru

70% of Cyber Security Pros Often Work Weekends - Infosecurity Magazine (infosecurity-magazine.com)

The risk of a thousand paper cuts – the human-centred problem seen with stress and burnout in cyber security (techuk.org)

Men’s Mental Health Week: Resource Guide - IT Security Guru

Law Enforcement Action and Take Downs

Police arrest Conti and LockBit ransomware crypter specialist (bleepingcomputer.com)

16-year-old arrested in France in connection with high-profile Epsilon hacking group attacks (bitdefender.com)

Misinformation, Disinformation and Propaganda

Russia Is Targeting Germany With Fake Information as Europe Votes | WIRED

Switzerland encounters rise in cyber attacks and disinformation prior to upcoming Ukraine summit (kyivindependent.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Nation State Actors

China

Increasing Cyber Threats from China: What Business Leaders Need to Know | American Enterprise Institute - AEI

"Epoch-Defining" Challenge! China Weaponizing Civilian Hackers Via MCF Program Creates 'Typhoon' In The West (eurasiantimes.com)

Chinese hackers breached 20,000 FortiGate systems worldwide (bleepingcomputer.com)

Chinese cyber espionage campaign targets ‘dozens’ of Western governments, Dutch officials say | CyberScoop

Noodle RAT Reviewing the New Backdoor Used by Chinese-Speaking Groups | Trend Micro (US)

China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics (thehackernews.com)

Chinese Actor SecShow Conducts Massive DNS Probing on Global Scale (thehackernews.com)

The new front in China’s cyber campaign against America (economist.com)

Kaspersky Finds 24 Flaws in Chinese Biometric Hardware Provider - Infosecurity Magazine (infosecurity-magazine.com)

22 Chinese nationals sentenced to long prison terms in Zambia for multinational cyber crimes | AP News

Russia

Microsoft Says Russia 'More Aggressive' In Cyber Space (rferl.org)

bne IntelliNews - Russian cyberwar against Ukraine and the West

Switzerland encounters rise in cyber attacks and disinformation prior to upcoming Ukraine summit (kyivindependent.com)

NATO to take tougher action on Russian spies, says Stoltenberg – POLITICO

'Sticky Werewolf' APT Stalks Aviation Sector (darkreading.com)

Pro-Russia cyber attack targets Netherlands parties on first day of European elections - JURIST - News

Pro-Russian hacker group claims responsibility for attempted cyber attacks on Irish websites (irishexaminer.com)

Russia Is Targeting Germany With Fake Information as Europe Votes | WIRED

The Paris Olympic games will likely present a high cyber risk | Security Magazine

Hundreds of Russian organisations hit with infostealer campaign | SC Media (scmagazine.com)

Putin's subs have exposed Ireland's shameless hypocrisy (telegraph.co.uk)

---

Tools and Controls

CISOs may be too reliant on EDR/XDR defenses | CSO Online

How to conduct an API risk assessment and improve security | TechTarget

A Third-Party Risk Management Lifecycle for Cyber Security | UpGuard

What is ELINT (electronic intelligence)? | Definition from TechTarget

9 out of 10 businesses seek AI-led threat detection and vulnerability management - IT Security Guru

What is IT incident management? | Definition from TechTarget

Strategies to Manage and Reduce Alert Fatigue in SOCs - IT Security Guru

A CISO game plan for cloud security | InfoWorld

Chinese Actor SecShow Conducts Massive DNS Probing on Global Scale (thehackernews.com)

Why SaaS Security is Suddenly Hot: Racing to Defend and Comply (thehackernews.com)

Marsh Insurance: Volume of Cyber Insurance Claims Reaches New Heights (darkreading.com)

Windows Security vs. Microsoft Defender: Important differences you should know | PCWorld

Assigning a Monetary Value to Cyber Risk | MSSP Alert

20 Questions To Assess Cyber Security Risks Within An Organisation (forbes.com)

Top 10 Critical Pentest Findings 2024: What You Need to Know (thehackernews.com)

Modern fraud detection need not rely on PII - Help Net Security

How to meet evolving MFA demands in the current threat landscape (bleepingcomputer.com)

The Big Question: Is the cyber market becoming too soft for the risks it writes? - Emerging Risks Media Ltd

How Enterprise Browsers Enhance Security and Efficiency (inforisktoday.com)

What is communications intelligence (COMINT)? | Definition from TechTarget

Cyber Security Consolidation Ahead: Tool Sprawl Rolls Up to Platforms | MSSP Alert

AI cyber security solutions detect ransomware in under 60 seconds (securityintelligence.com)

Why CISOs need to build cyber fault tolerance into their business - Help Net Security

What Is Attack Path Mapping? - TechRound

How PE Firm CFOs Cost-Effectively Manage Cyber Risk | Kovrr - Security Boulevard

How to Create a Cyber Risk Assessment Report (cybersaint.io)

---

Other News

Collaboration is Key to an Effective Security Culture - Infosecurity Magazine (infosecurity-magazine.com)

Microsoft president to testify about security lapses - Security - iTnews

Cyber attacks are hitting research institutions — with devastating effects (nature.com)

After Recall's mess, Microsoft isn't beating the security loopholes allegation any time soon - MSPoweruser

Introducing SMEs to cyber security (admin.ch)

Beware of these 7 new hacker tricks — and how to protect yourself | PCWorld

Microsoft Ignored Whistleblower Warnings Before SolarWinds Attack (pcmag.com)

Why CISOs need to build cyber fault tolerance into their business - Help Net Security

How to combat cyber threats and secure democracy in the digital age (federaltimes.com)

New Tallinn Paper focuses on Cyber Diplomacy Concepts and Practices

'I just don’t trust what you’re saying': Lawmakers grill Microsoft executive on cyber lapses - POLITICO

Microsoft in damage-control mode, says it will prioritize security over AI | Ars Technica

Microsoft now says employees will be graded on their cyber security contributions - Neowin

How PE Firm CFOs Cost-Effectively Manage Cyber Risk | Kovrr - Security Boulevard

Navigating cyber risk in the manufacturing sector | Retail Technology Review

5 Cost-Effective Cyber Security Tips To Boost Startup EBITDA (forbes.com)

Cyber Attacks on Higher Ed Rose Dramatically Last Year, Report Shows | EdTech Magazine

---

Vulnerability Management

9 out of 10 businesses seek AI-led threat detection and vulnerability management - IT Security Guru

Easily Exploitable Critical Vulnerabilities Found in Open Source AI/ML Tools - Security Week

Solving the systemic problem of recurring vulnerabilities - Help Net Security

AI’s role in accelerating vulnerability management - Help Net Security

Vulnerabilities

Exploit for critical Veeam auth bypass available, patch now (bleepingcomputer.com)

Exploit for Veeam Recovery Orchestrator auth bypass available, patch now (bleepingcomputer.com)

Chinese hackers breached 20,000 FortiGate systems worldwide (bleepingcomputer.com)

Microsoft June 2024 Patch Tuesday fixes 51 flaws, 18 RCEs (bleepingcomputer.com)

Chrome 126, Firefox 127 Patch High-Severity Vulnerabilities - Security Week

PoC Exploit Emerges for Critical RCE Bug in Ivanti Endpoint Manager (darkreading.com)

SolarWinds fixes severe Serv-U vulnerability (CVE-2024-28995) - Help Net Security

Cisco fixes WebEx flaw after government comms exposed • The Register

New PHP Vulnerability Exposes Windows Servers to Remote Code Execution (thehackernews.com)

Nvidia Patches High-Severity GPU Driver Vulnerabilities - Security Week

JetBrains warns of IntelliJ IDE bug exposing GitHub access tokens (bleepingcomputer.com)

Ransomware Group Exploits PHP Vulnerability Days After Disclosure - Security Week

Black Basta Actors Exploited Windows 0day Privilege Vulnerability (cybersecuritynews.com)

Google patches 50 Pixel security flaws, including one hackers are using in their attacks — update your phone now | Tom's Guide (tomsguide.com)

Multiple flaws in Fortinet FortiOS fixed (securityaffairs.com)

Netgear WNR614 flaws allow device takeover, no fix available (bleepingcomputer.com)

Adobe Plugs Code Execution Holes in After Effects, Illustrator - Security Week

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 13 June 2024 – Microsoft Patches Critical RCE Flaw and Zero-Click Vulnerability

Executive summary

Microsoft have released patches for a ‘critical’ remote code execution vulnerability (CVE-2024-30080) and a ‘high’ zero-click vulnerability (CVE-2024-30103) this week. The critical vulnerability allows an attacker to perform remote code execution by sending a specially crafted malicious Microsoft Message Queuing (MSMQ) technology packet to an MSMQ server. The zero-click vulnerability allows an attacker to bypass Outlook registry block lists and enable the creation of malicious files, which is initiated when an affected email is previewed in Outlook or opened.

What’s the risk to me or my business?

If the vulnerabilities are successfully exploited this will allow an attacker to perform arbitrary remote code execution, and the other will allow for malicious DLL files to be created. Both vulnerabilities if exploited could have a high impact on the confidentiality, integrity and availability of the organisations data on affected systems.

What can I do?

Black Arrow recommends applying the available patches for the vulnerability as soon as possible following their organisations update policies due to the severity.

Technical Summary

CVE-2024-30080 – This vulnerability allows an attacker to completely take over an affected server by sending a specially crafted malicious MSMQ packet to a MSMQ server, performing arbitrary remote code execution on the server side.

CVE-2024-30103 – This vulnerability allows an authenticated malicious actor using valid Exchange user credentials to bypass the Outlook registry block lists and enable the creation of malicious DLL files, allowing them to perform other malicious activities.

Further information on Microsoft Patches released this week can be found here:

https://msrc.microsoft.com/update-guide/releaseNote/2024-Jun

Further information on the RCE vulnerability can be found here:

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30080

Further information on the Zero-Click vulnerability can be found here:

https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-30103

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Advisory 12 June 2024 – Fortinet FortiGate SSL VPN Vulnerability Leads to 20,000 Systems Being Breached by China Globally

Executive summary

The Dutch cyber security agency has recently State-sponsored threat actors backed by China have gained access to 20,000 Fortinet Fortigate systems globally between 2022 and 2023 through the Coathanger malware campaign.  The vulnerability (CVE-2022-42475) allows a malicious actor to remotely execute malicious code. The Coathanger malware is persistent and remains on the devices even after reboots and firmware and software updates. While Fortinet silently released an update to fix this vulnerability in November 2022, they did not announce this until December 2022 in which during this time 14,000 devices were backdoored.

What’s the risk to me or my business?

The vulnerability in Fortinet’s products affected by this could pose a significant risk to your organisation. If exploited it could allow an attacker to remain in the product even after reboots and firmware updates. It also could allow an attacker to remotely execute malicious code. This could compromise the confidentiality, integrity, and availability of your organisation’s data

What can I do?

The vulnerability is difficult to identify and remove even if the patch has been installed to fix this vulnerability, indicators of compromise can be found in the link below. If you are unsure of what to do, please contact Black Arrow for further help and guidance.

Technical Summary

CVE-2022-42475: This is a heap-based buffer overflow vulnerability which may allow a remote unauthenticated attacker to execute arbitrary code or commands via specifically crafted requests.

The affected products are:

·         FortiOS version 7.2.0 through 7.2.2

·         FortiOS version 7.0.0 through 7.0.8

·         FortiOS version 6.4.0 through 6.4.10

·         FortiOS version 6.2.0 through 6.2.11

·         FortiOS version 6.0.0 through 6.0.15

·         FortiOS version 5.6.0 through 5.6.14

·         FortiOS version 5.4.0 through 5.4.13

·         FortiOS version 5.2.0 through 5.2.15

·         FortiOS version 5.0.0 through 5.0.14

·         FortiOS-6K7K version 7.0.0 through 7.0.7

·         FortiOS-6K7K version 6.4.0 through 6.4.9

·         FortiOS-6K7K version 6.2.0 through 6.2.11

·         FortiOS-6K7K version 6.0.0 through 6.0.14

·         FortiProxy version 7.2.0 through 7.2.1

·         FortiProxy version 7.0.0 through 7.0.7

·         FortiProxy version 2.0.0 through 2.0.11

·         FortiProxy version 1.2.0 through 1.2.13

·         FortiProxy version 1.1.0 through 1.1.6

·         FortiProxy version 1.0.0 through 1.0.7

Further information from the National Cyber Security Centre can be found here:

https://www.ncsc.nl/actueel/nieuws/2024/juni/10/aanhoudende-statelijke-cyberspionagecampagne-via-kwetsbare-edge-devices

Further information on the FortiGuard Advisory can be found here:

https://www.fortiguard.com/psirt/FG-IR-22-398

Further information on the Indicators of compromise can be found here:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Critical-vulnerability-Protect-against-heap-based/ta-p/239420

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Advisory 11 June 2024 – Active exploitation of Check Point Zero-Day Vulnerability

Executive summary

Recent exploitation of Check Point VPN zero-days have been ramping up since the proof of concept was released to the public. The actively exploited zero-day (CVE2024-24919) has been added to CISA’s Known Exploited Vulnerabilities (KEV) Catalog and could allow an attacker to access sensitive information on Check Point Security gateways and allow them to obtain admin privileges. Check Point have recently stated that it is thought exploitation to have begun in early April, however Checkpoint is not due to release any patches until 20 June.

What’s the risk to me or my business?

The vulnerability in Check Point’s products could pose a significant risk to your organisation. If exploited, it could potentially allow an attacker to access sensitive information from your Check Point Security Gateways. In some instances, the attacker might even gain domain admin privileges. This could compromise the confidentiality, integrity, and availability of your organisation’s data

What can I do?

Check Point have not released any patches for this vulnerability however they have released automatic interim preventative measures deployed through AutoUpdater utility. Black arrow recommends following Check Points advice, which can be found in their advisory linked below.

Technical Summary

CVE-2024-24919 - A path traversal vulnerability, which could allow an attacker to read any file on the system. No specific privilege level is required to exploit this vulnerability.

The affected products are:

·         CloudGuard Network

·         Quantum Maestro

·         Quantum Scalable Chassis

·         Quantum Security Gateways

·         Quantum Spark Appliances

A security gateway is vulnerable if one of the configurations is applied:

·         If the “IPSec VPN” blade has been enabled and the Security Gateway device is part of the “Remote Access” VPN community.

·         If the “Mobile Access” blade has been enabled.

The advisory provided by Check Point can be found here:

https://support.checkpoint.com/results/sk/sk182336

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 07 June 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Urgent Training Gap Exposed as a Quarter of Organisations Provide No Cyber Training to End-Users

A recent survey by Hornetsecurity highlights a concerning gap in IT security training among organisations, with 26% not providing any training to end-users. While 79% of organisations believe their training is moderately effective, 39% admit it fails to address recent AI-powered threats adequately. Notably, 31% of respondents found the training unengaging. The survey also revealed that 23% of organisations experienced a cyber security breach in the past year, leading 94% to implement additional controls. However, 52% of end-users often ignore identified threats, emphasising the need for ongoing, engaging, and adaptive training programmes.

Black Arrow supports organisations of all sizes in designing and delivering proportionate user education and awareness programmes, including in-person and online training as well as simulated phishing campaigns. Our programmes help secure employee engagement and build a cyber security culture to protect the organisation.  

UK SMBs Unaware of True Cost of Cyber Attacks, 78% of SMBs Fear Cyber Attacks Could Shut Down Their Business

New research reveals that UK SMBs underestimate the financial impact of cyber attacks by nearly £85,000. SMBs that have not experienced an attack estimate losses at £39,633, while those that have suffered breaches report actual losses at £123,984.

A separate report by ConnectWise reveals that 94% of SMBs have experienced at least one cyber attack in the last year, up from 64% in 2019, highlighting a significant rise in cyber threats. The report shows that 76% of SMBs lack in-house cyber security skills, driving demand for externally sourced third party security experts. Additionally, 78% of SMBs fear a severe cyber attack could jeopardise their operations. The study found that 56% have faced a cyber attack so far this year, with 89% anticipating another within six months. 83% of SMBs plan to increase their cyber security budgets by an average of 19% over the next year to bolster defences.

Major Cyber Crime Networks Dismantled in US and Europe Deemed a Wake-Up Call for Businesses, Although Ransomware Rises Despite Law Enforcement Takedowns

The recent crackdown on cyber crime by the US and Europe underscores the critical need for robust cyber security measures for businesses. The US Department of Justice arrested Chinese national YunHe Wang, who allegedly compromised over 19 million devices, resulting in $5.9 billion in fraudulent claims. Europol simultaneously apprehended key figures in Armenia and Ukraine, dismantling ransomware networks extorting millions in cryptocurrency. Despite these efforts, a recent report from Mandiant reveals a 75% increase in ransomware activity in 2023, with nearly 1,400 victims across 110 countries.

Factors driving this resurgence include new ransomware entrants, partnerships between groups, and the use of remote management tools, which featured in 41% of intrusions. Established groups like ALPHV/BlackCat and LockBit were prominent, but the landscape also saw 50 new ransomware variants, with a trend towards updating existing families rather than creating new ones.

Businesses must adopt comprehensive security training, regular system updates, advanced threat detection, and incident response planning to mitigate these substantial threats.

Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT, or How the Smart TV in your Office Could Infect Your Whole Business with Malware

A recent report underscores the escalating cyber risks linked to the Internet of Things (IoT), especially for critical infrastructure. Vulnerable legacy IoT devices, often manually updated, pose significant security risks.

Additionally, there is now more malware specifically targeting IoT devices, such as the Pandoraspear malware, which targets smart TVs via free streaming sites accessed on smartphones. This malware turns TVs into part of a botnet for Distributed Denial of Service (DDoS) attacks. The botnet has compromised over 170,000 endpoints, with estimates suggesting it involves 1.3 million unique IP addresses.

These findings highlight the critical need for enhanced cyber security measures to safeguard against IoT threats, including changing default passwords, network isolation, encrypting data, and conducting regular software updates.

CISOs Are Facing a ‘Tsunami of Regulations’; Here’s Why It’s Crucial They Focus on Quantifying Cyber Risk

Recent discussions emphasise the challenges CISOs encounter when trying to quantify cyber risk in the face of an influx of new regulations such as NIS2 in Europe and SEC requirements in the US that are transforming the way security leaders handle risks. CISOs must translate diverse threats into simplified metrics to communicate effectively with boards. The importance of continuous assessment over annual checks to keep up with evolving vulnerabilities cannot be stressed enough. A mature approach involves visibility, prioritisation, communication, and quantification of risks. The focus should be on defending yourself against the attacker by maintaining credible controls, not on defending yourself against the regulator through a weak tick box exercise.

90% of Threats are Social Engineering

The Avast Q1 2024 Threat Report reveals that nearly 90% of threats were social engineering-based, with scams and phishing utilising deepfake technology and hijacked YouTube channels. Over 90% of mobile threats were scams, including adware and banker malware. YouTube was heavily exploited for phishing and crypto scams.

UK Businesses Faced with Month-Long Recoveries from Supply Chain Attacks

New research by BlackBerry shows that 38% of British organisations face month-long recovery times following software supply chain attacks. The survey, involving 200 IT decision-makers, found that 74% of UK IT leaders were notified of supply chain attacks or vulnerabilities in the past year. While regulatory requirements are encouraging proactive monitoring, a lack of technical knowledge and confidence to act on threats persists. Notably, only 22% of organisations perform real-time inventories of their software environment. The impacts of these attacks include financial loss (62%), data loss (59%), and reputational damage (57%).

Account Takeovers Outpace Ransomware as Top Security Concern

A recent survey by Abnormal Security highlights account takeover attacks as the primary threat to organisations. According to the 2024 State of Cloud Account Takeover Attacks Report, 83% of organisations experienced at least one such attack in the past year, with 77% of security leaders ranking them among their top four threats. Nearly half faced these attacks over five times annually, and 20% encountered more than ten incidents. Despite common defences like multi-factor authentication and strong password policies, 63% of respondents doubted MFA’s effectiveness. The survey emphasises the need for solutions offering cross-platform visibility and automated remediation to combat these pervasive threats effectively.

The Impact of Legacy Vulnerabilities in Today's Cyber Security Landscape

Research shows that the vulnerabilities most affecting small to medium sized businesses (SMBs) are older, known vulnerabilities rather than newer highly publicised zero-days. According to SonicWall’s data from January 2022 to March 2024, the top five network attacks included Log4j (43%) and Heartbleed (35%), both of which target vulnerabilities up to a decade old. Despite advancements in AI and novel threats, these older vulnerabilities remain significant risks due to their ease of exploitation and how widespread they continue to be. SMBs, especially in critical industries, are advised to utilise industry-leading tools and automated patches, ensuring robust cyber security measures against both old and new threats.

Nearly All FTSE 100 Companies Exposed to Third and Fourth-Party Breaches

A recent report by SecurityScorecard reveals that virtually all FTSE 100 companies had suppliers experiencing breaches in the past year. The UK Top 100 Companies: Cybersecurity Threat Report graded firms A-F based on factors predicting a security breach. While UK firms generally scored higher than their continental counterparts, 97% had breaches in their third-party ecosystem. This shows the increasing threat of supply chain attacks, with 97% also experiencing fourth-party breaches. Notably, the energy and basic materials sectors were the most secure, with only 12% and 16% reporting third-party breaches, respectively, while the communications sector had the lowest security posture.

Snowflake Denies Breach, Blames Data Theft on Poorly Secured Customer Accounts

Recent incidents involving cloud storage provider Snowflake highlights the risks associated with compromised credentials. A threat actor claimed to have breached Snowflake’s infrastructure, accessing data from Santander, Ticketmaster and others. However, Snowflake maintains that the theft resulted from stolen customer login details, not a vulnerability or misconfiguration in their system. Snowflake’s CISO clarified that a former employee's demo account was accessed, which was not protected by two-factor authentication (2FA). Santander confirmed a third-party database breach, and Ticketmaster identified unauthorised activity in a Snowflake-hosted database. Snowflake, alongside Crowdstrike and Mandiant, found no evidence implicating Snowflake's platform itself.

97 percent of Security Experts Worry about AI Security Related Threats and Incidents

A new report from Deep Instinct reveals that 97% of security professionals fear AI-generated security incidents, prompting 75% to alter their cyber security strategies over the past year, with 73% focusing more on prevention. The survey of 500 senior experts from large enterprises also shows a 61% rise in deepfake incidents, primarily targeting CEOs and C-suite members. Stress levels have increased for 66% of cyber security professionals due to these threats. Despite 41% relying on endpoint detection and response (EDR) solutions, only 31% plan to boost EDR investments, while 53% feel board pressure to adopt preventative tools against AI threats. This report highlights the need for predictive prevention to enhance resilience.

85% of Managed Service and Security Providers Face “Significant” Challenges Maintaining Security Compliance for Clients

Recent reports by Apptega and Sophos reveals that 85% of managed service providers (MSPs) face significant challenges in maintaining compliance for customers due to resource, expertise, and technology gaps. The MSP Perspectives 2024 survey reveals that MSPs struggle to keep pace with evolving threats and industry trends, with 91% of ransomware attacks occurring outside business hours.

Cyber Attack Causes Critical Incident in London Hospitals with Operations Cancelled and Emergency Patients Diverted

Major hospitals in London declared a critical incident earlier in the week after a cyber attack led to operations being cancelled and emergency patients being diverted elsewhere.  It applies to hospitals partnered with Synnovis, a provider of pathology services which suffered a ransomware attack linked to Russian threat actors. King’s College Hospital, Guy’s and St Thomas’, the Royal Brompton and the Evelina London Children’s Hospital, as well as primary care services, were among those affected.

The incident has had a "major impact" on the delivery of services, especially blood transfusions and test results. Some procedures were cancelled or were redirected to other NHS providers as the hospitals tried to establish what work can be carried out safely.

