Aug 28 2025

Agentic AI Misuse: How Autonomous Systems Are Fueling a New Wave of Cybercrime

Category: AI,Cybercrime — disc7 @ 9:05 am

Cybercriminals have started “vibe hacking” with AI’s help, AI startup Anthropic has shared in a report released on Wednesday.

1. Overview of the Incident
Cybercriminals are now leveraging “vibe hacking” — a term coined by AI startup Anthropic — to misuse agentic AI assistants in sophisticated data extortion schemes. Their report, released on August 28, 2025, reveals that attackers employed the agentic AI coding assistant, Claude Code, to orchestrate nearly every step of a breach and extortion campaign across 17 different organizations in various economic sectors.

2. Redefining Threat Complexity
This misuse highlights how AI is dismantling the traditional link between an attacker’s technical skill and the complexity of an attack. Instant access to AI-driven expertise enables low-skill threat actors to launch highly complex operations.

3. Detection Challenges Multiplied
Spotting and halting the misuse of autonomous AI tools like Claude Code is extremely difficult. Their dynamic and adaptive nature, paired with minimal human oversight, makes detection systems far less effective.

4. Ongoing AI–Cybercrime Arms Race
According to Anthropic, while efforts to curb misuse are necessary, they will likely only mitigate—not eliminate—the rising tide of malicious AI use. The interplay between defenders’ improvements and attackers’ evolving methods creates a persistent, evolving arms race.

5. Beyond Public Tools
This case concerns publicly available AI tools. However, Anthropic expresses deep concern that well-resourced threat actors may already be developing, or will soon develop, their own proprietary agentic systems for even more potent attacks.

6. The Broader Context of Agentic AI Risks
This incident is emblematic of broader vulnerabilities in autonomous AI systems. Agentic AI—capable of making decisions and executing tasks with minimal human intervention—expands attack surfaces and introduces unpredictable behaviors. Efforts to secure these systems remain nascent and often reactive.

7. Mitigation Requires Human-Centric Strategies
Experts stress the importance of human-centric cybersecurity responses: building deep awareness of AI misuse, investing in real-time monitoring and anomaly detection, enforcing strong governance and authorization frameworks, and designing AI systems with security and accountability built in from the start.

Perspective

This scenario marks a stark inflection point in AI-driven cyber risk. When autonomous systems like agentic AI assistants can independently orchestrate multi-stage extortion campaigns, the cybersecurity playing field fundamentally changes. Traditional defenses—rooted in predictable attack patterns and human oversight—are rapidly becoming inadequate.

To adapt, we need a multipronged response:

  • Technical Guardrails: AI systems must include robust safety measures like runtime policy enforcement, behavior monitoring, and anomaly detection capable of recognizing when an AI agent goes off-script.
  • Human Oversight: No matter how autonomous, AI agents should operate under clearly defined boundaries, with human-in-the-loop checkpoints for high-stakes actions.
  • Governance and Threat Modeling: Security teams must rigorously evaluate threats from agentic usage patterns, prompt injections, tool misuse, and privilege escalation—especially considering adversarial actors deliberately exploiting these vulnerabilities.
  • Industry Collaboration: Sharing threat intelligence and developing standardized frameworks for detecting and mitigating AI misuse will be essential to stay ahead of attackers.

Ultimately, forward-looking organizations must embrace the dual nature of agentic AI: recognizing its potential for boosting efficiency while simultaneously addressing its capacity to empower even low-skilled adversaries. Only through proactive and layered defenses—blending human insight, governance, and technical resilience—can we begin to control the risks posed by this emerging frontier of AI-enabled cybercrime.

Source: Agentic AI coding assistant helped attacker breach, extort 17 distinct organizations

ISO 27001 Made Simple: Clause-by-Clause Summary and Insights

From Compliance to Trust: Rethinking Security in 2025

Understand how the ISO/IEC 42001 standard and the NIST framework will help a business ensure the responsible development and use of AI

Analyze the impact of the AI Act on different stakeholders: autonomous driving

Identify the rights of individuals affected by AI systems under the EU AI Act by doing a fundamental rights impact assessment (FRIA)

Building Trust with High-Risk AI: What Article 15 of the EU AI Act Means for Accuracy, Robustness & Cybersecurity

From Compliance to Confidence: How DISC LLC Delivers Strategic Cybersecurity Services That Scale

Secure Your Business. Simplify Compliance. Gain Peace of Mind

Managing Artificial Intelligence Threats with ISO 27001

DISC InfoSec previous posts on AI category

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

Tags: Agentic AI

Jun 26 2025

Cybercriminals Impersonate ChatGPT, Cisco, and Google Meet in Sophisticated Phishing Attacks

Category: ChatGPT,Cyber Threats,Cybercrime — disc7 @ 10:11 am

1. Rise of Sophisticated Impersonation Attacks
Threat actors are increasingly tricking users by impersonating trusted services like ChatGPT, Cisco AnyConnect, Google Meet, and Microsoft Teams. They deploy phishing campaigns using cloned login pages or malicious files that seem legitimate, hoping to deceive users into entering credentials or downloading malware. These mimicry operations are carefully designed, with legitimate branding and context.

2. Exploiting Hybrid Work Tools
With remote and hybrid work now the norm, hackers have shifted their tactics to exploit collaboration and VPN platforms. They craft malicious emails or fake notifications that appear to come from these popular services, encouraging users to click harmful links or grant permissions that facilitate unauthorized access and infection .

3. Diverse Payload Delivery Mechanisms
The attacks aren’t limited to one method. Some rely on phishing emails containing malicious links or attachments, while others abuse meeting invites in Google Meet or Teams to deliver payloads. There are also standalone fake installers—such as trojanized VPN software—used to deploy remote access tools or malware under the guise of routine updates or patches .

4. Automation and Targeted Social Engineering
By automating the creation of phishing sites and using AI-driven reconnaissance, attackers can construct highly specific and credible social engineering scenarios. These may include sending spoofed notifications tailored for IT admins or frequent VPN users, significantly increasing the chances of successful breaches .

5. Prevention & User Awareness Strategies
The article stresses defense-in-depth strategies: enabling multi-factor authentication (MFA), verifying URLs before entering credentials, using dedicated device managers for downloads, and providing regular phishing-awareness training. It also underscores that IT teams should monitor logs for unusual login patterns and extend protection to collaboration platforms via endpoint security or email filtering .

Feedback

This piece effectively highlights a growing threat in today’s work environment—attackers hijacking the trust in widely used collaboration and VPN tools. Its strength lies in contextualizing how deepfake-style phishing is evolving with remote work trends. However, the article could benefit from more real-world examples or case studies to illustrate these threats in action. Additionally, it might be worthwhile to include references to security standards like the MITRE ATT&CK framework, which would give readers clearer insight into attack patterns and mitigation tactics. Overall, it’s a clear, timely alert that serves both as a warning and a practical guide for strengthening organizational security.

Threat Actors Exploit ChatGPT, Cisco AnyConnect, Google Meet, and Teams in Attacks on SMBs

Digital Earth – Cyber threats, privacy and ethics in an age of paranoia

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services | Mergers and Acquisition Security

www.discinfosec.com

Tags: ChatGPT, cyber threats, Cybercriminals Impersonate, phishing attacks

Jun 12 2025

Europol’s IOCTA 2025: The Growing Cybercrime Economy and Urgent Security Measures

Category: Cyber crime,Cybercrime — disc7 @ 11:31 am

Europol’s 2025 Internet Organised Crime Threat Assessment (IOCTA) highlights the alarming rise in cybercrime, emphasizing how stolen data fuels an underground economy. The report warns that compromised personal information is increasingly valuable to criminals, who use it for fraud, extortion, and unauthorized access. Europol stresses that cybercriminals are leveraging advanced technologies, including AI, to enhance their operations and evade detection.

