May 15 2025

Coinbase data breach highlights significant vulnerabilities in the cryptocurrency industry

Category: Crypto,Data Breach,Information Security,Security Breach — disc7 @ 9:31 am

Coinbase‘s recent data breach, estimated to cost between $180 million and $400 million, wasn’t caused by a technological failure, but rather by a sophisticated social engineering attack. Cybercriminals bribed offshore support agents to obtain sensitive customer data, including personally identifiable information (PII), government IDs, bank details, and account information.

This highlights a critical breakdown in Coinbase‘s internal security, specifically in access control and oversight of its contractors. No cryptocurrency was stolen directly, but the exposure of such sensitive data poses significant risks to affected customers, including identity theft and financial fraud. The financial repercussions for Coinbase are substantial, encompassing remediation costs and customer reimbursements. The incident raises serious questions about the security practices within the cryptocurrency industry and whether the term “innovation” appropriately describes practices that expose users to such significant risks.

Impact and Fallout

While no cryptocurrency was stolen, the breach exposed sensitive customer information, such as names, bank account numbers, and routing numbers . This exposure poses risks of identity theft and fraud. Coinbase has estimated potential costs for cleanup and customer reimbursements to be between $180 million and $400 million. The breach has also led to increased regulatory scrutiny and potential legal challenges .

Broader Implications

This incident highlights a critical issue in the crypto industry: the reliance on human factors and inadequate security training. Despite advanced technological safeguards, human error remains a significant vulnerability. The breach was not due to a failure in technology but rather a breakdown in trust, access control, and oversight. It raises questions about the industry’s approach to security and whether current practices are sufficient to protect users .

Moving Forward

The Coinbase breach serves as a wake-up call for the crypto industry to reevaluate its security protocols, particularly concerning employee training and access controls. It underscores the need for robust security measures that address not only technological vulnerabilities but also human factors. As the industry continues to evolve, prioritizing comprehensive security strategies will be essential to maintain user trust and ensure the integrity of crypto platforms.

The scale of the breach and its potential long-term consequences for customers and the reputation of Coinbase are considerable, prompting discussions about necessary improvements in security protocols and regulatory oversight within the cryptocurrency space.

Coinbase faces $400M bill after insider phishing attack

Here are some countermeasures to prevent similar incidents from happening again.

To prevent future breaches like the recent Coinbase incident, a multi-pronged approach is necessary, focusing on both technological and human factors. Here’s a breakdown of potential countermeasures:

Enhanced Security Measures:

  • Multi-Factor Authentication (MFA): Implement robust MFA across all systems and accounts, making it mandatory for all employees and contractors. This adds an extra layer of security, making it significantly harder for unauthorized individuals to access accounts, even if they obtain credentials.
  • Zero Trust Security Model: Adopt a zero-trust architecture, assuming no user or device is inherently trustworthy. This involves verifying every access request, regardless of origin, using continuous authentication and authorization mechanisms.
  • Regular Security Audits and Penetration Testing: Conduct frequent and thorough security audits and penetration testing to identify and address vulnerabilities before malicious actors can exploit them. These assessments should cover all systems, applications, and infrastructure components.
  • Employee Training and Awareness Programs: Implement comprehensive security awareness training programs for all employees and contractors. This should cover topics like phishing scams, social engineering tactics, and safe password practices. Regular refresher courses are essential to maintain vigilance.
  • Access Control and Privileged Access Management (PAM): Implement strict access control policies, limiting access to sensitive data and systems based on the principle of least privilege. Use PAM solutions to manage and monitor privileged accounts, ensuring that only authorized personnel can access critical systems.
  • Data Loss Prevention (DLP): Deploy DLP tools to monitor and prevent sensitive data from leaving the organization’s control. This includes monitoring data transfers, email communications, and cloud storage access.
  • Blockchain-Based Security Solutions: Explore the use of blockchain technology to enhance security. This could involve using blockchain for identity verification, secure data storage, and tamper-proof audit trails.
  • Threat Intelligence and Monitoring: Leverage threat intelligence feeds and security information and event management (SIEM) systems to proactively identify and respond to potential threats. This allows for early detection of suspicious activity and enables timely intervention.

Improved Contractor Management:

  • Background Checks and Vetting: Conduct thorough background checks and vetting processes for all contractors, particularly those with access to sensitive data. This should include verifying their identity, credentials, and past employment history.
  • Contractual Obligations: Clearly define security responsibilities and liabilities in contracts with contractors. Include clauses outlining penalties for data breaches and non-compliance with security policies.
  • Regular Monitoring and Oversight: Implement robust monitoring and oversight mechanisms to track contractor activity and ensure compliance with security protocols. This could involve regular audits, access reviews, and performance evaluations.
  • Secure Communication Channels: Ensure that all communication with contractors is conducted through secure channels, such as encrypted email and messaging systems.

Regulatory Compliance:

  • Adherence to Data Protection Regulations: Strictly adhere to relevant data protection regulations, such as GDPR and CCPA, to ensure compliance with legal requirements and protect customer data.

By implementing these countermeasures, organizations can significantly reduce their risk of experiencing similar breaches and protect sensitive customer data.

The Ultimate Guide to Staying Safe from Cryptocurrency Scams and Hacks

From Cartels to Crypto: The digitalisation of money laundering

Lazarus APT Laundered Over $900 Million Worth of Cryptocurrency

Attackers hit software firm Retool to get to crypto companies and assets

7 Rules Of Risk Management For Cryptocurrency Users

Hackers use Rilide browser extension to bypass 2FA, steal crypto

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Coinbase, cryptocurrency

Feb 14 2025

DOGE: A National Security Cyber Breach

Category: Data Breach,Security Breach — disc7 @ 9:22 am

In a recent series of events, the U.S. government has faced significant security breaches, not from external cyberattacks, but through actions initiated by the Department of Government Efficiency (DOGE), a newly established entity led by a billionaire with an ambiguous governmental role. These breaches have profound implications for national security.

Initially, individuals associated with DOGE accessed the U.S. Treasury’s computer systems, granting them the capability to collect data on and potentially control approximately $5.45 trillion in annual federal payments. Subsequently, unauthorized DOGE personnel obtained classified information from the U.S. Agency for International Development, possibly transferring it to their own systems. Following this, the Office of Personnel Management (OPM), which maintains detailed personal data on millions of federal employees, including those with security clearances, was compromised. Additionally, Medicaid and Medicare records were breached.

In another alarming incident, partially redacted names of CIA employees were transmitted via an unclassified email account. DOGE personnel have also been reported to input Education Department data into artificial intelligence software and have commenced operations within the Department of Energy.

On February 8, a federal judge intervened, prohibiting the DOGE team from further accessing Treasury Department systems. However, given that DOGE operatives may have already copied data and altered software, the effectiveness of this injunction remains uncertain. Without strict adherence to established security protocols by federal employees, further breaches of critical government systems are anticipated.

The systems compromised by DOGE are integral to the nation’s infrastructure. For instance, the Treasury Department’s systems contain detailed blueprints of federal financial operations, while the OPM network holds comprehensive information on government personnel and contractors.

What sets this situation apart is the method of breach. Unlike traditional foreign adversaries who employ stealth and spend years infiltrating government systems, DOGE operatives, with limited experience and oversight, are openly accessing and modifying some of the United States’ most sensitive networks. This not only introduces potential new security vulnerabilities but also involves the dismantling of essential security measures, such as incident response protocols and auditing mechanisms, by replacing seasoned officials with inexperienced personnel.

A fundamental security principle, known as “separation of duties,” has been undermined in these instances. This principle ensures that no single individual has unchecked power over critical systems, requiring multiple authorized personnel to collaborate on significant actions. The erosion of this safeguard poses a substantial risk to national security.