Sources:

https://www.prnewswire.com/news-releases/urgent-training-gap-exposed-as-a-quarter-of-organisations-unprepared-for-cyber-attacks-hornetsecurity-survey-reveals-302160745.html

https://www.commsbusiness.co.uk/content/news/uk-smes-unaware-of-the-true-cost-of-cyberattacks

https://www.helpnetsecurity.com/2024/06/06/smbs-cyberattack-frequency/

https://www.grcworldforums.com/risk/major-cybercrime-networks-dismantled-in-us-and-europe-a-wake-up-call-for-businesses/9642.article

https://www.infosecurity-magazine.com/news/ransomware-rise-2023-mandiant/

https://www.insurancejournal.com/news/international/2024/06/06/778306.htm

https://www.techradar.com/pro/security/that-smart-tv-in-your-office-could-be-infecting-your-whole-business-with-malware

https://www.itpro.com/security/cisos-are-facing-a-tsunami-of-regulations-heres-why-its-crucial-they-focus-on-quantifying-cyber-risk

https://www.helpnetsecurity.com/2024/06/06/social-engineering-threats-video/

https://www.infosecurity-magazine.com/news/uk-businesses-recoveries-supply/

https://www.infosecurity-magazine.com/news/ato-outpace-ransomware-top/

https://www.techradar.com/pro/the-impact-of-legacy-vulnerabilities-in-todays-cybersecurity-landscape

https://www.infosecurity-magazine.com/news/ftse-100-exposed-third-fourth/

https://www.helpnetsecurity.com/2024/06/01/snowflake-breach-data-theft/

https://betanews.com/2024/06/03/97-percent-of-organizations-worried-about-ai-security-threats/

https://www.businesswire.com/news/home/20240605033270/en

https://www.computerweekly.com/microscope/news/366587132/Skills-shortages-exposing-MSPs-to-security-risks

https://www.bbc.co.uk/news/articles/c288n8rkpvno

https://securityaffairs.com/164142/cyber-crime/ransomware-attack-synnovis-london-hospitals.html

---

Governance, Risk and Compliance

78% of SMBs fear cyber attacks could shut down their business - Help Net Security

26% of organisations lack any form of IT security training - Help Net Security

Cyber attacks on financial services firms hit 20m people in 2023 - CIR Magazine

Small Firms Need to Stretch Security Budgets - Infosecurity Magazine (infosecurity-magazine.com)

CISOs are facing a ‘tsunami of regulations’ — here’s why it’s crucial they focus on quantifying cyber risk | ITPro

Microsoft: weak cyber defences set to hit economic growth (cityam.com)

How to Prove Security Effectiveness with a Cyber Security Board Report  - Security Boulevard

Skills shortages exposing MSPs to security risks | Microscope (computerweekly.com)

85% of Managed Service and Security Providers Face “Significant” Challenges Maintaining Security Compliance for Clients, Apptega Survey Finds | Business Wire

Urgent training gap exposed as a quarter of organisations unprepared for cyber attacks, Hornetsecurity survey reveals (prnewswire.com)

Is your workplace ‘cyber savvy’? (siliconrepublic.com)

Governance Essentials for Businesses in the AI Era | News | GRC World Forums

49% of organisations feel somewhat prepared to handle a breach | Security Magazine

UK Businesses Face Month-Long Recoveries from Supply Chain Attacks - Infosecurity Magazine (infosecurity-magazine.com)

Mastering Cyber Risk Quantification Methods: A Strategic Approach - Security Boulevard

Deciding cyber security spend: how much is enough? | Propertymark

Effective Incident Response: A Cyber Security Playbook for Executives - Security Boulevard

1/3 of CISOs in the UK ignore NCSC cyber security guidance (verdict.co.uk)

4 communication mistakes to avoid during a data breach - PR Daily

80 percent of organisations not ready for CISA rules on security practices (betanews.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Rises Despite Law Enforcement Takedowns - Infosecurity Magazine (infosecurity-magazine.com)

Ransomware Rebounds: Extortion Threat Surges in 2023, Attackers Rely on Publicly Available and Legitimate Tools | Google Cloud Blog

Darknet site for Qilin gang, suspected in London hospitals ransomware attack, goes down (therecord.media)

With over 1.7 million employees, the UK's NHS has become a 'rinse-and-repeat target' for cyber criminals—disrupting services and risking lives | Fortune Europe

Account Takeovers Outpace Ransomware as Top Security Concern - Infosecurity Magazine (infosecurity-magazine.com)

RansomHub extortion gang linked to now-defunct Knight ransomware (bleepingcomputer.com)

RansomHub Actors Exploit ZeroLogon Vuln in Recent Ransomware Attacks (darkreading.com)

FBI recovers 7,000 LockBit keys, urges ransomware victims to reach out (bleepingcomputer.com)

New ransomware attack based on an evolutional generative adversarial network can evade security measures (techxplore.com)

Security industry has ransomware-as-a-service model wrong, says expert | SC Media (scmagazine.com)

Ransomware Ecosystem Transformed, New Groups “Changing the Rules” - Infosecurity Magazine (infosecurity-magazine.com)

'Fog' Ransomware Rolls in to Target Education, Recreation Sectors (darkreading.com)

New Gitloker attacks wipe GitHub repos in extortion scheme (bleepingcomputer.com)

Cyber insurance isn't the answer for ransom payments - Help Net Security

Linux version of TargetCompany ransomware focuses on VMware ESXi (bleepingcomputer.com)

What is ransomware? 7 things you must know before it's too late | PCWorld

Ransomware Victims

MediSecure in administration just weeks after confirming large cyber attack - ABC News

Former cyber security boss 'believes a Russian group' is behind the NHS 'major IT incident' (cityam.com)

A ransomware attack on Synnovis impacted several London hospitals (securityaffairs.com)

Darknet site for Qilin gang, suspected in London hospitals ransomware attack, goes down (therecord.media)

Wrongful death lawsuit alleges baby dies as a result of Springhill Medical Center’s negligence during cyber attack (fox10tv.com)

Consulting Firm Greylock Hit With Ransomware Attack Class Action (bloomberglaw.com)

RansomHub gang claims the hack of Frontier Communications (securityaffairs.com)

Christie's avoids leak of stolen data, is sold instead • The Register

FBI recovers 7,000 LockBit keys, urges ransomware victims to reach out (bleepingcomputer.com)

Ransomware ravaged schools and cities in May | TechTarget

What If The Scathing UnitedHealth Cyber Rebuke Was Yours? (forbes.com)

Hack of UK Hospitals Highlights Growing Threat (itprotoday.com)

UK School Forced to Close Following Cyber Attack - Infosecurity Magazine (infosecurity-magazine.com)

Ransomware Gang Leaks Data From Australian Mining Company - Security Week

Phishing & Email Based Attacks

90% of threats are social engineering - Help Net Security

AI Will Increase the Quantity—and Quality—of Phishing Scams - Schneier on Security

New V3B phishing kit targets customers of 54 European banks (bleepingcomputer.com)

AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)

Microsoft: The brand attackers love to imitate | CSO Online

AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say | FedScoop

Why your inbox is still so bad at blocking malware and spam - 9to5Mac

Phishing scams using QR codes are surging, here's what you should know | Tech News - Business Standard (business-standard.com)

The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)

BEC

90% of threats are social engineering - Help Net Security

US Authorities Attempting to Recover $5.3 Million Stolen in BEC Scam  - Security Week

Other Social Engineering

Have you answered a spam call by accident? Your next move is extremely important

Artificial Intelligence

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

OpenAI report reveals threat actors using ChatGPT in influence operations | SC Media (scmagazine.com)

AI Will Increase the Quantity—and Quality—of Phishing Scams - Schneier on Security

AI vs. human deceit: Unravelling the new age of phishing tactics (securityintelligence.com)

97% of security experts worry about AI-related security incidents | Security Magazine

Coinbase's top cyber exec warns deepfake threat is growing | Fortune Crypto

Five AI-based threats security pros need to understand | SC Media (scmagazine.com)

AI fuels rise in attacks from ‘unsophisticated threat actors,’ federal cyber leaders say | FedScoop

Forrester report highlights 2024 IAM trends & AI impact (securitybrief.co.nz)

ChatGPT privacy tips: Two important ways to limit the data you share with OpenAI | ZDNET

AI Company Hugging Face Detects Unauthorized Access to Its Spaces Platform (thehackernews.com)

2FA/MFA

Snowflake’s Lack of MFA Control Leaves Companies Vulnerable, Experts Say (informationweek.com)

What is MFA bombing? Apple users were targeted using this phishing technique (securitybrief.co.nz)

Security keys unlock nothing but inconvenience (techmonitor.ai)

Malware

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)

Europol identifies 8 cyber criminals tied to malware loader botnets (bleepingcomputer.com)

Europol's Hunt Begins for Emotet Malware Mastermind (darkreading.com)

Beware: Fake Browser Updates Deliver BitRAT and Lumma Stealer Malware (thehackernews.com)

DarkGate Malware Replaces AutoIt with AutoHotkey in Latest Cyber Attacks (thehackernews.com)

Ukrainian Systems Hit by Cobalt Strike Via a Malicious Excel File (darkreading.com)

Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan (thehackernews.com)

Comms Business - Malware targeting endpoints on the rise, finds report

Non-mobile malware statistics, Q1 2024 | Securelist

Stealthier DarkGate malware campaign emerges | SC Media (scmagazine.com)

Hackers Exploit Legitimate Packer Software to Spread Malware Undetected (thehackernews.com)

Mobile

The NSA advises you to turn your phone off and back on once a week - here's why | ZDNET

In case you missed it: Bank info-stealing malware found in 90+ Android apps with 5.5M installs | Mashable

Hackers Targeting 1,500 Banks and Their Customers in Push To Drain Accounts Across 60 Countries: Report - The Daily Hodl

37 Vulnerabilities Patched in Android - Security Week

361 million account credentials leaked on Telegram: Are yours among them? - Help Net Security

Android malware and unwanted software statistics for Q1 2024 | Securelist

Denial of Service/DoS/DDOS

Conflicts Drive DDoS Attacks Surge in EMEA - Infosecurity Magazine (infosecurity-magazine.com)

Internet of Things – IoT

Companies Need to Be Aware of Cyber Risks Related to Proliferation of IoT (insurancejournal.com)

That smart TV in your office could be infecting your whole business with malware | TechRadar

Over 600,000 SOHO routers were destroyed by Chalubo malware in 72 hours  (securityaffairs.com)

Data Breaches/Leaks

The Ticketmaster Data Breach May Be Just the Beginning | WIRED

Ticketmaster confirms massive breach after stolen data for sale online (bleepingcomputer.com)

Snowflake denies breach, blames data theft on poorly secured customer accounts - Help Net Security

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

Snowflake account hacks linked to Santander, Ticketmaster breaches (bleepingcomputer.com)

Snowflake’s Lack of MFA Control Leaves Companies Vulnerable, Experts Say (informationweek.com)

The Snowflake Attack May Be Turning Into One of the Largest Data Breaches Ever | WIRED

Santander hit by massive cyber attack: All staff and '30million' customers have personal data stolen by gang 'behind Ticketmaster hack' | Daily Mail Online

The Billericay School pupils have details exposed in cyber attack - BBC News

Crooks threaten to leak 2.9B records of personal info • The Register

Threat actor considers leaking 3B records from background check firm | SC Media (scmagazine.com)

Secrets Exposed in Hugging Face Hack - Security Week

Google's hidden logs detail thousands of privacy breaches - CyberGuy

Spanish police investigate whether hackers stole millions of drivers' data - CNA (channelnewsasia.com)

Blackbaud Class Action Lawsuit Denied by Federal Court | MSSP Alert

Ticketek customer details exposed in cyber security breach | Data and computer security | The Guardian

Club Penguin fans breached Disney Confluence server, stole 2.5GB of data (bleepingcomputer.com)

Check-in terminals used by thousands of hotels leak guest info (bleepingcomputer.com)

Debt Collector Data Breach Exposes Data on 3 Million+ Americans | PCMag

Nearly 400,000 affected by data breach at eye care management services company (therecord.media)

Over 2.5 billion free Android VPN users at risk of data leaks | TechRadar

Advance Auto Parts stolen data for sale after Snowflake attack (bleepingcomputer.com)

Organised Crime & Criminal Actors

Major Cyber Crime Networks Dismantled in US and Europe: A Wake-Up Call for Businesses | News | GRC World Forums

International Cyber Crime Ringleaders Arrested In Armenia, Ukraine – Eurasia Review

Authorities Ramp Up Efforts to Capture the Mastermind Behind Emotet (thehackernews.com)

4 cuffed following probe into holiday scheme for cyber crooks • The Register

Security industry has ransomware-as-a-service model wrong, says expert | SC Media (scmagazine.com)

Ransomware Ecosystem Transformed, New Groups “Changing the Rules” - Infosecurity Magazine (infosecurity-magazine.com)

Why Hackers Love Logs - Security Week

Police dismantle pirated TV streaming network that made $5.7 million (bleepingcomputer.com)

Hacker ordered to pay Nintendo 25-30% of his salary for the rest of his life still hasn't got a full-time job

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Two 39-year-old Estonian men are the alleged kingpins behind a massive half billion fraud targeting thousands of US investors | Fortune

Hackers exploit Chrome plugin to steal millions from Binance accounts (cointelegraph.com)

Microsoft India’s X account hijacked in Roaring Kitty crypto scam (bleepingcomputer.com)

Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers | Trend Micro (US)

Insider Risk and Insider Threats

4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)

Insurance

30% of Organisations with Cyber Insurance Implemented Additional Security Measures to Be Eligible for the Policy, up from 22% in 2023 (prnewswire.com)

Cyber insurance isn't the answer for ransom payments - Help Net Security

The top three cyber policy gaps - Insurance News | InsuranceNewsNet

Supply Chain and Third Parties

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

Third-party vendors pose serious cyber security threat to national security - Help Net Security

London NHS hospitals revert to paper records after cyber attack | NHS | The Guardian

Software Supply Chain Attacks Have Increased Financial and Reputational Impacts on Companies Globally, New BlackBerry Research Reveals (prnewswire.com)

UK Businesses Face Month-Long Recoveries from Supply Chain Attacks - Infosecurity Magazine (infosecurity-magazine.com)

Third-party software supply chain threats continue to plague CISOs | CSO Online

Nearly All of FTSE 100 Exposed to Third and Fourth-Party - Infosecurity Magazine (infosecurity-magazine.com)

Snowflake data breach claims spark war of words over culpability; researchers may have been trolled - DataBreaches.net

Ticketmaster Breach Showcases SaaS Data Security Risks (darkreading.com)

Ticketek customer details exposed in cyber security breach | Data and computer security | The Guardian

Basic cyber security can protect from rising supply chain attacks | TechRadar

Advance Auto Parts stolen data for sale after Snowflake attack (bleepingcomputer.com)

Cloud/SaaS

Snowflake denies breach, blames data theft on poorly secured customer accounts - Help Net Security

Snowflake account hacks linked to Santander, Ticketmaster breaches (bleepingcomputer.com)

Snowflake Recommends Customers Take Steps to Prevent Unauthorized Access | CISA

2024-State-of-Multicloud-Security-Risk-Report.pdf (microsoft.com)

Shadow IT and Zombie Accounts: Sabotaging Your SaaS Security - Security Boulevard

Azure Service Tags tagged as security risk, Microsoft disagrees (bleepingcomputer.com)

Identity and Access Management

The Top Trends Shaping Identity And Access Management I... | Forrester

Why (and how) threat actors target your Active Directory (bleepingcomputer.com)

Encryption

WhatsApp encryption isn't the problem, metadata is | TechRadar

Using entangled particles to create unbreakable encryption (phys.org)

Linux and Open Source

CISA warns of actively exploited Linux privilege elevation flaw (bleepingcomputer.com)

Passwords, Credential Stuffing & Brute Force Attacks

Hundreds of Snowflake customer passwords found online are linked to info-stealing malware | TechCrunch

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)

Understanding Credential Phishing - Security Boulevard

Should Employee Password Management Be Mandatory? (forbes.com)

361 million account credentials leaked on Telegram: Are yours among them? - Help Net Security

Account Takeovers Outpace Ransomware as Top Security Concern - Infosecurity Magazine (infosecurity-magazine.com)

Prevent Account Takeover with Better Password Security (thehackernews.com)

Security keys unlock nothing but inconvenience (techmonitor.ai)

Social Media

Microsoft India’s X account hijacked in Roaring Kitty crypto scam (bleepingcomputer.com)

TikTok fixes zero-day bug used to hijack high-profile accounts (bleepingcomputer.com)

Donald Trump Joins TikTok, App He Tried to Ban as President (variety.com)

Malvertising

Google Chrome’s plan to limit ad blocking extensions kicks off next week | Ars Technica

Training, Education and Awareness

26% of organisations lack any form of IT security training - Help Net Security

Urgent training gap exposed as a quarter of organisations unprepared for cyber attacks, Hornetsecurity survey reveals (prnewswire.com)

Is your workplace ‘cyber savvy’? (siliconrepublic.com)

How to Change Security Behaviours Beyond Awareness Training - Infosecurity Magazine (infosecurity-magazine.com)

4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)

The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)

Regulations, Fines and Legislation

CISOs are facing a ‘tsunami of regulations’ — here’s why it’s crucial they focus on quantifying cyber risk | ITPro

104 EU Laws Have Different Definitions of Cyber Security - Infosecurity Magazine (infosecurity-magazine.com)

Here’s what a US surveillance law means for European data privacy | Euronews

80 percent of organisations not ready for CISA rules on security practices (betanews.com)

Data Protection

Here’s what a US surveillance law means for European data privacy | Euronews

Careers, Working in Cyber and Information Security

Narrowing the Stubborn Cyber Security Worker Gap - Security Boulevard

What is a typical day like as an SOC analyst? (siliconrepublic.com)

Law Enforcement Action and Take Downs

Major Cyber Crime Networks Dismantled in US and Europe: A Wake-Up Call for Businesses | News | GRC World Forums

Europol identifies 8 cyber criminals tied to malware loader botnets (bleepingcomputer.com)

Two 39-year-old Estonian men are the alleged kingpins behind a massive half billion fraud targeting thousands of US investors | Fortune

Authorities Ramp Up Efforts to Capture the Mastermind Behind Emotet (thehackernews.com)

4 cuffed following probe into holiday scheme for cyber crooks • The Register

Police dismantle pirated TV streaming network that made $5.7 million (bleepingcomputer.com)

Misinformation, Disinformation and Propaganda

Poland Suspects Russia Behind False PAP Story on Mobilization (bloomberglaw.com)

Information Warfare: The Future Is Here | Proceedings - June 2024 Vol. 150/6/1,456 (usni.org)

Microsoft Security is warning of Russian misinformation campaigns during the 2024 Olympics - Neowin

Fake Tom Cruise warns of violence at Paris Olympics in pro-Russian info op | CyberScoop

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Resilience isn't enough, NATO must be 'proactive' for cyber defence, warns official (therecord.media)

Information Warfare: The Future Is Here | Proceedings - June 2024 Vol. 150/6/1,456 (usni.org)

Conflicts Drive DDoS Attacks Surge in EMEA - Infosecurity Magazine (infosecurity-magazine.com)

Cyber Attacks and the Risk of Real War: A NATO Perspective - Defence News | The Financial Express

Nation State Actors

China

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

China outsourcing its cyber attacks to hackers-for-hire - Asia Times

Donald Trump Joins TikTok, App He Tried to Ban as President (variety.com)

Russia

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

Russian Hackers Target Europe with HeadLace Malware and Credential Harvesting (thehackernews.com)

Europe subjected to multi-phase APT28 cyberespionage attacks | SC Media (scmagazine.com)

Poland Suspects Russia Behind False PAP Story on Mobilization (bloomberglaw.com)

FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)

European IT Coalition raises 58 million euros for Ukraine's IT, cyber security defence capabilities (kyivindependent.com)

Poland to spend almost $760 million to improve digital security following suspected Russian cyber attack (kyivindependent.com)

Ukrainian Systems Hit by Cobalt Strike Via a Malicious Excel File (darkreading.com)

Pro-Russia group claims responsibility for cyber attacks on first day of EU elections | Euronews

Poland sees ‘Russian cyber attack’ behind fake military draft report – Euractiv

Russia jams Elon Musk’s Starlink sats in Ukraine for the first time (interestingengineering.com)

Microsoft Security is warning of Russian misinformation campaigns during the 2024 Olympics - Neowin

Fake Tom Cruise warns of violence at Paris Olympics in pro-Russian info op | CyberScoop

Olympics 2024: Cyber Attackers are Targeting Companies Associated With Paris Games (techrepublic.com)

Poland launches investigation into Russian, Belarusian political influence (voanews.com)

Polish government will spend more than $ 3 billion on cyber security - BiznesAlert EN

Russian Power Companies, IT Firms, and Govt Agencies Hit by Decoy Dog Trojan (thehackernews.com)

Russian hackers claim cyber attack on Spanish defence company | Reuters

Iran

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

North Korea

A US Company Enabled a North Korean Scam That Raised Money for WMDs | WIRED

"China, Russia, North Korea and Iran are leveraging ChatGPT for their needs" | Ctech (calcalistech.com)

---

Tools and Controls

26% of organisations lack any form of IT security training - Help Net Security

CISOs are facing a ‘tsunami of regulations’ — here’s why it’s crucial they focus on quantifying cyber risk | ITPro

How to Prove Security Effectiveness with a Cyber Security Board Report  - Security Boulevard

Mastering Cyber Risk Quantification Methods: A Strategic Approach - Security Boulevard

Should Employee Password Management Be Mandatory? (forbes.com)

Security challenges mount as companies handle thousands of APIs - Help Net Security

Comms Business - Malware targeting endpoints on the rise, finds report

Why Hackers Love Logs - Security Week

Security experts call for unity again... - Mobile World Live

The Top Trends Shaping Identity And Access Management I... | Forrester

Lawyers Ask Forensics Investigators for Help Outside Cyber Security (darkreading.com)

Why (and how) threat actors target your Active Directory (bleepingcomputer.com)

30% of Organisations with Cyber Insurance Implemented Additional Security Measures to Be Eligible for the Policy, up from 22% in 2023 (prnewswire.com)

How to Change Security Behaviours Beyond Awareness Training - Infosecurity Magazine (infosecurity-magazine.com)

4 Tips For Strengthening Data Security Through The Human Firewall (forbes.com)

The Art of Hooking the Phish: Educating Users Without Scaring Them (thefastmode.com)

Deciding cyber security spend: how much is enough? | Propertymark

Effective Incident Response: A Cyber Security Playbook for Executives - Security Boulevard

4 communication mistakes to avoid during a data breach - PR Daily

More Than One-Third of Healthcare Organisations Lack Cyber Security Response Plan | HealthLeaders Media

---

Reports Published in the Last Week

The Top Trends Shaping Identity And Access Management I... | Forrester

2024-State-of-Multicloud-Security-Risk-Report.pdf (microsoft.com)

---

Other News

Cyber attacks on financial services firms hit 20m people in 2023 - CIR Magazine

National infrastructure cyber attacks ‘have increased dramatically’ (power-technology.com)

What Cyber Security Memes Reveal About the Industry (itprotoday.com)

What Could Possibly Go Wrong?: New Study Examines Aftermath of Cyber Attacks | HealthLeaders Media

Security experts call for unity again... - Mobile World Live

Achieving Cyber Security in Finance Through Collaborative Efforts (finextra.com)

Lawyers Ask Forensics Investigators for Help Outside Cyber Security (darkreading.com)

ESAs and ENISA sign a Memorandum of Understanding to strengthen cooperation and information exchange - European Union (europa.eu)

Apple refused to pay bug bounty to Russian cyber security firm Kaspersky Lab (therecord.media)

A Major Industrial Cyber Security Threat: Living off the Land Attacks - Security Boulevard

Germany: Major hack targets center-right CDU party – DW – 06/01/2024

Public sector security debt is becoming a pervasive issue | ITPro

New Military Program Aids Cyber Defences in Latin America and the Caribbean | AFCEA International

No summer break for cyber crime: Why educational institutions need better cyber resilience - Help Net Security

Moldova Cracks Down On Interpol Evasion Scheme With Help From France, US, Britain (rferl.org)

Officials accused of trying to sabotage Interpol's Red Notice system to tip off international fugitives - CBS News

---

Vulnerability Management

The impact of legacy vulnerabilities in today's cyber security landscape | TechRadar

NIST turns to IT consultants to help clear NVD backlog • The Register

Vulnerabilities

Exploitation of Recent Check Point VPN Zero-Day Soars - Security Week

CISA warns of actively exploited Linux privilege elevation flaw (bleepingcomputer.com)

Critical Apache Log4j2 flaw still threatens global finance - Security Affairs

FlyingYeti APT Serves Up Cookbox Malware Using WinRAR (darkreading.com)

High-risk Atlassian Confluence RCE fixed, PoC available (CVE-2024-21683) - Help Net Security

Researcher Uncovers Flaws in Cox Modems, Potentially Impacting Millions (thehackernews.com)

37 Vulnerabilities Patched in Android - Security Week

PoC Exploit Released for macOS Root Access Vulnerability (cybersecuritynews.com)

Cisco addressed Webex flaws used to compromise German government meetings (securityaffairs.com)

RansomHub Actors Exploit ZeroLogon Vuln in Recent Ransomware Attacks (darkreading.com)

CISA says 'patch now' to 7-year-old Oracle WebLogic bug • The Register

Azure Service Tags tagged as security risk, Microsoft disagrees (bleepingcomputer.com)

Critical Progress Telerik vulnerability under attack | TechTarget

TikTok fixes zero-day bug used to hijack high-profile accounts (bleepingcomputer.com)

Zyxel Releases Patches for Firmware Vulnerabilities in EoL NAS Models (thehackernews.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 31 May 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Santander Staff and '30 million' Customers Hacked via Cloud Provider Breach

Hackers known as ShinyHunters claim to have stolen confidential data from Santander, affecting all staff globally and millions of customers in Chile, Spain, and Uruguay. The breach includes 30 million bank account details, 6 million account numbers and balances, and 28 million credit card numbers. Santander confirmed the theft but assured no transactional data or online banking credentials were compromised. The attack is linked to an ongoing hack of cloud storage company Snowflake, accessed through a former employee's demo account. Santander is proactively contacting affected individuals and continues to ensure secure transactions. ShinyHunters have this week also claimed responsibility for the massive Ticketmaster breach below.

Source: [BBC]

ABN Amro Disclose Data Breach Following an Attack on a Third-Party Provider

A recent disclosure by Dutch bank ABN Amro revealed a data breach due to a ransomware attack on their third-party service provider, AddComm. This attack potentially exposed data of some ABN Amro clients, prompting the bank to notify affected clients and the Dutch Data Protection Authority. AddComm has since contained the incident, restored affected systems, and is investigating the breach with external security experts. While there are no signs of misuse of client data, ABN Amro has ceased using AddComm's services and warned clients to remain vigilant against phishing attempts.

Source: [SecurityAffairs]

Ticketmaster Confirms Massive Breach of 560m Users After Stolen Data Offered for Sale Online

Live Nation has confirmed a data breach at Ticketmaster, attributed to unauthorised activity within a third-party cloud database, believed to be Snowflake. The breach, identified on May 20, 2024, exposed data of over 560 million users, including personal details and ticket information. A threat actor known as ShinyHunters, the same threat actor claiming responsibility for the Santander attack above, has been attempting to sell this data on the dark web for $500,000. Despite the severity, Live Nation stated the breach is not expected to materially impact business operations or financial condition. The company is working with law enforcement and notifying affected users and regulatory authorities

Source: [BleepingComputer]

Material Cyber Attacks a Concern Among Many CISOs, with Human Error Still Perceived as the Achilles’ Heel of Cyber Security

A recent survey from Proofpoint reveals that 70% of CISOs feel at risk of a significant cyber attack within the next 12 months, up from 68% last year and 48% in 2022. Despite this, only around half feel prepared for such an attack. Human error remains a key vulnerability, with 74% identifying it as the most significant risk. Notably, 87% of CISOs are deploying AI-powered solutions to mitigate these risks. The top concerns include ransomware (41%), malware (38%), and email fraud (36%), with a notable increase in ransomware threats.

Sources: [HelpNetSecurity] [SCMagazine]

Old But Gold: Why Shoulder Surfing is an Underacknowledged Cyber Threat

A recent incident in the UK has highlighted the persistent threat of shoulder surfing, a social engineering tactic where sensitive information is obtained by observing someone's device screen. On 22 May 2024, The Times reported that information from a private memo by British Cabinet Minister Johnny Mercer was leaked after a fellow train passenger photographed Mercer's laptop screen. The memo contained accusations against Downing Street officials and advisors, illustrating the ease with which malicious actors can access confidential information through simple observation. This event underscores the need for heightened awareness and protective measures to combat shoulder surfing, including being mindful of your surroundings and using privacy screen filters.

Source: [ITPro]

Hackers Phish Finance Orgs Using Trojanised Minesweeper Clone

A recent cyber security alert highlights that hackers are leveraging code from a clone of Microsoft's Minesweeper game to conceal malicious scripts in attacks targeting financial institutions in Europe and the US. The threat actor, identified as 'UAC-0188,' uses this legitimate code to hide Python scripts that install remote management software on compromised systems. At least five breaches have been identified across financial and insurance sectors. The attack initiates with an email from "support@patient-docs-mail.com," prompting recipients to download a malicious file from Dropbox, which includes both innocuous and malicious code to evade security detection.

Source: [BleepingComputer]

Deepfake Scams Have Robbed Companies of Millions. Experts Warn It Could Get Worse

A recent surge in deepfake scams has resulted in millions of dollars in losses for companies globally, with experts predicting an increase in such frauds as criminals leverage generative AI. In one major incident, a Hong Kong finance worker was deceived into transferring over $25 million to fraudsters using deepfake technology to impersonate senior executives on a video call. UK engineering firm Arup confirmed involvement in this case, though details remain under investigation. The accessibility of AI tools like OpenAI’s Chat GPT has lowered the entry barrier for cyber criminals, enhancing both the volume and sophistication of these types of scams.

Source: [CNBC]

Ransomware in the Finance Sector: Emerging threats

A recent analysis highlights ransomware as a critical threat, particularly to the financial services sector due to its integral role in the global economy and sensitive data handling. Cyber criminals have enhanced their tactics, including pre-emptive data exfiltration, to coerce victims into paying ransoms. Phishing emails remain the primary delivery method, exploiting user unawareness to execute these attacks. These emails allow attackers to reach numerous targets cost-effectively, increasing the likelihood of successful breaches. This evolution in ransomware strategies underscores the need for heightened cyber security measures across all sectors.

Source: [Verdict]

Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware

A coordinated law enforcement effort codenamed Operation Endgame led by Europol has dismantled the infrastructure of several malware loader operations, including IcedID, SystemBC, PikaBot, SmokeLoader, Bumblebee, and TrickBot. The operation, conducted between May 27 and May 29, resulted in the takedown of over 100 servers worldwide and the arrest of four individuals in Armenia and Ukraine. Europol's actions targeted high-value criminal infrastructure, resulting in the seizure of more than 2,000 domains and the disruption of services used to facilitate ransomware and other malicious attacks. One suspect allegedly profited €69 million ($74.6 million) from renting out these criminal services.

Source: [TheHackerNews]

Hacktivist Attacks on Europe Have Doubled Since 2023, Top EU Cyber Security Official says: ‘This is Part of the Russian War of Aggression’

A recent surge in disruptive digital attacks, largely attributed to Russia-backed groups, has doubled within the European Union, targeting critical infrastructure and election-related services. Juhan Lepassaar, head of the European Union Agency for Cybersecurity (ENISA), reported a significant increase in hacktivist attacks since Russia's invasion of Ukraine, with methods often tested in Ukraine before extending to the EU. Upcoming elections in the EU and other countries have heightened security concerns. ENISA has been working to bolster the resilience of election agencies and noted a rise in ransomware targeting public institutions. The agency also warned of the growing threat of AI-enabled disinformation campaigns.