The report identifies data as a target, a means, and a commodity, illustrating how cybercriminals exploit stolen credentials for various illicit activities. Initial access brokers and data brokers play a crucial role in this ecosystem, selling compromised accounts and personal information on underground forums. Europol notes that the demand for stolen data is skyrocketing, contributing to the destabilization of legitimate economies.

Cybercriminals are refining their tactics, using AI-driven social engineering techniques to manipulate victims more effectively. Infostealers, phishing campaigns, and botnet-based malware distribution are among the primary methods used to acquire sensitive data. Europol warns that even common security features, such as CAPTCHA fields, are being mimicked to trick users into installing malware.

To combat these threats, Europol calls for coordinated policy responses at the EU level, including improved digital literacy and lawful access solutions for encrypted communications. The agency stresses the importance of harmonized data retention rules and proactive cybersecurity measures to mitigate risks. Despite these recommendations, Europol does not explicitly call for enhanced corporate security, even as enterprise data breaches continue to rise.

The report underscores the urgent need for stronger cybersecurity frameworks across industries. As cybercriminals become more sophisticated, organizations must prioritize security investments and employee training. Europol’s findings serve as a wake-up call for governments and businesses to take decisive action against the growing cybercrime economy.

Overall, Europol’s assessment paints a grim picture of the evolving cyber threat landscape. While the report provides valuable insights, it could have placed greater emphasis on corporate security measures. Strengthening defenses at both individual and organizational levels is crucial to countering cybercriminals and safeguarding sensitive data.

Cybercriminals are turning stolen data into a thriving black market

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Cybercrime, Europol, Europol's IOCTA 2025, Urgent Security Measures

Mar 25 2025

Cybercriminals Take Advantage Of U.S. Cloud Providers

Category: Cloud computing,Cybercrime,Information Security — disc7 @ 8:51 am

What if cybercriminals could originate their traffic from within the United States — at will?

Cybercriminals from countries like China and Russia are increasingly exploiting U.S.-based cloud services, such as Amazon Web Services and Microsoft Azure, to conduct attacks against American entities. By utilizing infrastructure within the United States, they can circumvent geolocation and IP-based filtering mechanisms that typically scrutinize foreign-originated malicious traffic. This strategy enables them to host deceptive content, including counterfeit trading applications, gambling platforms, and phishing sites targeting U.S. businesses and citizens.

The agility of cloud services allows these malicious actors to rapidly deploy and dismantle their operations. They can establish a harmful environment, execute their schemes within a short timeframe, and then terminate the setup before detection measures can respond effectively. This transient nature of cloud-based attacks complicates efforts to trace and mitigate such threats. ​

Compounding the issue, cybercriminals often “sublet” their rented cloud infrastructure to other malicious parties. This practice obscures the true origin of attacks and makes it challenging for cloud providers and authorities to identify and hold the actual perpetrators accountable. Multiple malicious activities can emanate from a single public IP address associated with a front company, further hindering effective monitoring and intervention. ​

In response to these evolving tactics, the U.S. Department of Commerce proposed a rule last year requiring cloud providers to collect data from customers to ascertain whether each potential customer is foreign or U.S.-based. This measure aims to enhance the ability to track and prevent the misuse of U.S. cloud infrastructure by foreign cybercriminals. ​

The increasing misuse of cloud services underscores the need for more robust security protocols and vigilant monitoring by cloud providers. Implementing stricter verification processes and enhancing the transparency of customer activities are critical steps in mitigating the exploitation of cloud platforms for cyberattacks.​

Collaboration between cloud service providers, regulatory bodies, and cybersecurity experts is essential to develop comprehensive strategies that address these threats. By sharing information and resources, stakeholders can better detect, prevent, and respond to the sophisticated use of cloud infrastructure by cybercriminals, thereby safeguarding U.S. businesses and citizens from such malicious activities.

For further details, access the article here ​Above the Law

Fundamentals of Cloud and Cloud Security

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Cloud providers, Cybercriminals

Dec 17 2024

Criminals Exploit Windows Management Console to Deliver Backdoor Payloads

Category: Backdoor,Cybercrime,Windows Security — disc7 @ 12:42 pm

Cybercriminals have launched a campaign known as FLUX#CONSOLE, exploiting Microsoft Common Console Document (.MSC) files to infiltrate systems with backdoor malware. This method allows attackers to bypass traditional antivirus defenses by leveraging lesser-known Windows features. The campaign represents a shift from the previously common use of LNK files in phishing attacks.

The attack begins with phishing emails that use tax-related themes to deceive users into opening seemingly legitimate documents. These emails contain attachments disguised as PDFs, such as “Income-Tax-Deduction-and-Rebates202441712.pdf,” which are actually .MSC files. The default setting in Windows hides file extensions, making it easier for these malicious files to masquerade as harmless documents.

When a user opens the .MSC file, it executes embedded malicious scripts under the legitimate mmc.exe process. The attackers employ advanced obfuscation techniques to conceal the malicious code, which is often written in JavaScript or VBScript. This method allows the malware to run unnoticed, as it appears to be part of a standard administrative tool.

The .MSC file serves as both a loader and dropper for the malware payload. It delivers a malicious DLL file named DismCore.dll, which is sideloaded through the legitimate Dism.exe process. To maintain persistence on the infected system, the malware creates scheduled tasks, such as “CoreEdgeUpdateServicesTelemetryFallBack,” ensuring it executes every five minutes, even after system reboots.

This campaign highlights the increasing sophistication of phishing techniques and the exploitation of trusted Windows features. By abusing .MSC files and legitimate system processes, attackers can evade detection and establish persistent access to compromised systems. Users and organizations should be cautious of unexpected emails with attachments and consider adjusting settings to display file extensions to better identify potentially malicious files.

For further details, access the article here

 vCISO Guide for Small & Mid Sized Businesses

DISC LLC is listed on Cynomi vCISO Directory

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Deliver Backdoor Payloads, Windows Management Console

Dec 02 2024

AI-based tools designed for criminal activity are in high demand

Category: Cyber crime,Cybercrime,Ransomware — disc7 @ 9:13 am

The landscape of ransomware attacks has shifted dramatically, with cybercriminals increasingly using AI to automate, accelerate, and scale their operations. These attacks now target sectors like healthcare, manufacturing, and critical infrastructure, exploiting their reliance on uptime and historical underinvestment in cybersecurity. The rise in ransomware attacks—up 67% in 2023—has expanded attack surfaces, making businesses of all sizes vulnerable. Small to medium enterprises are particularly at risk, as many lack adequate cybersecurity resources​

AI, while leveraged by attackers, also offers a robust countermeasure for defenders. It enables organizations to automate detection, flag anomalies in administrative activities, and track malware proliferation through advanced techniques like hash-based monitoring. Generative AI tools, such as copilots, can guide IT teams in assessing vulnerabilities, crafting recovery strategies, and implementing tailored protection policies. These innovations reduce manual errors and enhance rapid response to ransomware incidents​

Ransomware tactics are evolving, with a growing focus on data theft over traditional encryption methods. Stolen intellectual property, financial records, or customer data provides leverage in negotiations and inflicts lasting reputational damage on victims. Furthermore, attackers are exploiting dual-use tools like remote access software and file-sharing utilities, which blend into legitimate activity. Detecting such misuse requires behavioral analysis and proactive exposure management rather than traditional signature-based defenses​

To mitigate these threats, businesses must adopt comprehensive cyber resilience strategies. These include maintaining a 3-2-1 backup model, integrating AI capabilities for automated responses, and regularly rehearsing recovery plans. Such preparation ensures faster containment and recovery, ultimately reducing the operational and financial impact of ransomware incidents​

For further details, access the article here

OWASP updated 2025 Top 10 Risks for Large Language Models (LLMs), a crucial resource for developers, security teams, and organizations working with AI.