For further details, access the article here

Elon Musk’s DOGE Posts Classified Data On Its New Website

Anyone Can Push Updates to the DOGE.gov Website

‘Experts left database open’: Hackers mock Elon Musk after easily defacing his DOGE site

DOGE Team Raises Major Cyber Security Concerns

Young engineers pose ‘the single greatest insider threat risk the Bureau has ever faced’ as experts warn of cybersecurity breaches

 Congressman Robert Garcia makes ‘A Minor’ Barb At DOGE

The Data Protection Guidebook: A Survey of U.S. Federal and State Laws, Statutes, and Regulations Governing Data Breach Notification, Biometric Information, Cybersecurity, and Data Privacy

Hackers are getting quicker—48 minutes is all it takes for a breach.

A Hacker’s Mind: How the Powerful Bend Society’s Rules, and How to Bend them Back

New regulations and AI hacks drive cyber security changes in 2025

Hackers will use machine learning to launch attacks

VNC Is The Hacker’s New Remote Desktop Tool For Cyber Attacks

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: Cyber Intrusion, data breach, data privacy, data protection, DOGE, National security

Jan 30 2025

Hackers are getting quicker—48 minutes is all it takes for a breach.

Category: Hacking,Security Breach — disc7 @ 3:06 pm

Cybercriminals are becoming alarmingly faster at breaching networks, with the average time to compromise a system now just 48 minutes. This rapid escalation means organizations have even less time to detect and respond to attacks before significant damage occurs. The speed at which hackers operate underscores the urgent need for real-time threat detection and automated security responses to minimize risk and disruption.

One of the key drivers behind this increased efficiency is the use of AI and automation by attackers. Cybercriminals are leveraging advanced tools to scan for vulnerabilities, deploy malware, and escalate privileges within minutes. Traditional cybersecurity approaches that rely on manual detection and response are no longer sufficient. Organizations must adopt AI-driven defense mechanisms that can detect threats instantly and initiate automated countermeasures.

The rise of ransomware-as-a-service (RaaS) has also contributed to the growing speed of attacks. Even less-skilled hackers can now launch highly effective cyberattacks, thanks to pre-packaged hacking tools available on the dark web. This democratization of cybercrime means that businesses of all sizes are at risk, making proactive security strategies and employee awareness training essential.

 “breakout time is the most critical window in an attack,” as successful threat containment at this stage prevents consequences “such as data exfiltration, ransomware deployment, data loss, reputational damage, and financial loss,” 

To stay ahead, companies must prioritize cybersecurity resilience, implementing zero-trust security models, continuous monitoring, and AI-enhanced threat detection. The 48-minute rule highlights a new reality—if an organization is not prepared to detect and respond to threats in real time, it risks catastrophic breaches. Cybersecurity is no longer about reacting after an attack; it’s about preventing compromise before it happens.

For further details, access the article here.

A Hacker’s Mind: How the Powerful Bend Society’s Rules, and How to Bend them Back

New regulations and AI hacks drive cyber security changes in 2025

Hackers will use machine learning to launch attacks

VNC Is The Hacker’s New Remote Desktop Tool For Cyber Attacks

THE PATH TO A PENTESTING CAREER (A BLUEPRINT FOR ASPIRING WHITE HATS)

Hackers Hijack Facebook Pages To Mimic AI Brands & Inject Malware

170K+ Python Developers GitHub Accounts Hacked In Supply Chain Attack

HackerGPT – A ChatGPT-Powered AI Tool for Ethical Hackers & Cyber Security Community

7 hacking tools that look harmless but can do real damage

SYSTEM HACKING, SCRIPTING, AND OTHER CONTRONYMS IN CYBERSECURITY

11 WAYS OF HACKING INTO CHATGPT LIKE GENERATIVE AI SYSTEMS

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot | Comprehensive vCISO Services | ISMS Services | Security Risk Assessment Services

Tags: breach, hackers

Oct 10 2024

This Hacker Toolkit Can Breach Any Air-Gapped System – Here’s How It Works

Category: Data Breach,Security Breach — disc7 @ 11:47 am
This Hacker Toolkit Can Breach Any Air-Gapped System – Here’s How It Works

The article discusses a newly developed hacker toolkit designed to compromise air-gapped systems, which are typically isolated from external networks for security purposes. This toolkit exploits electromagnetic waves and ultrasonic sound to covertly transmit data between air-gapped machines and attacker-controlled devices nearby, bypassing the lack of direct network connections.

The toolkit specifically targets vulnerabilities in hardware components, such as CPUs, which emit electromagnetic radiation during operation. Hackers can capture and manipulate these emissions to extract sensitive information like encryption keys and passwords without direct access to the system.

It also highlights how the toolkit leverages ultrasonic waves for data transmission. These inaudible sound waves can travel through the air to communicate with nearby devices, enabling a two-way exchange of information between an isolated system and the hacker’s equipment. This sophisticated method of attack can operate without needing to install traditional malware on the air-gapped machine.

The article emphasizes the significance of this emerging threat, as it poses risks to organizations that rely heavily on air-gapped systems for critical infrastructure protection. Even advanced security measures may not fully mitigate the risk from such unconventional attack vectors, underscoring the need for continuous adaptation in cybersecurity defenses.

For more details, visit Security Newspaper.

European govt air-gapped systems breached using custom malware

Mind The Gap: Can Air-Gaps Keep Your Private Data Secure?

The Black Box Hacker’s Toolkit: Techniques for Successful Pen Testing

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: Air-Gapped System, Hacker Toolkit

Jun 13 2024

Microsoft President Admits to Major Security Failures

Category: Security Breach — disc7 @ 3:25 pm

Brad Smith Says the Tech Giant ‘Accepts Responsibility’ for Cyber Breaches

https://www.databreachtoday.co.uk/microsoft-president-admits-to-major-security-failures-a-25515

Microsoft President Brad Smith during a tense U.S. congressional hearing Thursday acknowledged responsibility for a series of security failures that facilitated multiple high-profile state-sponsored cyberattacks targeting government institutions and the company itself.

Lawmakers on the House Committee on Homeland Security grilled Smith over Microsoft’s failure to address critical vulnerabilities and its mishandling of whistleblower warnings, which they argued led to the SolarWinds attack and other major breaches that federal cyber authorities say could have been avoided.

Rep. Mark Green, R-Tenn., who chairs the committee, described recent federal findings about Microsoft’s security blunders as “extremely concerning” and said the company’s “underinvestment in essential security measures exposed critical vulnerabilities.”

“Microsoft is deeply integrated into our nation’s digital infrastructure,” Green said, adding that the company has a “heightened responsibility” to ensure federal systems are protected from intrusion.

The hearing took place the same day ProPublica released a bombshell report alleging Microsoft ignored warnings from a whistleblower about a critical vulnerability that left the company susceptible to Russian hackers for several years. The whistleblower left the company in August 2020 out of frustration with its handling of the security flaw that ultimately facilitated Russia’s attack against SolarWinds just months later.

The federally empaneled Cyber Safety Review Board in a report published following a seven-month probe of the company’s security practices blamed Microsoft’s corporate culture for deprioritizing enterprise security investments and allowing preventable security breaches.

“Before I say anything else, I think it’s especially important for me to say that Microsoft accepts responsibility for each and every one of the issues cited in the CSRB’s report,” Smith said in his prepared opening remarks, adding: “Without equivocation or hesitation.”

The Russian state hacking group tracked as Midnight Blizzard, also known as APT29 and CozyBear, breached senior Microsoft executives’ email inboxes after using an unsophisticated hacking technique (see: Microsoft’s Latest Hack Sparks Major Security Concerns). The incident came less than a year after Microsoft disclosed that a group of Chinese hackers breached customers’ email systems as part of a cyberespionage campaign targeting federal agencies and other major organizations.