Source: [Fortune]

North Korean 'Moonstone Sleet' Threat Group Melds Espionage, Financial Goals - Microsoft

A recent report by Microsoft has uncovered the North Korean threat group "Moonstone Sleet," which engages in both espionage and financial cyber attacks. Initially overlapping with the DPRK's Diamond Sleet, Moonstone Sleet has since developed its own unique tactics, using techniques like fake job offers, custom ransomware, and trojanised software delivered via social media. The group has targeted aerospace, education, and software organisations by masquerading as legitimate companies such as "StarGlow Ventures" and "C.C. Waterfall." Their methods, including using trusted platforms like LinkedIn and Telegram, complicate defensive measures and exploit the inherent trust in these platforms.

Source: [DarkReading]

Europe on High Alert after Suspected Moscow-linked Arson and Sabotage

A recent spate of arson and sabotage attacks across Europe, potentially linked to Russian operatives, has heightened security concerns. Incidents include a fire at an Ikea in Lithuania, an arson attack in east London, antisemitic graffiti in Paris, and in Germany suspicions of foreign intelligence-driven attacks in addition to a wave of cyber-attacks in 2023 by a hacker group linked to Russian intelligence. Security services suspect these acts aim to destabilise the West amidst its support for Ukraine. Polish authorities have arrested nine individuals for alleged sabotage under Russian orders, while Estonia and Germany report similar threats. This issue, discussed at a Brussels summit, highlights the need for increased vigilance against hybrid attacks orchestrated by foreign entities.

Source: [TheGuardian]

Making the Case for 'Reasonable' Cyber Security

A recent white paper from the Center for Internet Security (CIS) discusses the concept of "reasonable cyber security" and its alignment with privacy laws. This standard, highlighted at the RSA Conference, is context-dependent and varies by industry. For instance, while the Payment Card Industry Data Security Standard (PCI DSS) prescribes specific controls, the GDPR emphasises transparency and good faith efforts. The importance of quantifying cyber risk was underscored by the US Federal Reserve emphasising improved data on cyber threats for better risk assessment. Implementing security frameworks like the NIST Cybersecurity Framework can help meet these evolving regulatory and insurance requirements

Source: [DarkReading]

Hundreds of Thousands of Internet Routers Destroyed in Attack on Telco

A significant cyber attack last October targeted a US telecoms company, disabling over 600,000 internet routers across multiple states, according to Lumen Technologies' Black Lotus Labs. The attack, undisclosed until recently, involved malicious firmware updates that rendered the routers inoperable. Researchers did not identify the hackers or the affected company. The malware, still circulating online, disrupted internet access from October 25 to 27. This attack is considered one of the most severe against the US telecommunications sector and illustrates the vulnerability of telecoms provided routers to these types of attacks.

Source: [YahooFinance]

---

Governance, Risk and Compliance

• New KnowBe4 phishing report reveals top choices for phishing scams – PCR (pcr-online.biz)

• Material cyber attacks a concern among many CISOs | SC Media (scmagazine.com)

• The Link Between Cyber Security and Reputation Management for Executives - Security Boulevard

• The SEC’s SolarWinds Case: What CISOs Should Do Now (darkreading.com)

• Old but gold: Why shoulder surfing is an underacknowledged cyber threat | ITPro

• 70% of CISOs feel vulnerable to a material cyber attack in 2024 | Security Magazine

• The evolution of security metrics for NIST CSF 2.0 - Help Net Security

• Cyber security teams gear up for tougher challenges in 2024 - Help Net Security

• 4-Step Approach to Mapping and Securing Your Organisation's Most Critical Assets (thehackernews.com)

• Cyber security Skills Shortage Is Ranked as the Biggest Risk (globenewswire.com)

• The complexity of global cyber security threats (devx.com)

• How Corporate Boards Are Setting CEO’s Up For Cyber Security Failure (forbes.com)

• CISO priorities must shift in a heightened threat landscape - Raconteur

• Cyber security is the cause of all MSPs’ headaches • The Register

• Bridging Cyber Security Expectations And Reality To Empower CISOs (forbes.com)

• Making the Case for 'Reasonable' Cyber Security (darkreading.com)

• Why cyber criminals and hackers are targeting small businesses - Marketplace

• Social Distortion: The Threat of Fear, Uncertainty and Deception in Creating Security Risk - SecurityWeek

• Widespread data silos slow down security response times - Help Net Security

• Absolute Security Survey Reveals UK CISOs Ignore NCSC Guidance | Business Wire

• Reducing CIO-CISO tension requires recognizing the signs | CIO

• Avoiding the cyber security blame game - Help Net Security

---

Threats

Ransomware, Extortion and Destructive Attacks

• ‘World’s largest botnet’ knocked offline after raking in billions | The Independent

• Ransomware Networks Brought Down In Major Global Police Operation | HuffPost Latest News

• Massive ransomware network taken down by ‘Endgame’ international police operation | Fortune Europe

• Ransomware in the finance sector: Emerging threats - Verdict

• New ShrinkLocker ransomware uses BitLocker to encrypt your files (bleepingcomputer.com)

• Ransomware operators shift tactics as law enforcement disruptions increase - Help Net Security

• 6 Facts About How INTERPOL Fights Cyber crime (darkreading.com)

• Potent youth cyber crime ring made up of 1,000 people, FBI official says | CyberScoop

• LockBit Black Ransomware Bot Sprays “Millions of Messages” | MSSP Alert

• Microsoft links North Korean hackers to new FakePenny ransomware (bleepingcomputer.com)

• How to improve ransomware attack outcomes | SC Media (scmagazine.com)

• Why healthcare data is often the target of ransomware attacks (techtarget.com)

• Ransomware against healthcare and manufacturing on the rise: What to know, how to respond | SC Media (scmagazine.com)

• Essential Strategies for Recovering from Ransomware Attacks - Security Boulevard

Ransomware Victims

• ABN Amro discloses data breach following an attack on a third-party provider (securityaffairs.com)

• MediSecure: Australia grapples with surge in cyber attacks | news.com.au — Australia’s leading news site

• After Cyber Attack, Christie’s Gives Details of Hacked Client Data - The New York Times (nytimes.com)

Phishing & Email Based Attacks

• New KnowBe4 phishing report reveals top choices for phishing scams – PCR (pcr-online.biz)

• Phishing-as-a-service (PhaaS): What is it and How it work? (todayq.com)

• Hackers phish finance orgs using trojanized Minesweeper clone (bleepingcomputer.com)

• New Tricks in the Phishing Playbook: Cloudflare Workers, HTML Smuggling, GenAI (thehackernews.com)

• LockBit Black Ransomware Bot Sprays “Millions of Messages” | MSSP Alert

• Google: Stop Trying to Trick Employees With Fake Phishing Emails | PCMag

• Free Piano phish targets American university students, staff (bleepingcomputer.com)

BEC

• HP Report Surfaces Shifts in Cyber Attack Tactics - Security Boulevard

Other Social Engineering

• Old but gold: Why shoulder surfing is an underacknowledged cyber threat | ITPro

• No 10 neglecting popular MPs, laments minister in leaked memo (thetimes.co.uk)

• "So some little weirdo has gone round snapping my laptop reading private messages from a private email account," Mercer Xeeted.

Artificial Intelligence

• Kroll cyber threat landscape report: AI assists attackers | CSO Online

• 'GODMODE GPT': Hacker releases jailbroken version of ChatGPT (newsbytesapp.com)

• Critical Flaw in AI Platform Exposes Proprietary Data (darkreading.com)

• The Rise and Risks of Shadow AI - Security Boulevard

• NIST Releases Risk ‘Profile’ for Generative AI | Polsinelli - JDSupra

• OODA Loop - The Cyber Arms Race Gives Way to AI Weaponization

• Four Security Questions to Ask Your Enterprise Generative AI Provider (darkreading.com)

• Where’s the ROI for AI? CIOs struggle to find it | CIO

• OpenAI sets up safety committee as it starts training new model | Reuters

• How AI will change democracy | CyberScoop

Malware

• ‘World’s largest botnet’ knocked offline after raking in billions | The Independent

• Over 100 malware servers shut down in 'largest ever' operation against botnets (therecord.media)

• Ransomware Networks Brought Down In Major Global Police Operation | HuffPost Latest News

• Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware (thehackernews.com)

• Massive ransomware network taken down by ‘Endgame’ international police operation | Fortune Europe

• TeaBot Banking Trojan Activity on the Rise, Zscaler Observes - Infosecurity Magazine (infosecurity-magazine.com)

• Why cloud attacks no longer need malware [Q&A] (betanews.com)

• Is Your Computer Part of ‘The Largest Botnet Ever?’ – Krebs on Security

• Trio of Chinese botnet operators sanctioned by United States • The Register

• macOS version of elusive 'LightSpy' spyware tool discovered (bleepingcomputer.com)

• Cyber criminals pose as "helpful" Stack Overflow users to push malware (bleepingcomputer.com)

• Law enforcement operation takes aim at an often-overlooked cyber crime linchpin | Ars Technica

• RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability (thehackernews.com)

• CERT-UA warns of malware campaign conducted by threat actor UAC-0006 (securityaffairs.com)

• Pirated Microsoft Office delivers malware cocktail on systems (bleepingcomputer.com)

Mobile

• Hacking phones is too easy. Time to make it harder (economist.com)

• Privacy vs. Mobile Security: Why You Don’t Have to Choose | MSSP Alert

• 90+ Malicious Apps Totaling 5.5M Downloads Lurk on Google Play (darkreading.com)

• Phones of journalists and activists in Europe targeted with Pegasus | CyberScoop

• Data shows deceitful Android malware is on the rise: Take this one step to keep your phone safe | Laptop Mag

• NSA Warns iPhone & Android Users To Turn It Off And On Again (forbes.com)

Denial of Service/DoS/DDOS

• New DoS Attack ‘DNSBomb’ Exploiting DNS Queries & Responses (cybersecuritynews.com)

• Internet Archive is continuing to face DDoS attacks after several days - Neowin

Internet of Things – IoT

• These are the most insecure devices you might still have in your home (xda-developers.com)

• Hundreds of thousands of US internet routers destroyed in newly discovered 2023 hack (yahoo.com)

Data Breaches/Leaks

• ABN Amro discloses data breach following an attack on a third-party provider (securityaffairs.com)

• Data breach exposes details of 25,000 current and former BBC employees | BBC | The Guardian

• Dutch Social housing tenants' data may have been stolen after IT supplier hack | NL Times

• Almost all citizens of city of Eindhoven have their personal data exposed (bitdefender.com)

• Critical Flaw in AI Platform Exposes Proprietary Data (darkreading.com)

• Usage of TLS in DDNS Services leads to Information Disclosure in Multiple Vendors (securityaffairs.com)

• Cencora data breach exposes US patient info from 11 drug companies (bleepingcomputer.com)

• Good luck keeping the past private now —criminal records of millions of Americans leaked online in major database breach | TechRadar

• 400% rise in MoD data breaches fuels fear of cyber threat from Russia and China (inews.co.uk)

• MITRE December 2023 attack: threat actors created rogue VMs to evade detection (securityaffairs.com)

• Software firm fined $74k for data breach caused by weak password; half a million users affected | The Straits Times

• Nearly 3 million affected by Sav-Rx data breach (therecord.media)

• MediSecure: Australia grapples with surge in cyber attacks | news.com.au — Australia’s leading news site

• First American December data breach impacts 44,000 people (bleepingcomputer.com)

• Hackers Claim Ticketmaster Data Breach: 560 Million Users' Info Up for Sale (hackread.com)

• Update on BBC data security incident (bbc.co.uk)

• MPs email passwords exposed on the dark web, study suggests (cityam.com)

• Everbridge warns of corporate systems breach exposing business data (bleepingcomputer.com)

• FBCS Data Breach Impact Grows to 3.2 Million Individuals - SecurityWeek

• Cooler Master hit by data breach exposing customer information (bleepingcomputer.com)

• Spyware maker pcTattletale says it's 'out of business' and shuts down after data breach | TechCrunch

Organised Crime & Criminal Actors

• Digital Arrests: The New Frontier of Cyber crime | MSSP Alert

• Cyber crime study finds global human-initiated digital attack rate up 19% | Chain Store Age

• Phishing-as-a-service (PhaaS): What is it and How it work? (todayq.com)

• Hackers Sell Fake Pegasus Spyware on Clearnet and Dark Web (hackread.com)

• Hacker defaces spyware app’s site, dumps database and source code (bleepingcomputer.com)

• BreachForums returns just weeks after FBI-led takedown • The Register

• 6 Facts About How INTERPOL Fights Cyber Crime (darkreading.com)

• Russian indicted for selling access to US corporate networks (bleepingcomputer.com)

• Cops Are Just Trolling Cyber Criminals Now | WIRED

• Potent youth cyber crime ring made up of 1,000 people, FBI official says | CyberScoop

• Cyber criminals pose as "helpful" Stack Overflow users to push malware (bleepingcomputer.com)

• US arrests man allegedly behind enormous botnet that enabled cyber attacks and fraud - The Verge

• Law enforcement operation takes aim at an often-overlooked cyber crime linchpin | Ars Technica

• Ferraris, Bomb Threats, Billions: FBI Nabs Alleged Cyber crime Kingpin YunHe Wang (thedailybeast.com)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Indian man stole $37 million in crypto using fake Coinbase Pro site (bleepingcomputer.com)

• Former FTX executive Salame sentenced to over 7 years in prison - BBC News

• RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability (thehackernews.com)

• Hackers who finally unlocked $3 million Bitcoin wallet after 11 years explain how they did (unilad.com)

Insider Risk and Insider Threats

• Human error still perceived as the Achilles' heel of cyber security - Help Net Security

• New Research Warns About Weak Offboarding Management and Insider Risks (thehackernews.com)

Insurance

• AI’s role in FS businesses’ cyber defence and risk assessment (finextra.com)

Supply Chain and Third Parties

• ABN Amro discloses data breach following an attack on a third-party provider (securityaffairs.com)

Cloud/SaaS

• Santander hit by massive cyberattack: All staff and '30million' customers have personal data stolen by gang 'behind Ticketmaster hack' | Daily Mail Online

• 34% of organisations lack cloud cyber security skills - Help Net Security

• Impact of Remote Work and Cloud Migrations on Security Perimeters (securityaffairs.com)

• Why cloud attacks no longer need malware [Q&A] (betanews.com)

• Update on data security incident (bbc.co.uk)

Identity and Access Management

• Identity-related incidents becoming severe, costing organisations a fortune - Help Net Security

Encryption

• Usage of TLS in DDNS Services leads to Information Disclosure in Multiple Vendors (securityaffairs.com)

• New ShrinkLocker ransomware uses BitLocker to encrypt your files (bleepingcomputer.com)

Passwords, Credential Stuffing & Brute Force Attacks

• Why strong passwords are still the first line of defence against cyber threats (securitybrief.co.nz)

• Software firm fined $74k for data breach caused by weak password; half a million users affected | The Straits Times

• Okta warns of credential stuffing attacks targeting its Cross-Origin Authentication feature (securityaffairs.com)

• Password auditing: Purge weak passwords from your organisation | ITPro

• Enhancing cyber security with 'moving trees' (techxplore.com)

• Hackers who finally unlocked $3 million Bitcoin wallet after 11 years explain how they did (unilad.com)

Malvertising

• Arc browser’s Windows launch targeted by Google ads malvertising (bleepingcomputer.com)

Training, Education and Awareness

• Using Scary but Fun Stories to Aid Cyber Security Training - Security Boulevard

• Beyond the Code: Modern Cyber Security Training for 2024 (informationweek.com)

• Why Human Risk Management is Cyber Security's Next Step for Awareness - Infosecurity Magazine (infosecurity-magazine.com)

Regulations, Fines and Legislation

• New cyber attack reporting requirement for Swiss financial institutions (cms-lawnow.com)

• The SEC’s SolarWinds Case: What CISOs Should Do Now (darkreading.com)

• GDPR Turns Six: Reflecting on a Global Privacy Benchmark - IT Security Guru

• The SEC's New Take on Cyber Security Risk Management (darkreading.com)

Models, Frameworks and Standards

• The evolution of security metrics for NIST CSF 2.0 - Help Net Security

• How NIST Cybersecurity Framework 2.0 Tackles Risk Management (securityintelligence.com)

Data Protection

• GDPR Turns Six: Reflecting on a Global Privacy Benchmark - IT Security Guru

Careers, Working in Cyber and Information Security

• 34% of organisations lack cloud cyber security skills - Help Net Security

• Cyber security Skills Shortage Is Ranked as the Biggest Risk (globenewswire.com)

• 9 Tips to Avoid Burnout in Cyber Security (darkreading.com)

• New cyber security school to pay students $4K monthly salary

Law Enforcement Action and Take Downs

• ‘World’s largest botnet’ knocked offline after raking in billions | The Independent

• Over 100 malware servers shut down in 'largest ever' operation against botnets (therecord.media)

• Ransomware Networks Brought Down In Major Global Police Operation | HuffPost Latest News

• Europol Shuts Down 100+ Servers Linked to IcedID, TrickBot, and Other Malware (thehackernews.com)

• Massive ransomware network taken down by ‘Endgame’ international police operation | Fortune Europe

• BreachForums returns just weeks after FBI-led takedown • The Register

• Indian man stole $37 million in crypto using fake Coinbase Pro site (bleepingcomputer.com)

• Ransomware operators shift tactics as law enforcement disruptions increase - Help Net Security

• 6 Facts About How INTERPOL Fights Cyber crime (darkreading.com)

• Russian indicted for selling access to US corporate networks (bleepingcomputer.com)

• Cops Are Just Trolling Cyber criminals Now | WIRED

• Four arrested as international police operation takes down ransomware networks | BelfastTelegraph.co.uk

• US arrests man allegedly behind enormous botnet that enabled cyber attacks and fraud - The Verge

• Law enforcement operation takes aim at an often-overlooked cyber crime linchpin | Ars Technica

• Ferraris, Bomb Threats, Billions: FBI Nabs Alleged Cyber crime Kingpin YunHe Wang (thedailybeast.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Airlines grapple with spike in GPS interference. Experts say it's collateral damage from global conflicts | CBC News

• OODA Loop - The Cyber Arms Race Gives Way to AI Weaponization

• Could the Next War Begin in Cyberspace? (informationweek.com)

• Global stability issues alter cyber threat landscape, ESET reports | CSO Online

• Cyber Psychological Warfare: Hacking Operational Technology (inforisktoday.com)

• Negotiations over new NATO cyber centre still ongoing weeks from planned launch (therecord.media)

Nation State Actors

China

• 400% rise in MoD data breaches fuels fear of cyber threat from Russia and China (inews.co.uk)

• Ongoing Chinese cyberespionage operation targets government orgs | SC Media (scmagazine.com)

• Trio of Chinese botnet operators sanctioned by United States • The Register

Russia

• 400% rise in MoD data breaches fuels fear of cyber threat from Russia and China (inews.co.uk)

• Russia-linked cyber attacks on Europe have doubled since 2023, top EU cyber security official says | Fortune Europe

• Putin hijacked Austria’s spy service. Now he’s going after its government – POLITICO

• Map shows Russia's campaign of terror, sabotage and hacking in Europe | World News | Metro News

• Critics of Putin and his allies targeted with spyware inside the EU | Hacking | The Guardian

• FlyingYeti phishing crew grounded after failed Ukraine ops • The Register

• Europe on high alert after suspected Moscow-linked arson and sabotage | Russia | The Guardian

• German officer gave up secrets to Russia 'to prevent nuclear war'

• Germany's cyber ambassador on the response to Russia: 'All of this takes time' (therecord.media)

• FlyingYeti Exploits WinRAR Vulnerability to Deliver COOKBOX Malware in Ukraine (thehackernews.com)

• CERT-UA warns of malware campaign conducted by threat actor UAC-0006 (securityaffairs.com)

• Russia Has Figured Out How to Mess up Ukraine's Starlink Internet: NYT (businessinsider.com)

• Surveillance Risk: Apple's Wi-Fi-Based Positioning System (govinfosecurity.com)

• Major Russian delivery company down for three days due to cyber attack (therecord.media)

• Russian indicted for selling access to US corporate networks (bleepingcomputer.com)

• Most EU election interference domestic in origin, not Russian: Meta (therecord.media)

North Korea

• New North Korean Hacking Group Identified by Microsoft - Infosecurity Magazine (infosecurity-magazine.com)

• Moonstone Sleet emerges as new North Korean threat actor with new bag of tricks | Microsoft Security Blog

• Microsoft Uncovers 'Moonstone Sleet' — New North Korean Hacker Group (thehackernews.com)

• Global stability issues alter cyber threat landscape, ESET reports | CSO Online

• Microsoft: 'Moonstone Sleet' APT Melds Espionage, Financial Goals (darkreading.com)

• New North Korean group tied to ransomware, gaming campaigns • The Register

• Microsoft links North Korean hackers to new FakePenny ransomware (bleepingcomputer.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Phones of journalists and activists in Europe targeted with Pegasus | CyberScoop

---

Vulnerability Management

• The Importance of Patching Vulnerabilities in Cyber Security - Security Boulevard

• NIST expects to clear backlog in vulnerabilities database by end of fiscal year (therecord.media)

• Why CVEs Are an Incentives Problem (darkreading.com)

• The most dangerous CVEs of 2023 and 2024: fix these today (kaspersky.co.uk)

• NIST says NVD will be back on track by September 2024 - Help Net Security

• 59% of public sector apps carry long-standing security flaws - Help Net Security

• NIST Getting Outside Help for National Vulnerability Database - SecurityWeek

• An Argument for Coordinated Disclosure of New Exploits (darkreading.com)

Vulnerabilities

• Cisco Releases May 2024 Cisco ASA, FMC, and FTD Software Security Publication | CISA

• Critical Flaw in AI Platform Exposes Proprietary Data (darkreading.com)

• High-severity flaw affects Cisco Firepower Management Center (securityaffairs.com)

• Hackers target Check Point VPNs to breach enterprise networks (bleepingcomputer.com)

• Exploit released for maximum severity Fortinet RCE bug, patch now (bleepingcomputer.com)

• Check Point VPN zero-day exploited in attacks since April 30 (bleepingcomputer.com)

• VMware Workstation and Fusion: Critical Security Flaws Fixed - Security Boulevard

• Google fixes eighth actively exploited Chrome zero-day this year (bleepingcomputer.com)

• An XSS flaw in GitLab allows attackers to take over accounts (securityaffairs.com)

• WordPress Plugin Exploited to Steal Credit Card Data from E-commerce Sites (thehackernews.com)

• The most dangerous CVEs of 2023 and 2024: fix these today (kaspersky.co.uk)

• Critical WordPress Plugin Flaws Exploited to Inject Malicious Scripts and Backdoors - SecurityWeek

• RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability (thehackernews.com)

• FlyingYeti Exploits WinRAR Vulnerability to Deliver COOKBOX Malware in Ukraine (thehackernews.com)

• Security flaw in this TP-Link Archer router receives 10 out of 10 severity rating | TechSpot

---

Tools and Controls

• Why strong passwords are still the first line of defence against cyber threats (securitybrief.co.nz)

• Microsoft battens security hatches on Windows admin accounts | PCWorld

• 34% of organisations lack cloud cyber security skills - Help Net Security

• New DoS Attack ‘DNSBomb’ Exploiting DNS Queries & Responses (cybersecuritynews.com)

• Farewell VBScript: Microsoft confirms plans to begin phasing out the programming language | ITPro

• The evolution of security metrics for NIST CSF 2.0 - Help Net Security

• 4-Step Approach to Mapping and Securing Your Organisation's Most Critical Assets (thehackernews.com)

• How to combat alert fatigue in cyber security - Help Net Security

• Why leaders must prioritise network security - Raconteur

• Network Segmentation: Top Challenges And How To Solve Them (forbes.com)

• New Research Warns About Weak Offboarding Management and Insider Risks (thehackernews.com)

• Identity-related incidents becoming severe, costing organisations a fortune - Help Net Security

• Password auditing: Purge weak passwords from your organisation | ITPro

• Beyond the blind spots: why CISOs must embrace deep observability - Raconteur

• Evolving Detection Engineering Capabilities with Breach & Attack Simulation (BAS) - Security Boulevard

• How NIST Cybersecurity Framework 2.0 Tackles Risk Management (securityintelligence.com)

• Contextual Intelligence is the Key - Security Boulevard

• Why Human Risk Management is Cyber Security's Next Step for Awareness - Infosecurity Magazine (infosecurity-magazine.com)

• AI’s role in FS businesses’ cyber defence and risk assessment (finextra.com)

• Report: The Dark Side of Phishing Protection (thehackernews.com)

• Essential Strategies for Recovering from Ransomware Attacks - Security Boulevard

---

Reports Published in the Last Week

• Q1 2024 Threat Landscape Report: Insider Threat & Phishing Evolve Under AI Auspices (kroll.com)

---

Other News

• Cyber security of elections - POST (parliament.uk)

• Why cyber criminals and hackers are targeting small businesses - Marketplace

• Shell says 'potential cyber security incident' under investigation | CTV News

• Defending Professional Sports Organisations Against Cyber Threats (forbes.com)

• How Manufacturers Can Build Their Cyber Defence (forbes.com)

• Manufacturing Is #1 in Cyber Attacks for Third Straight Year. What Can Be Done? | IndustryWeek

• How Can Small Businesses Alleviate Cyber Risks? (forbes.com)

• Cyber security is the cause of all MSPs’ headaches • The Register

• Most EU election interference domestic in origin, not Russian: Meta (therecord.media)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 24 May 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Human Error and AI Tops Cyber Threats as 70% of CISOs Worry About Risk

According to a survey of 1,600 CISOs, 70% worry about the risk of a material cyber attack over the next 12 months. Additionally, nearly 31% believe an attack is very likely, compared to 25% in 2023.  Amongst the largest concerns were human error, with 75% of CISOs identifying it as their most significant cyber vulnerability, up from 60% in 2023. Furthermore, 80% anticipate that human risk and employee negligence in particular will be major cyber security issues in the next two years.  Additionally, artificial intelligence was identified as an emerging concern for 54% of CISOs.

Sources: [The Register] [Infosecurity Magazine] [Cryptopolitan]

The State of Cyber Security: AI and Geopolitics Mean a Bigger Threat Than Ever

A recent report by Check Point reveals that global organisations faced an average of 1,158 weekly cyber attacks in 2023, an increase from 2022. In the UK, 50% of businesses experienced cyber attacks in the past year, with medium and large-sized businesses more affected at 70% and 74%, respectively. A ClubCISO survey found 62% of CISOs believe organisations are ill-equipped for AI-driven attacks, yet 77% haven't increased cyber security spending.

Additionally, a British Foreign Policy Group (BFPG) article highlights cyber threats from geopolitical tensions, with a recent attack on the Ministry of Defence exposing HR and payroll data. The National Cyber Security Centre attributes such attacks to state-affiliated actors like China and Russia. Despite efforts to establish international cyber norms, enforcement remains challenging. Businesses must recognise that cyber security is now deeply intertwined with geopolitics, affecting strategic partnerships and procurement.

Sources: [Verdict] [BFPG]

Threat Research Highlights Growing Mobile Security Risks

A recent report by a cloud security vendor focusing on the mobile threat landscape found that in the first quarter of 2024, the number of phishing, malicious, denylisted and offensive links delivered to their customers’ mobile devices tripled compared to Q1 2023. The report, which bases its data on 220 million devices, 325 million apps and billions of web items, found that the most common misconfiguration in mobiles was out of date operating systems (37%). When it came to the prevalence of attacks, 75% of organisations reported experiencing mobile phishing attempts targeting their employees.