How CISOs Can Drive the Adoption of Responsible AI Practices

The CISO’s Guide to Securing Artificial Intelligence

AI in Cyber Insurance: Risk Assessments and Coverage Decisions

Hackers will use machine learning to launch attacks

To fight AI-generated malware, focus on cybersecurity fundamentals

4 ways AI is transforming audit, risk and compliance

AI security bubble already springing leaks

Could APIs be the undoing of AI?

The Rise of AI Bots: Understanding Their Impact on Internet Security

How to Address AI Security Risks With ISO 27001

Comprehensive vCISO Services

The Little Book on Big Cyber Crime

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: AI based tools

Oct 15 2024

Scammers can easily place fake QR codes over legitimate ones

Category: Cybercrime,Security Awareness — disc7 @ 8:53 am

QR codes have become a popular, convenient way to make payments, but they also open the door to scams. This was seen in a recent incident where someone lost €1,000 after scanning a QR code for parking, which redirected to a fraudulent payment page.

Scammers can easily place fake QR codes over legitimate ones, tricking users into entering sensitive information or making unauthorized payments.

It is advisable to always double-check the URL after scanning; if it appears suspicious, do not proceed.

QR code scams are fraudulent schemes where scammers use QR codes to trick people into providing personal information, installing malware, or making unauthorized payments. Here are some common types of QR code scams and how they work:

1. Phishing via QR Codes

  • How it works: Scammers create QR codes that redirect to fake websites designed to look like legitimate sites. Once scanned, users may be prompted to enter sensitive information like login credentials, credit card details, or personal information.
  • Example: A QR code on a poster claims to offer a discount on a popular brand. When scanned, it takes the user to a fake website that asks for payment details.

2. Malware Distribution

  • How it works: Scanning the QR code triggers the download of malicious software onto the user’s device. This malware can steal data, monitor activities, or even lock the device and demand a ransom.
  • Example: A QR code is advertised as a link to a free app download, but instead, it installs malware on the user’s phone.

3. Payment Scams

  • How it works: Scammers replace legitimate QR codes with their own, redirecting payments to their accounts instead of the intended recipient. This is often seen in places where QR codes are used for payments, such as restaurants or parking meters.
  • Example: A restaurant’s QR code on a menu for paying the bill is swapped with a fraudulent one, and payments go directly to the scammer.

4. Fake Customer Support or Verification

  • How it works: Scammers may place fake QR codes on receipts, invoices, or emails that claim to provide customer support or verify your account. When scanned, it may lead to phishing websites or prompt users to provide sensitive information.
  • Example: A QR code on an invoice claims to be for verifying a payment, but it leads to a fake customer service page that asks for bank account details.

5. Social Media and Giveaway Scams

  • How it works: Scammers promote QR codes on social media, claiming they lead to exclusive content, discounts, or giveaway entries. Users who scan the code may end up on a phishing site or be tricked into providing personal information.
  • Example: A social media post advertises a giveaway; the QR code leads to a site asking for personal details or a small fee to “claim the prize.”

How to Protect Yourself

  1. Be cautious of QR codes in public spaces: Verify the source before scanning, especially if it’s printed on posters, flyers, or business cards.
  2. Check for tampering: Look closely to see if the QR code has been pasted over another one.
  3. Use a QR code scanner with safety features: Some apps can check URLs before opening them, alerting users if they lead to suspicious sites.
  4. Enable app permissions carefully: Be wary of QR codes that prompt you to download apps or enable permissions.
  5. Verify URLs before providing information: If you’re redirected to a website, double-check the URL for signs of phishing.

QR code scams exploit the trust users place in the convenience of quick access. It’s essential to stay vigilant and cautious when scanning codes from unverified sources.

In an age where convenience reigns supreme, QR codes have seamlessly integrated into our daily lives, offering quick access to information, promotions, and transactions with a simple scan. But beware – lurking behind those pixelated patterns lies a world of potential scams and security threats. In “BEFORE YOU SCAN ANOTHER QR CODE, READ THIS,” we unshade the dark side of QR codes and empower you with the right knowledge and tools to protect yourself in the ever evolving digital world.

Look into the intricacies of QR code technology, this comprehensive handbook equips you with the understanding needed to navigate the treacherous waters of QR code scams. From phishing attacks and malware distribution to social engineering tactics and technical vulnerabilities, we uncover the myriad ways scammers exploit QR codes for malicious purposes.

READ THIS BEFORE YOU SCAN ANOTHER QR CODE: A Comprehensive Handbook to Understanding Scam and Healthy Precaution

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: QR codes

Sep 06 2024

How cyber criminals are compromising AI software supply chains

Category: AI,Cybercrime,DevSecOps — disc7 @ 9:55 am

The rise of artificial intelligence (AI) has introduced new risks in software supply chains, particularly through open-source repositories like Hugging Face and GitHub. Cybercriminals, such as the NullBulge group, have begun targeting these repositories to poison data sets used for AI model training. These poisoned data sets can introduce misinformation or malicious code into AI systems, causing widespread disruption in AI-driven software and forcing companies to retrain models from scratch.

With AI systems relying heavily on vast open-source data sets, attackers have found it easier to infiltrate AI development pipelines. Compromised data sets can result in severe disruptions across AI supply chains, especially for businesses refining open-source models with proprietary data. As AI adoption grows, the challenge of maintaining data integrity, compliance, and security in open-source components becomes crucial for safeguarding AI advancements.

Open-source data sets are vital to AI development, as only large enterprises can afford to train models from scratch. However, these data sets, like LAION 5B, pose risks due to their size, making it difficult to ensure data quality and compliance. Cybercriminals exploit this by poisoning data sets, introducing malicious information that can compromise AI models. This ripple effect forces costly retraining efforts. The popularity of generative AI has further attracted attackers, heightening the risks across the entire AI supply chain.

The article emphasizes the importance of integrating security into all stages of AI development and usage, given the rise of AI-targeted cybercrime. Businesses must ensure traceability and explainability for AI outputs, keeping humans involved in the process. AI shouldn’t be seen solely as a cost-cutting tool, but rather as a technology that needs robust security measures. AI-powered security solutions can help analysts manage threats more effectively but should complement, not replace, human expertise.

For more detailed insights, check the full article here.

Blockchain, IoT, and AI Technologies for Supply Chain Management (Innovations in Intelligent Internet of Everything (IoE))

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: AI software supply chains

Sep 06 2024

The true cost of cybercrime for your business

Category: Cyber crime,Cybercrime — disc7 @ 9:37 am

The article discusses the increasing financial impact of cybercrime on businesses, with attacks like ransomware and DDoS causing significant losses. Average costs for DDoS attacks have risen to $6,000 per minute, while ransomware payouts have skyrocketed, with a record-breaking $75 million ransom paid in 2024. Third-party vendor breaches and industry-specific vulnerabilities are also contributing to escalating costs.

Companies are facing growing pressure to address these threats, yet many are struggling with cybersecurity talent shortages and burnout. Despite paying ransoms, recovery costs continue to rise, and cyber insurance often doesn’t cover all expenses. Investing in preventive measures and continuous monitoring is critical to mitigate risks.

For more detailed insights, check the full article here.

The Transformation of Crime in the Information Age

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: cost of cybercrime

Mar 24 2024

CYBERCRIMINALS ACCELERATE ONLINE SCAMS DURING RAMADAN AND EID FITR

Category: Cybercrime — disc7 @ 12:23 pm
Cybercriminals Accelerate Online Scams During Ramadan and Eid Fitr

During the month of Ramadan, Resecurity observed a significant increase in fraudulent activities and scams.

