Home Blog Page 112

Chinese Hacking Group “RedEcho” Targets Indian Power Sector

Cyber-Security-Threat-to-National-Power-Grids, Recorded Future

Relations between India and China have worsened after troops from both sides engaged in a skirmish in May 2020. While diplomacy factors have thwarted a direct war, cyber espionage operations from state-sponsored attackers continue to disrupt organizations in India. Cybersecurity experts recently uncovered a Chinese hacking group’s cyber campaign targeting India’s power grid and transmission sector.

Related News:

China Attempts Cyber War on India; Over 40,000 Cyberattacks in 5 Days

Research from security firm Recorded Future found a China-linked threat actors group dubbed RedEcho, targeting 12 Indian organizations, 10 of which are in the power sector. Recorded Future’s threat research team Insikt Group uncovered a subset of the servers that share some common tactics, techniques, and procedures (TTPs) with several previously reported Chinese state-sponsored groups.

 Key Findings

  • The targeting of Indian critical infrastructure offers limited economic espionage opportunities; however, we assess they pose significant concerns over potential pre-positioning of network access to support Chinese strategic objectives.
  • Pre-positioning on energy assets may support several potential outcomes, including geostrategic signaling during heightened bilateral tensions, supporting influence operations, or as a precursor to kinetic escalation.
  • RedEcho has strong infrastructure and victimology overlaps with Chinese groups APT41/Barium and Tonto Team, while ShadowPad is used by at least 5 distinct Chinese groups.
  • The high concentration of IPs resolving to Indian critical infrastructure entities communicating over several months with a distinct subset of AXIOMATICASYMPTOTE servers used by RedEcho indicates a targeted campaign, with little evidence of wider targeting in Recorded Future’s network telemetry.

“We’ve determined that a subset of these AXIOMATICASYMPTOTE servers share some common infrastructure tactics, techniques, and procedures (TTPs) with several previously reported Chinese state-sponsored groups, including APT41 and Tonto Team. Despite some overlaps with previous groups, Insikt Group does not currently believe there is enough evidence to firmly attribute the activity in this particular campaign to an existing public group and therefore continue to track it as a closely related but distinct activity group, RedEcho,” Recorded Future said.

Update on March 2, 2021

Mumbai Power Outage a “Cyber Sabotage” Attempt: Minister

The latest security incident raises doubts about a possible connection to a power blackout that crippled the financial capital of India – Mumbai – in October last year. At first, it was considered to be a technical failure at a power sub-station; however, later reports suggested that this could well have been an effect of a cyberattack on the power grid. The Maharashtra Cyber Cell department was summoned by the state’s Minister of Energy and Home Minister to carry out a thorough investigation into the possibilities of a cyberattack and asked to submit a subsequent report.

Related News:

Did a Cyberattack Cause Power Outage in India’s Financial Capital?

Yesterday, on March 1, 2021, a preliminary report of the investigations was submitted to Maharashtra’s Home Minister, Anil Deshmukh, and Energy Minister, Nitin Raut. Based on the findings in the report presented to them, Deshmukh in a press conference said,

An analysis of the Supervisory Control and Data Acquisition System (SCADA) has shown that there is a possibility that this incident was a cyber sabotage. 

Deshmukh also said that the preliminary report from the Cyber Crime Cell has noted three possible ways in which the sabotage was attempted:

  • Malware attack on one of the MSEB servers.
  • Transfer of 8GB unaccounted data from a foreign server to an MSEB server.
  • An attempt by several blacklisted IP addresses to log into MSEB server.

Ryuk Ransomware Gets Intelligent, Spreads on its Own!

ransomware, ryuk ransomware, cox media

Ryuk ransomware has spelled doom on organizations since its discovery in August 2018. At the end of 2020, Ryuk operators carried out a series of Ryuk ransomware attacks against multiple hospitals in the U.S. The success of their operations can be gauged from the fact that the Ryuk ransomware gang collected a ransom of more than $150 million in Bitcoins.

Related News:

A Tsunami of Ryuk Ransomware Attacks Hits U.S. Hospitals

Owing to their success, Ryuk operators seem to have further evolved the ransomware rendering its new and unique capabilities. Its new variant, which self-replicates over the local network, can cause unimaginable devastation, reported the French national cybersecurity agency, Agence Nationale de la Sécurité des Systèmes d’Information (better known as ANSSI). The self-spreading capabilities were found to work only on machines based on the Windows domain and through specific tasks.

 Key Highlights 

  • Ryuk ransomware’s new variant has self-replication capability over a local network.
  • It makes use of a Privileged account and machines based on Windows domain only for propagation.
  • The ransomware contains lines of code allowing files and subfolders encryption.
  • No mechanism (like MUTEX) for blocking the execution of the ransomware has been identified.
  • The files are encrypted using Microsoft CryptoAPI with AES256 algorithm.