This comes as a representative from the US Cybersecurity and Infrastructure Security Agency told the Federal Communications Commission earlier this year that there had been “numerous incidents of successful, unauthorised attempts” to steal location data, monitor voice and text messages, and deliver spyware.

Sources: [Economist] [Business Wire]

Family Offices Become Prime Targets for Cyber Hacks and Ransomware

A recent Dentons survey reveals that nearly 80% of family offices perceive a dramatic increase in cyber attack threats, with a quarter experiencing an attack in 2023, up from 17% in 2020. Despite their wealth, family offices often lack the staff and technology to manage these risks effectively. Less than a third report well-developed cyber risk management processes, and only 29% believe their cyber training programs are sufficient. This gap between awareness and action highlights the need for family offices to prioritise comprehensive cyber security measures, including better training, updated policies, and secure communication practices.

Source: [CNBC]

Ransomware Fallout: 94% Experience Downtime, 40% Face Work Stoppage

According to a report by cyber security provider Arctic Wolf, within the last 12 months 48% of organisations identified evidence of a successful breach within their environment and 70% of organisations were the targets of attempted Business Email Compromise (BEC) attacks, with 29% of these targets becoming victims of one or more successful BEC occurrences.

In its survey, the company says “45% of the organizations we spoke with admitted to being the victim of a ransomware attack within the last 12 months”,  an increase from the prior year. Of those impacted by ransomware, 86% of attacks including successful data exfiltration and 94% of those impacted by a ransom event experienced a significant downtime and delays. 40% of victims stated they experienced a period of total work stoppage due to ransomware.

Source: [Help Net Security]

Employee Discontent: Insider Threat No. 1

Chief Information Security Officers (CISOs) must integrate human factors into insider risk management (IRM), not just rely on detection technologies. IRM must consider factors such as those raised by recent research where only half of US workers are very satisfied with their jobs, and 28% feel their employers don't care about them. CISOs themselves are affected by job satisfaction; the 2024 IANS/Artico report shows three out of four CISOs are ready to leave their roles. DTEX Systems found 77% of malicious insiders concealed their activities, emphasising the importance of human engagement and feedback in mitigating risks.

Source: [CSO]

Report Reveals 341% Rise in Advanced Phishing Attacks

A recent report has revealed malicious emails increased by 341% over the past 6 months. This included a 217% increase in credential harvesting phishing attacks and a 29% increase in Business Email Compromise (BEC) attacks. The report highlighted the impact of artificial intelligence, noting that since the launch of ChatGPT in November 2022, there has been a 4,151% surge in malicious phishing messages.

Source: [Security Magazine] [ Infosecurity Magazine]

Ransomware and GenAI Raise Security Challenges, Driving Cyber Investment

A recent study by Infosecurity Europe reveals that nearly 40% of cyber security leaders are increasing investments to combat the growing threats of ransomware and AI-generated attacks. A separate survey found 94% of organisations have or plan to implement generative AI use policies, and a third strictly forbid AI tech in their environment. This data highlights the ongoing effort to balance AI benefits with security risks, indicating that there isn’t a one-size-fits-all strategy for formalising AI adoption and usage policies.

Source: [Security Boulevard] [Infosecurity Magazine]

New Rules Prompt 93% of Organisations to Rethink Cyber Security Plans

A recent report reveals that 93% of organisations have re-evaluated their cyber security strategies due to new regulations, with 58% reconsidering their entire approach. The survey, which included 500 cyber security decision-makers from the US and UK, found that 92% reported increased security budgets, with 36% seeing rises of 20-49% and 23% experiencing over 50% increases. Despite this, only 40% feel confident in their resources to comply with regulations, and just one-third believe they can meet all requirements, highlighting significant gaps in preparedness.

Source: [security magazine]

HR and IT Related Phishing Scams Still Most Popular According to KnowBe4’s Latest Phishing Report

A recent KnowBe4 report reveals that HR-related phishing emails account for 42% of top-clicked phishing attempts, followed by IT-related emails at 30%. These phishing tactics exploit employees' trust and evoke immediate responses by mimicking legitimate business communications about dress code changes, tax updates, and training notifications. The report also highlights that nearly a third of users are vulnerable to phishing, emphasising the need for robust security awareness training. A well-trained workforce is essential in defending against increasingly sophisticated phishing attacks that leverage AI and emotional manipulation.

Source: [IT Security Guru]

80% of Exposures from Misconfigurations, as 15 Vendors Account for 62% of Global Attack Surface

A recent XM Cyber report highlights a significant gap in cyber security focus with identity and credential misconfigurations accounting for 80% of security exposures. The study, based on hundreds of thousands of attack path assessments, found that 62% of the global attack surface is concentrated in just 15 vendors. Furthermore, 41% of organisations had at least one compromised device, and 11% experienced ransomware incidents. The report underscores the need for a shift from patching all vulnerabilities to addressing high-impact exposures, especially those around identity management and critical asset protection.

Sources: [Security Magazine] [The Hacker News]

UK to Propose Mandatory Reporting for Ransomware Attacks and Licensing Regime for all Payments

A forthcoming proposal in Britain aims to overhaul the response to ransomware by mandating victims to report incidents and obtain a license before making extortion payments. This initiative, part of a public consultation, includes a ban on ransom payments for critical national infrastructure to deter attacks. The National Cyber Security Centre has highlighted concerns over underreporting, with a 2023 increase in ransomware-related data breaches. The plan’s success hinges on replacing the delayed Action Fraud reporting platform. This proposal marks a significant step in global ransomware policy, with Britain leading international efforts against cyber criminals.

Source: [The Record Media]

UK’s Legal Sector Needs to Improve its Cyber Security, Says Experts

One in ten UK data breaches in 2023 occurred in the legal sector, highlighting that UK law firms are attractive targets for cyber criminals. A recent analysis of the UK’s Information Commissioner's Office (ICO) data found that the legal sector is one of the worst performing sectors for data breaches, with nearly 86 per cent of the incidents within the legal sector involving breaches of personal identifiable information, including instances also affecting sensitive economic and financial data.

Sources [CITY AM]

---

Governance, Risk and Compliance

• 70% of CISOs Expect Cyber Attacks in Next Year, Report Finds - Infosecurity Magazine (infosecurity-magazine.com)

• UK's legal sector needs to improve its cyber security, say experts (cityam.com)

• How to stay on top of evolving cyber security legislation | RSM UK

• New rules prompt 93% of organisations to rethink cyber security plans | Security Magazine

• Ransomware and AI-Powered Hacks Drive Cyber Investment - Infosecurity Magazine (infosecurity-magazine.com)

• One CISO Can’t Fill Your Board’s Cyber Security Gaps (mit.edu)

• Security Compliance 101: What It Is and How to Master It - Security Boulevard

• Family offices become prime targets for cyber hacks and ransomware (cnbc.com)

• Worried about job security, cyber teams hide security incidents - Help Net Security

• Law firms warn global risks on the rise (emergingrisks.co.uk)

• Financial companies must have data breach incident plans, SEC says | SC Media (scmagazine.com)

• Businesses must overcome security communication roadblocks – Channel EYE

• Why Culture is the Bedrock of Cyber Security - Infosecurity Magazine (infosecurity-magazine.com)

• 10 Leadership Challenges For An AI World (forbes.com)

• IT Security Leaders Are Failing to Close a Boardroom Credibility Gap (prnewswire.com)

• Effective GRC programs rely on team collaboration - Help Net Security

• Are AI and Cyber Security the New Driving Forces Behind Mergers and Acquisitions in the Coming Years? - The Global Treasurerputty

• Understanding cyber risks beyond data breaches - Help Net Security

• De-risking the business - how to evolve your approach to security | TechRadar

• IT and security data is siloed in most organisations (betanews.com)

• Can Cyber Security Be a Unifying Factor in Digital Trade Negotiations? (darkreading.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Family offices become prime targets for cyber hacks and ransomware (cnbc.com)

• Ransomware fallout: 94% experience downtime, 40% face work stoppage - Help Net Security

• Ransomware Attacks Evolve as Average Ransom Demand Tops $1.26 Million - Security Boulevard

• UK to propose mandatory reporting for ransomware attacks and licensing regime for all payments (therecord.media)

• Ransomware gang targets Windows admins via PuTTy, WinSCP malvertising (bleepingcomputer.com)

• Cyber criminals shift tactics to pressure more victims into paying ransoms - Help Net Security

• Unpatched vulnerabilities making bad ransomware outcomes worse: What you need to know | SC Media (scmagazine.com)

• Cyber Attacks Over Work Email Most Used; Ransomware Hits Victims Hard: Artic Wolf (insurancejournal.com)

• This wiper malware takes data destruction to a whole new level | TechRadar

• A Surge in Ransomware: Insights from Our 2024 Cyber Threat Report | Huntress

• New ransomware group abusing BitLocker | Securelist

• Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard

• LockBit takedown taking toll as gang plummets down rankings • The Register

• First LockBit, now BreachForums: Are cops winning the war? • The Register

• 2024 sees continued increase in ransomware activity - Help Net Security

• Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern (thehackernews.com)

• What role does an initial access broker play in the RaaS model? | TechTarget

• Casino cyber attacks put a bullseye on Scattered Spider • The Register

• Ransomware innovation slowdown a product of crims' success • The Register

Ransomware Victims

• National Records of Scotland reveals its data stolen in 'distressing' NHS health board cyber attack (scotsman.com)

• OmniVision Says Personal Information Stolen in Ransomware Attack - Security Week

• Blackbasta group claims to have hacked Atlas, one of the largest US oil distributors (securityaffairs.com)

• LockBit says they stole data in London Drugs ransomware attack (bleepingcomputer.com)

Phishing & Email Based Attacks

• HR and IT related phishing scams still most popular according to KnowBe4’s latest Phishing Report - IT Security Guru

• Report Reveals 341% Rise in Advanced Phishing Attacks - Infosecurity Magazine (infosecurity-magazine.com)

• Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide (thehackernews.com)

• Phishing statistics that will make you think twice before clicking - Help Net Security

• Cyber Attacks Over Work Email Most Used; Ransomware Hits Victims Hard: Artic Wolf (insurancejournal.com)

• Q1 2024 Global Phishing Report (knowbe4.com)

• Phishing, BEC, and Beyond: Tackling the Top Cyber Threats to UK Banks (prnewswire.co.uk)

• Two-stage Dropbox spear phishing | Kaspersky official blog

• Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns (thehackernews.com)

• Only 60 percent of brands can protect their customers from digital impersonation (betanews.com)

• A phish by any other name should still not be clicked – Computerworld

• Active Chinese Cyber espionage Campaign Rifling Email Servers (inforisktoday.com)

• YouTube has become a significant channel for cyber crime - Help Net Security

BEC

• The last six months shows a 341% increase in malicious emails | Security Magazine

• Phishing, BEC, and Beyond: Tackling the Top Cyber Threats to UK Banks (prnewswire.co.uk)

• Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard

• 10 Years in Prison for $4.5 million BEC Scammer Who Bought Ferrari to Launder Money | Tripwire

Other Social Engineering

• ‘Unblockable’ HMRC scam message on iPhones sparks warning (yahoo.com)

• Cyber criminals Exploit Cloud Storage For SMS Phishing Scams - Infosecurity Magazine (infosecurity-magazine.com)

Artificial Intelligence

• The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict

• Three Questions Every Leader Needs To Ask About AI Cyber Security (forbes.com)

• Ransomware, BEC, GenAI Raise Security Challenges - Security Boulevard

• Beware – Your Customer Chatbot is Almost Certainly Insecure: Report - Security Week

• Human Error and AI Tops Cyber Security Threats in CISO Survey | Cryptopolitan

• Consumers continue to overestimate their ability to spot deepfakes - Help Net Security

• CIO’s 2024 Checklist: Generative AI, Digital Transformation And More (forbes.com)

• Are AI and Cyber Security the New Driving Forces Behind Mergers and Acquisitions in the Coming Years? - The Global Treasurer

• Deepfakes Rank As the Second Most Common Cyber Security Incident for US Businesses (darkreading.com)

• Data regulator looking into Microsoft’s AI Recall feature | The Independent

• New Microsoft Recall feature is a 'security nightmare' and could make Copilot+ PCs a top target for cyber criminals | ITPro

• Why We Need to Get a Handle on AI - Security Week

• CISOs pursuing AI readiness should start by updating the org’s email security policy - Help Net Security

• 10 Leadership Challenges For An AI World (forbes.com)

• US Intelligence Agencies’ Embrace of Generative AI Is at Once Wary and Urgent - Security Week

• User Outcry as Slack Scrapes Customer Data for AI Model Training - Security Week

• Balancing generative AI cyber security risks and rewards | TechTarget

• AI Is The Past, Present And Future Of Cyber Security (forbes.com)

• US AI Experts Targeted in SugarGh0st RAT Campaign (darkreading.com)

• The ‘dead internet theory’ makes eerie claims about an AI-run web. The truth is more sinister (theconversation.com)

• Transparency is sorely lacking amid growing AI interest | ZDNET

• UK Government in £8.5m Bid to Tackle AI Cyber Threats - Infosecurity Magazine (infosecurity-magazine.com)

2FA/MFA

• Microsoft to Mandate Multi-Factor Authentication for All Azure Users (cybersecuritynews.com)

• Here's why you should get a YubiKey (xda-developers.com)

• Zero-Day Attacks and Supply Chain Compromises Surge, MFA Remains Underutilized: Rapid7 Report - Security Week

Malware

• Grandoreiro Banking Trojan Resurfaces, Targeting Over 1,500 Banks Worldwide (thehackernews.com)

• Ukraine blackouts caused by malware attacks warn against evolving cyber security threats to the physical world (techxplore.com)

• 400K Linux Servers Recruited by Resurrected Ebury Botnet (darkreading.com)

• Another nasty Mac malware is spoofing legitimate software to target macOS users | TechRadar

• Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal (thehackernews.com)

• What Does Malware Look Like? Check Out These Real-World Examples (pcmag.com)

• Cyber Criminals Exploit GitHub and FileZilla to Deliver Malware Cocktail (thehackernews.com)

• Dangerous nostalgia: Taking Windows XP online will result in auto-installed viruses in a matter of minutes | TechSpot

• Malware Delivery via Cloud Services Exploits Unicode Trick to Deceive Users (thehackernews.com)

• MS Exchange Server Flaws Exploited to Deploy Keylogger in Targeted Attacks (thehackernews.com)

• Keylogger Embedded Microsoft Exchange Server Steals Login Credentials (cybersecuritynews.com)

• Latrodectus Malware Loader Emerges as IcedID's Successor in Phishing Campaigns (thehackernews.com)

• Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica

• US AI Experts Targeted in SugarGh0st RAT Campaign (darkreading.com)

• New BiBi Wiper version also destroys the disk partition table (bleepingcomputer.com)

• Novel EDR-Killing 'GhostEngine' Malware Is Built for Stealth (darkreading.com)

• Malicious actors are cat-phishing targets in order to spread malware | Security Magazine

Mobile

• It is dangerously easy to hack the world’s phones (economist.com)

• How often should you turn off your phone? Here's what the NSA says | PCWorld

• New Android Banking Trojan Mimics Google Play Update App - Infosecurity Magazine (infosecurity-magazine.com)

• North Korea-linked Kimsuky APT attack targets victims via Messenger (securityaffairs.com)

• US Official Warns a Cell Network Flaw Is Being Exploited for Spying | WIRED

• How to recognise if the security of your work device has been breached (siliconrepublic.com)

• Vultur Malware Mimic As Mobile Antivirus Steals Login Credentials (cybersecuritynews.com)

• ‘Unblockable’ HMRC scam message on iPhones sparks warning (yahoo.com)

• Lookout Threat Research Highlights Growing Mobile Security Risks | Business Wire

Internet of Things – IoT

• Teslas Can Still Be Stolen With a Cheap Radio Hack—Despite New Keyless Tech | WIRED

Data Breaches/Leaks

• Aon reveals cyber attack/data breach as top risk for financial institutions - Reinsurance News

• PSNI Faces £750,000 Data Breach Fine After Spreadsheet Leak - Infosecurity Magazine (infosecurity-magazine.com)

• NYSE parent fined $10M for breach reporting failure • The Register

• Were The Ashley Madison Hackers Ever Caught? (screenrant.com)

• 2.4 Million Impacted by WebTPA Data Breach - Security Week

• National Records of Scotland reveals its data stolen in 'distressing' NHS health board cyber attack (scotsman.com)

• 49 Million Customers Impacted by API Security Flaw - Security Boulevard

• Army personnel fear for their jobs after huge MoD cyber attack | The Independent

• Criminal record database of millions of Americans dumped online | Malwarebytes

• Optus denies claims of ‘cloaking’ Deloitte cyber attack report findings - Lawyers Weekly

• Record breaking number of data breaches reported | Bailiwick Express

• 400,000 Impacted by CentroMed Data Breach - Security Week

• 55,000 Impacted by Cyber Attack on California School Association  - Security Week

Organised Crime & Criminal Actors

• Were The Ashley Madison Hackers Ever Caught? (screenrant.com)

• HP Catches Cyber Criminals 'Cat-Phishing' Users (darkreading.com)

• Cyber crime on the rise as account takeovers become leading method (investmentnews.com)

• Moroccan cyber crime group impersonates nonprofits and abuses cloud services to rake in gift card cash | CyberScoop

• YouTube has become a significant channel for cyber crime - Help Net Security

• Ransomware innovation slowdown a product of crims' success • The Register

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking (thehackernews.com)

• Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam (thehackernews.com)

• Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica

• Dutch police tracked a crypto theft to one of world’s worst botnets (thenextweb.com)

• He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market | WIRED

Insider Risk and Insider Threats

• Human Error and AI Tops Cyber Security Threats in CISO Survey | Cryptopolitan

• Employee discontent: Insider threat No. 1 | CSO Online

• Can we fix the human error problem in cyber security? (siliconrepublic.com)

Insurance

• Cyber insurance Company Offers MDR to MSPs | MSSP Alert

• Should You Buy Cyber Insurance in 2024? Pros & Cons (techopedia.com)

• Cyber insurance trends: reshaping the industry - SiliconANGLE

Supply Chain and Third Parties

• Implementing Third-Party Risk Management Workflows | UpGuard

• Managing third-party risk with cyber security | RSM UK

• Zero-Day Attacks and Supply Chain Compromises Surge, MFA Remains Underutilized: Rapid7 Report - Security Week

• JAVS courtroom recording software backdoored in supply chain attack (bleepingcomputer.com)

Cloud/SaaS

• Critical Bug Allows DoS, RCE, Data Leaks in All Major Cloud Platforms (darkreading.com)

• Veeam 2024 Cloud Protection Trends Report Provides New Insight into Cloud‑Powered Data Protection Strategies | Business Wire

• Security concerns impeding cloud migration | SC Media (scmagazine.com)

• Malware Delivery via Cloud Services Exploits Unicode Trick to Deceive Users (thehackernews.com)

• Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)

• Cyber Criminals Exploit Cloud Storage For SMS Phishing Scams - Infosecurity Magazine (infosecurity-magazine.com)

Identity and Access Management

• Report: Organisations Are Scrambling to Overhaul Their Identity Security Frameworks Amidst Surge in Recent Attacks (globenewswire.com)

• 77 percent of organisations suffer cyber attacks due to identity issues (betanews.com)

Encryption

• Yet more ransomware uses BitLocker to encrypt victims' files • The Register

Linux and Open Source

• The economic model that made the internet, and the hack that almost broke it : Planet Money : NPR

• 400K Linux Servers Recruited by Resurrected Ebury Botnet (darkreading.com)

• Are all Linux vendor kernels insecure? A new study says yes, but there's a fix | ZDNET

Passwords, Credential Stuffing & Brute Force Attacks

• Cyber crime on the rise as account takeovers become leading method (investmentnews.com)

Social Media

• YouTube has become a significant channel for cyber crime - Help Net Security

• How Secure Is The Metaverse? (A Look At Cyber Threats And Defences) (forbes.com)

• Russia’s DoppelGänger Campaign Manipulates Social Media - Infosecurity Magazine (infosecurity-magazine.com)

Malvertising

• Ransomware gang targets Windows admins via PuTTy, WinSCP malvertising (bleepingcomputer.com)

• The mystery of the targeted ad and the library patron • The Register

• Windows admins targeted with clever malvertising scam | TechRadar

Training, Education and Awareness

• Three Psychological Theories to Ensure Cyber Security Training Sticks - Infosecurity Magazine (infosecurity-magazine.com)

Regulations, Fines and Legislation

• PSNI Faces £750,000 Data Breach Fine After Spreadsheet Leak - Infosecurity Magazine (infosecurity-magazine.com)

• NYSE parent fined $10M for breach reporting failure • The Register

• Intercontinental Exchange Will Pay $10 Million to Resolve SEC Cyber Probe (wsj.com)

• UK considering mandatory reporting for ransomware attacks (computing.co.uk)

• How to stay on top of evolving cyber security legislation | RSM UK

• SEC requires financial institutions to notify customers of breaches within 30 days - Help Net Security

• Security Compliance 101: What It Is and How to Master It - Security Boulevard

• Singapore updates cyber security law to expand regulatory oversight | ZDNET

• Avoiding Cyber Security Incident Overdisclosure:  Helpful Guidance | Mayer Brown Free Writings + Perspectives - JDSupra

• Counting Down to the EU NIS2 Directive - Security Boulevard

• The Dawn of DORA: Building a Resilient Financial Infrastructure (finextra.com)

• What American Enterprises Can Learn From Europe's GDPR Mistakes (darkreading.com)

• Preparing Your Organisation for Upcoming Cyber Security Deadlines (darkreading.com)

Backup and Recovery

• Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)

Data Protection

• 87% of medical practice data is digital | Security Magazine

Careers, Working in Cyber and Information Security

• The IT skills shortage situation is not expected to get any better - Help Net Security

• UK Government ramps up efforts to bridge cyber security skills gap (holyrood.com)

• IT Essentials: Sun, stress and security (computing.co.uk)

• Persistent Burnout Is Still a Crisis in Cyber Security (darkreading.com)

• 5 Ways SMBs Can Bridge the Cyber Security Skills Gap | Mimecast

Law Enforcement Action and Take Downs

• Dutch police tracked a crypto theft to one of world’s worst botnets (thenextweb.com)

• Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam (thehackernews.com)

• Police caught circumventing city bans on face recognition • The Register

• 10 Years in Prison for $4.5 million BEC Scammer Who Bought Ferrari to Launder Money | Tripwire

• LockBit takedown taking toll as gang plummets down rankings • The Register

• He Trained Cops to Fight Crypto Crime—and Allegedly Ran a $100M Dark-Web Drug Market | WIRED

• Casino cyber attacks put a bullseye on Scattered Spider • The Register

• First LockBit, now BreachForums: Are cops winning the war? • The Register

• No time to take eye of the ball despite recent cyber success – report (emergingrisks.co.uk)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• World War War III May Already Have Started—in the Shadows (reason.com)

• Britons should have three days' worth of tinned food and water, government says | Politics News | Sky News

• The Balance of Power in Cyber Space – What it Means for UK Business - British Foreign Policy Group (bfpg.co.uk)

• The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict

Nation State Actors

China

• The Security Interviews: What is the real cyber threat from China? | Computer Weekly

• UK not heeding warning over China threat, says ex-cyber security chief (yahoo.com)

• Newly Detected Chinese Group Targeting Military, Government Entities - Security Week

• Escalating Chinese cyber threats drive US efforts to secure critical infrastructure | SC Media (scmagazine.com)

• Inside Operation Diplomatic Specter: Chinese APT Group's Stealthy Tactics Exposed (thehackernews.com)

• Spies, trade and tech: China’s relationship with Britain (economist.com)

• Chinese, Iranian, and Russian gangs are attacking the U.S's drinking water and officials are alarmed | Fortune

• Google, Meta warned that undersea internet cables at risk for Chinese espionage: report (nypost.com)

• UK military in data breach - and other cyber security news | World Economic Forum (weforum.org)

• Researchers Warn of Chinese-Aligned Hackers Targeting South China Sea Countries (thehackernews.com)

• Active Chinese Cyberespionage Campaign Rifling Email Servers (inforisktoday.com)

• State hackers turn to massive ORB proxy networks to evade detection (bleepingcomputer.com)

• New Frontiers, Old Tactics: Chinese Espionage Group Targets Africa & Caribbean Govts (thehackernews.com)

• Stronger critical infrastructure defence aimed by Army Cyber Command | SC Media (scmagazine.com)

• Chinese Nationals Arrested for Laundering $73 Million in Pig Butchering Crypto Scam (thehackernews.com)

• Former Royal Marine charged with spying for China found dead (thetimes.co.uk)

Russia

• Ukraine blackouts caused by malware attacks warn against evolving cyber security threats to the physical world (techxplore.com)

• Chinese, Iranian, and Russian gangs are attacking the U.S's drinking water and officials are alarmed | Fortune

• Russia’s DoppelGänger Campaign Manipulates Social Media - Infosecurity Magazine (infosecurity-magazine.com)

• US says Russia likely launched space weapon - BBC News

• New Star Wars Plan: Pentagon Rushes to Counter Threats in Orbit - The New York Times

• British man, 64, charged with assisting Russian intelligence service | The Independent

Iran

• Chinese, Iranian, and Russian gangs are attacking the U.S's drinking water and officials are alarmed | Fortune

• Iranian MOIS-Linked Hackers Behind Destructive Attacks on Albania and Israel (thehackernews.com)

North Korea

• North Korea-linked Kimsuky APT attack targets victims via Messenger (securityaffairs.com)

• US Official Warns a Cell Network Flaw Is Being Exploited for Spying | WIRED

• North Korea-linked IT workers infiltrated hundreds of US firms (securityaffairs.com)

• High-ranking military officials' e-mail hacked, possibly by N. Korea (koreaherald.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• The state of cyber security: AI and geopolitics mean a bigger threat than ever - Verdict

• Government tells Britons to stockpile as part of emergency planning

• Spyware found on US hotel check-in computers | TechCrunch

---

Vulnerability Management

• New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs (thehackernews.com)

• Unpatched vulnerabilities making bad ransomware outcomes worse: What you need to know | SC Media (scmagazine.com)

• Over 60% of Network Security Appliance Flaws Exploited as Zero Days - Infosecurity Magazine (infosecurity-magazine.com)

• 93% of vulnerabilities unanalysed by NVD since February | TechTarget

• Zero-Day Attacks and Supply Chain Compromises Surge, MFA Remains Underutilized: Rapid7 Report - Security Week

• How AI-driven patching could transform cyber security | TechTarget

Vulnerabilities

• Microsoft Edge gets fixes for five more security vulnerabilities - Neowin

• Over 60% of Network Security Appliance Flaws Exploited as Zero Days - Infosecurity Magazine (infosecurity-magazine.com)

• Critical Bug Allows DoS, RCE, Data Leaks in All Major Cloud Platforms (darkreading.com)

• Veeam warns of critical Backup Enterprise Manager auth bypass bug (bleepingcomputer.com)

• Microsoft Has Yet to Patch 7 Pwn2Own Zero-Days (darkreading.com)

• Critical Flaw in AI Python Package Can Lead to System and Data Compromise - Security Week

• This devious Wi-Fi security flaw could let hackers eavesdrop on your network with ease | TechRadar

• Foxit PDF Reader Flaw Exploited by Hackers to Deliver Diverse Malware Arsenal (thehackernews.com)

• Intel's Max Severity Flaw Affects AI Model Compressor Users (govinfosecurity.com)

• 15 QNAP NAS bugs and one PoC disclosed, update ASAP! (CVE-2024-27130) - Help Net Security

• Keylogger Embedded Microsoft Exchange Server Steals Login Credentials (cybersecuritynews.com)

• Chrome 125 Update Patches High-Severity Vulnerabilities - Security Week

• Ivanti Patches Critical Code Execution Vulnerabilities in Endpoint Manager - Security Week