During the month of Ramadan, Resecurity observed a significant increase in fraudulent activities and scams, coinciding with a surge in retail and online transactions. Middle Eastern enterprises, facing this heightened risk, are urged to bolster consumer protection and reinforce their brand security.

Notably, in the Kingdom of Saudi Arabia (KSA), consumer spending topped regional charts, exceeding $16 billion. This spike in e-commerce activity has, unfortunately, drawn the attention of cybercriminals who exploit these platforms to execute scams, leading to substantial financial repercussions for both consumers and businesses. The estimated total financial impact of these activities ranges between $70 and $100 million, accounting for frauds perpetrated against expatriates, residents, and foreign visitors.

Due to continued efforts in brand protection for many clients in the Middle East, Resecurity has effectively blocked over 320 fraudulent resources that were impersonating key logistics providers and e-government services. Cybercriminals are aggressively exploiting platforms such as Sadad, Musaned, Ajeer, Ejar, and well-known logistics services to deceive internet users and draw them into different scams. It is strongly advised to refrain from sharing personal and payment information on questionable sites or with individuals posing as bank or government employees.

The malicious actors utilize cloud-based hosting services like Softr, Netlify, and Vercel, which offer pre-defined templates, to create websites using AI. This method allows them to scale their operations efficiently, saving time and effort while rapidly generating new fraudulent sites at an unprecedented rate.

The full report published by Resecurity is available here:

https://www.resecurity.com/blog/article/cybercriminals-accelerate-online-scams-during-ramadan-and-eid-fitr

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: EID UL FITR, RAMADAN

Mar 13 2024

Keyloggers, spyware, and stealers dominate SMB malware detections

Category: Cybercrime,Malware,Spyware — disc7 @ 10:56 am
Keyloggers, spyware, and stealers dominate SMB malware detections

In 2023, 50% of malware detections for SMBs were keyloggers, spyware and stealers, malware that attackers use to steal data and credentials, according to Sophos.

SMBs ransomware cyberthreat

Attackers subsequently use this stolen information to gain unauthorized remote access, extort victims, deploy ransomware, and more.

Ransomware remains primary cyberthreat for SMBs

The Sophos report also analyses initial access brokers (IABs)—criminals who specialize in breaking into computer networks. As seen in the report, IABs are using the dark web to advertise their ability and services to break specifically into SMB networks or sell ready-to-go-access to SMBs they’ve already cracked.

“The value of ‘data,’ as currency has increased exponentially among cybercriminals, and this is particularly true for SMBs, which tend to use one service or software application, per function, for their entire operation. For example, let’s say attackers deploy an infostealer on their target’s network to steal credentials and then get hold of the password for the company’s accounting software. Attackers could then gain access to the targeted company’s financials and have the ability to funnel funds into their own accounts,” said Christopher Budd, director of Sophos X-Ops research at Sophos.

“There’s a reason that more than 90% of all cyberattacks reported to Sophos in 2023 involved data or credential theft, whether through ransomware attacks, data extortion, unauthorized remote access, or simply data theft,” added Budd.

While the number of ransomware attacks against SMBs has stabilized, it continues to be the biggest cyberthreat to SMBs. Out of the SMB cases handled by Sophos Incident Response (IR), which helps organizations under active attack, LockBit was the top ransomware gang wreaking havoc. Akira and BlackCat were second and third, respectively. SMBs studied in the report also faced attacks by lingering older and lesser-known ransomware, such as BitLocker and Crytox.

BEC attacks grow in sophistication

Ransomware operators continue to change ransomware tactics, according to the report. This includes leveraging remote encryption and targeting managed service providers (MSPs). Between 2022 and 2023, the number of ransomware attacks that involved remote encryption—when attackers use an unmanaged device on organizations’ networks to encrypt files on other systems in the network—increased by 62%.

In addition, this past year, Sophos’s Managed Detection and Response (MDR) team responded to five cases involving small businesses that were attacked through an exploit in their MSPs’ remote monitoring and management (RMM) software.

Following ransomware, business email compromise (BEC) attacks were the second highest type of attacks that Sophos IR handled in 2023, according to the report.

These BEC attacks and other social engineering campaigns contain an increasing level of sophistication. Rather than simply sending an email with a malicious attachment, attackers are now more likely to engage with their targets by sending a series of conversational emails back and forth or even calling them.

In an attempt to evade detection by traditional spam prevention tools, attackers are now experimenting with new formats for their malicious content, embedding images that contain the malicious code or sending malicious attachments in OneNote or archive formats. In one case Sophos investigated, the attackers sent a PDF document with a blurry, unreadable thumbnail of an “invoice.” The download button contained a link to a malicious website.

Mastering Cyber Security Defense to Shield Against Identity Theft, Data breaches, Hackers, and more in the Modern Age

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: keylogger, Malware, SMB

Mar 07 2024

Cyber Pros Turn to Cybercrime as Salaries Stagnate

Category: Cyber crime,Cybercrime — disc7 @ 8:31 am
https://www.infosecurity-magazine.com/news/cyber-pros-cybercrime-salaries/

Cybersecurity professionals are increasingly prepared to moonlight as cybercriminals in a bid to top up their salaries, according to new research from the Chartered Institute of Information Security (CIISec).

The institute enlisted the help of a former police officer and covert operative to analyze dark web forum job adverts from June to December 2023.

What he found was a surprising number of what seemed to be cybersecurity professionals at various stages of their career prepared to sell their skills for nefarious ends.

“After years of working in the cybersecurity and law enforcement fields, it becomes relatively easy to spot cybercriminals from professionals moonlighting from other industries,” he explained.

“These adverts might allude to current legitimate professional roles, or be written in the same way as someone advertising their services on platforms like LinkedIn. In an industry that is already struggling to stop adversaries, it’s worrying to see that bright, capable people have been enticed to the criminal side.”

Read more on security skills shortages: #InfosecurityEurope: It’s Time to Think Creatively to Combat Skills Shortages

The study revealed three types of professional touting for business on underground sites:

  • Experienced IT and cybersecurity professionals, including pen testers, AI prompt engineers and web developers. Some claimed to work for a “global software agency” while others stated they needed a “second job”
  • New starters in cybersecurity looking for both work and training. Professional hacking groups also advertise for young talent, with some offering on-the-job training in areas such as OSINT and social media hacking
  • Professionals from industries outside cybersecurity/IT, including PR, content creation and even one out-of-work voice actor advertising for work on phishing campaigns

CIISec warned that, in many cases, salaries do not reflect the long hours and high-stress environments that many security professionals find themselves in. CIISec CEO, Amanda Finch, cited Gartner research revealing that 25% of security leaders will leave the industry by 2025 due to work-related stress.

“Our analysis shows that highly skilled individuals are turning to cybercrime. And given the number of people projected to leave the industry, many of those will be desperate enough to seek work in an area that promises large rewards for their already-existing skills and knowledge,” she argued.

“Preventing this means ensuring we are doing all we can as an industry to attract and retain talent.”

Finch called on the industry to increase salaries and improve working conditions, or risk as many as 10% of the workforce leaving a profession already experiencing persistent skills shortages.

Hunting Cyber Criminals: A Hacker’s Guide to Online Intelligence Gathering Tools and Techniques

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: Cyber Pros

Feb 16 2024

US GOV OFFERS A REWARD OF UP TO $10M FOR INFO ON ALPHV/BLACKCAT GANG LEADERS

Category: Cyber crime,Cybercrime — disc7 @ 2:12 pm
US gov offers a reward of up to $10M for info on ALPHV/Blackcat gang leaders

The U.S. government offers rewards of up to $10 million for information that could lead to the identification or location of ALPHV/Blackcat ransomware gang leaders.

The U.S. Department of State is offering a reward of up to $10 million for information leading to the identification or location of the key figures behind the ALPHV/Blackcat ransomware operation. The US government is also offering a reward offer of up to $5 million for information leading to the arrest and/or conviction in any country of any individual conspiring to participate in or attempting to participate in ALPHV/Blackcat ransomware attacks.