Ryuk Ransomware’s New Capabilities

ANSSI said that Ryuk’s new variant uses scheduled tasks of the Windows operating system to propagate itself over the local network. It then lists all the IP addresses in the local ARP cache and disguises them as Wake-on-LAN (WOL) packets while sending them to all the discovered devices. Further, it adds all sharing resources found for each device so that it can encrypt maximum content.

ANSSI’s analysis found that the legitimate schtasks.exe Windows tool is being used to execute scheduled tasks on each subsequently compromised network host. The analysis also suggested the absence of an exclusion mechanism that is generally present to prevent the ransomware from re-encrypting devices.

Ryuk officially does not use the Ransomware as a Service (RaaS) model. However, it is observed that several different attackers are involved in designing multiple infection chains leading to the deployment of Ryuk. Thus, having common remediation steps for all deployment methods is practically impossible. But in the case of this new variant, ANSSI says that infection can be contained by stopping the spread to other hosts on the network. It suggests “One way to tackle the problem could be to change the password or disable the user account (according to the used account) and then proceed to a double KRBTGT domain password change. This would induce many disturbances on the domain – and most likely require many reboots but would also immediately contain the propagation. Other propagation containment approaches could also be considered, especially through the targeting of the malware execution environment.”

With the amount of success that Ryuk ransomware operators garnered through 2020, its latest variant could be one to beware of in the year 2021.

Related News:

Ryuk Ransomware Gang Made More Than $150 Mn in Ransom

TikTok Finds Itself on the U.S. Judicial Radar; Agrees $92 Mn Payout Over Privacy Lawsuit

TikTok, TikTok data privacy, TikTok children's privacy

TikTok, the China-based social media company, has agreed to pay $92 million to settle multiple privacy lawsuits for violating users’ data privacy. The lawsuits alleged that TikTok harvested users’ private information including facial recognition data without their consent and shared it with third-party vendors based in China. The proposed settlement is related to over 89 million TikTok users in the U.S. who claimed that TikTok allegedly tracked and sold their data to advertisers, violating data privacy laws.

“The complaint also alleges violations of a number of other statutory, common law, and constitutional claims arising from Defendants’ alleged taking and transmission of other private, legally protected data. Plaintiffs assert claims for violations of the Computer Fraud and Abuse Act (CFAA), California Comprehensive Data Access and Fraud Act (CDAFA), California Constitutional Right to Privacy, California Unfair Competition and False Advertising laws, Video Privacy Protection Act (VPPA),” the TikTok lawsuit said.

The settlement comes because of 21 federal lawsuits filed in California and Illinois last year mostly on behalf of children that claimed the company accessed their data for various purposes, including tracking users by age, gender, location, operating system, and interest to attract targeted marketing and ad sales.

Mishandling Children’s Data

Last year, South Korean telecommunication watchdog, Korea Communications Commission (KCC), found TikTok guilty of mishandling child data in the country and thus imposed a 186 million won (approximately US$155,000) fine. The KCC’s investigation that originally began to investigate the secret extraction of user data by the Chinese government through this app led them to these findings: TikTok illegally collected a minimum of 6,007 pieces of child data between May 31, 2017, and December 6, 2019, of users younger than 14 years.

T-Mobile Suffers Data Breach…Again!

T-Mobile data breach

Mobile telecommunication company T-Mobile has revealed a security incident that compromised its customers’ sensitive data, including personal identification numbers (PINs). In a data breach notice,  the company stated that an unknown hacker gained access to customers’ account information. T-Mobile alerted the affected customers and reported the issue to the U.S. attorney generals’ offices.

While there is no evidence whether the attackers gained access to the employees’ accounts, T-Mobile claimed that there is a chance of SIM Swapping attacks as the attackers were able to port mobile numbers.

Sensitive Data at Risk 

The information accessed by threat actors included customers’ full names, addresses, email addresses, account numbers, social security numbers, account details, account security questions and answers, birth dates, plan information, and the number of lines subscribed to their accounts.

“An unknown actor gained access to certain account information. It appears the actor may then have used this information to port your line to a different carrier without your authorization. T-Mobile identified this activity, terminated the unauthorized access, and implemented measures to protect against reoccurrence,” a T-Mobile spokesperson said.

T-Mobile urged the affected customers to change their account’s password, PIN, and their security questions and answers for further security. The telecom giant is also offering two years of free credit monitoring and identity theft detection services to the impacted customers in the incident.

One Telecom – Multiple Data Breaches

This is not the first time that T-Mobile has faced a data breach. In 2020, the company alerted customers about the attack against its email vendor that led to unauthorized access to certain T-Mobile employee email accounts, which contained account information of customers and employees.

In 2018, a data breach compromised the personal information of around two million T-Mobile users. The compromised data included names, email addresses, account numbers, and other billing information of its customers.