Lawmakers on both sides of the political aisle expressed doubts over whether Microsoft has been fully transparent with its customers and the federal government in the wake of recent security breaches. The ProPublica report published Thursday says that Smith testified to the Senate Intelligence Committee in 2017 that Microsoft became aware of the flaw leading to the SolarWinds attack only after the cybersecurity firm CyberArk published a blog post describing the exploit, known as Golden SAML.

“My concerns about whether we can rely on Microsoft to be transparent were heightened this morning when I read a ProPublica article about how an employee alerted Microsoft’s leadership to a vulnerability,” said ranking member Rep. Bennie Thompson, D-Mo. “That vulnerability was ultimately used by Russian hackers to carry out secondary phases of the SolarWinds attack in 2020.”

“Transparency is the foundation of trust, and Microsoft needs to be more transparent,” he said.

In response, Smith testified that Microsoft has made changes to its corporate governance structure to improve enterprisewide cybersecurity efforts and “integrate security into every process.” The company has added deputy CISOs to each of its components as part of its Secure Future Initiative, Smith said. The company launched the initiative in November 2023 (see: Microsoft Overhauls Security Practices After Major Breaches).

Smith also told lawmakers he is not aware of any vulnerabilities within Microsoft’s operating system that could affect government networks and said the company was “focused on identifying every vulnerability our employees can find.”

AJ Grotto, director of Stanford University’s geopolitics, technology and governance program and former senior White House director for cyber policy, said Microsoft “uses restrictive licensing to dominate the public sector” despite repeatedly putting federal networks in harm’s way.

“We’ve become accustomed to security flaws in Microsoft’s products, followed by promises from Microsoft to improve security, only to have the cycle repeat – with no consequences for Microsoft,” Grotto said in a statement sent to Information Security Media Group. Grotto urged lawmakers to demand the company “develop and share with Congress a plan for diversifying its exposure to cybersecurity risk.”

Smith told the House committee Microsoft has begun implementing 16 of the CSRB’s recommendations that apply directly to the company and added an additional 18 security measures to help improve its overall cyber posture.

Asked directly about the risk associated with the federal government’s reliance on a single technology vendor, Smith acknowledged potential concerns but said a network with too many players could be equally problematic.

“Just as there is risk relying on one vendor, there are risks in relying on multiple vendors,” Smith said. “Fundamentally, whether you have one vendor or multiple, the problem is similar – we all need to work together and just keep making progress.”

Microsoft President Brad Smith testifies before the House Committee on Homeland Security on June 13, 2024.

Big Breaches: Cybersecurity Lessons for Everyone

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: Major Security Failures, Microsoft

Jun 12 2024

20,000 FortiGate appliances compromised by Chinese hackers

Category: Hacking,Security Breach — disc7 @ 7:43 am
20,000 FortiGate appliances compromised by Chinese hackers

How Coathanger persists on FortiGate devices

In February 2024, the Dutch Military Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) made it known that Chinese state-sponsored hackers breached the Dutch Ministry of Defense in 2023 by exploiting a known FortiOS pre-auth RCE vulnerability (CVE-2022-42475), and used novel remote access trojan malware to create a persistent backdoor.

The RAT was dubbed Coathanger and found to be capable of surviving reboots and firmware upgrades. It’s also difficult to detect its presence by using FortiGate CLI commands, and to remove it from compromised devices.

The security services shared indicators of compromise and a variety of detection methods in an advisory, and explained that “the only currently identified way of removing [it] from an infected FortiGate device involves formatting the device and reinstalling and reconfiguring the device.”

They also attributed the intrusion and the malware to a Chinese cyber-espionage group.

A widespread campaign

On Monday, the Dutch National Cyber Security Center said that the MIVD continued to investigate the campaign, and found that:

  • The threat actor gained access to at least 20,000 FortiGate systems worldwide within a few months in both 2022 and 2023
  • They exploited the FortiOS vulnerability (CVE-2022-42475) as a zero-day, at least two months before Fortinet announced it

“During this so-called ‘zero-day’ period, the actor alone infected 14,000 devices. Targets include dozens of (Western) governments, international organizations and a large number of companies within the defense industry,” the NCSC said.

The threat actor installed the Coathanger malware at a later time, on devices of relevant targets.

“It is not known how many victims actually have malware installed. The Dutch intelligence services and the NCSC consider it likely that the state actor could potentially expand its access to hundreds of victims worldwide and carry out additional actions such as stealing data,” they said, and added that given the difficult discovery and clean-up process, “it is likely that the state actor still has access to systems of a significant number of victims.”

Another problem is that the Coathanger malware can be used in combination with any present or future vulnerability in FortiGate devices – whether zero- or N-day.

Advice for organizations

“Initial compromise of an IT network is difficult to prevent if the attacker uses a zero-day. It is therefore important that organizations apply the ‘assume breach’ principle,” the NCSC opined.

“This principle states that a successful digital attack has already taken place or will soon take place. Based on this, measures are taken to limit the damage and impact. This includes taking mitigating measures in the areas of segmentation, detection, incident response plans and forensic readiness.”

(In the attack targeting the Dutch MoD, the effects of the intrusion were limited due to effective network segmentation.)

Finally, the NCSC noted that the problem is not specifically Fortinet appliances, but “edge” devices – firewalls, VPN servers, routers, SMTP servers, etc. – in general.

“Recent incidents and identified vulnerabilities within various edge devices show that these products are often not designed according to modern security-by-design principles,” they said. Because almost every organization has one or more edge devices deployed, they added, it pays for threat actors to look for vulnerabilities affecting them.

The NCSC has, therefore, published helpful advice on how organizations should deal with using edge devices.

The Hacker and the State: Cyber Attacks and the New Normal of Geopolitics 

InfoSec services | InfoSec books | Follow our blog | DISC llc is listed on The vCISO Directory | ISO 27k Chat bot

Tags: Chinese hackers, FortiGate appliances, The Hacker and the State

Mar 20 2023

NBA Cyber Incident – Fans’ Personal Information Exposed

Category: Data Breach,PII,Security Breach — DISC @ 12:05 pm
NBA Cyber Incident – Fans’ Personal Information Exposed

As a result of a recent data breach, the NBA notified all its fans about the fact that a significant amount of personal information was compromised.

While using the information gathered, phishing attacks can be conducted by the threat actors on the individuals who have been affected. A third-party newsletter service was said to be holding the personal information exposed in the leak.

In addition to managing five professional sports leagues, the NBA also manages a media organization. And here below, we have listed those five sports leagues:-

  • NBA
  • WNBA
  • Basketball Africa League
  • NBA G League
  • NBA 2K League

In over 215 countries and territories worldwide, with over 50 languages spoken, NBA programming and games are broadcast worldwide.

NBA Cyber Incident

A number of fans have been notified of the cyber security incident through an email sent out with the tag “Notice of Cybersecurity Incident.”

According to the NBA, neither its systems nor the credentials of the fans affected by the incident were compromised. But, some theft of the personal information belonged to some fans.

Further, the association reported that the names and email addresses were accessed and copied by an unauthorized third party. But, in this instance, sensitive information, such as usernames and passwords, was not exposed.

Apart from this, a third-party provider and an external cybersecurity service are being engaged by the NBA to assist in the investigation of the issue to know the extent of the impact and resolve the issue as soon as possible.

NBA warned fans of phishing attacks

NBA warned that phishing attacks and various scams could be targeted at the affected individuals due to the sensitive nature of the data involved, reported Bleeping Computer.

It was strongly recommended to the affected fans that they remain vigilant when they open any suspicious emails that they receive. In the notification emails, the NBA informs fans that it will never send them an email asking for any of this information:-

  • Other account information
  • Usernames
  • Passwords

It is also recommended for fans who have been impacted verify the authenticity of any emails they receive by ensuring that the sender’s email address ends with “@nba.com.” 

Check that the embedded links point to a trustworthy website, and don’t open email attachments that they haven’t been expecting to receive.