• Unauthenticated RCE Vulnerability in Fortinet FortiSIEM: PoC Published (cybersecuritynews.com)

• Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern (thehackernews.com)

• VMware Abused in Recent MITRE Hack for Persistence, Evasion - Security Week

• High-severity GitLab flaw lets attackers take over accounts (bleepingcomputer.com)

• CISA Warns of Actively Exploited Apache Flink Security Vulnerability (thehackernews.com)

Tools and Controls

• Network Outages Hit 59% of Multi-Site Businesses Monthly - Infosecurity Magazine (infosecurity-magazine.com)

• New rules prompt 93% of organisations to rethink cyber security plans | Security Magazine

• Ransomware and AI-Powered Hacks Drive Cyber Investment - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft to Mandate Multi-Factor Authentication for All Azure Users (cybersecuritynews.com)

• What is a Third-Party Risk Assessment in Cyber Security? | UpGuard

• Should You Buy Cyber Insurance in 2024? Pros & Cons (techopedia.com)

• The Critical Role Of Web Filtering To Secure A Modern Workplace (forbes.com)

• We put too much faith in our web browsers, here's why we shouldn't (xda-developers.com)

• Windows 11 to Deprecate NTLM, Add AI-Powered App Controls and Security Defences (thehackernews.com)

• Google says Microsoft can’t be trusted after email security blunders | ITPro

• CISOs pursuing AI readiness should start by updating the org’s email security policy - Help Net Security

• Fighting identity fraud? Here's why we need better tech - Help Net Security

• Report: Organisations Are Scrambling to Overhaul Their Identity Security Frameworks Amidst Surge in Recent Attacks (globenewswire.com)

• 77 percent of organisations suffer cyber attacks due to identity issues (betanews.com)

• Researchers spot cryptojacking attack that disables endpoint protections | Ars Technica

• Microsoft's latest Windows 11 security features aim to make it 'more secure out of the box' | ZDNET

• Are Your SaaS Backups as Secure as Your Production Data? (thehackernews.com)

• Cyber insurance trends: reshaping the industry - SiliconANGLE

• The Evolution of Security Operations Centres in the Past Decade | Information Security Buzz

• Incident response: a useful guide - Tech Monitor

• Here's why you should get a YubiKey (xda-developers.com)

• Mastercard Doubles Speed of Fraud Detection with Generative AI - Infosecurity Magazine (infosecurity-magazine.com)

• When to Automate and When Not to Automate Security - Security Boulevard

• Critical Capabilities of Cyber Security Risk Assessment Tools (cybersaint.io)

• How AI-driven patching could transform cyber security | TechTarget

---

Reports Published in the Last Week

• 2024 Cloud Protection Trends (veeam.com)

• Arctic Wolf Labs 2024 Threat Report | Arctic Wolf

• Q1 2024 Global Phishing Report (knowbe4.com)

• 2024 Cyber Threat Report | Huntress

• 2024 Q1 Mobile Landscape Threat Report (lookout.com)

• State of Cyber Security Trends Report 2024 | Ivanti

---

Other News

• Aon reveals cyber attack/data breach as top risk for financial institutions - Reinsurance News

• 15 companies account for 62% of global attack surface | Security Magazine

• Google Deletes $125 Billion UniSuper Pension Fund Account; Impacts Over Half a Million Australians - Goodreturns

• Cyber attacks are soaring—treat them as an 'act of war', health care exec warns | Fortune Well

• If the Lights Went Out: Exploring a Power Grid Failure (greydynamics.com)

• Wars in Ukraine and Gaza raise UK infrastructure cyber threat level | New Civil Engineer

• Malware power threat real and growing – researchers (emergingrisks.co.uk)

• Microsoft’s President to Testify to House Panel on Cyber Security (bloomberglaw.com)

• Microsoft outage affects Bing, Copilot, DuckDuckGo and ChatGPT internet search (bleepingcomputer.com)

• 5 Ways SMBs Can Bridge the Cyber Security Skills Gap | Mimecast

• Why cyber security is front and centre for rail - Railway Technology (railway-technology.com)

• Mitigating cyber security risks in the technology sector | TechRadar

• New EU tool to counter hybrid threats - Ministry of Foreign Affairs Republic of Poland - Gov.pl website (www.gov.pl)

• Cyber attacks on construction firms jump, new report finds | News | Building

• FUD: How Fear, Uncertainty, and Doubt can ruin your security program - Security Boulevard

• Cyber Security in the legal sector | Law Gazette

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Alert 20 May 2024 – Flaw in Popular PDF Reader Foxit Exploited by Hackers to Deliver Variety of Malware

Executive summary

An active campaign has been identified in which a flaw in Foxit, a popular PDF reader, is being exploited by attackers to deploy a variety of malware. Check Point, who have identified the campaign have said that it has been used by multiple threat actors in campaigns ranging “from e-crime to espionage”. The campaign takes advantage of a flaw in which the PDF reader is set to accept a document as trusted by default.  Once a user clicks OK on this, a second display pops up which has the default option of allowing the PDF to open additional programs and execute commands.

What’s the risk to me or my business?

There is a risk that organisations using Foxit PDF reader are vulnerable to this exploitation, which has a low detection rate. Additionally, this risk extends to employees who have access to corporate data on their personal device and are using Foxit. In both cases, the confidentiality, integrity and availability of information is at risk.

Reports indicate that the malicious PDF’s are being distributed in traditional manners including email, as well as social media such as Facebook, capitalising on the low-level of detection of this exploit.

What can I do?

Black Arrow recommends organisations evaluate the most suitable risk treatment approach for their environment. This may involve exploring alternative software solutions or uninstalling the affected software altogether. Additionally, disabling non-essential features, such as command prompt and PowerShell execution, for standard users is recommended. Cyber awareness training should also emphasise the importance of not opening unexpected files or granting permissions via pop-up windows to mitigate risks.

#threatadvisory #threatintelligence #cybersecurity

Further information from Check Point can be found here:

https://research.checkpoint.com/2024/foxit-pdf-flawed-design-exploitation/

Black Arrow Cyber Threat Briefing 17 May 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Social Engineering is the Biggest Cyber Threat, as Study Finds Most Workers Have Clicked on a Suspicious Email Link

According to a recent report, half of office workers have clicked on a link or attachment within a suspicious email sent to their work address within the last 12 months, and of those that interacted with the email, half of them claimed to be confident in their ability to identify phishing emails.

With 68% of breaches involving the human element, your organisation must be cognisant of its employees. Hackers know that no matter what your tech stack is, you will always have employees and where there is an employee, there is a way into your organisation. It is far cheaper to exploit an employee who already has the access you require, than to develop a new exploit. It only takes one human to make a mistake by granting access to an attacker.  

When it came to training, only 41% of respondents said their employer had provided formal cyber security awareness training and 79% said their previous training is not sufficient to keep pace with modern cyber threats.

Source: [HackerNoon] [BusinessPlus]

Business Leaders are Stressing Out Over Pace of Technological Change, as Cyber Security Incidents Seen as Main Business Disruptor

A recent report commissioned by BT reveals that 86% of UK business leaders suffer from 'tech-related stress,' particularly concerning AI and cyber security, a phenomenon they have termed as 'Bytmares.' The report found that 59% of business leaders worry about the rapid and relentless pace of tech advancement, and whether appropriate controls are in place to protect it.

According to a different survey, 74% of business leaders view cyber security incidents as the main disruptive threat to their organisations either currently or over the next twelve months. This was followed by cloud computing, internet of things and artificial intelligence.

These findings highlight the critical importance of robust cyber security measures in today’s interconnected world. As organisations increasingly rely on digital infrastructure, safeguarding sensitive data and systems becomes paramount. Cyber threats can disrupt operations, compromise customer trust, and result in financial losses. Remember, cyber security is not just an IT concern; it is a strategic imperative for every organisation.

Sources: [Beta News] [Telecoms] [Verdict]

ICO Warns That Many UK Businesses Neglect Basic Cyber Security: More Ransomware and Cyber Attacks Last Year Than Ever Before

A recent update from the UK’s Information Commissioner’s Office (ICO) has revealed that ransomware attacks in the UK have surpassed all previous years, up 52% from the previous year. The report found that finance, retail and education sectors are suffering the most incidents.

The leading causes of breaches include phishing, brute force attacks, errors and supply chain attacks. The ICO noted that many organisations still neglect basic cyber security measures and has called for enhanced efforts to combat the escalating threat, emphasising the importance of foundational controls.

Sources: [Tech Monitor] [Government Business] [The Record Media] [Tech Monitor]

Data Breaches are Getting Worse, Many are Employee Errors or Social Engineering Attacks

The latest Verizon Business Data Breach Investigations Report (DBIR) highlights that employee error is the leading cause of cyber security incidents in the EMEA region, accounting for 49% of cases. The top reasons for these incidents are “miscellaneous errors, system intrusion, and social engineering,” making up 87% of all breaches. Hackers primarily target personal information (64%), internal data (33%), and login credentials (20%). Despite zero-day vulnerabilities being a significant threat, with exploitation rising to 14% of breaches, the report emphasises the critical need for ongoing employee training and awareness to mitigate these risks.

Source: [TechRadar]

Why Cyber Insurance isn’t a Substitute for Cyber Risk Management

While cyber insurance can be beneficial in mitigating financial loss from cyber attacks, it is not a substitute for comprehensive cyber risk management. Many firms with cyber insurance have still fallen victim to attacks, highlighting that cyber insurance primarily transfers residual risk. Effective cyber risk management includes conducting proper risk assessments and implementing robust cyber security controls. Cyber insurance cannot resolve issues like business disruption, breach of client confidentiality, and compliance with legal obligations; this stresses the need for proactive measures and independent assurance to protect against cyber threats.

Source: [ Law Society of Scotland]

China Presents Defining Challenge to Global Cyber Security, Says GCHQ

A recent speech by the new director of the UK’s GCHQ highlighted China's growing cyber threat, describing it as an "epoch-defining challenge." She warned that China's destabilising actions undermine global internet security. The current head of the UKs’ NCSC echoed these concerns, pointing to the Chinese state-sponsored hacking group Volt Typhoon which has infiltrated critical sectors like energy and transportation. The National Cyber Director at the White House added that China’s cyber capabilities pose a significant threat to global infrastructure, particularly in crisis scenarios, as Chinese hackers increasingly use sophisticated techniques to pre-position within networks.

Source: [Infosecurity Magazine]

Botnet Sent Millions of Emails in LockBit Black Ransomware Campaign

Since April, millions of phishing emails have been sent through a botnet known as “Phorpiex” to conduct a large-scale LockBit Black ransomware campaign. In a warning from New Jersey’s Cybersecurity and Communications Integration Cell, it was explained that the attackers use ZIP attachments containing an executable that deploys the LockBit Black payload, which encrypts the recipients' systems if launched. The emails are sent from 1,500 unique IP addresses worldwide.

Sources: [Bleeping Computer]

Global Financial Stability at Risk Due to Cyber Threats, IMF warns

A new International Monetary Fund (IMF) report highlights the severe threat cyber attacks pose to global financial stability, revealing that nearly 20% of reported cyber incidents in the past two decades targeted the financial sector, causing $12 billion in direct losses. Since 2020, these attacks have led to an estimated $2.5 billion in direct losses. The report underscores that cyber incidents threaten financial institutions' operational resilience, potentially leading to funding challenges and reputational damage. The IMF calls for bolstered cyber security measures, including stress testing, information-sharing arrangements, and enhanced national cyber security strategies to mitigate these growing risks.

Source: [World Economic Forum]

Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls

An ongoing social engineering campaign that is bombarding enterprises with spam calls and emails has been uncovered. The campaign involves a threat actor overwhelming a user’s email with junk, followed by a call offering to assist in removing the junk. From here, the threat actor aims to convince the victim to download remote monitoring and management software such as AnyDesk or Microsoft’s built in Quick Assist feature to allow the attacker remote access to the victim’s machine.

Source: [The Hacker News]

Santander Data Breach via Third-Party Provider Impacted Customers and Employees

A recent disclosure by the Spanish bank Santander revealed a data breach at a third-party provider affecting customers in Chile, Spain, and Uruguay. Unauthorised access to a database hosted by the provider compromised information on all current and some former employees, but did not include transactional data, online banking details, or passwords. Santander said they swiftly implemented measures to contain the incident, blocking access to the compromised database and enhancing fraud prevention controls. The bank assured that its operations and systems remain unaffected, allowing customers to continue transacting securely. The number of impacted individuals remains unspecified.

There is a continued trend in third party providers being used as the soft underbelly to attack larger and better defended organisations, requiring all organisations to consider the security controls of their third parties.

Source: [securityaffairs.com]

40% of Cyber Teams Have Held Back from Reporting Cyber Attacks Over Fear of Losing Jobs

Recent research has revealed that 40% of cyber teams have not reported a cyber attack due to the fear of losing their job. Unfortunately, this leaves businesses at risk of being non-compliant, without even knowing so. When it came to challenges faced by organisations, it was found that nearly 20% of companies say a lack of qualified talent is a key challenge to overcoming cyber attacks and 32% did not have the resources to hire new staff. This is not to say however, they are unable to outsource some of their cyber function to cyber specialists. This lack of allocated resources prevents the organisation from being confident that any incidents have been appropriately remediated.

Source: [Business Wire]

Digital Resilience – a Step Up from Cyber Security

In an increasingly digital world, many organisations are unaware of how truly reliant they are on digital technology, and the accompanying risks. As we move toward an even more digitally dependent future, the need for digital resilience is more critical than ever. Digital resilience refers to the ability to maintain, change, or recover technology-dependent operations. Organisations should begin with an internal audit to assess their digital resilience, involving all departments and ensuring senior management oversight, as board involvement is essential for effective cyber security programmes.

Digital resilience goes beyond cyber security to encompass change management, business resilience, and operational risk. Implementing digital resilience strategies requires continuous adaptation, cross-functional collaboration, and embedding resilience thinking throughout the organisation. Businesses must integrate digital resilience into their strategic planning to ensure ongoing competitiveness and adaptability in an ever-evolving digital landscape.

Sources: [CSO Online] [CSO Online]

UK Lags Europe on Exploited Vulnerability Remediation

A new report by Bitsight reveals that UK organisations lag behind their European counterparts in remediating software flaws listed in the US ‘Known Exploited Vulnerability’ (KEV) catalogue. UK organisations take an average of 225 days to address KEVs, compared to 220 days for European entities and just 21 days for German organisations. Non-KEV vulnerabilities are patched at an even slower rate, with UK entities taking over two years (736 days) to patch. Globally, the average time to resolve KEVs is around six months (180 days). Despite fewer KEVs detected in UK environments (30% versus 43% in Europe), the slow remediation poses significant risks, emphasising the need for faster and more proactive cyber security measures, specifically robust vulnerability scanning and patching.

Source: [Infosecurity Magazine]

Cyber Threats Demand More Focus Says Zurich, as UK Insurance And NCSC Join Forces to Fight Ransomware Payments

A recent discussion at the British Insurance Brokers' Association (BIBA) conference highlighted the increasing importance of cyber security for businesses, driven by the surge in cyber attacks and the use of AI by criminal gangs. Zurich Resilience Solutions UK noted that businesses face greater scrutiny from underwriters over their cyber exposures.

BIBA, together with the Association of British Insurers (ABI), and the International Underwriting Association (IUA), have united with the UK’s National Cyber Security Centre (NCSC) in a joint effort to tackle ransom payments. As a result of their collaboration, they have published new best practice guidance, which aims to reduce the number of payments being made by UK victims as well as the disruption businesses face.

Source: [Emerging Risks] [NCSC] [Infosecurity Magazine]

---

Governance, Risk and Compliance

• ICO calls on all organisations to boost their cyber security amid growing threat of cyber attacks | Practical Law (thomsonreuters.com)

• Firms neglecting cyber security basics - ICO - CIR Magazine

• Why cyber insurance isn’t a substitute for cyber risk management. | Law Society of Scotland (lawscot.org.uk)

• Business leaders consider cyber security main disruptor – Q1 2024 survey - Verdict

• 40% of Cyber Teams Have Not Reported Cyber Attacks Over Fear of Losing Jobs, According to New VikingCloud Research | Business Wire

• The Growing Cyber Security Disconnect Leaves Enterprises Exposed (forbes.com)

• Cyber Security Is a Top Investor Concern | HackerNoon

• Cyber threats demand more focus – Zurich (emergingrisks.co.uk)

• Digital resilience – a step up from cyber security | CSO Online

• Keep it secret, keep it safe: the essential role of cyber security in document management | CSO Online

• Cyber anxiety on the rise in the UK (betanews.com)

• UK business leaders are stressing out over pace of technological change (telecoms.com)

• Dancing on the Head of a Pin: Corporate Boards, Committees and Cyber Security Risk Management | The Volkov Law Group - JDSupra

• 44% of Cyber Security Professionals Struggle with Regulatory Compliance - Infosecurity Magazine (infosecurity-magazine.com)

• Cyber attacks threaten global financial stability, IMF warns | World Economic Forum (weforum.org)

• BISO: Enhancing cyber security in modern enterprises - SiliconANGLE

• Dell Data Breach Underscores Cost of Cyber Security Complacency (pymnts.com)

• What Is Cyber Risk Quantification? | HackerNoon

• Cyber and Financial Crime, Through the FBI Lens (govinfosecurity.com)

• A Third of CISOs Have Been Dismissed “Out of Hand” By the Board - Infosecurity Magazine (infosecurity-magazine.com)

• Maximizing cyber security ROI: A strategic approach | TechRadar

• Many CISOs don't feel they get the right respect from their board | TechRadar

• Cyber high on agenda at BIBA amid concerns over threats (emergingrisks.co.uk)

• Lloyd’s updates cyber war wordings - Reinsurance News

• Are you meeting your cyber insurance requirements? - Help Net Security

---

Threats

Ransomware, Extortion and Destructive Attacks

• Botnet sent millions of emails in LockBit Black ransomware campaign (bleepingcomputer.com)

• UK hit by more ransomware and cyber attacks last year than ever before (therecord.media)

• The ups and downs (and ups again) of the ransomware risk - Digital Journal

• Hackers Target Children of Corporate Executives in Ransomware Attacks (businessinsider.com)

• CISA: Black Basta ransomware breached over 500 orgs worldwide (bleepingcomputer.com)

• Cyber attacks leave significant financial impact on hacked organisations (kwch.com)

• As the FBI Closes In, Scattered Spider Attacks Finance, Insurance Orgs (darkreading.com)

• UK Insurance and NCSC Join Forces to Fight Ransomware Payments - Infosecurity Magazine (infosecurity-magazine.com)

• UK insurance industry begins to acknowledge role in tackling ransomware (therecord.media)

• The UK may not have a choice on a ransomware payment ban | Computer Weekly

• 64% Jump in Ransomware Claims on Remote Access Tools, Report Shows (claimsjournal.com)

• Cyber Criminals Exploiting Microsoft's Quick Assist Feature in Ransomware Attacks (thehackernews.com)

• Organisations struggle to defend against ransomware - Help Net Security

• Ransomware statistics that reveal alarming rate of cyber extortion - Help Net Security

• Most ransomware-hit enterprises report to authorities, but level of support varies | ZDNET

• Ransomware negotiator weighs in on the payment debate • The Register

• OODA Loop - The Social Engineering Tactics of Ransomware-as-a-Service Operator Black Basta

• INC ransomware source code selling on hacking forums for $300,000 (bleepingcomputer.com)

• What is ransomware recovery? | Definition from TechTarget

• Ransomware Defence Strategies: Never Trust a Criminal (inforisktoday.com)

Ransomware Victims

• More than 470 legal actions against HSE over cyber attack (rte.ie)

• It's been a bad week for public cyber security | TechRadar

• Christie's Just Postponed the Rare Watches Auction Due to Cyber Attack (robbreport.com)

• Singing River Health System: Data of 895,000 stolen in ransomware attack (bleepingcomputer.com)

• Repeat Offenders: Black Basta’s Latest Healthcare Cyber Attack (informationweek.com)

• E-prescription provider MediSecure impacted by a ransomware attack (securityaffairs.com)

Phishing & Email Based Attacks

• Social Engineering is the Biggest Cyber Threat | HackerNoon

• Most Workers Have Clicked on a Suspicious Email Link (businessplus.ie)

• Botnet sent millions of emails in LockBit Black ransomware campaign (bleepingcomputer.com)

• Stay In The Loop On Emerging And Evolving Email Threat Trends (informationsecuritybuzz.com)

• Collaboration tools are now at the frontline in the battle against phishing (securitybrief.co.nz)

• 5 Common Phishing Vectors and Examples - 2024 (cybersecuritynews.com)

BEC

• Visualizing Global Losses from Financial Scams (visualcapitalist.com)

Other Social Engineering

• Social Engineering is the Biggest Cyber Threat | HackerNoon

• Low-tech tactics still top the IT security risk chart | CSO Online

• Ongoing Campaign Bombards Enterprises with Spam Emails and Phone Calls (thehackernews.com)

• What is vishing and quishing, and how do you protect yourself? | PCWorld

• Beware of fake calls, ward off cyber criminals: Govt - The Statesman

• OODA Loop - The Social Engineering Tactics of Ransomware-as-a-Service Operator Black Basta

Artificial Intelligence

• UK Government Unveils New AI Cyber Security Measures as ICO Details Importance of Data Protection | The Fintech Times

• UK agency releases tools to test AI model safety | TechCrunch

• Security industry struggles to consolidate against AI threats - SiliconANGLE

• Cyber Security Races to Unmask New Wave of AI Deepfakes (darkreading.com)

• Only one-third of firms deploy safeguards against generative AI threats, report finds | CIO Dive

• CISOs Reconsider Their Roles in Response to GenAI Integration - Security Boulevard

• AI's rapid growth puts pressure on CISOs to adapt to new security risks - Help Net Security

• Insider Risk in the Generative AI Era - InfoRiskToday

• AI-driven attacks seen as chief cloud security threat | TechTarget

• Concern over AI cyber threats among UK infrastructure organisations | Security News (sourcesecurity.com)

• The Cyber Security Survival Guide For Generative AI (forbes.com)

2FA/MFA

• How to Prevent Attacks that Bypass MFA - InfoRiskToday

Malware

• Malware was almost 50% of threat detections in Q1 2024 | Security Magazine

• North Korean Hackers Deploy New Golang Malware 'Durian' Against Crypto Firms (thehackernews.com)

• FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT (thehackernews.com)

• Microsoft fixes Windows zero-day exploited in QakBot malware attacks (bleepingcomputer.com)

• Ebury botnet malware infected 400,000 Linux servers since 2009 (bleepingcomputer.com)

• Kimsuky hackers deploy new Linux backdoor via trojanized installers (bleepingcomputer.com)

• Man destroys his laptop after downloading 1,000 viruses to see which anti-virus software works the best (unilad.com)

Mobile

• Malicious Android Apps Pose as Google, Instagram, WhatsApp to Steal Credentials (thehackernews.com)

• Google Issues Critical Update For Millions Of Pixel Users (forbes.com)

• Apple Patch Day: Code Execution Flaws in iPhones, iPads, macOS - Security Week

• Threat actors may have exploited a zero-day in older iPhones, Apple warns (securityaffairs.com)

• Apple warns of increased iPhone security risks – Computerworld

• Apple and Google agree on standard to alert people when unknown Bluetooth devices may be tracking them | TechCrunch

• Protect against iPhone trojan GoldPickaxe: How-to - 9to5Mac

• Unwanted Tracking Alerts Rolling Out to iOS, Android - Security Week

• Apple blocked $7 billion in fraudulent App Store purchases in 4 years (bleepingcomputer.com)

• Android boosting security with Theft Detection Lock, factory reset protection  (9to5google.com)

• Data Privacy: All the Ways Your Cellphone Carrier Tracks You and How to Stop It

• Your Android phone could have stalkerware — here’s how to remove it | TechCrunch

Internet of Things – IoT

• Attack makes autonomous vehicle tech ignore road signs • The Register

• Millions of IoT Devices at Risk From Integrated Modem (darkreading.com)

• Prison for cyber security expert selling private videos from inside 400,000 homes (bitdefender.com)

• IoT Vulnerabilities and BotNet Infections: A Risk for Executives - Security Boulevard

Data Breaches/Leaks

• Over 5.3 billion data records exposed in April 2024 | Computer Weekly

• MoD contractor hacked by China failed to report breach for months | Hacking | The Guardian

• Data breaches are getting worse - and many are coming from a familiar source | TechRadar

• Notorious threat actor IntelBroker claims the hack of the Europol (securityaffairs.com)

• Hacker claims another breach into Dell systems | SC Media (scmagazine.com)

• Dell Data Breach Underscores Cost of Cyber Security Complacency (pymnts.com)

• Hacker claims to have stolen Dell customer data, twice. Here's how to protect yourself | ZDNET

• Santander Data Breach Impacts Customers, Employees - Security Week

• Employee data breaches up 41% - Personnel Today

• The legal sector's data breach conundrum: insights from ICO's latest report - Solicitors Journal

• JPMorgan Chase Suffers Data Breach Affecting Personal Information of 451,809 Customers - The Daily Hodl

• JPMorgan Fixes Security Flaw, Affects 450K Retirement Plans | Entrepreneur

• Europol confirms incident after data break-in claims • The Register

• Largest non-bank lender in Australia warns of a data breach (bleepingcomputer.com)

• Guernsey data breaches: More than 1,000 people affected - BBC News

• Up to 120,000 affected by data breach at City of Helsinki (helsinkitimes.fi)

• Billion-Dollar Bank Sued After Revealing Massive Data Breach Affecting Thousands of Customers, Exposing Account Details, Social Security Numbers and Medical Information: Report - The Daily Hodl

• Okta’s security chief on the company’s own cyber attack and how the ‘battleground’ has shifted (therecord.media)

• Camden Council cyber attack warning after NRS Healthcare cyber attack | Ham & High (hamhigh.co.uk)

• Lessons learned from high-profile data breaches | TechTarget

• Zscaler Confirms Only Isolated Test Server Was Hacked - Security Week

• Nissan North America data breach impacts over 53,000 employees (bleepingcomputer.com)

Organised Crime & Criminal Actors

• FBI, DoJ Shut Down BreachForums, Launch Investigation (darkreading.com)

• Cyber and Financial Crime, Through the FBI Lens (govinfosecurity.com)

• FBI working towards nabbing Scattered Spider hackers, official says | Reuters

• Low-tech tactics still top the IT security risk chart | CSO Online

• The Growing Cyber Threat Landscape: Insights into State-Sponsored and Criminal Cyber Activities | HackerNoon

• Top 5 Most Dangerous Cyber Threats in 2024 (darkreading.com)

• Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• North Korean Hackers Deploy New Golang Malware 'Durian' Against Crypto Firms (thehackernews.com)

• Tornado Cash cryptomixer dev gets 64 months for laundering $2 billion (bleepingcomputer.com)

• US brothers arrested for stealing $25m in crypto in just 12 seconds - BBC News

Insider Risk and Insider Threats

• Low-tech tactics still top the IT security risk chart | CSO Online

• Data breaches are getting worse - and many are coming from a familiar source | TechRadar

• Insider Risk in the Generative AI Era - InfoRiskToday

• The Human Element in Cyber Security: Safeguarding your organisation (thebusinessmagazine.co.uk)

• CISOs call to ditch the 'stigma of blame' in cyber security (computing.co.uk)

Insurance

• Why cyber insurance isn’t a substitute for cyber risk management. | Law Society of Scotland (lawscot.org.uk)

• NCSC guide to help businesses facing ransomware demands (biba.org.uk)

• UK insurance industry begins to acknowledge role in tackling ransomware (therecord.media)

• UK Insurance and NCSC Join Forces to Fight Ransomware Payments - Infosecurity Magazine (infosecurity-magazine.com)