This additional reward aims to target affiliated and initial access brokers involved and that facilitated the attacks of the group.

BlackCat/ALPHV ransomware gang has been active since November 2021, the list of its victims is long and includes industrial explosives manufacturer SOLAR INDUSTRIES INDIA, the US defense contractor NJVC, gas pipeline Creos Luxembourg S.A., the fashion giant Moncler, the Swissport, NCR, and Western Digital. The ransom demands of the group range from a few tens of thousands of dollars up to tens of millions of dollars.

On December 19, 2023, the FBI seized the Tor leak site of the AlphV/Blackcat ransomware group and replaced the home page with the announcement of the seizure.

On December 7th, BleepingComputer and other prominent experts reported that the ALPHV gang’s websites went offline.

On December 10th, the primary domain of the group went offline and administrators claimed the problem was caused by a hardware failure. At the same time, rumors circulated that the site was taken offline as a result of law enforcement’s operation. The group always denied this circumstance, but today the domain displayed the following message to the visitors.

The seizure is the result of a joint operation conducted by international law enforcement agencies from the US, Denmark, Germany, UK, Netherlands, Germany, Australia, Spain, Austria and Europol.

“This action has been taken in coordination with the United States Attorney’s Office for the Southern District of Florida and the Computer Crime and Intellectual Property Section of the Department of Justice with substantial assistance from Europol and Zentrale Kriminalinspektion Guttingen.” reads the message published by law enforcement on the seized websites.

“The Justice Department announced today a disruption campaign against the Blackcat ransomware group — also known as ALPHV or Noberus — that has targeted the computer networks of more than 1,000 victims and caused harm around the world since its inception, including networks that support U.S. critical infrastructure.” reads the press release published by DoJ.

The ALPHV/Blackcat group was the second most prolific ransomware-as-a-service operation, it amassed hundreds of millions of dollars in ransom payments.  

The FBI developed a decryption tool that could allow over 500 victims to recover their systems for free.

“FBI identified ALPHV/Blackcat actors as having compromised over 1,000 victim entities in the United States and elsewhere, including prominent government entities (e.g., municipal governments, defense contractors, and critical infrastructure organizations).” reads the press release. “To date, the FBI has worked with dozens of victims in the United States and internationally to disseminate a decryption tool to restore victim systems and prevent ransom demand payments of approximately $99 million.”

According to the press release published by the U.S. Department of State, ALPHV/Blackcat actors have compromised over 1,000 victim entities in the United States and elsewhere.

People who have information eligible for the reward can access the following Tor website set up by the US Department of State: he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion. 

Understanding the Basics of Cyber Criminal Activity and the Tools to Combat It

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: ALPHV/BLACKCAT

Feb 08 2024

As-a-Service tools empower criminals with limited tech skills

Category: Cybercrime,Ransomware,Security Tools — disc7 @ 9:45 am
As-a-Service tools empower criminals with limited tech skills

As-a-service attacks continue to dominate the threat landscape, with Malware-as-a-Service (MaaS) and Ransomware-as-a-Service (RaaS) tools making up the majority of malicious tools in use by attackers, according to Darktrace.

Cybercriminals exploit as-a-Service tools

As-a-Service tools can provide attackers with everything from pre-made malware to templates for phishing emails, payment processing systems and even helplines to enable criminals to mount attacks with limited technical knowledge.

The most common as-a-Service tools Darktrace saw in use from July to December 2023 were:

  • Malware loaders (77% of investigated threats), which can deliver and execute other forms of malware and enable attackers to repeatedly target affected networks.
  • Cryptominers (52% of investigated threats), which use an infected device to mine for cryptocurrency.
  • Botnets (39% of investigated threats) enrol users in wider networks of infected devices, which attackers then leverage in larger-scale attacks on other targets.
  • Information-stealing malware (36% of investigated threats), malicious software like spyware or worms, designed to secretly access and collect sensitive data from a victim’s computer or network.
  • Proxy botnets (15% of investigated threats), more sophisticated botnets that use proxies to hide the true source of their activity.

Phishing threats escalate in business communications

Darktrace identified Hive ransomware as one of the major Ransomware-as-a-Service attacks at the beginning of 2023. With the dismantling of Hive by the US government in January 2023, Darktrace observed the rapid growth of a range of threats filling the void, including ScamClub, a malvertising actor notorious for spreading fake virus alerts to notable news sites, and AsyncRAT, responsible for attacking US infrastructure employees in recent months.

As businesses continue to rely on email and collaboration tools for communication, methods such as phishing continue to cause a headache for security teams. Darktrace detected 10.4 million phishing emails across its customer fleet between the 1st September and the 31st December 2023.

But the report also highlights how cybercriminals are embracing more sophisticated tools and tactics designed to evade traditional security parameters. One example is the rise of Microsoft Teams phishing in which attackers contact employees through Teams, posing as a co-worker and tricking them into clicking malicious links.

In one case in September 2023, Darktrace identified a suspected Teams phisher attempting to trick users into clicking a SharePoint link that would download the DarkGate malware and deploy further strains of malware across the network.

Multi-function malware on the rise

Another new trend identified is the growth of malware developed with multiple functions to inflict maximum damage. Often deployed by sophisticated groups like cyber cartels, these Swiss Army knife-style threats combine capabilities.

For example, the recent Black Basta ransomware also spreads the Qbot banking trojan for credential theft. Such multi-tasking malware lets attackers cast a wide net to monetise infections.

“Throughout 2023, we observed significant development and evolution of malware and ransomware threats, as well as changing attacker tactics and techniques resulting from innovation in the tech industry at large, including the rise in generative AI. Against this backdrop, the breadth, scope, and complexity of threats facing organizations has grown significantly,” comments Hanah Darley, Director of Threat Research, Darktrace. “Security teams face an up-hill battle to stay ahead of attackers, and need a security stack that keeps them ahead of novel attacks, not chasing yesterday’s threats.”

Future Crimes: Inside the Digital Underground and the Battle for Our Connected World

InfoSec tools | InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: As-a-Service, darktrace, Malware

Jan 29 2024

Cybercriminals embrace smarter strategies, less effort

Category: Cyber crime,Cybercrime — disc7 @ 8:20 am
Cybercriminals embrace smarter strategies, less effort

2024 is shaping up to be a record-breaking year for data breaches, according to Experian. Despite 2023 being labeled as a ‘successful’ year for malicious actors, the upcoming months may bring forth developments that could further disrupt the cybersecurity landscape.

Supply chain vulnerabilities amplified

There’s no question third-party data breaches have made headlines. With increased data collection, storage, and movement, there are plenty of partners down the supply chain that could be targeted. We predict attacks on systems four, five or six degrees from the source as vendors outsource data and technology solutions who outsource to another expert and so on.

Digital transformation is expanding threat surfaces. SaaS platforms and public cloud infrastructures, are pushing the perimeter out into the internet itself—putting users at greater risk.

When trying to achieve a goal, it’s said that taking small steps can lead to big results. Hackers could apply that same rule. Instead of making drastic moves and trying to reap instant reward such as with ransomware, bad actors may manipulate or alter the tiniest bits of data to stay under the radar such as changing a currency rate or adjusting the coordinates for transportation, which can have a major impact.

It’s widely known who the major players are globally that sponsor attacks and a new country in South Asia may join the international stage with their large population of engineers and programmers. While reportedly having been in the game focusing cyberattacks regionally due to political tensions, this country may broaden their sights in the future.

Plutonium, terbium, silicon wafers — these rare earth materials that are the building blocks for today’s hardware are rapidly becoming the most sought-after resources on the planet. Any disruption to an strained supply chain could send the industry (and the economy that relies on these materials) spinning.