NBA Cyber Incident

NBA warns fans over data breach, personal details copied

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: NBA Cyber Incident

Mar 16 2023

Multiple threat actors exploited Progress Telerik bug to breach U.S. federal agency

Category: Data Breach,Security Breach — DISC @ 9:00 am
Multiple threat actors exploited Progress Telerik bug to breach U.S. federal agency

Multiple threat actors exploited a critical flaw in Progress Telerik to breach an unnamed US federal agency, said the US government.

A joint advisory issued by the Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), and Multi-State Information Sharing and Analysis Center (MS-ISAC) revealed that multiple threat actors, including a nation-state actor, exploited a critical vulnerability in Progress Telerik to breach an unnamed US federal agency.

The three-year-old vulnerability, tracked as CVE-2019-18935 (CVSS score: 9.8), is a .NET deserialization issue that resides in the Progress Telerik UI for ASP.NET AJAX. Exploitation can result in remote code execution.

“CISA analysts determined that multiple cyber threat actors, including an Advanced Persistent Threat (APT) actor, exploited a .NET deserialization vulnerability in Progress Telerik user interface for ASP.NET AJAX. Exploitation of this vulnerability allowed malicious actors to successfully execute remote code on a federal civilian executive branch (FCEB) agency’s Microsoft Internet Information Services (IIS) web server.” reads the advisory. “Actors were then able to upload malicious dynamic-link library (DLL) files (some masqueraded as portable network graphics [PNG] files) to the C:\Windows\Temp\ directory.” 

Threat actors exploited the vulnerability to execute arbitrary code on a Microsoft Internet Information Services (IIS) web server used by a federal civilian executive branch (FCEB) agency.

In 2020 and 2021, this flaw was included by the US National Security Agency (NSA) in the list of the top 25 vulnerabilities exploited by Chinese state-sponsored hacking groups in attacks in the wild.

The flaw was also used in the past by the NetWalker ransomware gang in its operations.

The joint alert recommends network defenders review the Malware Analysis Report, MAR-10413062-1.v1 Telerik Vulnerability in U.S. Government IIS Server, to reference CISA’s analysis for the identified malicious files.

According to the MAR, CISA received 18 files for analysis from a forensic analysis engagement conducted at a Federal Civilian Executive Branch (FCEB) agency. Experts reported that 11 of the dynamic link library (DLL) files employed in the attack allows threat actors to read, create, and delete files on the target systems.

“If the DLL contains a hardcoded Internet Protocol (IP) address, status messages will be sent to the IP. One DLL file will attempt to collect the target system’s Transmission Control Protocol (TCP) connection table, and exfiltrate it to a remote Command and Control server (C2).” reads the MAR. “Five of the files drop and decode a reverse shell utility that can send and receive data and commands. In addition, the files drop and decode an Active Server Pages (ASPX) webshell. Two DLL files are capable of loading and executing payloads.”

US CISA has also provided Indicators of Compromise (IOCs) and YARA rules for detection in the Malware Analysis Report (MAR).

CISA Known Exploited Vulnerabilities Catalog Progress Telerik bug

Tags: Telerik bug, U.S. federal agency

Mar 10 2023

US Lawmakers Face Cyberattacks, Potential Physical Harm After DC Health Link Breach

Category: Cyber Attack,Data Breach,Information Security,Security Breach — DISC @ 12:24 pm

The threat actor who posted the data for sale has claimed credit for multiple other breaches, including one at grocery platform Weee! that exposed data on more than 1.1 million customers.

Jai VijayanContributing Writer, Dark Reading

US House of Representatives seal
Source: Ron Adar via Shutterstock

Hundreds of US lawmakers and their families are at risk of identity theft, financial scams, and potentially even physical threats after a known info-theft threat actor called IntelBroker made House of Representatives members’ personally identifiable information (PII) available for sale on the “Breached” criminal forum.

The information, confirmed as being obtained via a breach at health insurance marketplace DC Health Link, includes names, Social Security numbers, birth dates, addresses, and other sensitive identifying information. The data on the House members was part of a larger data set of PII belonging to more than 170,000 individuals enrolled with DC Health Link that the threat actor put up for sale this week.

DC Health Link: A Significant Breach

In a March 8 email to members of the House and their staff, US House Chief Administrative Officer Catherine Szpindor said the attack on DC Health Link does not appear to have specifically targeted US lawmakers. But the breach was significant and potentially exposed PII on thousands of people enrolled with DC Health Link.

“The FBI also informed us that they were able to purchase this PII, along with other enrollee information, on the Dark Web,” Speaker of the House Kevin McCarthy (R-Calif.) and House Minority Leader Hakeem Jeffries (D-N.Y.) said in a joint letter to the executive director at DC Health Link on March 8. The letter sought specifics from the health exchange on the breach, including details on the full scope of the attack and DC Health Link’s plans to notify affected individuals and offer credit monitoring services for them.

Despite the letter, details of the intrusion at DC Health Link are not yet available. The organization, governed by an executive board appointed by the DC mayor, did not immediately respond to a request for comment on the incident.

A report in BleepingComputer this week first identified the threat actor as the appropriately named IntelBroker, after the cybercriminals put the stolen data up for sale on March 6. According to the underground forum ad, the data set is available for “an undisclosed amount in Monero cryptocurrency.” Interested parties are asked to contact the sellers via a middleman for details.

IntelBroker’s Resume of Previous Breaches

This is not the first big heist for the group: A threat actor, using the same moniker in February, had claimed credit for a breach at Weee!, an Asian and Hispanic food delivery service. IntelBroker later leaked some 1.1 million unique email addresses and detailed information on over 11.3 million orders placed via the service. 

Security vendor BitDefender, which covered the incident in its blog at the time, published an ad that IntelBroker placed on BreachedForums that showed the attacker boasting about obtaining full names, email addresses, phone number, and even order notes which included apartment and building access codes.

Meanwhile, Chris Strand, chief risk and compliance officer at Cybersixgill says his company has been tracking IntelBroker since 2022 and is about to release a report on the actor. “IntelBroker is a highly active Breached member with an 9/10 reputation score, who claimed in the past to be the developer of Endurance ransomware,” Strand says.

IntelBroker’s use of Breached to sell the health exchange PII, instead of a dedicated leak site or a Telegram channel, is consistent with the threat actor’s previous tactics. It suggests either a lack of resources or inexperience on the individual’s part, Strand says. 

“In addition to IntelBroker’s presence on Breached, the threat actor has maintained a public GitHub repository titled Endurance-Wiper,” he tells Dark Reading.

In November, IntelBroker claimed that it used Endurance to steal data from high level US government agencies, Strand notes. The threat actor has in total made some 13 claims about breaching top US government agencies, likely to attract customers to a ransomware-as-a-service (RaaS) program. Other organizations that IntelBroker claims to have broken into include Volvo, cult footwear maker Dr. Martens, and an Indonesian subsidiary of The Body Shop.

“Our intelligence analysts have been tracking IntelBroker since 2022, and we have been collecting intel attributed to that threat actor since then, as well as associated threats that have been related or attributed to IntelBroker,” Strand says.

Is House Members’ PII a National Security Threat?

Justin Fier, senior vice president of red team operations at Darktrace, says the threat actor’s reason for putting the data up for sale appears to be purely financially motivated rather than political. And given the high profile of the victims, IntelBroker may find that the attention the breach is garnering will increase the value of the stolen data (or bring more heat than it would like).

The buyers might be another story. Given the availability of physical addresses and electronic contact information, the kinds of potential follow-on attacks are myriad, ranging from social engineering for identity theft or espionage, to physical targeting, meaning that interested parties could run the gamut in terms of motivation.

“The amount tells you a great deal about who they may be thinking of in terms of buyers,” he says. If all that the threat actor ends up asking is a couple of thousand dollars, they are likely to be a smaller criminal enterprise. But “you start talking millions, they are clearly then catering to nation-state buyers,” he says.