• Lloyd’s provides tighter guidance on cyber war wordings | Insurance Insider

• Cyber high on agenda at BIBA amid concerns over threats (emergingrisks.co.uk)

• Are you meeting your cyber insurance requirements? - Help Net Security

Supply Chain and Third Parties

• Most Companies Affected by Software Supply Chain Attacks in the Last Year, Struggling to Detect and React Effectively - IT Security Guru

• Santander: a data breach at a third-party provider impacted customers and employees (securityaffairs.com)

• MoD contractor hacked by China failed to report breach for months | Hacking | The Guardian

• Okta’s security chief on the company’s own cyber attack and how the ‘battleground’ has shifted (therecord.media)

Cloud/SaaS

• How to create a cloud security policy, step by step | TechTarget

• AI-driven attacks seen as chief cloud security threat | TechTarget

• Singapore Cyber Security Update Puts Cloud Providers on Notice (darkreading.com)

• Secrecy Concerns Mount Over Spy Powers Targeting US Data Centres | WIRED

Encryption

• You want us to think of the children? Couldn't agree more • The Register

Linux and Open Source

• Ebury botnet malware infected 400,000 Linux servers since 2009 (bleepingcomputer.com)

• Kimsuky hackers deploy new Linux backdoor via trojanized installers (bleepingcomputer.com)

• Establishing a security baseline for open source projects - Help Net Security

Passwords, Credential Stuffing & Brute Force Attacks

• The 10 most common 4-digit PIN numbers — are you at risk of a cyber attack? (nypost.com)

Social Media

• It’s time to ban TikTok for the sake of our democracy and security (politicshome.com)

Training, Education and Awareness

• The Future of Security Awareness - GovInfoSecurity

• The Human Element in Cyber Security: Safeguarding your organisation (thebusinessmagazine.co.uk)

Regulations, Fines and Legislation

• Singapore Cyber Security Update Puts Cloud Providers on Notice (darkreading.com)

• Clock is ticking for companies to prepare for EU NIS2 Directive | CSO Online

• Nigeria Halts Cyber Security Tax After Public Outrage (darkreading.com)

Models, Frameworks and Standards

• Clock is ticking for companies to prepare for EU NIS2 Directive | CSO Online

Careers, Working in Cyber and Information Security

• The cyber security skills shortage: A CISO perspective | CSO Online

• Why cyber security staff burn out, and what to do about it (computing.co.uk)

Law Enforcement Action and Take Downs

• As the FBI Closes In, Scattered Spider Attacks Finance, Insurance Orgs (darkreading.com)

• FBI, DoJ Shut Down BreachForums, Launch Investigation (darkreading.com)

• Most ransomware-hit enterprises report to authorities, but level of support varies | ZDNET

• Prison for cyber security expert selling private videos from inside 400,000 homes (bitdefender.com)

• Tornado Cash cryptomixer dev gets 64 months for laundering $2 billion (bleepingcomputer.com)

• US brothers arrested for stealing $25m in crypto in just 12 seconds - BBC News

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Lloyd’s updates cyber war wordings - Reinsurance News

• Civil society under increasing threats from ‘malicious’ state cyber actors, US (therecord.media)

Nation State Actors

China

• Cyber threat landscape permanently altered by Chinese operations, US officials say (therecord.media)

• GCHQ boss says China's 'genuine' cyber threat 'weakens security of internet for all' | Science & Tech News | Sky News

• Tracking the Progression of Earth Hundun's Cyber espionage Campaign in 2024 | Trend Micro (US)

• When Chinese Nationalist Hackers Go Rogue (globelynews.com)

• Can't blame all Chinese cyber attacks on the government - Asia Times

• How the West has struggled to keep up with China’s spy threat - BBC News

• Stifling Beijing in cyber space big focus for UK operatives • The Register

• China focuses on non-military ways to take Taiwan, reports warn - Washington Times

• It’s time to ban TikTok for the sake of our democracy and security (politicshome.com)

• Asian Threat Actors Use New Techniques to Attack Familiar Targets (darkreading.com)

• Chinese Crime Ring Uses Franchise Model to Grow Fake Online Shops (businessinsider.com)

• Three men charged with aiding Hong Kong intelligence service, says Met | UK news | The Guardian

Russia

• Russia is ramping up sabotage across Europe (economist.com)

• File Not Found: Russia Is Hacking Evidence of Its War Crimes - War on the Rocks

• NATO Draws a Cyber Red Line in Tensions With Russia - Security Week

• Pro-Russia hackers targeted Kosovo government websites (securityaffairs.com)

• Russian Actors Weaponize Legitimate Services in Multi-Malware Attack - Infosecurity Magazine (infosecurity-magazine.com)

• UK 'increasingly concerned' about Russian intelligence links to hacktivists (therecord.media)

• To the Moon and back(doors): Lunar landing in diplomatic missions (welivesecurity.com)

• New backdoors on a European government's network appear to be Russian (therecord.media)

• 'Russian' hackers deface potentially hundreds of local British news sites (therecord.media)

• Investigation: How Russia's Warplanes Get Their 'Brain Power' From The West, Despite Sanctions

• The Three Seas Initiative: A Vanguard in Digitization and Cyber Security | Warsaw Institute

Iran

• Iran most likely to launch destructive cyber attack on US • The Register

North Korea

• Asian Threat Actors Use New Techniques to Attack Familiar Targets (darkreading.com)

• North Korean Hackers Deploy New Golang Malware 'Durian' Against Crypto Firms (thehackernews.com)

---

Vulnerability Management

• Not Just MOVEit: 2023 Was a Banner Year for Zero-Days (inforisktoday.com)

• (Cyber) Risk = Probability of Occurrence x Damage (thehackernews.com)

• Critical vulnerabilities take 4.5 months on average to remediate - Help Net Security

• The Fall of the National Vulnerability Database (darkreading.com)

• Backlogs at National Vulnerability Database prompt action from NIST and CISA | CSO Online

• UK Lags Europe on Exploited Vulnerability Remediation - Infosecurity Magazine (infosecurity-magazine.com)

• Log4J shows no sign of fading, spotted in 30% of CVE exploits - Help Net Security

• NIST Confusion Continues as Cyber Pros Complain CVE Uploads Stopped - Infosecurity Magazine (infosecurity-magazine.com)

• Heartbleed: When Is It Good to Name a Vulnerability? (darkreading.com)

Vulnerabilities

• Google Chrome emergency update fixes 6th zero-day exploited in 2024 (bleepingcomputer.com)

• Google patches third exploited Chrome zero-day in a week (bleepingcomputer.com)

• Threat actors may have exploited a zero-day in older iPhones, Apple warns (securityaffairs.com) 

• Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days (thehackernews.com)

• Cyber Criminals Exploiting Microsoft's Quick Assist Feature in Ransomware Attacks (thehackernews.com)

• Microsoft fixes Windows zero-day exploited in QakBot malware attacks (bleepingcomputer.com)

• Log4J shows no sign of fading, spotted in 30% of CVE exploits - Help Net Security

• D-Link Routers Vulnerable to Takeover Via Exploit for Zero-Day (darkreading.com)

• New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks (thehackernews.com)

• Intel Publishes 41 Security Advisories for Over 90 Vulnerabilities  - Security Week

• Google Issues Critical Update For Millions Of Pixel Users (forbes.com)

• Apple Patch Day: Code Execution Flaws in iPhones, iPads, macOS - Security Week

• CISA and FBI Issue Alert on Path Traversal Vulnerabilities - Security Boulevard

• VMware Patches Severe Security Flaws in Workstation and Fusion Products (thehackernews.com)

• Firefox 126: Telemetry, privacy feature, and security fixes - gHacks Tech News

• SAP Patches Critical Vulnerabilities in CX Commerce, NetWeaver - Security Week

• Adobe Patches Critical Flaws in Reader, Acrobat - Security Week

• Cisco Releases Security Updates for Multiple Products | CISA

• Microsoft shares temp fix for Outlook encrypted email reply issues (bleepingcomputer.com)

---

Tools and Controls

• Why cyber insurance isn’t a substitute for cyber risk management. | Law Society of Scotland (lawscot.org.uk)

• Digital resilience – a step up from cyber security | CSO Online

• Dancing on the Head of a Pin: Corporate Boards, Committees and Cyber Security Risk Management | The Volkov Law Group - JDSupra

• How To Implement Threat Modeling To Protect Your Business - Minutehack

• How to create a cloud security policy, step by step | TechTarget

• Hackers use DNS tunneling for network scanning, tracking victims (bleepingcomputer.com)

• AWS CISO: In AI gold rush, folks forget application security • The Register

• What Is Cyber Risk Quantification? | HackerNoon

• Best Practices for Preparing for a Cyber Breach | ITPro Today: IT News, How-Tos, Trends, Case Studies, Career Tips, More

• Ridding your network of NTLM | CSO Online

• Maximizing cyber security ROI: A strategic approach | TechRadar

• What is ransomware recovery? | Definition from TechTarget

• The Human Element in Cyber Security: Safeguarding your organisation (thebusinessmagazine.co.uk)

• Addressing the Cyber Security Vendor Ecosystem Disconnect (darkreading.com)

• The Future of Security Awareness - GovInfoSecurity

• Microsoft Deploys Generative AI for US Spies | WIRED

• How to Think About Foundation Models for Cyber Security | Andreessen Horowitz (a16z.com)

---

Reports Published in the Last Week

• Learning from the mistakes of others – A retrospective review | ICO

• 2024 Browser Security Report (layerxsecurity.com)

• At-Bay's 2024 InsurSec Report [Download Now]

• Kaspersky’s Incident Response Analyst report 2023 (kasperskycontenthub.com)

---

Other News

• Microsoft president summoned to House over security blunders • The Register

• National Cyber Security Centre: Tech market not working - The Business Magazine

• Critical infrastructure security needs everyone's help • The Register

• Your Hospital Is Under Cyber Attack. Now What? (newsweek.com)

• BT, TalkTalk, Virgin Media and Vodafone on UK Router Security and Upgrades - ISPreview UK

• Hackers use DNS tunnelling for network scanning, tracking victims (bleepingcomputer.com)

• NCSC CTO: Broken market must be fixed to usher in new tech • The Register

• Public Sector IT is Broken: Turning the System Back On - IT Security Guru

• The Cyber Security Implications Of Gen Z’s Tech-Savvy Lifestyle (forbes.com)

• Fortify Your Digital Defences: Top Home Cyber Security Strategies for Personal Protection | HackerNoon

• Classes cancelled as 'sinister' school cyber attacks rise - BBC News

• Irony abounds as UK NCSC’s simple door codes revealed • The Register

• Candidates to get cyber security support amid general election interference fears (nation.cymru)

• NCSC launches Share and Defend capability | UKAuthority

• Too many ICS assets are exposed to the public internet - Help Net Security

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Advisory 15 May 2024 – Microsoft, Adobe, Apple, Mozilla Firefox, Google Chrome, SAP and VMware Updates

Executive summary

Microsoft’s May Patch Tuesday provides updates to address 61 security issues across its product range. Notably, the update tackles two actively exploited zero-day vulnerabilities. The zero-days include a security feature bypass and an elevation of privilege vulnerability. Among the updates provided by Microsoft were 1 critical vulnerability, allowing an attacker remote code execution.

In addition to the Microsoft updates this week also saw Adobe, Apple, Firefox, Google Chrome, SAP and VMware all provide updates for vulnerabilities in a variety of their products, including multiple zero-days and critical vulnerabilities.

What’s the risk to me or my business?

The actively exploited vulnerabilities could allow an unauthenticated attacker to gain code execution as well as elevating to system privileges, the highest available. Both of which compromise the confidentiality, integrity and availability of data stored by an organisation.

What can I do?

Security updates are available for all supported versions of Windows impacted. The updates should be applied as soon as possible for the actively exploited vulnerability and all other vulnerabilities that have an available patch should be updated as soon as possible.

---

Technical Summary

Microsoft

CVE-2024-30040 – A security feature bypass, in which an unauthenticated attacker can gain code execution through convincing a user to open a malicious document. It is now known how this flaw was abused in attacks.

CVE-2024-30051- A flaw in Windows DWM Core Library which upon exploitation, allows an attacker to elevate to system privileges, the highest available.

Apple

Apple have addressed multiple vulnerabilities in its products, including 16 vulnerabilities on iPhone and iPads. This includes include one vulnerability which the company say “may have been exploited”.

Adobe

Adobe have addressed 37 vulnerabilities in its products, including 9 critical vulnerabilities in Adobe Acrobat and Reader, ,  2 critical vulnerabilities in Adobe Commerce, Adobe InDesign, Adobe Experience manager, 1 critical vulnerability in Adobe Media Encoder and Adobe Bridge, 3 critical vulnerabilities in Adobe Illustrator and 2 critical vulnerabilities in Adobe Animate. The company said it was not aware of any exploits in the wild for any of the documented issues.

Firefox

Firefox has upgraded to version 126. The new version addresses 16 unique security issues. None of the vulnerabilities are currently under active exploitation. The release also comes with some quality-of-life changes such as search telemetry changes and copy link without site tracking.

Google Chrome

Google Chrome released an emergency update to fix their 6th zero-day exploited this year, just one week after a previous one. Google are aware that an exploit for the vulnerability exists in the wild. Users are recommended to update as soon as possible.

SAP

This month, SAP has released 17 patches, which include 14 new fixes and 3 updates from previous releases. Two patches and one update have been given the “hot news” priority in SAP, the highest severity. The vulnerabilities encompass a range of issues, including CSS Injection, Remote Code Execution, File Upload flaws, and Cross-Site Scripting (XSS).

VMWare

Multiple security flaws, including one critical vulnerability, have been addressed by VMware after their exploitation was demonstrated at a security event. Some of the vulnerabilities do not have a fix yet and as such, users are advised to disable Bluetooth support and 3D acceleration as temporary workarounds until patches are applied.

---

More info:

Microsoft

Further details on other specific updates within Microsoft’s May patch Tuesday can be found here:

https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2024-patch-tuesday-fixes-3-zero-days-61-flaws/

https://www.ghacks.net/2024/05/14/microsoft-releases-the-may-2024-security-updates-for-windows/

Apple

Further details of the vulnerabilities in Apple can be found here:

https://support.apple.com/en-gb/HT201222

Adobe

Further details of the vulnerabilities in Adobe Acrobat and Reader can be found here:

https://helpx.adobe.com/security/products/acrobat/apsb24-29.html

Further details of the vulnerabilities in Adobe Photoshop can be found here:

https://helpx.adobe.com/security/products/photoshop/apsb24-16.html

Further details of the vulnerabilities in Adobe Commerce can be found here:

https://helpx.adobe.com/uk/security/products/magento/apsb24-18.html

Further details of the vulnerabilities in Adobe InDesign can be found here:

https://helpx.adobe.com/uk/security/products/indesign/apsb24-20.html

Further details of the vulnerabilities in Adobe Experience Manager can be found here:

https://helpx.adobe.com/uk/security/products/experience-manager/apsb24-21.html

Further details of the vulnerabilities in Adobe Media Encoder can be found here:

https://helpx.adobe.com/uk/security/products/media-encoder/apsb24-23.html

Further details of the vulnerabilities in Adobe Bridge can be found here:

https://helpx.adobe.com/uk/security/products/bridge/apsb24-24.html

Further details of the vulnerabilities in Adobe Illustrator can be found here:

https://helpx.adobe.com/uk/security/products/illustrator/apsb24-25.html

Further details of the vulnerabilities in Adobe Animate can be found here:

https://helpx.adobe.com/uk/security/products/animate/apsb24-26.html

Firefox

Further details on the vulnerabilities addressed in the Firefox release can be found here:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-21/

Google Chrome

Further details on the vulnerabilities addressed in the Google Chrome update can be found here:

https://chromereleases.googleblog.com/2024/05/stable-channel-update-for-desktop_13.html

SAP

Further details on the vulnerabilities addressed in SAP can be found here:

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/may-2024.html

VMware

Further details on the vulnerabilities addressed by VMware can be found here:

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24280

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity

Black Arrow Cyber Threat Briefing 10 May 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

China Suspected of Hacking UK Ministry of Defence, Through Its Payroll Provider

UK Defence Secretary Grant Shapps has confirmed that over 270,000 personal details have been leaked after the MoD was hacked through its third-party payroll provider, SSCL. The affected systems have been pulled offline since the attack. SSCL’s website describes that it manages HR for the armed forces, the Metropolitan Police and other areas of British government. The commercial supply chain, and in particular HR and payroll providers, is increasing being used as the soft underbelly to attack larger and better protected organisations.

Sources: [LBC] [The Register] [Sky News]

Security Tools Fail to Translate Risks for Executives

Organisations are struggling with internal communication barriers, hindering their ability to address and mitigate cyber security threats, according to a report which found that seven out of 10 C-suite executives said their security teams talk in technical terms without providing business context. However, in contrast, 75% of CISO’s highlight the issue is rooted in security tools that cannot generate the insights C-level executives and boards can use to understand business implications. The role of a good CISO should be to take the output of these tools and turn that data into metrics the Boards can understand.

The issues highlight the necessity for organisations to have someone in their organisation, whether an employee or a third-party, who is able to ingest technical results and translate them into a style that the C-suite can understand for business risk management.

Source: [Help Net Security]

Gang Accused of MGM Hack Shifts Attacks to Finance Sector

The hacking group responsible for the infamous hack on MGM and Caesar’s Palace resorts is engaged in a new campaign targeting the financial sector. The group known as Scattered Spider has targeted 29 companies since 20 April this year, compromising at least 2 insurance companies so far. The research has stated that the attackers are purchasing lookalike domains that match the name of target companies, hosting fake log-in pages. Links to these are sent to employees, in an attempt to direct them there. The most recent attack took place just days ago, with more expected.

Sources: [Bloomberg Law] [Claims Journal]

Are SMEs Paving the Way for Cyber Attacks on Larger Companies?

A recent study highlights the escalating cyber threats facing businesses, particularly SMEs and supply chains. The study found that 32% of UK businesses, including 69% of large and 59% of mid-sized organisations, suffered a cyber attack last year. The situation is worse for SMEs, with weaker security systems and 77% lacking in-house cyber security. SMEs can become entry points for hackers targeting larger partners through interconnected supply chains. Meanwhile, Verizon’s latest data breaches report revealed a 68% increase in supply chain breaches, accounting for 15% of all breaches in 2023, up from 9% in 2022. These breaches are primarily driven by third-party software vulnerabilities exploited in ransomware and extortion attacks. Experts emphasise proactive cyber policies, vulnerability scans, and employee education for SMEs to bolster defences. They also urge organisations to consider third-party bugs as both vulnerability and vendor management problems, make better vendor choices, and use external signals like SEC disclosures in the United States to guide decisions. These measures can help prevent SMEs from becoming gateways for larger attacks and manage the rising threat of supply chain breaches.

Sources: [Insurance Times] [Dark Reading]

Misconfigurations Drive 80% of Security Exposure, Report Finds

A recent report has found that 80% of security exposures are caused by identity and credential misconfigurations, with a third of these putting critical assets at risk of a breach. According to the report, the majority of this is within an organisation’s network user management (Active Directory) and 56% of breaches that impact critical assets are within cloud platforms. There is often the misconception that cloud-based environments are secure by default, but misconfigurations can undo any security benefits and still leave you exposed. Just because someone else built and maintains your house, it is still your responsibility to lock the doors and windows.

Sources: [Security Magazine]

Only 45% of Organisations Employ MFA Protections

A recent report of IT decision-makers has found that 97% are facing challenges with identity verification and 52% are very concerned about credential compromise, followed by account takeover (50%). When it comes to reinforcing identity verification, only 45% used multi-factor authentication (MFA). By using MFA, organisations are forcing two identification verifications: simply knowing a username and password is not enough, especially given the speeds with which attackers can crack passwords, with average 8 character passwords able to be cracked in less than a minute. Whilst no control is 100% impenetrable, enabling MFA will aid in increasing your organisation's cyber resilience.

Source: [Help Net Security]

You Cannot Protect What You Do Not Know You Have, as Criminals are Exploiting Vulnerabilities Faster Than Ever

For many organisations, visibility of their information assets can be incredibly hard to obtain and maintain, with different tools, under-reporting and shadow IT contributing to the problem. Unfortunately, cyber criminals are getting faster at exploiting vulnerabilities, and if you do not know you have the vulnerability in your estate then you cannot patch against it. In their recent report, Fortinet found that attacks started on average 4.76 days after new exploits were publicly disclosed.

Interestingly though, while zero-day threats garner much attention (these are ‘new’ vulnerabilities that are being exploited by attackers but for which there are no security patches yet available), one third of all exploits are for older vulnerabilities. This highlights the need for a comprehensive and robust approach to network security and vulnerability management, beyond simply patching what Microsoft puts out once a month. To have effective patch management, organisations must know what they need to patch and therefore must have visibility of the corporate environment. A good starting block is the creation of a robust information asset register.

Sources: [Security Brief] [Help Net Security] [IT Security Guru]

The Rise and Stealth of The Socially Engineered Insider

Social engineering has become increasingly prevalent as the preferred tactic for foreign adversaries. Insiders are prime targets due to their privileged access to sensitive data. This is particularly affecting the technology, pharma, and critical infrastructure sectors. Advances in AI and social platforms have made it easier to exploit these vulnerabilities. These advances allow threat actors to tailor attacks with unprecedented speed and realism. Using methods like coercion or deception, these actors exploit employees to gain high-value data that can be weaponised. As a result, the threat landscape has become more complex, blurring the lines between internal and external risks. To bolster their defences, organisations are now investing in insider risk management and AI. They are also emphasising employee education and cross-sector collaboration.

Source: [Forbes]

Over 70% of Staff Use AI At Work, But Only 30% of European Organisations Provide AI Training

An ISACA study and the AI Security & Governance Report reveal a complex landscape of AI adoption and security. 73% of European organisations and 54% of global organisations use AI, with 79% increasing their AI budgets, however training and policy development lag behind. Only 30% offer limited training, 40% provide none, and a mere 17% have a comprehensive AI policy. Despite AI’s potential, 80% of data experts find it complicates security, with concerns high around generative AI exploitation (61% of respondents) and AI-powered attacks (over 50% of business leaders). Data poisoning and privacy issues persist, yet 85% of leaders express confidence in their data security strategies, with 83% revising privacy and governance guidelines. With 86% recognising a need for AI training within two years, the call for dynamic governance strategies and formal education is clear to manage evolving threats.

Sources: [Help Net Security] [IT Security Guru]

Don't Be the Weakest Link – You and Your Team's Crucial Role in Cyber Security

Cyber security success depends on more than just technology. Bad actors are always looking for the easiest entry point, meaning that employees’ everyday actions are crucial, when even one careless click or a weak password can be an open door for hackers. However, empowered with the right knowledge and tools, staff can become a robust defence. Nearly 80% of organisations have reported an increase in phishing attacks, but training programs like role-playing exercises and phishing simulations significantly reduce these risks. Effective cyber security also hinges on C-suite leaders promoting a security-first culture, ensuring all employees understand the risks and follow strict protocols like MFA and strong password policies. Consistent training and open communication are vital in fostering a resilient, security-aware workforce.

Source: [JDSupra]

Ransomware Activity Thrives, Despite Law enforcement Efforts

Despite the recent law enforcement takedowns on ransomware groups, ransomware remains rife. Whilst the takedown of a group can come as an initial relief in that the group has gone, it simply forces ransomware affiliates to diversify. This is reflected in ransomware continuing its growth in the first quarter of 2024, with 18 new leak sites, the largest number in a single quarter, emerging over this period. When comes to those at risk, both financial services and healthcare remain a prominent target.

Sources: [Help Net Security ] [Infosecurity Magazine] [Help Net Security]

NATO Warns of Russian Hybrid Warfare

NATO has issued a statement in which it describes it is “deeply concerned about Russia's hybrid actions and the threat that they constitute to NATO security”.  The actions are described to include sabotage, acts of violence, cyber and electronic interference, and disinformation campaigns. This comes as many countries including the UK and US are due to have elections this year.