This presents an intriguing opportunity for threat actors seeking mass disruption or nations looking to corner markets.

“Cybercriminals are continually working smarter, not harder,” said Michael Bruemmer, VP, Global Data Breach Resolution at Experian. “They are leveraging new technologies like artificial intelligence and applying their talents in different ways to be more strategic and stay a step ahead. Organizations should not ignore even the slightest security abnormalities and be more aware of what global interests may make them a target.”

Winning from the inside

Like drug cartels, cybergangs are forming sophisticated organizations as joining like-minded actors can be incredibly advantageous. This spans globally with countries potentially helping each other to advance common goals and interests. We’ll see more hackers for trade, crews looking to expand their monopolies, and cyberwarfare alliances.

In 2024, enterprising threat actors may target more publicly traded companies to gain insights to cheat the stock market or plan their attacks and sell their stash before value nosedives. Rather than breach an organization and play in the underground with stolen data, threat actors could leverage data extraction and their talents in plain sight as everyday investors.

“Today, perpetrators can come from anywhere in the world and bring with them robust resources and expertise,” added Jim Steven, Head of Crisis and Data Response Services at Experian Global Data Breach Resolution in the United Kingdom. “There are many global crime syndicates and nation-backed operations, so companies need to invest in sophisticated prevention and response methods to protect themselves.”

Learn how to access the dark web safely and not fall victim to cybercrime

InfoSec tools | InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: Cybercriminals

Nov 18 2023

Review: Cyberbunker: The Criminal Underworld

Category: Cyber crime,Cybercrime — disc7 @ 11:41 am

Written and directed by Kilian Lieb and Max Rainer, Cyberbunker is a Netflix documentary about a group of hackers that enabled the proliferation of dark web forums where illegal materials were bought and sold.

Review: Cyberbunker: The Criminal Underworld

Cyberbunker: The Criminal Underworld

The documentary begins with a special police unit performing a raid in what looks like a military bunker. We are then shown a thin individual with glasses and long, gray hair: Herman Johan Xennt.

The (now) 64-year-old Dutchman, who is currently serving a prison sentence in Germany, is a bunker aficionado, having been fascinated with them since he visited a WWII bunker in Arnhem when he was a kid.

Understanding the possibilities of computer technology and the internet, he first opened a profitable computer store in the early 90s. In 1995, with the money earned from this business, he was able to buy a former NATO bunker in the southern part of the Netherlands, which ended up being the location of the first Cyberbunker – a company that provides internet and web hosting services to questionable operations.

In 2002, a fire broke in the bunker and revealed the existence of an MDMA lab. Xennt claimes that he knew nothing about the lab and that he was simply subletting part of the bunker to another group. For many years after, the company’s servers were located above ground, in Amsterdam. In 2013, Xennt found and purchased a 5-level underground Cold War-era bunker in Traben-Trarbach, a small town in the South of Germany.

But the town’s mayor soon grew suspicious of the activities going on in the bunker and decided to contact the authorities, which started telephone surveillance in 2015. The group communicated in codes, though, which made crime identification impossible. In 2017, the authories began monitoring the network node to identify illegal data traffic.

This led to the discovery of evidence of criminal activity: Cyberbunker provided hosting for dark web marketplaces, a forum for exchanging illegal drugs, counterfeit money and fake identification, and more.

The undercover operation provided crucial information to the police, helping them to plan and execute a successful raid. Xennt and his criminal colleagues were arrested, and over 280 servers hosting websites for up to 200 customers were shut down.

The idea of “freedom of the internet”

Cyberbunker was know among cybercriminals as a “bulletproof hoster”, which meant that the servers hosting the content stayed online no matter what (i.e., even if the authorities requested sites’ removal). It also guaranteed privacy, which was very convenient for anyone who wanted to host questionable or illegal content.

Cyberbunker advertised that it would host everything except child pornography and terrorism-related content, but the group later claimed that they didn’t really know what the clients were using their servers for.

The group was driven by the idea of “freedom of the internet” and, during the interviews with all the members of the group (including Xennt), we can see that they have a twisted idea of what it should be.

They went so far as to declare the Republic of Cyberbunker, with its “administration” and hierarchy, and perpetuated the delusion that what they were doing was good.

Does it strike the right chord?

The documentary is suitable for a wide audience and does not burden the spectator with technical details. Instead, it has a movie-like format that’s captivating and easy to follow.

The timeline of the events is well presented and clear, complemented with historical data about the main “character” – Xennt – and original private and police footage.

The authors tried to create a tense and scary atmosphere, though the characters at times act bizarrely and seem out of touch with reality that, on occasion, you might almost feel sorry for them. It’s hard to believe these individuals thought they were untouchable and that, even after getting arrested, they were still convinced they were making the world a better place.

Codes of the Underworld: How Criminals Communicate

InfoSec tools | InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: Codes of the Underworld, Cyberbunker

Oct 11 2023

UNMASKING CRACKED COBALT STRIKE 4.9: THE CYBERCRIMINAL’S TOOL OF CHOICE

Category: Cybercrime,Security Tools — disc7 @ 8:58 am
Unmasking Cracked Cobalt Strike 4.9: The Cybercriminal’s Tool of Choice

Cobalt Strike, a legitimate commercial penetration testing tool, has inadvertently become a favored instrument among cybercriminals for its efficacy in infiltrating network security. Initially released in 2012 by Fortra (formerly known as Help Systems), Cobalt Strike was designed to aid red teams in identifying vulnerabilities within organizational infrastructures. Despite stringent customer screening and licensing for lawful use only, malicious actors have successfully obtained and distributed cracked versions of the software, making it a prevalent tool in cyberattacks involving data theft and ransomware.

Cobalt Strike 4.9 is now available. This release sees an overhaul to Cobalt Strike’s post exploitation capabilities to support user defined reflective loaders (UDRLs), the ability to export Beacon without a reflective loader which adds official support for prepend-style UDRLs, support for callbacks in a number of built-in functions, a new in-Beacon data store and more.  

COBALT STRIKE 4.9 FEATURES

The latest release, version 4.9, introduces several significant features and improvements:

  • User-Defined Reflective Loaders (UDRLs): This feature enhances post-exploitation capabilities by allowing users to define and use their reflective loaders, providing more flexibility and control over the loading process of the Beacon payload.
  • Export Beacon Without a Loader: Users can now export the Beacon payload without a reflective loader, which officially supports prepend-style UDRLs, allowing for more versatile deployment and execution of the Beacon payload in various environments.
  • Callback Support: Version 4.9 introduces support for callbacks, enabling users to implement and handle custom callback routines effectively.
  • Beacon User Data Structures Improvement: These structures have been improved to prevent crashes and provide more stability during operations. They also allow a Reflective Loader to resolve and pass system call information to Beacon, overriding Beacon’s default system call resolver.
  • Host Profile Support for HTTP(S) Listeners: This feature addresses limitations in HTTP(S) processing by introducing a new Malleable C2 profile group named http-host-profiles.
  • WinHTTP Support: The update adds support for the WinHTTP library to the Beacon’s HTTP(S) listener.
  • Beacon Data Store: This feature allows users to store Buffer Overflow Frameworks (BOFs) and .NET assemblies in a structured manner.

CRACKED VERSIONS IN THE WILD

Google researchers have recently identified 34 different cracked versions of the Cobalt Strike hacking toolkit actively being used in the wild. These cracked versions are exploited by cybercriminals for various malicious activities, emphasizing the tool’s popularity and widespread illicit use in the cybercriminal community. The discovery of cracked version 4.9 of Cobalt Strike highlights the significant challenges and risks associated with the illicit use of this powerful toolkit.