Fier assesses that the data that the threat actor stole on US House members as potentially posing a national security issue. “We shouldn’t only think external nation-states that might want to purchase this,” Fier says. “Who is to say that other political parties and/or activists couldn’t weaponize it?”

https://www.darkreading.com/application-security/us-lawmakers-cyberattacks-physical-harm-dc-health-link-breach

Previous posts on Cyber Attacks

InfoSec Threats | InfoSec books | InfoSec tools | InfoSec services

Tags: Cyberattacks, US Lawmakers

Feb 22 2023

Login Details of Tech Giants Leaked in Two Data Center Hacks

Category: Hacking,Security Breach — DISC @ 9:54 am
Login Details of Tech Giants Leaked in Two Data Center Hacks

The leaked data includes email addresses, password hashes, names, phone numbers, and more.

Hackers obtained login credentials for several mainstream corporate giants, including Microsoft, Samsung, Uber and Apple, etc. and gained remote access to the entities’ surveillance cameras after attacking two data centers in Asia.

Two Data Centers Hacked- Login Credentials for Amazon, Apple, and BMW Stolen
A screenshot from the leaked data shows login credentials for Samsung, Amazon, Uber, Alibaba and more. (Credit: Hackread.com)

This was revealed by the cyber security firm Resecurity. The company originally identified the data breach in September 2021; however, details of it were only revealed to the media now as on February 20th, 2023, hackers leaked the stolen login credentials online.

It is worth noting that these credentials were leaked on Breachforums by a threat actor going by the handle of “Minimalman.” For your information, Breachforums is a hacker and cybercrime forum that surfaced as an alternative to the popular and now-seized Raidforums.

According to Resecurity, hackers accessed two of the largest data center operators in Asia that were being used by several mainstream companies and technology giants. From there, the hackers could obtain customer support logins for high-profile companies, including Amazon and Apple, BMW, Microsoft, Alibaba, Walmart, Goldman Sachs, etc.

As seen by Hackread.com on the hacker forum, the threat actors managed to obtain and leak credentials from over 2,000 firms and a Chinese foreign-exchange platform.

The data centers have been identified as Shanghai-based GDS Holdings and Singapore-based ST Telemedia Global. Both data centers reportedly forced all customers to change their passwords in January 2023.

Two Data Centers Hacked- Login Credentials for Amazon, Apple, and BMW Stolen

Dangers

The dangers of hackers obtaining login credentials of tech giants such as Apple, Amazon, Microsoft, Samsung and others are numerous and severe. Firstly, such credentials allow hackers to access sensitive customer data, including payment information and personal details, which can lead to identity theft and financial fraud.

Secondly, hackers can use these credentials to gain access to the company’s networks, potentially compromising intellectual property and trade secrets. Additionally, with access to company accounts, hackers can launch cyber attacks against other organizations, amplifying the damage caused by their actions.

Furthermore, a breach of a tech giant’s login credentials can have far-reaching consequences, impacting not only the company and its customers but the wider economy and society as a whole. For instance, if a company like Amazon were to suffer a significant data breach, it could lead to a loss of consumer trust, which could in turn affect the confidence of investors and the stock market.

Moreover, a successful hack of a tech giant’s credentials could inspire copycat attacks, leading to an escalation in cybercrime and potentially destabilizing the digital infrastructure that underpins much of our daily lives.

To mitigate these risks, tech giants must remain vigilant in their cybersecurity measures, ensuring that their systems are regularly updated and that their employees are trained to detect and prevent security breaches.

Companies must also invest in advanced technologies such as machine learning and artificial intelligence to detect and respond to cyber threats in real time. Finally, companies must ensure that they comply with industry standards and regulations related to cybersecurity, such as the General Data Protection Regulation (GDPR), to protect the privacy and security of their customers.

How to protect from Data Breach?

There are several steps you can take to protect yourself from a data breach:

  1. Use strong, unique passwords: Use different passwords for each of your accounts and make sure they are strong and difficult to guess. Consider using a password manager to keep track of your passwords.
  2. Enable two-factor authentication: Two-factor authentication adds an extra layer of security to your accounts by requiring you to provide a second form of identification, such as a code sent to your phone, in addition to your password.
  3. Keep your software up to date: Keep your operating system, web browser, and antivirus software up to date to ensure that they have the latest security updates.
  4. Be cautious of suspicious emails: Be wary of emails from unknown senders or emails that contain suspicious links or attachments. These could be phishing emails designed to trick you into giving away your personal information.
  5. Limit your personal information online: Be cautious about sharing personal information online, and only provide it when necessary. Consider using privacy settings on social media to limit who can see your information.
  6. Monitor your accounts: Keep an eye on your accounts for any suspicious activity and report anything out of the ordinary to the appropriate authorities or financial institutions.

By taking these steps, you can help protect yourself from a data breach and minimize the impact if one occurs.

Big Breaches: Cybersecurity Lessons for Everyone 

Previous posts on Security Breach


InfoSec Threats

Tags: Security Breach

Dec 15 2022

Microsoft-Signed Drivers Helped Hackers Breach System Defenses

Category: Data Breach,Hacking,Security Breach — DISC @ 10:12 am
Microsoft-Signed Drivers Helped Hackers Breach System Defenses

This is not the first time threat actors have used drivers signed by Microsoft in their operations, as we know it, and it seems that putting a stop to this practice has not been an easy task for Microsoft.

Evidence suggests that the Cuba ransomware gang used malicious hardware drivers certified by Microsoft’s Windows Hardware Developer Program in an attempted ransomware attack.

Remember when, in 2021, a report surfaced that revealed Microsoft had signed a driver called Netfilter, and later it turned out it contained malware? Well, it has happened again, but on a larger scale.

Sophos X-Ops Rapid Response (RR) recently discovered evidence which proves that threat actors potentially belonging to the Cuba ransomware gang used malicious hardware drivers certified by Microsoft’s Windows Hardware Developer Program in an attempted ransomware attack. 

Drivers — the software that allows operating systems and apps to access and communicate with hardware devices — require highly privileged access to the operating system and its data, which is why Windows requires drivers to bear an approved cryptographic signature before allowing the driver to load.

However, cybercriminals have long since found approaches to exploit vulnerabilities found in existing Windows drivers from legitimate software publishers. These hackers make an effort to progressively move up the trust pyramid, using increasingly well-trusted cryptographic keys to digitally sign their drivers. 

Sophos along with researchers from Google-owned Mandiant and SentinelOne warned Microsoft about these signed malicious drivers which were being planted into targeted machines using a variant of the BurntCigar loader utility. These two then worked in tandem to kill processes associated with antivirus (AV) and endpoint detection and response (EDR) products. 

“Ongoing Microsoft Threat Intelligence Center analysis indicates the signed malicious drivers were likely used to facilitate post-exploitation intrusion activity such as the deployment of ransomware,” Microsoft said in an advisory published as part of its monthly scheduled release of security patches, known as Patch Tuesday.

Microsoft approved Driver Malware Used To Bypass System Security
On left is a valid signature identified by Mandiant – On the right is a valid signature identified by Sophos

Microsoft concluded its investigation by stating that “no compromise has been identified,” and proceeded to suspend the partners’ seller accounts. Moreover, they released Windows security updates to revoke the abused certificates. 

Mandiant’s report is available here. In SentinelOne’s blog post, the security firm reported that it had seen several attacks where a threat actor used malicious signed drivers to evade security products which usually trust components signed by Microsoft.

The threat actors were observed to be targeting organisations in the business process outsourcing (BPO), telecommunications, entertainment, transportation, MSSP, financial and cryptocurrency sectors and in some instances, SIM swapping was the end goal.