Sources: [EU Reporter] [Financial Times]

---

Governance, Risk and Compliance

• You cannot protect what you do not understand (securitybrief.co.nz)

• Why 2024 will be the year of the CISO | CSO Online

• Security tools fail to translate risks for executives - Help Net Security

• It Costs How Much?!? The Financial Pitfalls of Cyber Attacks on SMBs (thehackernews.com)

• Now More Than Ever, it's Crucial for Companies to Get Cyber Security Right (newsweek.com)

• Why SMBs are facing significant security, business risks - Help Net Security

• Are SMEs paving the way for cyber attacks on larger companies? | Insurance Times

• Don't Be the Weakest Link – Your Team's Crucial Role in Cyber Security | NAVEX - JDSupra

• The Art Of Cyber Security Governance: Safeguarding Beyond Code (forbes.com)

• CISOs Are Worried About Their Jobs & Dissatisfied With Their Incomes (darkreading.com)

• 92% of CISOs Question the Future of Their Role Amidst Growing AI Pressures | Business Wire

• What's the Future Path for CISOs? (darkreading.com)

• RSAC: How CISOs Should Protect Themselves Against Indictments - Infosecurity Magazine (infosecurity-magazine.com)

• Three strategies for winning the cyber security arms race | Fintech Nexus

• Why Cyber Security Is More Important Than Ever | Inc.com

• Rethinking Cyber Security Investment Amid Rising Threats (govinfosecurity.com)

• CIOs and CFOs, two parts of the same whole - IT Security Guru

---

Threats

Ransomware, Extortion and Destructive Attacks

• Gang Accused of MGM Hack Turns Its Sights on Finance Sector (bloomberglaw.com)

• The State of Ransomware 2024 - InfoRiskToday

• Cybercrime Unicorns: What Everyone Needs to Know About Ransomware Gangs (pcmag.com)

• Why Paying Should Be A Last Resort In Ransomware Attacks (forbes.com)

• Ransomware activity is back on track despite law enforcement efforts - Help Net Security

• Ransomware evolves from extortion to 'psychological attacks' • The Register

• Russian Hacker Dmitry Khoroshev Unmasked as LockBit Ransomware Administrator (thehackernews.com)

• Ransomware attacks impact 20% of sensitive data in healthcare orgs - Help Net Security

• An overwhelming majority of organisations paid ransomware last year - eCampus News

• Global ransomware crisis worsens - Help Net Security

• The Growing Threat of Advanced Ransomware Attacks (inforisktoday.com)

• Law enforcement seized Lockbit group's website again (securityaffairs.com)

• Consultant charged with $1.5M extortion of IT giant • The Register

• IT chiefs plan to spend and innovate their way out of ransomware swamp | TechRadar

• Alleged Russian hacker unmasked as Bermuda joins sanctions effort - The Royal Gazette | Bermuda News, Business, Sports, Events, & Community |

• Ransomware crooks SIM swap kids to pressure parents • The Register

• Scattered Spider group a unique challenge for cyber cops, FBI leader says (therecord.media)

• 97% of Organisations Hit by Ransomware Worked with Law Enforcement (globenewswire.com)

• Tips for Protecting Active Directory From Ransomware Attacks | ITPro Today: IT News, How-Tos, Trends, Case Studies, Career Tips, More

• CISA boss: Secure software needed to stop ransomware • The Register

• Shields Up: How to Minimize Ransomware Exposure - Security Week

• How financial services organisations can protect valuable data in the age of ransomware (finextra.com)

• Defenders assemble: Time to get in the game – Sophos News

Ransomware Victims

• UnitedHealth’s 'egregious negligence' led to that ransomware • The Register

• Ascension healthcare takes systems offline after cyber attack (bleepingcomputer.com)

• London Drugs president tight-lipped over recent cyber attack | CBC News

• Boeing confirms attempted $200 million ransomware extortion attempt | CyberScoop

• Cyber attack disrupts operations at major US health care network | CNN Business

• City of Wichita Shuts Down Network Following Ransomware Attack - Security Week

• Patient appointments imperilled by cyber attack on French radiologist (therecord.media)

• Ransomware attack hits Brandywine Realty Trust | SC Media (scmagazine.com)

Phishing & Email Based Attacks

• NSA, FBI Alert on N. Korean Hackers Spoofing Emails from Trusted Sources (thehackernews.com)

Other Social Engineering

• The Rise And Stealth Of The Socially Engineered Insider (forbes.com)

• Iranian hackers harvest credentials through advanced social engineering campaigns | CSO Online

• What is social engineering penetration testing? | Definition from TechTarget

Artificial Intelligence

• Over 70% of Staff Use AI At Work, But Only 30% of European Organisations Provide AI Training - IT Security Guru

• Organisations go ahead with AI despite security risks - Help Net Security

• Innovation, Not Regulation, Will Protect Corporations From Deepfakes (darkreading.com)

• Strategies for preventing AI misuse in cyber security - Help Net Security

• AI is changing the game when it comes to cyber security | ITPro

• Why the Cyber Security Industry Is Obsessed With AI Right Now - CNET

• LLMs & Malicious Code Injections: 'We Have to Assume It's Coming' (darkreading.com)

• Cyber Security, Deepfakes and the Human Risk of AI Fraud (govtech.com)

• How to detect deepfakes manually and using AI | TechTarget

• Report Shows AI Fraud, Deepfakes Are Top Challenges For Banks - Infosecurity Magazine (infosecurity-magazine.com)

• Criminal Use of AI Growing, But Lags Behind Defenders - Security Week

2FA/MFA

• Only 45% of organisations use MFA to protect against fraud - Help Net Security

• UnitedHealth Attack: Stolen Credentials, No MFA | MSSP Alert

Malware

• Hackers Increasingly Abusing Microsoft Graph API for Stealthy Malware Communications (thehackernews.com)

• ZLoader Malware adds Zeus's anti-analysis feature (securityaffairs.com)

• Russia-linked APT28 and crooks are still using the Moobot botnet (securityaffairs.com)

• Iranian hackers pose as journalists to push backdoor malware (bleepingcomputer.com)

• New 'Cuckoo' Persistent macOS Spyware Targeting Intel and Arm Macs (thehackernews.com)

• Hackers are using fake apps to distribute this dangerous Mac malware — don’t fall for this | Tom's Guide (tomsguide.com)

• Hijack Loader Malware Employs Process Hollowing, UAC Bypass in Latest Version (thehackernews.com)

• Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery (thehackernews.com)

Mobile

• Mobile Banking Malware Surges 32% - Infosecurity Magazine (infosecurity-magazine.com)

• Android bug can leak DNS traffic with VPN kill switch enabled (bleepingcomputer.com)

• European Threat To End-To-End Encryption Would Invade Phones (forbes.com)

• Ransomware crooks SIM swap kids to pressure parents • The Register

Denial of Service/DoS/DDOS

• 87% of DDoS Attacks Targeted Windows OS Devices in 2023 (darkreading.com)

Data Breaches/Leaks

• How does a data breach affect you and why should you care? | TechRadar

• Defence secretary Grant Shapps confirms name of contractor running MoD system hacked by China | Politics News | Sky News

• Dell customer order database stolen, for sale on dark web • The Register

• IT Consulting Firm Blames MSP for Data Breach | MSSP Alert

• 10,000 Customers’ Data Exposed in UK Government Breaches - Infosecurity Magazine (infosecurity-magazine.com)

• The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics | WIRED

• Cyber attack: Large volume of data stolen in attack on Scottish health board (scotsman.com)

• Security breach affects 6,000 German military VC meetings (avinteractive.com)

• Security company exposes 1.2M guard and suspect records • The Register

• Children's mental health records published after cyber attack - BBC News

• Georgia education agency's MOVEit data theft impacted 800K • The Register

• Data Brokers: What They Are and How to Safeguard Your Privacy - IT Security Guru

• Zscaler Investigates Hacking Claims After Data Offered for Sale - Security Week

• UK government departments reveal rise in data breaches & lost devices (datacentrenews.uk)

• 'Sophisticated' cyber attacks involving British Colombia government networks found | CBC News

• Cancer patients' sensitive information accessed by "unidentified parties" after being left exposed by screening lab for years (bitdefender.com)

• Over 380K more NYC students had info leaked, bringing total to over 1M (nypost.com)

• Dating apps kiss'n'tell all sorts of sensitive user info • The Register

Organised Crime & Criminal Actors

• Hackers of all kinds are attacking routers across the world | TechRadar

• Cyber crime stats you can't ignore - Help Net Security

• These Dangerous Scammers Don’t Even Bother to Hide Their Crimes | WIRED

• Threat Actors Weaponize Hacktivism for Financial Gain - Infosecurity Magazine (infosecurity-magazine.com)

• Massive webshop fraud ring steals credit cards from 850,000 people (bleepingcomputer.com)

• Scattered Spider group a unique challenge for cyber cops, FBI leader says (therecord.media)

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

• Alexander Vinnik, the operator of BTC-e exchange, pleaded guilty to money laundering (securityaffairs.com)

Insider Risk and Insider Threats

• The Rise And Stealth Of The Socially Engineered Insider (forbes.com)

• Don't Be the Weakest Link – Your Team's Crucial Role in Cyber Security | NAVEX - JDSupra

Supply Chain and Third Parties

• UK Military Data Breach a Reminder of Third-Party Risk (darkreading.com)

• Details of UK military personnel exposed in huge payroll data breach | AP News

• Firm at centre of MoD 'China' hack handles data for several Whitehall departments (inews.co.uk)

• DBIR: Supply Chain Breaches Up 68% Year Over Year (darkreading.com)

• IT Consulting Firm Blames MSP for Data Breach | MSSP Alert

• The complexities of third-party risk management - Help Net Security

Cloud/SaaS

• What is Cloud Security in Banking? | HackerNoon

• Does cloud security have a bad reputation? | InfoWorld

Encryption

• Cop complaints won't stop E2EE, says encryption advocate • The Register

• European Threat To End-To-End Encryption Would Invade Phones (forbes.com)

Linux and Open Source

• Open-Source Cyber Security Is a Ticking Time Bomb (gizmodo.com)

• Spies Among Us: Insider Threats in Open Source Environments (darkreading.com)

• A Guide to Open Source Software Security - The New Stack

Passwords, Credential Stuffing & Brute Force Attacks

• Iranian hackers harvest credentials through advanced social engineering campaigns | CSO Online

• Microsoft introduces Passkeys support for consumer accounts - gHacks Tech News

• Google Announces Passkeys Adopted by Over 400 Million Accounts (thehackernews.com)

• UnitedHealth Attack: Stolen Credentials, No MFA | MSSP Alert

• Hackers can crack average 8-character passwords in under a minute (newsbytesapp.com)

• What is credential stuffing? | Kaspersky official blog

• How secure is the “Password Protection” on your files and drives? - Help Net Security

Social Media

• These Dangerous Scammers Don’t Even Bother to Hide Their Crimes | WIRED

Training, Education and Awareness

• Over 70% of Staff Use AI At Work, But Only 30% of European Organisations Provide AI Training - IT Security Guru

Regulations, Fines and Legislation

• The EU Cyber Diplomacy Toolbox: Shaping Global Cyber Security Standards | UpGuard

• EU plan to force messaging apps to scan for CSAM risks millions of false positives, experts warn | TechCrunch

• The NIS2 Compliance Deadline Is Nearing. Are You Prepared? - Security Boulevard

• Innovation, Not Regulation, Will Protect Corporations From Deepfakes (darkreading.com)

Models, Frameworks and Standards

• The NIS2 Compliance Deadline Is Nearing. Are You Prepared? - Security Boulevard

Data Protection

• Privacy requests increased 246% in two years - Help Net Security

Careers, Working in Cyber and Information Security

• How workforce reductions affect cyber security postures - Help Net Security

• One in Four Tech CISOs Unhappy with Compensation - Security Boulevard

Law Enforcement Action and Take Downs

• Ransomware activity is back on track despite law enforcement efforts - Help Net Security

• Law Enforcement Takedowns Force Ransomware Affiliates to Diversify - Infosecurity Magazine (infosecurity-magazine.com)

• LockBit's seized darknet site resurrected by police, teasing new revelations (therecord.media)

• LockBit leader unmasked and sanctioned - National Crime Agency

• Israeli private investigator wanted for hacking in US is arrested in London | The Independent

• German police bust Europe's 'largest' scam call centre – DW – 05/02/2024

• Consultant charged with $1.5M extortion of IT giant • The Register

• 97% of Organisations Hit by Ransomware Worked with Law Enforcement (globenewswire.com)

• Alexander Vinnik, the operator of BTC-e exchange, pleaded guilty to money laundering (securityaffairs.com)

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• Israeli private investigator wanted for hacking in US is arrested in London | The Independent

• Cyber Attacks on US Utilities: New Trends in Cyber Warfare - ClearanceJobs

• 'The Mask' Espionage Group Resurfaces After 10-Year Hiatus (darkreading.com)

Nation State Actors

China

• Defence secretary Grant Shapps confirms name of contractor running MoD system hacked by China | Politics News | Sky News

• Firm at centre of MoD 'China' hack handles data for several Whitehall departments (inews.co.uk)

• Lessons from LOCKED SHIELDS 2024 cyber exercise | SC Media (scmagazine.com)

• Geopolitical tensions rise with China. (thecyberwire.com)

• China-Linked Hackers Used ROOTROT Webshell in MITRE Network Intrusion (thehackernews.com)

Russia

• Malice from Moscow: NATO warns of Russian hybrid warfare - EU Reporter

• Russia plotting sabotage across Europe, intelligence agencies warn (ft.com)

• How Nato could respond after wave of Russian spy arrests across Europe (inews.co.uk)

• EU, NATO denounce Russia's cyber attacks on Germany, Czechia (kyivindependent.com)

• Russia Cyber Attack Germany's Ruling Party, Defence | Silicon UK

• Foreign Ministry:  Czech institutions targeted by GRU cyber attacks | Radio Prague International

• Microsoft Outlook Flaw Exploited by Russia's APT28 to Hack Czech, German Entities (thehackernews.com)

• Russia-linked APT28 and crooks are still using the Moobot botnet (securityaffairs.com)

• Russia slammed for cyber attacks (emergingrisks.co.uk)

• Ukraine records increase in financially motivated attacks by Russian hackers (therecord.media)

• UK joins partners in condemnation of malicious cyber activity by Russian Intelligence Services: UK government statement - GOV.UK (www.gov.uk)

• Russian cyber attacks on Germany spur intensified cyber recruitment and training   - Freelance Informer

• Cyber War? EU rages over alleged Russian cyber attack on German’s ruling SPD (brusselssignal.eu)

• Lessons from LOCKED SHIELDS 2024 cyber exercise | SC Media (scmagazine.com)

• A (Strange) Interview With the Russian-Military-Linked Hackers Targeting US Water Utilities | WIRED

• Russia says Germany using baseless 'hacker myths' to destroy ties | Reuters

• Highlights of international and Ukrainian cyber security news in April 2024 - National Security and Defence Council of Ukraine (rnbo.gov.ua)

• Poland says it too was targeted by Russian hackers – POLITICO

• Kaspersky denies claims it helped Russia with drones • The Register

Iran

• Iranian hackers pose as journalists to push backdoor malware (bleepingcomputer.com)

• Iranian hackers harvest credentials through advanced social engineering campaigns | CSO Online

North Korea

• NSA, FBI Alert on North Korean Hackers Spoofing Emails from Trusted Sources (thehackernews.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• Far-right websites hacked and defaced  | CyberScoop

• Threat Actors Weaponise Hacktivism for Financial Gain - Infosecurity Magazine (infosecurity-magazine.com)

• Amnesty International Cites Indonesia as a Spyware Hub (darkreading.com)

• New 'Cuckoo' Persistent macOS Spyware Targeting Intel and Arm Macs (thehackernews.com)

• Apple’s iPhone Spyware Problem Is Getting Worse. Here’s What You Should Know | WIRED

---

Vulnerability Management

• Cyber criminals are getting faster at exploiting vulnerabilities - Help Net Security

• Misconfigurations drive 80% of security exposures | Security Magazine

• Cyber Threat Research: Poor Patching Practices and Unencrypted Protocols Continue to Haunt Enterprises - IT Security Guru

• Patch management vs. vulnerability management: Key differences | TechTarget

• How remote work is changing patch management | TechTarget

• What is Risk-Based Vulnerability Management (RBVM)? (techtarget.com)

• CISA’s KEV list improving private and public-sector patching • The Register

• CISA Announces CVE Enrichment Project 'Vulnrichment' - Security Week

---

Vulnerabilities

• Microsoft Outlook Flaw Exploited by Russia's APT28 to Hack Czech, German Entities (thehackernews.com)

• Citrix Addresses High-Severity NetScaler Servers Flaw (darkreading.com)

• Over 50,000 Tinyproxy servers vulnerable to critical RCE flaw (bleepingcomputer.com)

• Veeam fixes RCE flaw in backup management platform (CVE-2024-29212) - Help Net Security

• LiteSpeed Cache WordPress plugin actively exploited in the wild (securityaffairs.com)

• New Spectre-Style 'Pathfinder' Attack Targets Intel CPU, Leak Encryption Keys and Data (thehackernews.com)

• New BIG-IP Next Central Manager bugs allow device takeover (bleepingcomputer.com)

• Microsoft: April Windows Server updates also cause crashes, reboots (bleepingcomputer.com)

• Android bug can leak DNS traffic with VPN kill switch enabled (bleepingcomputer.com)

• Mirai Botnet Exploits Ivanti Connect Secure Flaws for Malicious Payload Delivery (thehackernews.com)

• Apple just fixed an iTunes security flaw for Windows users, but they probably have bigger issues to worry about anyway | iMore

• Citrix warns customers to update PuTTY version installed on their XenCenter system manually (securityaffairs.com)

---

Tools and Controls

• Behind Closed Doors: The Rise of Hidden Malicious Remote Access (cybereason.com)

• Security tools fail to translate risks for executives - Help Net Security

• Misconfigurations drive 80% of security exposures | Security Magazine

• A Guide to Cyber Threat Intelligence (greydynamics.com)

• NSA, FBI Alert on North Korean Hackers Spoofing Emails from Trusted Sources (thehackernews.com)

• Microsoft plans to lock down Windows DNS like never before. Here’s how. | Ars Technica

• Novel attack against virtually all VPN apps neuters their entire purpose | Ars Technica

• Cyber Threat Research: Poor Patching Practices and Unencrypted Protocols Continue to Haunt Enterprises - IT Security Guru

• Strategies for preventing AI misuse in cyber security - Help Net Security

• Shadow APIs: An Overlooked Cyber Risk for Orgs (darkreading.com)

• How to detect deepfakes manually and using AI | TechTarget

• What is social engineering penetration testing? | Definition from TechTarget

• How workforce reductions affect cyber security postures - Help Net Security

• What is biometrics? 10 physical and behavioural identifiers that can be used for authentication | CSO Online

• What is Risk-Based Vulnerability Management (RBVM)? (techtarget.com)

• Top 10 physical security considerations for CISOs | CSO Online

• Three Battle-Tested Tips for Surviving a Cyber Attack - Infosecurity Magazine (infosecurity-magazine.com)

• IT chiefs plan to spend and innovate their way out of ransomware swamp | TechRadar

• A SaaS Security Challenge: Getting Permissions All in One Place  (thehackernews.com)

• Tips for Protecting Active Directory From Ransomware Attacks | ITPro Today: IT News, How-Tos, Trends, Case Studies, Career Tips, More

• Tips for Controlling the Costs of Security Tools - The New Stack

• Rethinking Cyber Security Investment Amid Rising Threats (govinfosecurity.com)

• Microsoft confirms Windows 11 24H2 turns on Device Encryption by default (windowslatest.com)

---

Reports Published in the Last Week

• The State of Ransomware 2024 - Sophos

---

Other News

• Microsoft overhaul treats security as ‘top priority’ after a series of failures - The Verge

• Microsoft will base part of senior exec comp on security, add deputy CISOs to product groups – GeekWire

• The EU Cyber Diplomacy Toolbox: Shaping Global Cyber Security Standards | UpGuard

• Complexity leads to trade-off between risk and innovation (betanews.com)

• When has the UK faced cyber attacks in the past? | The Independent

• Man-in-the-middle attack: The new cyber security threat | YourStory

• Paris 2024 gearing up to face unprecedented cyber security threat | Reuters

• From Warnings to Action: Preparing America’s Infrastructure for Imminent Cyber Threats - Security Week

• 38% of riskiest cyber physical systems neglected, warns Claroty report (securitybrief.co.nz)

• Why undersea cables need high-priority protection • The Register

• GAO: NASA Faces 'Inconsistent' Cyber Security Across Spacecraft (darkreading.com)

• Cyber security regulations: Are non-compliant cars more vulnerable? | Autocar

• Fujitsu sets aside £200m as calls mount for Post Office scandal payout

• eGates across UK airports go down (thelondoneconomic.com)

• FE News | Why the education sector needs to do the homework on cyber security as attacks soar

• Caught with our pants down - The Royal Gazette | Bermuda News, Business, Sports, Events, & Community |

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

---

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

Black Arrow Cyber Threat Briefing 03 May 2024

Welcome to this week’s Black Arrow Cyber Threat Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Top Cyber Stories of the Last Week

Most Attacks Impacting SMB’s Target Older, Unpatched Vulnerabilities

Attackers continue to aggressively target small and mid-size businesses using specific high-profile vulnerabilities dating back a decade or more, network telemetry shows. Findings have shown that this is due to these vulnerabilities featuring in a wide range of products. Due to their prevalence, they can often become missed by organisations conducting patch management and therefore leave the organisation open.

For this reason it is critical that all organisations, including smaller organisations, have internal as well as external vulnerability scanning. You might believe your systems are patched up to date but there is no way to confirm without scanning , or to know which patches might have been missed.

Sources: [Infosecurity Magazine]

91% of Ransomware Victims Paid At least One Ransom in the Past Year, as 1 in 5 Ransomware Attacks Triggers Lawsuit

Ransomware attacks saw a significant surge in 2023, following a dip in 2022. The number of victims increased by 66% from 2022 to 2023, with 91% of those affected paying at least one ransom. 58% of organisations have been targeted six times or more.

The Sophos State of Ransomware 2023 report highlighted ransom payments rose by 500%; nearly two-thirds exceeded $1m or more, with an average payment of $2m. Furthermore, 30% of the demands were for over $5m.

In the US, 18% of incidents led to litigation, with 123 lawsuits filed in 2023 and 355 over five years. Data breaches, affecting 283.3 million records, primarily triggered these lawsuits, especially in healthcare and finance sectors. The resolution rate is 59%, with the highest settlement at $8.7m. Regulatory fines added nearly $10m to the financial impact. These figures underscore the significant financial implications of ransomware attacks and the urgent need for robust cyber security measures.

Sources: [ZD Net] [Infosecurity Magazine] [Security Magazine] [PrNewsWire] [Infosecurity Magazine]

BEC and Fund Transfer Fraud Top Insurance Claims

Cyber Insurer Coalition's 2024 Cyber Claims Report highlights a significant trend in cyber security threats, identifying email-based fraud as the predominant cause of insurance claims in 2023, accounting for 53% of all claims. Business email compromise (BEC) and funds transfer fraud (FTF) topped the list, contributing to 28% of claims and increasing claim amounts by 24% to an average loss exceeding $278,000. In contrast, ransomware, while less frequent at 19% of claims, also saw a rise in both frequency and severity, with average losses climbing to over $263,000. The report also notes a 13% year-on-year surge in overall claims, with substantial losses tied to compromised network security devices and a notable vulnerability in organisations using exposed remote desktop protocols.

Source: [Infosecurity Magazine]

Correlating Cyber Investments with Business Outcomes

The US Securities and Exchange Commission (SEC) has implemented stringent new rules compelling organisations to report significant cyber incidents within four days and to annually disclose details concerning their cyber security risk management, strategy, and governance. These mandates are seen as giving “more teeth to the idea that cyber security is a business problem” and “bringing an element of cyber security to the boardroom” according to cyber security solutions provider SecurityGate. Highlighted in the "Cybersecurity Insights" podcast, experts argue for simplifying cyber security strategies, advocating sustained resource allocation over reactive measures, and emphasising the importance of training over expensive solutions. These steps are deemed crucial for enhancing organisational resilience and security in a landscape where cyber threats are increasingly sophisticated and pervasive.

Source: [InfoRisk Today] 

Verizon: Vulnerability Exploitation up 180%, 68% of Breaches involved Humans and Supply Chain Weak Link

Verizon has released the findings of its 17th Annual Data Breach Investigations Report, which showed security incidents doubled year over year in 2023 to a record high 30,458 security events and 10,626 confirmed breaches. Some of the key takeaways from the 100-page report include zero-day attacks on unpatched systems and devices rising 180% in 2023, most breaches (68%) involving a non-malicious human element and the median time for users to fall for phishing emails falling just south of 60 seconds. In its first inclusion as a separate metric, supply chain attacks were found to contribute to 15% of all attacks.

Sources: [MSSP Alert] [Verizon]

MOVEit & Change Healthcare Attacks Designated as Cyber Catastrophe Loss Events by Insurer

Verisk’s Property Claim Services (PCS) has recently identified the MOVEit and Change Healthcare cyber attacks as significant Cyber Catastrophe Loss Events. These designations are part of PCS’s Global Cyber solution, which tracks cyber incidents and their potential impact on the insurance market. The designation indicates that each attack is anticipated to result in insurance industry losses exceeding USD 250 million.

The MOVEit attack, linked to the Russian-affiliated group Cl0p, compromised over 2,700 organisations globally, affecting up to 90 million individuals. The Change Healthcare attack, attributed to the ALPHV/Blackcat gang, notably disrupted UnitedHealth Group’s operations, with projected costs and lost revenue totalling up to USD 1.6 billion. These designations highlight the escalating scale and financial impact of cyber incidents on global markets.

Source: [Reinsurance News]

Securing Your Organisation’s Supply Chain: Reducing the Risks of Third Parties

Nearly every organisation is part of a supply chain, where a significant amount of data is transferred. When data leaves your infrastructure, its security depends on the third party. The risks of a cyber incident increases as the supply chain increases.

Organisations need to mitigate the risks that their third party brings. This requires an understanding of the supply chain actors, and performing cyber security assessments of the most critical ones. The objective is to ensure that your organisation is satisfied with the third party’s security controls, or to work together to remediate any gaps.

Source: [Help Net Security]

Why Remote Desktop Tools are Facing an Onslaught of Cyber Threats

In the era of hybrid work, remote desktop tools have become crucial yet vulnerable points within corporate networks, attracting significant cyber criminal attention. A study by Barracuda Networks underscores the challenges of securing these tools. Virtual Network Computing (VNC) is particularly susceptible; it is targeted in 98% of these types of attacks due to its use of multiple, sometimes unsecured ports. VNC attacks predominantly exploit weak password practices, notably through brute force methods. Conversely, Remote Desktop Protocol (RDP) accounts for about 1.6% of these attacks but is favoured for more extensive network breaches, often involving ransomware or crypto mining. The study highlights a pressing need for robust endpoint management and heightened security measures to mitigate these threats.

Source: [ITPro]

95% of Organisations Revamped Cyber Security Strategies in the Last Year: Make Sure Yours is Right

A recent report found that 95% of companies have altered their cyber security strategies in the last twelve months. This was driven by keeping pace with the shifting regulatory landscape (98%), the need to meet customer expectations for data protection and privacy (89%), and the rise of AI-driven threats and solutions (65%). Almost half (44%) of non-security executives do not understand the regulatory requirements their organisation must adhere to.

When it came to reporting, the study found that security teams aren’t reporting on key operational metrics that define whether their security investments and strategy changes have a measurable impact. It is evident that there is a disconnect between security and non-security professionals when it comes to the business strategy.

Sources: [Business Wire] [Security Magazine]

Human Factor a Significant Risk for Small and Medium-Sized Businesses.

A survey of business and IT security in small and medium-sized businesses (SMBs) conducted by LastPass found that roughly one in five business leaders admits to circumventing security policies, as do one in 10 IT security leaders. The survey found that password management is critically important to cyber security, with nearly half (47%) reporting recent breaches due to compromised passwords.

Sources: [Beta News] [Business Wire]

Microsoft CEO Says it is Putting Security Above All Else in Major Refocus

Following a series of high-profile attacks in recent months and a report by the US Cyber Safety Review Board (CSRB), Microsoft’s CEO has revealed it will now focus its efforts on an increase in the commitment to security. Investigating a summer 2023 attack, Microsoft was deemed to have made a series of “avoidable errors”, including the failure to detect several compromises, the CSRB said.

Sources: [TechRadar]

Ending the Culture of Silence in Cyber Security; Three Ways to Empower Teams

A recent discussion on workplace errors highlights the significant repercussions of cyber breaches compared to typical office mistakes. In the UK, nearly a third of businesses face cyber attacks weekly, with each breach costing approximately £4,000. However, a concerning trend is that 41% of these breaches are not reported to internal leadership, often due to fears among staff about the consequences of admitting faults. A three-pronged approach has been suggested to foster a blame-free culture: providing tailored and evolving cyber training, establishing safe zones for admitting mistakes, and implementing robust recovery plans. This approach not only prepares employees to handle potential breaches more effectively but also encourages them to report incidents promptly, reducing the overall impact and aiding quicker recovery. Such strategies are essential for maintaining resilience against increasingly sophisticated cyber threats.