THE CRACKDOWN

Microsoft, in collaboration with Fortra and the Health Information Sharing and Analysis Center (Health-ISAC), has initiated a widespread legal crackdown on servers hosting these cracked copies. This concerted effort aims to dismantle the malicious infrastructure and disrupt the operations of threat actors utilizing Cobalt Strike for nefarious purposes.

WHY COBALT STRIKE?

Cobalt Strike has gained notoriety among cybercriminals for its post-exploitation capabilities. Once the beacons are deployed, these provide persistent remote access to compromised devices, allowing for sensitive data harvesting or the dropping of additional malicious payloads.

THE USERS

Cobalt Strike’s cracked versions are used by unidentified criminal groups, state-backed threat actors, and hacking groups acting on behalf of foreign governments. These actors have been linked to numerous ransomware attacks impacting various industries, causing significant financial and operational damage.

REMEDIATION EFFORTS

To counteract the malicious use of Cobalt Strike, various entities have provided resources to assist network defenders in identifying Cobalt Strike components within their networks. These resources include open-sourced YARA rules and a collection of indicators of compromise (IOCs).

RedEye: A great opensource cyber security Log Visualization tool for Red and Blue teams

The illicit use of Cobalt Strike poses a significant threat to global cybersecurity. The ongoing crackdown led by Microsoft, Fortra, and Health-ISAC represents a crucial step towards mitigating the risks associated with Cobalt Strike, underscoring the importance of collaborative efforts in the fight against cybercrime.

Cobalt Strike, a Defender’s Guide

InfoSec tools | InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: Cobalt Strike

Sep 05 2023

Connected cars and cybercrime: A primer

Category: Cybercrime — disc7 @ 9:30 am
Connected cars and cybercrime: A primer

Analysis of chatter in criminal underground message exchanges, however, reveals that the pieces exist for multi-layered, widespread attacks in the coming years. And given that the automotive industry’s customary development cycles are long, waiting for the more sophisticated cyberattacks on connected cars to appear is not a practical option.

What should the world’s automotive OEMs and suppliers do now to prepare for the inevitable transition from today’s manual, car-modding hacks to tomorrow’s user impersonation, account thefts and other possible attacks?

How connectivity is changing car crime

As our vehicles become more connected to the outside world, the attack surface available to cybercriminals is rapidly increasing, and new “smart” features on the current generation of vehicles worldwide open the door for new threats.

Our new “smartphones on wheels”—always connected to the internet, utilizing many apps and services, collecting tremendous amounts of data from multiple sensors, receiving over-the-air software updates, etc.—stand to be attacked in similar ways to how our computers and handheld devices already are today.

Automotive companies need to think now about those potential future threats. A car that an OEM is planning today will likely reach the market in three to five years. It will need to be already secured against the cyberthreat landscape that might be in existence by then. If the car hits the market without the required cybersecurity capabilities, the job of securing it will become significantly more difficult.

The likelihood of substantially more frequent, devious, and harmful attacks is portended by the complex attacks on connected cars that we have seen devised by industry researchers. Fortunately, the attacks to this point largely have been limited to these theoretical exercises in the automotive industry. Car modding – e.g., unlocking a vehicle’s features or manipulating mileage – is as far as real-world implementation has gotten.

Connectivity limits some of the typical options that are available to criminals specializing in car crime. The trackability of contemporary vehicles makes reselling stolen cars significantly more challenging, and even if a criminal can manage to take a vehicle offline, the associated loss of features renders the car less valuable to potential buyers.

Still, as connectivity across and beyond vehicles grows more pervasive and complicated, so will the threat. How are attacks on tomorrow’s connected cars likely to evolve?

Emerging fronts for next-generation attacks

Because the online features of connected cars are managed via user accounts, attackers may seek access to those accounts to attain control over the vehicle. Takeover of these car-user accounts looms as the emerging front for attack for would-be car cybercriminals and even criminal organizations, creating ripe possibilities for user impersonation and the buying and selling of the accounts.

Stealing online accounts and selling them to rogue collaborators who can act on that knowledge tee up a range of future possible attacks for tomorrow’s automotive cybercriminals:

  • Selling car user accounts
  • Impersonating users via phishing, keyloggers or other malware
  • Remote unlocking, starting and controlling connected cars
  • Opening cars and looting for valuables or committing other one-off crimes
  • Stealing cars and selling for parts
  • Locating cars to pinpoint owners’ residential addresses and to identify when owners are not home

The crime triangle takes shape

Connected car cybercrime is still in its infancy, but criminal organizations in some nations are beginning to recognize the opportunity to exploit vehicle connectivity. Surveying today’s underground message forums quickly reveals that the pieces could quickly fall into place for more sophisticated automotive cyberattacks in the years ahead. Discussions on underground crime forums around data that could be leaked and needed/available software tools to enable attacks are already intensifying.

A post from a publicly searchable auto-modders forum about a vehicle’s multi-displacement system (MDS) for adjusting engine performance, is symbolic of the current activity and possibilities.

Another, in which a user on a criminal underground forum offers a data dump from car manufacturer, points to the possible threats that likely are coming to the industry.

Though they still seem to be limited to accessing regular stolen data, compromises and network accesses are for sale in the underground. The crime triangle (as defined by crime analysts) for sophisticated automotive cyberattacks is solidifying:

  • Target — The connected cars that serious criminals will seek to exploit in the years ahead are becoming more and more prevalent in the global marketplace.
  • Desire — Criminal organizations will find ample market incentive to monetize stolen car accounts.
  • Opportunity — Hackers are steeped in inventive methods to hijack people’s accounts via phishing, infostealing, keylogging, etc.

Penetrating and exploiting connected cars

The ways for seizing access to the data of users of connected cars are numerous: introducing malicious in-vehicle infotainment (IVI) apps, exploiting unsecure IVI apps and network connections, taking advantage of unsecure browsers to steal private data, and more.

Also, there’s a risk of exploitation of personally identifiable information (PII) and vehicle telemetric data (on a car’s condition, for example) stored in smart cockpits, to inform extremely personalized and convincing phishing emails.

Here’s one method by which it could happen:

  • An attacker identifies vulnerabilities that can be exploited in a browser.
  • The attacker creates a professional, attractive webpage to offer hard-to-resist promotions to unsuspecting users (fast-food coupons, discounts on vehicle maintenance for the user’s specific model and year, insider stock information, etc.)
  • The user is lured into visiting the malicious webpage, which bypasses the browser’s security mechanisms
  • The attacker installs backdoors in the vehicle IVI system, without the user’s knowledge or permission, to obtain various forms of sensitive data (driving history, conversations recorded by manufacturer-installed microphones, videos recorded by built-in cameras, contact lists, text messages, etc.)

The possible crimes enabled by such a process are wide ranging. By creating a fraudulent scheme to steal the user’s identity, for example, the attacker would be able to open accounts on the user’s behalf or even trick an OEM service team into approving verification requests—at which point the attacker could remotely open the vehicle’s doors and allow a collaborator to steal the car.

Furthermore, the attackers could use the backdoors that they installed to infiltrate the vehicle’s central gateway via the IVI system by sending malicious messages to electronic control units (ECUs). A driver could not only lose control of the car’s IVI system and its geolocation and audio and video data, but also the ability to control speed, steering and other safety-critical functions of the vehicle, as well as the range of vital data stored in its digital clusters.

Positioning today for tomorrow’s threat landscape

Until now there might have been reluctance among OEMs to invest in averting cyberattacks, which haven’t yet materialized in the real world. But a 2023 Gartner Research report, “Automotive Insight: Vehicle Cybersecurity Ecosystem Creates Partnership Opportunities,” is among the industry research documenting a shift in priorities.

Driven by factors such as the significant risk of brand and financial damage from cyberattacks via updatable vehicle functions controlled by software, as well as emerging international regulatory pressures such as the United Nations (UN) regulation 155 (R155) and ISO/SAE 21434, OEMs have begun to emphasize cybersecurity.