Microsoft approved Driver Malware Used To Bypass System Security
Code signing overview

Cuba Ransomware group was identified to be involved in gaining $60 million from attacks against 100 organisations globally, according to a joint advisory earlier this month from the US Cybersecurity and Infrastructure Security Agency (CISA) and the FBI.

The advisory also included warnings regarding the ransomware group which has been active since 2019 and continues to attack US entities in critical infrastructure, including financial services, government facilities, healthcare and public health, and critical manufacturing and information technology.

This is not the first time threat actors have used drivers signed by Microsoft in their operations, as we know it, and it seems that putting a stop to this practice has not been an easy task for Microsoft.

Tags: Microsoft-Signed Drivers

Sep 18 2022

Uber Downplays Data Breach Impact, Claims No Sensitive Data Stolen

Category: Data Breach,Security Breach — DISC @ 9:40 am
Uber Downplays Data Breach Impact, Claims No Sensitive Data Stolen

Uber Downplays Data Breach Impact, Claims No Sensitive Data Stolen – Uber is downplaying a data breach that occurred on Thursday, saying that no sensitive data was exposed.

Uber Downplays Data Breach Impact, Claims No Sensitive Data Stolen

Tags: Uber Data Breach

Sep 01 2022

List of Data Breaches and Cyber Attacks in August 2022 – 97 Million Records Breached

Category: Cyber Attack,Data Breach,data security,Information Security,Security Breach — DISC @ 9:01 am

August 2022 has been a lesson in being careful with whom you provide sensitive information. In a month that saw the former US president accused of misappropriating classified government documents, there were also a spate of malicious insiders compromising their employer’s systems.

Meanwhile, the bastion of password security, LastPass, announced that its systems had been breached – although the organisation is confident that customers’ details remain secure.

In total, we identified 112 publicly disclosed security incidents in August, resulting in 97,456,345 compromised records.

You can find the full list of incidents below, broken into their respective categories.

Contents

Data Breaches

Data Security

Free Basic network and Data Security Awareness

Tags: data breach, data security, infosec breach

Aug 10 2022

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see

Category: Cryptograghy,Data Breach,Security Architecture,Security Breach,Security vulnerabilities — DISC @ 10:50 pm

Here’s this week’s BWAIN, our jocular term for a Bug With An Impressive Name.

BWAIN is an accolade that we hand out when a new cybersecurity flaw not only turns out to be interesting and important, but also turns up with its own logo, domain name and website.

This one is dubbed ÆPIC Leak, a pun on the words APIC and EPIC.

The former is short for Advanced Programmable Interrupt Controller, and the latter is simply the word “epic”, as in giant, massive, extreme, mega, humongous.

The letter Æ hasn’t been used in written English since Saxon times. Its name is æsc, pronounced ash (as in the tree), and it pretty much represents the sound of the A in in the modern word ASH. But we assume you’re supposed to pronounce the word ÆPIC here either as “APIC-slash-EPIC”, or as “ah!-eh?-PIC”.

What’s it all about?

All of this raises five fascinating questions:

  • What is an APIC, and why do I need it?
  • How can you have data that even the kernel can’t peek at?
  • What causes this epic failure in APIC?
  • Does the ÆPIC Leak affect me?
  • What to do about it?

What’s an APIC?

Let’s rewind to 1981, when the IBM PC first appeared.

The PC included a chip called the Intel 8259A Programmable Interrupt Controller, or PIC. (Later models, from the PC AT onwards, had two PICs, chained together, to support more interrupt events.)

The purpose of the PIC was quite literally to interrupt the program running on the PC’s central processor (CPU) whenever something time-critical took place that needed attention right away.

These hardware interrupts included events such as: the keyboard getting a keystroke; the serial port receiving a character; and a repeating hardware timer ticking over.

Without a hardware interrupt system of this sort, the operating system would need to be littered with function calls to check for incoming keystrokes on a regular basis, which would be a waste of CPU power when no one was typing, but wouldn’t be responsive enough when they did.

As you can imagine, the PIC was soon followed by an upgraded chip called the APIC, an advanced sort of PIC built into the CPU itself.

These days, APICs provide much more than just feedback from the keyboard, serial port and system timer.

APIC events are triggered by (and provide real-time data about) events such as overheating, and allow hardware interaction between the different cores in contemporary multicore processors.

And today’s Intel chips, if we may simplifly greatly, can generally be configured to work in two different ways, known as xAPIC mode and x2APIC mode.

Here, xAPIC is the “legacy” way of extracting data from the interrupt controller, and x2APIC is the more modern way.

Simplifying yet further, xAPIC relies on what’s called MMIO, short for memory-mapped input/output, for reading data out of the APIC when it registers an event of interest.

In MMIO mode, you can find out what triggered an APIC event by reading from a specific region of memory (RAM), which mirrors the input/output registers of the APIC chip itself.

This xAPIC data is mapped into a 4096-byte memory block somewhere in the physical RAM of the computer.

This simplifies accessing the data, but it requires an annoying, complex (and, as we shall see, potentially dangerous) interaction between the APIC chip and system memory.

In contrast, x2APIC requires you to read out the APIC data directly from the chip itself, using what are known as Model Specific Registers (MSRs).

According to Intel, avoiding the MMIO part of the process “provides significantly increased processor addressability and some enhancements on interrupt delivery.”

Notably, extracting the APIC data directly from on-chip registers means that the total amount of data supported, and the maximum number of CPU cores that can be managed at the same time, is not limited to the 4096 bytes available in MMIO mode.

APIC/EPIC! Intel chips leak secrets even the kernel shouldn’t see…

Tags: Cryptography, Data loss

Jul 28 2022

Experts warn of hacker claiming access to 50 U.S. companies through breached MSP

Category: Hacking,Security Breach — DISC @ 2:23 pm
Experts warn of hacker claiming access to 50 U.S. companies through breached MSP

Experts warn of hacker claiming access to 50 U.S. companies through breached MSP

Cybersecurity experts are raising concerns about an individual on a hacker forum claiming to have access to 50 American companies through an unnamed managed service provider (MSP).

MSPs are paid to manage IT infrastructure and provide support, typically by smaller organizations lacking their own IT departments. In recent years they have been singled out by cybersecurity agencies as potentially vulnerable access points for hackers to exploit.

Harlan Carvey, senior incident responder at cybersecurity firm Huntress, told The Record that on July 18 someone with the handle “Beeper” had posted in Russian on exploit.in asking for help monetizing access to a managed service provider.

“Looking for a Partner for MSP processing. I have access to the MSP panel of 50+ companies. Over 100 ESXi, 1,000+ servers … I want to work qualitatively, but I do not have enough people,” the translated message said.

“In terms of preparation, only little things are left, so my profit share will be high. Please send me a message for more details and suggestions.”

https://therecord.media/experts-warn-of-hacker-claiming-access-to-50-u-s-companies-through-breached-msp/

Several cybersecurity experts have shared the message on Twitter and other social media sites warning of the potential fallout from the kind of access the hacker purportedly has. 

Carvey said it appears that the hacker gained access to an MSP’s management system and has already done some of the initial legwork.

“It sounds as if they’re claiming to have done some pre-work, perhaps something like identifying an account with a high privilege level. As a result, anyone who takes them up on their offer isn’t going to have to do much ‘heavy lifting’ to achieve whatever their goals may be,” Carvey said. “It doesn’t appear that there’s any data involved at this point, per se. Intent isn’t clear at this point, and it may depend upon who responds to the ad. The original poster does seem to be offering to answer questions and provide additional details.”

Carvey added that based on the typical customer base he sees for MSPs, personal details, business data and healthcare information could be at risk. 

Some online noted that Kansas City-based MSP NetStandard announced on Wednesday morning that their hosted environment had been hit by a cyberattack. The company did not respond to requests for comment but told customers they discovered the attack on Tuesday and are “working to isolate the threat and minimize impact.”