Source: [Minute Hack]

Governance, Risk and Compliance

• Verizon 2024 Data Breach Investigations Report: 5 Takeaways | MSSP Alert

• 2024 Data Breach Investigations Report: Half of the breaches in EMEA were internal (globenewswire.com)

• Verizon DBIR: Vulnerability exploitation in breaches up 180% | TechTarget

• Verizon DBIR: Basic Security Gaffes Cause Breach Surge (darkreading.com)

• 95% of Organisations Revamped Their Cyber Security Strategies in the Last Year | Business Wire

• 95% of organisations adjusted cyber security strategies this past year | Security Magazine

• 1 in 5 US Ransomware Attacks Triggers Lawsuit - Infosecurity Magazine (infosecurity-magazine.com)

• Vulnerability Exploits Triple as Initial Access Point for Breaches - Infosecurity Magazine (infosecurity-magazine.com)

• MOVEit & Change Healthcare attacks designated as cyber catastrophe loss events by PCS - Reinsurance News

• Are Enterprises Overconfident About Cyber Security Readiness? (govinfosecurity.com)

• How CISOs Can Contend with Increasing Scrutiny from Regulators (informationweek.com)

• Correlating Cyber Investments with Business Outcomes (inforisktoday.com)

• Ending The Culture of Silence In Cyber Security – 3 Ways To Empower Teams - Minutehack

• 97% of security leaders have increased SaaS security budgets - Help Net Security

• The rise in CISO job dissatisfaction – what’s wrong and how can it be fixed? | CSO Online

• Should Cyber Security Leadership Finally be Professionalized? - SecurityWeek

• What needs to change to overcome nonchalant security approaches | TechRadar

• Agile by Design: Cyber Security at the Heart of Transformation (noeticcyber.com)

---

Threats

Ransomware, Extortion and Destructive Attacks

• Q1 2024 Ransomware Report: 21% Increase in Q1 2023 Ransomware Activity (corvusinsurance.com)

• Ransomware Rising Despite Takedowns, Says Corvus Report - Infosecurity Magazine (infosecurity-magazine.com)

• Impact of organisational structure on ransomware outcomes: Where does your org fit in? | SC Media (scmagazine.com)

• OODA Loop - Social Engineering Remains the Coin of the Realm for Ransomware Gangs (or APTs- Advanced Persistent Threats)

• 91% of ransomware victims paid at least one ransom in the past year, survey finds | ZDNET

• Ransom Payments Surge by 500% to an Average of $2m - Infosecurity Magazine (infosecurity-magazine.com)

• 1 in 5 US Ransomware Attacks Triggers Lawsuit - Infosecurity Magazine (infosecurity-magazine.com)

• There was an 81% year-over-year increase in ransomware attacks | Security Magazine

• Ransomware and extortion incidents surged by 67% in 2023, according to NTT Security Holdings 2024 Global Threat Intelligence Report (prnewswire.com)

• Finnish hacker imprisoned for accessing thousands of psychotherapy records and demanding ransoms | AP News

• LockBit, Black Basta, Play Dominate Ransomware in Q1 2024 - Infosecurity Magazine (infosecurity-magazine.com)

• Understanding Scattered Spider, and how they perform cloud-centric identity attacks | SC Media (scmagazine.com)

• Ransom recovery costs reach $2.73 million - Help Net Security

• Cactus Ransomware Group Targets Qlik Sense Servers | Decipher (duo.com)

• How AI and data protection intersect in today's threat era - SiliconANGLE

• Better hygiene may mitigate the need to ban ransomware payments | Computer Weekly

• Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million (thehackernews.com)

• How Businesses Should Grapple With Ransomware Threats (eetimes.eu)

• Cyber security consultant arrested after allegedly extorting IT firm (bleepingcomputer.com)

Ransomware Victims

• Single Citrix Compromised Credential Results in $22,000,000 Ransom to Change Healthcare | InfoStealers

• Change Healthcare breached via Citrix portal with no MFA | TechTarget

• Almost all US hospitals took financial hit from Change hack, AHA says | Reuters

• Another major pharmacy chain shuts following possible cyber attack | TechRadar

• Hack That Paralyzed US Health Care Turns Up Scrutiny on Insurer (claimsjournal.com)

• Cyber attack to cost Western Isles Council half a million pounds (holyrood.com)

• LockBit publishes confidential data stolen from Cannes hospital in France (therecord.media)

• French hospital CHC-SV refuses to pay LockBit extortion demand (bleepingcomputer.com)

• 'Cybersecurity incident' closes London Drugs' pharmacies • The Register

Phishing & Email Based Attacks

• AI-driven phishing attacks deceive even the most aware users - Help Net Security

• US Post Office phishing sites get as much traffic as the real one (bleepingcomputer.com)

• If you receive a Shein mystery box, do not open it | TechRadar

• Why the automotive sector is a target for email-based cyber attacks - Help Net Security

BEC

• BEC and Fund Transfer Fraud Top Insurance Claims - Infosecurity Magazine (infosecurity-magazine.com)

Other Social Engineering

• OODA Loop - Social Engineering Remains the Coin of the Realm for Ransomware Gangs (or APTs- Advanced Persistent Threats)

• FBI warns of fake verification schemes targeting dating app users (bleepingcomputer.com)

• A Lot of People Are Falling for Those 'Your Package Cannot Be Delivered' Texts | PCMag

Artificial Intelligence

• AI-driven phishing attacks deceive even the most aware users - Help Net Security

• AI is creating a new generation of cyber attacks - Help Net Security

• Combating the Rising Tide of AI-Driven Cyber Crime (cryptopolitan.com)

• Businesses turn to generative AI but many don't have policies on it (betanews.com)

• State of Security 2024 Report Reveals Growing Impact of Generative AI on Cyber Security Landscape | Business Wire

• How AI and data protection intersect in today's threat era - SiliconANGLE

• Understanding emerging AI and data privacy regulations - Help Net Security

• To understand the risks posed by AI, follow the money – O’Reilly (oreilly.com)

• From Risk to Resilience: Managing Data Security in AI-Driven Enterprises | Inc.com

• Security in the AI Sector: Understanding Infostealer Exposures and Corporate Risks - Security Boulevard

• Cyber security experts face AI risks, deepfakes, burnout | Fortune

• US Government Releases New AI Security Guidelines for Critical Infrastructure (thehackernews.com)

• Why Using Microsoft Copilot Could Amplify Existing Data Quality and Privacy Issues - SecurityWeek

• Why the Military Can’t Trust AI | Foreign Affairs

2FA/MFA

• Change Healthcare breached via Citrix portal with no MFA | TechTarget

Malware

• New "Goldoon" Botnet Targets D-Link Routers With Decade-Old Flaw (thehackernews.com)

• New SOHO router malware aims for cloud accounts, internal company resources - Help Net Security

• Guarding the Gates: The Growing Abundance of Linux Malware - VMRay

• Bogus npm Packages Used to Trick Software Developers into Installing Malware (thehackernews.com)

• Stealthy malware: The threats hiding in plain sight | ITPro

• Millions of Malicious 'Imageless' Containers Planted on Docker Hub Over 5 Years (thehackernews.com)

• ZLoader Malware Evolves with Anti-Analysis Trick from Zeus Banking Trojan (thehackernews.com)

• New Cuttlefish malware infects routers to monitor traffic for credentials (bleepingcomputer.com)

Mobile

• Powerful 'Brokewell' Android Trojan Allows Attackers to Takeover Devices - SecurityWeek

• Google Prevented 2.28 Million Malicious Apps from Reaching Play Store in 2023 (thehackernews.com)

• New Wpeeper Android malware hides behind hacked WordPress sites (bleepingcomputer.com)

• NCSC’s New Mobile Risk Model Aimed at “High-Threat” Firms - Infosecurity Magazine (infosecurity-magazine.com)

• Android Flaw Affected Apps With 4 Billion Installs - Infosecurity Magazine (infosecurity-magazine.com)

• Microsoft warns of "Dirty Stream" attack impacting Android apps (bleepingcomputer.com)

Denial of Service/DoS/DDOS

• Hackers Target New NATO Member Sweden with Surge of DDoS Attacks - Infosecurity Magazine (infosecurity-magazine.com)

Internet of Things – IoT

• NCSC: New UK law bans default passwords on smart devices (securityaffairs.com)

• DJI Could Get Banned In The U.S. As Authorities Believe That The Chinese Firm And Its Drones Present A Major Security Risk (wccftech.com)

• A glaring Android TV security flaw might put your Gmail at risk | Android Central

Data Breaches/Leaks

• PSNI data breach: Almost 5,000 officers and staff in legal action - BBC News

• 2024 Data Breach Investigations Report: Half of the breaches in EMEA were internal (globenewswire.com)

• Marriott admits it falsely claimed for five years it was using encryption during 2018 breach | CSO Online

• Kaiser Permanente data breach may have impacted 13.4 million patients (securityaffairs.com)

• Social exclusion charity Extern “urgently reviewing” impact of data breach following ransomware attack – The Irish News

• FBCS data breach impacted 2M individuals (securityaffairs.com)

• States shares health debt data of 5,000 in an email | Guernsey Press

• Qantas app exposed sensitive traveller details to random users (bleepingcomputer.com)

• DropBox says hackers stole customer data, auth secrets from eSignature service (bleepingcomputer.com)

• Mitre Shares Lessons Learned from Breach | MSSP Alert

• Hull City Council pays £30K in data breach claims and suffers nine cyber attacks in three years - Hull Live (hulldailymail.co.uk)

• Philadelphia Inquirer: Data of over 25,000 people stolen in 2023 breach (bleepingcomputer.com)

• Australian pubgoers' personal info posted to leak site • The Register

• Monash Health data breach exposes sexual assault and family violence claims (smh.com.au)

• Panda Restaurant Group disclosed a data breach (securityaffairs.com)

Organised Crime & Criminal Actors

• AI is creating a new generation of cyber attacks - Help Net Security

• Combating the Rising Tide of AI-Driven Cyber Crime (cryptopolitan.com)

• INTERPOL Identifies 20,674 Suspicious Networks Linked To Terrorists, Warns of Rising Cyber Crimes | Greenbarge Reporters (greenbreporters.com)

• Understanding Scattered Spider, and how they perform cloud-centric identity attacks | SC Media (scmagazine.com)

• Router Roulette: Cyber Criminals and Nation-States Sharing Compromised Networks | Trend Micro (US)

Insider Risk and Insider Threats

• 2024 Data Breach Investigations Report: Half of the breaches in EMEA were internal (globenewswire.com)

• 2024 Data Breach Investigations Report: Most breaches involve a non-malicious human element - Help Net Security

• Survey: Human Factors Create Significant Cyber Security Risks for Small and Medium-Sized Businesses, Despite Increased Technology Investment | Business Wire

• How insider threats can cause serious security breaches - Help Net Security

• Ex-NSA Employee Sentenced to 22 Years for Trying to Sell U.S. Secrets to Russia (thehackernews.com)

Insurance

• MOVEit & Change Healthcare attacks designated as cyber catastrophe loss events by PCS - Reinsurance News

• Cyber facility in capacity raise as risk severity grows (emergingrisks.co.uk)

• Hack That Paralyzed US Health Care Turns Up Scrutiny on Insurer (claimsjournal.com)

• Alarming Insurance Gaps and Soaring Breach Rates Call for a United Front in Cyber Security | HaystackID - JDSupra

Supply Chain and Third Parties

• UK and global cyber threats require robust supply chain risk management - Osborne Clarke | Osborne Clarke

• Securing your organisation's supply chain: Reducing the risks of third parties - Help Net Security

Cloud/SaaS

• Understanding Scattered Spider, and how they perform cloud-centric identity attacks | SC Media (scmagazine.com)

• New SOHO router malware aims for cloud accounts, internal company resources - Help Net Security

• 97% of security leaders have increased SaaS security budgets - Help Net Security

Encryption

• UK's Investigatory Powers Bill approved to become law • The Register

• Marriott admits it falsely claimed for five years it was using encryption during 2018 breach | CSO Online

• Ten years of Heartbleed: Lessons learned | SC Media (scmagazine.com)

• White Swan, Black Swan and QuantumBleed (forbes.com)

Linux and Open Source

• Guarding the Gates: The Growing Abundance of Linux Malware - VMRay

Passwords, Credential Stuffing & Brute Force Attacks

• Single Citrix Compromised Credential Results in $22,000,000 Ransom to Change Healthcare | InfoStealers

• Change Healthcare breached via Citrix portal with no MFA | TechTarget

• Okta warns of "unprecedented" credential stuffing attacks on customers (bleepingcomputer.com)

• NCSC: New UK law bans default passwords on smart devices (securityaffairs.com)

• Nvidia's flagship gaming GPU can crack complex passwords in under an hour | Tom's Hardware (tomshardware.com)

• New Cuttlefish malware infects routers to monitor traffic for credentials (bleepingcomputer.com)

• Five Ways to Dramatically Reduce the Risk of Password Compromise - Infosecurity Magazine (infosecurity-magazine.com)

• Google Online Security Blog: Your Google Account allows you to create passkeys on your phone, computer and security keys (googleblog.com)

• How to use a YubiKey to log into Windows and macOS (xda-developers.com)

Social Media

• How TikTok Grew From a Fun App for Teens Into a Potential National Security Threat - SecurityWeek

• Disinformation: EU Opens Probe Against Meta Ahead of Election - Infosecurity Magazine (infosecurity-magazine.com)

• Facebook at 20: Contemplating the Cost of Privacy (darkreading.com)

Training, Education and Awareness

• Ending The Culture Of Silence In Cyber Security – 3 Ways To Empower Teams - Minutehack

• Everyone's an Expert: How to Empower Your Employees for Cyber Security Success (thehackernews.com)

Regulations, Fines and Legislation

• UK's Investigatory Powers Bill approved to become law • The Register

• UK rolls out new consumer safeguards for smart devices (betanews.com)

• UK and global cyber threats require robust supply chain risk management - Osborne Clarke | Osborne Clarke

• FCC fines major wireless carriers over illegal location data sharing - Help Net Security

• Understanding emerging AI and data privacy regulations - Help Net Security

• CISA's incident reporting requirements go too far, trade groups and lawmakers say | CyberScoop

Data Protection

• How AI and data protection intersect in today's threat era - SiliconANGLE

Careers, Working in Cyber and Information Security

• Cyber security experts face AI risks, deepfakes, burnout | Fortune

• The rise in CISO job dissatisfaction – what’s wrong and how can it be fixed? | CSO Online

• Agencies to turn toward ‘skill-based hiring’ for cyber and tech jobs, ONCD says | CyberScoop

• Cyber Security Degrees, Are They Really Worth It? | HackerNoon

• Beyond the Buzz: Rethinking Alcohol as a Cyber Security Bonding Ritual - SecurityWeek

Law Enforcement Action and Take Downs

• INTERPOL Identifies 20,674 Suspicious Networks Linked To Terrorists, Warns of Rising Cyber Crimes | Greenbarge Reporters (greenbreporters.com)

• Finnish hacker imprisoned for accessing thousands of psychotherapy records and demanding ransoms | AP News

• Ukrainian REvil Hacker Sentenced to 13 Years and Ordered to Pay $16 Million (thehackernews.com)

• Police shuts down 12 fraud call centres, arrests 21 suspects (bleepingcomputer.com)

• Cyber security consultant arrested after allegedly extorting IT firm (bleepingcomputer.com)

• CEO who sold fake Cisco devices to US military gets 6 years in prison (bleepingcomputer.com)

Misinformation, Disinformation and Propaganda

• Disinformation: EU Opens Probe Against Meta Ahead of Election - Infosecurity Magazine (infosecurity-magazine.com)

• ‘Honeypots’ and influence operations: China’s spies turn to Europe (ft.com)

• Think tank: Tech companies spread China's propaganda • The Register

• Two hackers in Ukraine accused of spreading Russian propaganda (therecord.media)

• Why China Is So Bad at Disinformation | WIRED

---

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

• 'DuneQuixote' Shows Stealth Cyber Attack Methods Are Evolving (darkreading.com)

Nation State Actors

China

• ‘Honeypots’ and influence operations: China’s spies turn to Europe (ft.com)

• Philippines Pummelled by Cyber Attacks & Misinformation Tied to China (darkreading.com)

• Germany grapples with wave of spying threats from Russia and China - BBC News

• How TikTok Grew From a Fun App for Teens Into a Potential National Security Threat - SecurityWeek

• Think tank: Tech companies spread China's propaganda • The Register

• China's attacks on critical infrastructure ‘tip of the iceberg' | SC Media (scmagazine.com)

• DJI Could Get Banned In The U.S. As Authorities Believe That The Chinese Firm And Its Drones Present A Major Security Risk (wccftech.com)

• Chinese Hackers Have Been Probing DNS Networks Globally for Years: Report - SecurityWeek

• Muddling Meerkat hackers manipulate DNS using China’s Great Firewall (bleepingcomputer.com)

• Why China Is So Bad at Disinformation | WIRED

• Chinese government website security has big problems • The Register

• Espionage breaches account for 25% in APAC, report reveals (securitybrief.co.nz)

Russia

• Router Roulette: Cyber Criminals and Nation-States Sharing Compromised Networks | Trend Micro (US)

• Russian Hackers Target Industrial Systems in North America, Europe - SecurityWeek

• Pro-Russia hacktivists attacking vital tech in water and other sectors, agencies say | CyberScoop

• Critical infrastructure operators urged to harden systems against pro-Russia hackers (therecord.media)

• Ukraine's military intelligence launches cyber attack against United Russia party (kyivindependent.com)

• Germany grapples with wave of spying threats from Russia and China - BBC News

• Ukraine Targeted in Cyber Attack Exploiting 7-Year-Old Microsoft Office Flaw (thehackernews.com)

• The Dangerous Rise of GPS Attacks | WIRED

• Russia’s Pawprints on Aircraft Jamming Outbreak - CEPA

• Germany Warns Of Consequences For Alleged Russian Cyber Attack (rferl.org)

• Hackers Claim to Have Infiltrated Belarus’ Main Security Service - SecurityWeek

• Military Tank Manual, 2017 Zero-Day Anchor Latest Ukraine Cyber Attack (darkreading.com)

• Sweden prepares for Eurovision amidst fears of protests, cyber attacks and unrest | Euronews

• Ex-NSA Employee Sentenced to 22 Years for Trying to Sell U.S. Secrets to Russia (thehackernews.com)

• Two British men charged with helping Russian intelligence - BBC News

• Two hackers in Ukraine accused of spreading Russian propaganda (therecord.media)

Iran

• Israel winning cyber war against Iran, says former officer of elite IDF intelligence unit | All Israel News

North Korea

• DPRK's Kimsuky APT Abuses Weak DMARC Policies, Feds Warn (darkreading.com)

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

• INTERPOL Identifies 20,674 Suspicious Networks Linked To Terrorists, Warns of Rising Cyber Crimes | Greenbarge Reporters (greenbreporters.com)

• Sweden prepares for Eurovision amidst fears of protests, cyber attacks and unrest | Euronews

---

Vulnerability Management

• When is One Vulnerability Scanner Not Enough? (thehackernews.com)

• Vulnerability exploitation nearly tripled in 2023 (telecoms.com)

Vulnerabilities

• Cisco devices again targeted by state-linked threat campaign - TechCentral.ie

• Okta warns of "unprecedented" credential stuffing attacks on customers (bleepingcomputer.com)

• 1,200+ Vulnerabilities Detected In Microsoft Products In 2023 (gbhackers.com)

• Most attacks affecting SMBs target five older vulnerabilities | CSO Online

• Severe Flaws Disclosed in Brocade SANnav SAN Management Software (thehackernews.com)

• UnitedHealth hackers took advantage of Citrix vulnerability to break in, CEO says (yahoo.com)

• Palo Alto Updates Remediation for Max-Critical Firewall Bug (darkreading.com)

• Palo Alto firewalls: CVE-2024-3400 exploitation and PoCs for persistence after resets/upgrades - Help Net Security

• WordPress plugin vulnerability poses severe security risk, allows for site takeovers | TechSpot

• Ukraine Targeted in Cyber Attack Exploiting 7-Year-Old Microsoft Office Flaw (thehackernews.com)

• New R Programming Vulnerability Exposes Projects to Supply Chain Attacks (thehackernews.com)

• Grafana Tool Vulnerability Let Attackers Inject SQL Queries (gbhackers.com)

• Microsoft says April Windows updates break VPN connections (bleepingcomputer.com)

• NTLM auth traffic spikes after Windows Server patch • The Register

• New "Goldoon" Botnet Targets D-Link Routers With Decade-Old Flaw (thehackernews.com)

• Four Critical Vulnerabilities Expose HPE Aruba Devices to RCE Attacks (thehackernews.com)

• Ten years of Heartbleed: Lessons learned | SC Media (scmagazine.com)

• 1,400 GitLab Servers Impacted by Exploited Vulnerability - SecurityWeek

---

Tools and Controls

• Why remote desktop tools are facing an onslaught of cyber threats | ITPro

• Correlating Cyber Investments With Business Outcomes (inforisktoday.com)

• When is One Vulnerability Scanner Not Enough? (thehackernews.com)

• Microsoft CEO says it is "putting security above all else" in major refocus | TechRadar

• Can automating security relieve CISO pressure? (techinformed.com)

• 10 Critical Endpoint Security Tips You Should Know (thehackernews.com)

• 7 antivirus myths that are dead wrong | PCWorld

• Businesses turn to generative AI but many don't have policies on it (betanews.com)

• EDR vs. EPP: What's the difference? | TechTarget

• Cobalt's 2024 State of Pentesting Report Reveals Cyber Security Industry Seeks Partners and Solutions as Staffing Shortages and New AI Threats Collide (prweb.com)

• Ending The Culture Of Silence In Cyber Security – 3 Ways To Empower Teams - Minutehack

• Organisations Struggle with Zero Trust: Gartner | MSSP Alert

• Tech Tip: Why Haven't You Set Up DMARC Yet? (darkreading.com)

• Three-Quarters of CISOs Admit App Security Incidents - Infosecurity Magazine (infosecurity-magazine.com)

• 97% of security leaders have increased SaaS security budgets - Help Net Security

• Communication gaps between IT departments and senior corporate leadership worsening application security risks - Tech Monitor

• Continuous threat exposure management (CTEM): What it is and how to achieve it | SC Media (scmagazine.com)

• DPRK's Kimsuky APT Abuses Weak DMARC Policies, Feds Warn (darkreading.com)

• Fortifying Cyber Defence With the Power of Linux Intrusion Detection and Prevention Systems | Linux Journal

• How to Red Team GenAI: Challenges, Best Practices, and Learnings (darkreading.com)

• What is API Security? - Security Boulevard

• Chinese Hackers Have Been Probing DNS Networks Globally for Years: Report - SecurityWeek

• Muddling Meerkat hackers manipulate DNS using China’s Great Firewall (bleepingcomputer.com)

• Why LLMs are predicting the future of compliance and risk management | VentureBeat

• Navigating the Threat Landscape: Understanding Exposure Management, Pentesting, Red Teaming and RBVM (thehackernews.com)

---

Reports Published in the Last Week

• Q1 2024 Ransomware Report: 21% Increase in Q1 2023 Ransomware Activity (corvusinsurance.com)

• Global Threat Intelligence Report 2024 by NTT Security Holdings

• 2024 Data Breach Investigations Report | Verizon

• The State of Security 2024 | Splunk

• Cobalt's 2024 State of Pentesting Report Reveals Cyber Security Industry Seeks Partners and Solutions as Staffing Shortages and New AI Threats Collide (prweb.com)

---

Other News

• Microsoft CEO says it is "putting security above all else" in major refocus | TechRadar

• 3 Key Business Areas Cyber Security Falls Short | Inc.com

• 7 antivirus myths that are dead wrong | PCWorld

• A Season Of Health Breaches, A Season Of Changes (forbes.com)

• Bank of England tells payment firms to step up disruption mitigation plans (yahoo.com)

• Three-Quarters of CISOs Admit App Security Incidents - Infosecurity Magazine (infosecurity-magazine.com)

• NCSC updates warning over hacktivist threat to CNI | Computer Weekly

• Cyber Space: EU and partners discuss ways to strengthen cooperation in promoting international security and stability | EEAS (europa.eu)

• The EU's Strategy for a Cyber Secure Digital Single Market | UpGuard

• Cyber attack at Irish telecoms firm? – The Irish Times

• To Damage OT Systems, Hackers Tap USBs, Old Bugs & Malware (darkreading.com)

• During National Small Business Week, Take Steps to Secure Your Business | CISA

• At Microsoft, years of security debt come crashing down | Cybersecurity Dive

• National Small Business Week: IRS warns entrepreneurs to take precautions on data security; protect their businesses, employees, customers | Internal Revenue Service

• Zelenskyy fires security service chief accused of "weaponized draft" against journalist - Euromaidan Press

• Sweden prepares for Eurovision amidst fears of protests, cyber attacks and unrest | Euronews

• The ultimate cyber spring-cleaning checklist (avast.com)

• European New Space Companies Prepare to Counter Growing Security Threat - Via Satellite (satellitetoday.com)

---

Sector Specific

Industry specific threat intelligence reports are available.

Contact us to receive tailored reports specific to the industry/sector and geographies you operate in.

·         Automotive

·         Construction

·         Critical National Infrastructure (CNI)

·         Defence & Space

·         Education & Academia

·         Energy & Utilities

·         Estate Agencies

·         Financial Services

·         FinTech

·         Food & Agriculture

·         Gaming & Gambling

·         Government & Public Sector (including Law Enforcement)

·         Health/Medical/Pharma

·         Hotels & Hospitality

·         Insurance

·         Legal

·         Manufacturing

·         Maritime

·         Oil, Gas & Mining

·         OT, ICS, IIoT, SCADA & Cyber-Physical Systems

·         Retail & eCommerce

·         Small and Medium Sized Businesses (SMBs)

·         Startups

·         Telecoms

·         Third Sector & Charities

·         Transport & Aviation

·         Web3

As usual, contact us to help assess where your risks lie and to ensure you are doing all you can do to keep you and your business secure.

Look out for our ‘Cyber Tip Tuesday’ video blog and on our YouTube channel.

You can also follow us on Facebook, Twitter and LinkedIn.

Links to articles are for interest and awareness and linking to or reposting external content does not endorse any service or product, likewise we are not responsible for the security of external links.

It’s World Password Day today; if you are protecting your systems access using a password, then you need to know this

Passwords are one of the basic ways that we confirm our identity when we access systems on our company network, or our own person email account for example. Although many organisations have a policy that requires users to create passwords of a certain length and complexity, the challenge is that the user can fulfil those criteria even if they create a weak password that can be easily guessed or cracked by an attacker. This is yet another intersection of technology and human behaviours that can make or break cyber security.

Did you know that attackers exchange lists of passwords from previous attacks, which they use at high speed in combination with a user’s email address for example, to try to break into a system?

If you are told that you need to create a password that uses upper and lower case letters, with numbers and special characters, the chances are you will use a word that starts with a capital letter, then add a number and use an exclamation point or similar at the end. The attackers know this, and they have millions of examples of them in their password listing. Equally, passwords like querty12345 are, sadly, still frequently used.

The trick is for us all to avoid using ‘weak’ passwords that are likely to feature on the password listing, which means we need to avoid falling into predictable human behaviour patterns. Equally, users need to avoid obvious passwords, like the name of their town or their pet dog, which can be guessed or cracked by a dedicated attacker.

As a solution consider using a passphrase such as “BananaHippoCyclist” and if you want it even more complex, trying adding a few numbers and special characters. And make sure every access you have uses a different password. We all live in the real world, and it can be hard to manage multiple passwords, so you could consider a password manager application to store your passwords, providing you use a very strong master password to access it.

Even strong passwords need extra security, which is why they should be used in conjunction with other multi-factor authentication methods such as facial recognition or biometrics (something you are) or verification codes received on your mobile phone (something you have). Utilising multiple methods of authentication makes it significantly harder for attackers to compromise your accounts.

If you are wondering how to implement this in your organisation, then reach out to us for a free 30-minute consultation to discuss your specific needs and proportionate options. We love discussing this and other aspects of cyber security, so contact us through our website page www.blackarrowcyber.com/contact, and we will get back to you shortly.

In the meantime, Happy World Password Day!

Black Arrow Cyber Insight 30 April 2024 – UK’s New IoT Legislation Aiming to Protect Consumers From Cyber Attacks Comes in to Force

Executive summary

The UK Government has released new legislation to protect consumers from cyber criminals. 

The regime comprises of two pieces of legislation: 

• Part 1 of the Product Security and Telecommunications Infrastructure (PSTI) Act 2022; and 

• The Product Security and Telecommunications Infrastructure (Security Requirements for Relevant Connectable Products) Regulations 2023.

Now that this new legislation is in force, the UK’s consumer connectable product security regime will be enforced, aiming to protect consumers against hacking and cyber attacks. This regulation sets out the minimum-security standards that all IoT (Internet of Things) devices are now legally obliged to meet.

What are the security requirements?

The regulations set out specific requirements that the relevant people, manufacturer, importer and distributor of the products have to follow:

1.      Passwords must be unique per the product. This includes banning common and easily guessable passwords for example admin or 12345 to prevent vulnerabilities and hacking.

2.      The manufacturer must provide clear and transparent information on how to report security issues about their product.  Manufacturers are also obligated to provide information on timescales of acknowledging, reporting and updating the status of security issues to the consumer until they have been resolved.

3.      The manufacturers and retailers must publish to consumers in a clear and accessible way, the minimum time they can expect to receive important security updates. This information should be available without prior request in English and free of charge.

While these security requirements demonstrate the seriousness in which the Government regards cyber security, they should not be relied upon alone and organisations ensure they are employing their own controls such as changing default passwords, performing vulnerability scanning and conducting timely patch management. Effective cyber security requires multiple layers of defence

The official UK Government legislation can be found below:

Need help understanding your gaps, or just want some advice? Get in touch with us.

#threatadvisory #threatintelligence #cybersecurity