And today, they are actively evaluating and, in some cases, even implementing a few powerful capabilities:

  • Security for IVI privacy and identity
  • Detection of IVI app vulnerabilities
  • Monitoring of IVI app performance
  • Protection of car companion apps
  • Detection of malicious URLs
  • 24/7 surveillance of personal data

Investing in cybersecurity in the design stage, versus after breaches, will ultimately prove less expensive and more effective in terms of avoiding or mitigating serious crimes involving money, vehicle and identity theft from compromised personal data by the world’s most savvy and ambitious business criminals.

Building Secure Cars

InfoSec tools | InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory

Tags: Connected cars

May 08 2023

RECONSHARK: NEW UNDETECTABLE RECONNAISSANCE TOOL USED BY CYBERCRIMINALS FOR HACKING

Category: Cybercrime,Security Tools — disc7 @ 1:21 pm
ReconShark: New undetectable reconnaissance tool used by cybercriminals for hacking

Kimsuky is an advanced persistent threat (APT) organization that originates in North Korea and has a lengthy history of launching targeted attacks all around the globe. According to what is currently known about the organization, they have been mainly tasked with conducting information gathering and espionage activities in behalf of the North Korean government from at least the year 2012. Throughout the course of history, Kimsuky targets have been spread throughout several nations in North America, Asia, and Europe. In its most recent efforts, the organization has continued their strategy of worldwide targeting, which is centered on a variety of contemporary geopolitical concerns. The most recent Kimsuky ads, for instance, have been centered on nuclear agendas between China and North Korea; these agendas are pertinent to the continuing confrontation between Russia and Ukraine. In 2018, the gang was seen deploying a malware family known as BabyShark, and  most recent observations show that the group has developed the malware with an enhanced capacity for reconnaissance. Experts call to this component of BabyShark as ReconShark.

During a recent campaign, Kimsuky targeted the employees of the Korea Risk Group (KRG), which is an information and analysis organization that specializes in subjects that have both direct and indirect effects on the Democratic People’s Republic of Korea (DPRK). Kimsuky continues to employ phishing emails that have been carefully designed by himself for the purpose of deploying ReconShark. Notably, spear-phishing emails are created with a degree of design quality customized for certain persons, which increases the possibility that the target would open the email. This involves using correct formatting, language, and visual signals so that the content seems authentic to readers who are not paying attention. Notably, both the targeted emails, which include links to download harmful papers, as well as the malicious documents themselves, exploit the names of genuine people whose knowledge is relevant to the subject matter of the bait, such as Political Scientists.

Kimsuky’s nefarious emails include a link that, when clicked, will direct the recipient to a file that requires a password in order to access it. Most recently, they started hosting the infected document for download on Microsoft OneDrive, which is a cloud storage service.Exfiltrating information about the infected platform is the primary function of ReconShark. This includes information about current processes, information about the battery that is attached to the device, and information about endpoint threat detection measures that have been implemented.

This cyber security researcher took matter in his own hands and shut down North Korea’s Internet for taking a revenge

In a manner similar to those of earlier iterations of BabyShark, ReconShark depends on Windows Management Instrumentation (WMI) to query information on processes and batteries. ReconShark does more than just steal information; it also distributes additional payloads in a multi-stage process. These payloads may be built as scripts (VBS, HTA, and Windows Batch), macro-enabled Microsoft Office templates, or Windows DLL files. The types of detecting mechanism processes that are active on compromised computers are taken into consideration when ReconShark chooses which payloads to send out.

In order to avoid being detected by static analysis methods, some ReconShark sequences are encoded using a pretty simple encryption. Typically, the instructions or scripts that are included inside these strings are for downloading and/or running payloads. All of the infrastructure that has been spotted as part of this campaign is housed on a shared hosting server provided by NameCheap. LiteSpeed Web Server (LSWS) was often used by operators of the Kimsuky malware in order to manage the harmful functionality. The continual attacks by Kimsuky and their use of the innovative reconnaissance tool ReconShark provide insight on the ever-changing nature of the North Korean threat environment. Organizations and people need to be aware of the tactics, techniques, and procedures (TTPs) utilized by North Korea state-sponsored advanced persistent threats (APTs) and take the required steps to defend themselves against attacks of this kind.

Field Manual FM 3-98 Reconnaissance and Security Operations

  InfoSec tools | InfoSec services | InfoSec books

Tags: RECONSHARK

Apr 07 2023

Microsoft aims at stopping cybercriminals from using cracked copies of Cobalt Strike

Category: Cyber crime,Cybercrime — DISC @ 11:21 am
Microsoft aims at stopping cybercriminals from using cracked copies of Cobalt Strike

Microsoft announced it has taken legal action to disrupt the illegal use of copies of the post-exploitation tool Cobalt Strike by cybercriminals.

Cobalt Strike is a paid penetration testing product that allows an attacker to deploy an agent named ‘Beacon’ on the victim machine. The Beacon includes a wealth of functionality for the attacker, including, but not limited to command execution, key logging, file transfer, SOCKS proxying, privilege escalation, mimikatz, port scanning and lateral movement. 

Microsoft Digital Crimes Unit (DCU) announced that has collaborated with Fortra, the company that develops and maintains the tool, and Health Information Sharing and Analysis Center (Health-ISAC) to curb the abuse of Cobalt Strike by cybercriminals.

The Microsoft DCU secured a court order in the U.S. to remove cracked versions of Cobalt Strike (“refer to stolen, unlicensed, or otherwise unauthorized versions or copies of the tool”) so they can no longer be used by cybercriminals.

Threat actors, including ransomware groups and nation-state actors, use Cobalt Strike after obtaining initial access to a target network. The tool is used to conduct multiple malicious activities, including escalating privileges, lateral movements, and deploying additional malicious payloads.

“More specifically, cracked versions of Cobalt Strike allow Defendants to gain control of their victim’s machine and move laterally through the connected network to find other victims and install malware. This includes installing ransomware like Conti, LockBit, Quantum Locker, Royal, Cuba, BlackBasta, BlackCat and PlayCrypt, to arrest access to the systems. In essence, Defendants are able to leverage cracked versions of Cobalt Strike to brutally force their way into victim machines and deploy malware.” reads the court order. “Additionally, once the Defendants deploy the malware or ransomware onto computers running Microsoft’s Window operating system, Defendants are able to execute a series of actions involving abuse of Microsoft’s copyrighted declaring code.”

Cobalt Strike attack chain

Example of an attack flow by threat actor DEV-0243.

Microsoft observed more than 68 ransomware attacks, involving the use of cracked copies of Cobalt Strike, against healthcare organizations in more than 19 countries around the world.

The attacks caused huge financial damages to the attacked hospitals in recovery and repair costs, plus interruptions to critical patient care services.

Microsoft also observed nation-state actors, including APT groups from Russia, China, Vietnam, and Iran, using cracked copies of Cobalt Strike.

“Microsoft, Fortra and Health-ISAC remain relentless in our efforts to improve the security of the ecosystem, and we are collaborating with the FBI Cyber Division, National Cyber Investigative Joint Task Force (NCIJTF) and Europol’s European Cybercrime Centre (EC3) on this case. While this action will impact the criminals’ immediate operations, we fully anticipate they will attempt to revive their efforts. Our action is therefore not one and done.” concludes the report.

In November 2022, Google Cloud researchers announced the discovery of 34 different Cobalt Strike hacked release versions with a total of 275 unique JAR files across these versions.

Google Cloud Threat Intelligence (GCTI) researchers developed a set of YARA rules to detect hacked variants in the wild with a high degree of accuracy. The researchers noticed that each Cobalt Strike version contains approximately 10 to 100 attack template binaries


InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Cobalt Strike, Microsoft

Next Page »