“MyAppsAnywhere services, which include Hosted GP, Hosted CRM, Hosted Exchange, and Hosted Sharepoint, will be offline until further notice,” the company said. 

“At this point, no additional information on the extent of the impact nor time to resolution can be provided. We are engaged with our cybersecurity insurance vendor to identify the source of the attack and determine when the environment can be safely brought back online.” 

The cybersecurity authorities of the U.K. (NCSC-UK), Australia (ACSC), Canada (CCCS), New Zealand (NCSC-NZ), and the United States (FBI, CISA and NSA) warned in May that hackers and APT groups have stepped up their targeting of MSPs in their efforts to exploit provider-customer network trust relationships.

Two of the most prominent hacks from the last two years involved popular MSPs – SolarWinds and Kaseya – and caused widespread damage due to the access they have to hundreds of companies and government agencies. 

The CISA alert noted that government agencies are aware of reports of an increase in malicious cyber activity targeting MSPs, adding that they “expect this trend to continue.”

“As this joint advisory makes clear, malicious cyber actors continue to target managed service providers, which can significantly increase downstream risk to the businesses and organizations they support – why it’s critical that MSPs and their customers take action to protect their networks,” said CISA Director Jen Easterly. 

The agencies provided a range of recommendations to MSPs, such as hardening defenses against password spraying and phishing by potential attackers.

Former Obama administration cybersecurity commissioner Tom Kellermann, who now serves as head of cybersecurity strategy at VMware, previously told The Record that cybercrime cartels have studied the interdependencies of financial institutions and have a better understanding of which MSPs are used.

“In turn, these organizations are targeted and hacked to island hop into banks. Rogue nation states love this method of cyber-colonization,” Kellermann explained, referring to an attack that targets a third party in order to gain access to another entity. VMware has found that such attacks have increased 58% over the past year.

“I am concerned that as geopolitical tension metastasizes in cyberspace, these attacks will escalate and Russian cyber-spies will use this stratagem to deploy destructive malware across entire customer bases of MSP,” he said.

Tags: breached MSP

Apr 25 2022

BlackCat Ransomware gang breached over 60 orgs worldwide

Category: Ransomware,Security Breach — DISC @ 7:53 am
BlackCat Ransomware gang breached over 60 orgs worldwide

At least 60 entities worldwide have been breached by BlackCat ransomware, warns a flash report published by the U.S. FBI.

The U.S. Federal Bureau of Investigation (FBI) published a flash report that states that at least 60 entities worldwide have been breached by BlackCat ransomware (aka ALPHV and Noberus) since it started its operations in November.

“The Federal Bureau of Investigation (FBI) has released a Flash report detailing indicators of compromise (IOCs) associated with attacks involving BlackCat/ALPHV, a Ransomware-as-a-Service that has compromised at least 60 entities worldwide.” reads the flash advisory. “CISA encourages users and administrators to review the IOCs and technical details in FBI Flash CU-000167-MW and apply the recommended mitigations.”

The list of the victims of the gang includes Moncler, the Swissport, and Inetum.

The BlackCat/ALPHV a Ransomware was first discovered in December by malware researchers from Recorded Future and MalwareHunterTeam. The malware is the first professional ransomware strain that was written in the Rust programming language.

BlackCat can target Windows, Linux, and VMWare ESXi systems, but at this time the number of victims is limited. The popular malware researcher Michael Gillespie said that the BlackCat ransomware is “very sophisticated.

Recorded Future experts speculate that the author of the BlackCat ransomware, known as ALPHV, was previously involved with the REvil ransomware operations.

According to the alert, many of the developers and money launderers for gang are linked to
Darkside/Blackmatter operations.

ALPHV has been advertising the BlackCat Ransomware-as-a-Service (RaaS) on the cybercrime forums XSS and Exploit since early December. Like other ransomware groups, the gang also implements a double-extortion model, threatening to leak the stolen data if the victims don’t pay.

ALPHV is attempting to recruit affiliates for its operations, offering them between 80% and 90% of the final ransom, depending on its value. The BlackCat operations only hit a small number of victims at this time in the USA, Australia, and India.

Ransom demands range from a few hundreds of thousands up to $3M worth of Bitcoin or Monero.

The alert includes indicators of compromise (IoCs) associated with BlackCat/ALPHV, as of mid-February 2022.

The FBI is seeking any information that can be shared related to the operations of the BlackCat ransomware operation.

Below are recommended mitigations included in the alert:

  • Review domain controllers, servers, workstations, and active directories for new or unrecognized user accounts.
  • Regularly back up data, air gap, and password-protect backup copies offline. Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.
  • Review Task Scheduler for unrecognized scheduled tasks. Additionally, manually review operating system defined or recognized scheduled tasks for unrecognized “actions” (for example: review the steps each scheduled task is expected to perform).
  • Review antivirus logs for indications they were unexpectedly turned off.
  • Implement network segmentation.
  • Require administrator credentials to install software.
  • Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location (e.g., hard drive, storage device, the cloud).
  • Install updates/patch operating systems, software, and firmware as soon as updates/patches are released.
  • Use multifactor authentication where possible.
  • Regularly change passwords to network systems and accounts, and avoid reusing passwords for different accounts.
  • Implement the shortest acceptable timeframe for password changes.
  • Disable unused remote access/Remote Desktop Protocol (RDP) ports and monitor remote access/RDP logs.
  • Audit user accounts with administrative privileges and configure access controls with least privilege in mind.
  • Install and regularly update antivirus and anti-malware software on all hosts.
  • Only use secure networks and avoid using public Wi-Fi networks. Consider installing and using a virtual private network (VPN).
  • Consider adding an email banner to emails received from outside your organization.
  • Disable hyperlinks in received emails.

Ransomware Protection Playbook

Tags: BlackCat

Apr 01 2022

List of data breaches and cyber attacks in March 2022 – 3.99 million records breached

Category: Cyber Attack,Data Breach,Security Breach — DISC @ 8:42 am
List of data breaches and cyber attacks in March 2022 – 3.99 million records breached

In March, we discovered 88 publicly disclosed cyber security incidents, accounting for 3,987,593 breached records.

That brings the total number of breached records in the first quarter of 2022 to 75,099,482. We’ll be providing more stats from Q1 2022 in our quarterly review of cyber security incidents, which will be published on our website in the coming days.

Be sure to check our blog to find that article, or subscribe to our Weekly Round-up to make sure you get the latest content delivered straight to your inbox.

Meanwhile, you can find the full list of cyber attacks and data breaches for March 2022 below.

List of data breaches and cyber attacks in March 2022 – 3.99 million records breached

Luke Irwin  31st March 2022

In March, we discovered 88 publicly disclosed cyber security incidents, accounting for 3,987,593 breached records.

That brings the total number of breached records in the first quarter of 2022 to 75,099,482. We’ll be providing more stats from Q1 2022 in our quarterly review of cyber security incidents, which will be published on our website in the coming days.

Be sure to check our blog to find that article, or subscribe to our Weekly Round-up to make sure you get the latest content delivered straight to your inbox.

Meanwhile, you can find the full list of cyber attacks and data breaches for March 2022 below.

Contents

Big Breaches: Cybersecurity Lessons for Everyone

Tags: cyber attacks in March 2022

Mar 02 2022

NVIDIA discloses data breach after the recent ransomware attack

Category: Data Breach,Ransomware,Security Breach — DISC @ 10:31 am
NVIDIA discloses data breach after the recent ransomware attack

Chipmaker giant Nvidia confirmed a data breach after the recently disclosed security incident, proprietary information stolen.

The chipmaker giant Nvidia was recentty victim of a ransomware attack that impacted some of its systems for two days. The security breach is not connected to the ongoing crisis in Ukraine, according to a person familiar with the incident.

The incident also impacted the company’s developer tools and email systems, but business and commercial activities were not affected.

“Our business and commercial activities continue uninterrupted,” Nvidia said in a statement. “We are still working to evaluate the nature and scope of the event and don’t have any additional information to share at this time.”

The Lapsus$ ransomware gang is claiming responsibility for this attack, the group announced to have stolen 1 TB of data from Nvidia’s network. The ransomware gang leaked online around 20GB of data, including credentials for all Nvidia employees.

The company launched an investigation into the incident to determine the extent of the intrusion that confirmed that the attackers have stolen data from the chipmaker.

NVIDIA said employee credentials and proprietary information were stolen during a cyberattack they announced on Friday. 

The chipmaker giant discovered the intrusion on February 23, the attack also impacted its IT resources.

“Access to NVIDIA employee VPN requires the PC to be enrolled in MDM (Mobile Device Management). With this they were able to connect to a [virtual machine] we use. Yes they successfully encrypted the data,” the group claimed in a subsequent message.” the LAPSU$ ransomware gang wrote on its Telegram change. “However we have a backup and it’s safe from scum! We are not hacked by a competitors groups or any sorts.”

Below is the statement shared by NVIDIA with some websites and published by BleepingComputer.

“On February 23, 2022, NVIDIA became aware of a cybersecurity incident which impacted IT resources. Shortly after discovering the incident, we further hardened our network, engaged cybersecurity incident response experts, and notified law enforcement.” reads the statement. “We have no evidence of ransomware being deployed on the NVIDIA environment or that this is related to the Russia-Ukraine conflict. However, we are aware that the threat actor took employee credentials and some NVIDIA proprietary information from our systems and has begun leaking it online. Our team is working to analyze that information. We do not anticipate any disruption to our business or our ability to serve our customers as a result of the incident.”

Big Breaches: Cybersecurity Lessons for Everyone

Tags: Big Breaches, NVIDIA data breach

Feb 21 2022

BEC scammers impersonate CEOs on virtual meeting platforms

Category: Identity Theft,Information Privacy,Security Breach,social engineering,Threat detection — DISC @ 10:54 am
BEC scammers impersonate CEOs on virtual meeting platforms

The FBI warned US organizations and individuals are being increasingly targeted in BECattacks on virtual meeting platforms

The Federal Bureau of Investigation (FBI) warned this week that US organizations and individuals are being increasingly targeted in BEC (business email compromise) attacks on virtual meeting platforms.

Business Email Compromise/Email Account Compromise (BEC/EAC) is a sophisticated scam that targets both entities and individuals who perform legitimate transfer-of-funds requests

Cybercriminals are targeting organizations of any size and individuals, in BEC attack scenarios attackers pose as someone that the targets trust in, such as business partners, CEO, executives, and service providers.

Scammers use to compromise legitimate business or personal email accounts through different means, such as social engineering or computer intrusion to conduct unauthorized transfers of funds.

Crooks started using virtual meeting platforms due to the popularity they have reached during the pandemic.

The Public Service Announcement published by FBI warns of a new technique adopted by scammers that are using virtual meeting platforms to provide instructions to the victims to send unauthorized transfers of funds to fraudulent accounts.

“Between 2019 through 2021, the FBI IC3 has received an increase of BEC complaints involving the use of virtual meeting platforms to instruct victims to send unauthorized transfers of funds to fraudulent accounts. A virtual meeting platform can be defined as a type of collaboration technique used by individuals around the world to share information via audio, video conferencing, screen sharing and webinars.” reads the FBI’s PSA.

Crooks are using the virtual meeting platforms for different purposes, including impersonating CEOs in virtual meetings and infiltrating meetings to steal sensitive and business information.

Below are some of the examples provided by the FBI regarding the use of virtual meeting platforms by crooks:

  • Compromising an employer or financial director’s email, such as a CEO or CFO, and requesting employees to participate in a virtual meeting platform where the criminal will insert a still picture of the CEO with no audio, or “deep fake1” audio, and claim their video/audio is not properly working. They then proceed to instruct employees to initiate transfers of funds via the virtual meeting platform chat or in a follow-up email.
  • Compromising employee emails to insert themselves in workplace meetings via virtual meeting platforms to collect information on a business’s day-to-day operations.
  • Compromising an employer’s email, such as the CEO, and sending spoofed emails to employees instructing them to initiate transfers of funds, as the CEO claims to be occupied in a virtual meeting and unable to initiate a transfer of funds via their own computer.
BEC virtual meeting platforms

Below are recommendations provided by the FBI:

  • Confirm the use of outside virtual meeting platforms not normally utilized in your internal office setting.
  • Use secondary channels or two-factor authentication to verify requests for changes in account information.
  • Ensure the URL in emails is associated with the business/individual it claims to be from.
  • Be alert to hyperlinks that may contain misspellings of the actual domain name.
  • Refrain from supplying login credentials or PII of any sort via email. Be aware that many emails requesting your personal information may appear to be legitimate.
  • Verify the email address used to send emails, especially when using a mobile or handheld device, by ensuring the sender’s address appears to match who it is coming from.
  • Ensure the settings in employees’ computers are enabled to allow full email extensions to be viewed.
  • Monitor your personal financial accounts on a regular basis for irregularities, such as missing deposits.

Tags: CEO, scammers impersonate

Feb 07 2022

Hackers breached a server of National Games of China days before the event

Category: Security Breach — DISC @ 10:25 am
Hackers breached a server of National Games of China days before the event

Researchers at cybersecurity firm Avast discovered that a Chinese-language-speaking threat actor has compromised systems at National Games of China in 2021. The event took place on September 15, 2021 in Shaanxi (China), it is a national version of the Olympics with only local athletes.

The attackers breached a web server on September 3rd and deployed multiple reverse web shells to establish a permanent foothold in the target network.

Experts noticed that the threat actors started a reconnaissance phase in August, they have done some tests to determine which type of file was possible to upload to the server. In order to perform the tests, attackers seem to have exploited a vulnerability in the webserver.

The attackers tried submitting files with different file-types and also file extensions, such as a legitimate image with different file extensions: ico, lua, js, luac, txt, html and rar.

“After gaining knowledge on blocked and allowed file types, they tried to submit executable code. Of course, they started submitting PoCs instead of directly executing a webshell because submitting PoCs is more stealthy and also allows one to gain knowledge on what the malicious code is allowed to do.” reported Avast. “For instance, one of the files uploaded was this Lua script camouflaged as an image (20210903-160250-168571-ab1c20.jpg)”

The attackers reconfigured the web server by uploading a configuration file, camouflaged as a PNG file, that allowed the execution of lua scripts. Experts found evidence that the server was configured to execute new threads in a thread pool which didn’t work for Rebeyond Behinder webshell. Then, as a final payload, the attackers uploaded and ran an entire Tomcat server properly configured and weaponized with Rebeyond Behinder.

After gaining access to the server, the attackers tried to perform lateral movements by brute-forcing services and using exploits in an automated way. Attackers were able to upload some tools (dnscrypt-proxy, fscan, mssql-command-tool, behinder) to the server and execute a network scanner (fscan) and a custom one-click exploitation framework written in Go and distributed as a single binary.

“The procedure followed by the attackers hacking the 14th National Games of China is not new at all. They gained access to the system by exploiting a vulnerability in the web server. This shows the need for updating software, configuring it properly and also being aware of possible new vulnerabilities in applications by using vulnerability scanners.” concludes the report. “The most fundamental security countermeasure for defenders consists in keeping the infrastructure up-to-date in terms of patching. Especially for the Internet facing infrastructure.”

Avast reported that the security breach appears to have been resolved before the beginning of the games, however, the experts were not able to determine the type of information exfiltrated by the threat actor.

Penetration Testing – Post Exploitation

Tags: Big Breaches, Hackers breached, National Games of China, Pen testing

Next Page »