IoT Security Trends and Challenges in the Wake of COVID-19

IoT attacks

Finally, we have arrived in the age of an Internet of Things (IoT) ecosystem, with connected devices deployed in our homes, workplace, and public places. According to research analyst Omdia’s most recent “IoT Devices Market Tracker,” the global IoT installed base is expected to reach 27.5 billion in 2020, growing to 45.9 billion in 2025. With that number of devices deployed and even more on the way, it is anticipated that the volume of cybercrime or attempts to thwart cybersecurity will only increase. With threats from both criminal and rival nations evolving, it is important that defensive strategies are put in place to protect IoT systems, especially with threats to the digital scape looming large.

By Vikas Bhonsle, CEO, Crayon India

This is again, a pre-pandemic world’s observation. Omdia believes that industrial markets will continue to drive IoT demand, but growth in the communications and medical fields will accelerate. Overall, only a few markets are projected to remain strong amid COVID-19, and IoT security is one of them. COVID-19 has accelerated the security trends in the direction of integration, consolidation, and cloud transformation. According to an April 2020 report from IoT Analytics, since the early months of 2020, there has been an increase in cyberattacks that has raised the importance of IoT security considering the growing demand.

Securing an IoT infrastructure requires a precise in-depth strategy that includes securing cloud data, data integrity, data devices, any device or system connected to a network, or that is online and has the potential to reveal personal information to cybercriminals. Hence it is important to ensure the security of the IoT network of devices or appliances.

Procrastination towards security

There is a general attitude of procrastination among enterprises about employing security measures for their digital network and devices. When deploying data systems in any environment, security teams traditionally look for three things: speed, security, and budget-friendliness. Unfortunately, organizations tend to choose only two, leaving security out of the equation while cost and convenience remain the bane of data protection efforts for years to come.

Strengthening Assent Inventory Management

Organizations must prioritize strengthening the security measures of their devices and the network, especially during the pandemic. As data and devices are getting scattered with remote working in practice, it is vital to review corporate security strategies and ensure a decent overview of the inventory of assets and IoT devices. It’s recommended to build a broad review of asset inventory with a much deeper knowledge of individual assets including asset tracking, traffic pattern analysis, updating the assets, and rapid-response in the case of a cyberattack.

Shadow IoT Devices

The COVID-19 crisis has led to another issue known as shadow IoT devices, which is when employees working at home introduce unauthorized IoT devices to the enterprise. This increases a significant level of vulnerability for the organization and its data as these devices are not layered with security measures and can easily give access to an enterprise network.

A leading cloud security provider reported that during the early months of 2020, there was a 1500% increase in IoT device usage at enterprises. These are unauthorized IoT devices that include digital home assistants, TV set-top boxes, IP cameras, smart home devices, smart TVs, smartwatches, and even automotive multimedia systems. Each of these assets can be used as a point of exposure to get access to an enterprise network. Hence, it is crucial that IT and security professionals pay heed to the digital security hygiene practices of the workforce.

Cloud Security

As most people have moved their work off-premise since COVID-19, experts conclude that there will be a massive rate of cloud adoption during this period.

Cloud security tools with other cloud-hosted applications can help scale new assets quickly, remotely apply software patches, and integrate with other tools through standardized APIs with ease. Cloud connections can, on the other hand, face an increasing risk of data breaches. It is, therefore pivotal for IT and security departments to do a thorough risk assessment to decide which apps should be on the cloud and which should be on-premise.

Security Automation with AI

There has been a huge improvement in Machine Learning and AI technology, including AI-based security tools, which deliver better and often faster outcomes. It is therefore advised that organizations look for a predictive and detective strategy when it comes to IoT security. With AI, applications can now be programmed to automatically trigger a reaction to specific abnormalities, which is helpful when a rapid response is needed. The traditional Security Information & Event Management (SIEM) solutions are also witnessing AI-enhancement by models that provide streaming data analysis and threat modeling.

Conclusion

COVID-19 has led to a hike in cyberattacks that have in turn led to a surge in the need for IoT and IoT security adoption. It is high time organizations come to acknowledge that pandemic or not, adoption of technology has increased multi-fold, and we have now moved from an also-digital to an only-digital phase. Cybersecurity must include best practices for a robust and healthy IoT ecosystem to flourish.

This story first appeared in the August 2020 issue of CISO MAG. Subscribe now!

About the Author

Vikas Bhonsle is the Chief Executive Officer (CEO) at Crayon Software Experts India Pvt. Ltd. and has been leading it across India since June 2014. Vikas is an alumnus of the University of Mumbai where he completed his graduation in the field of physics and did his MBA. He is well versed with the disciplines of Business Management, Sales, Marketing, Strategy Formulation, Operational Management, and Relationship Management with over 20 years of experience.

Disclaimer

The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Cybersecurity Top 5 Lessons Learned from COVID-19

COVID-19 Cyberthreats

At last, I went to a grocery shop with enough precautions after using multiple online delivery services for weeks. And I found that most people are following health advice and keeping safe distances, although it makes it hard to recognize anyone wearing a mask. This was, and still is, an unusual experience for everyone. COVID-19 is the biggest challenge that we face today. The COVID-19 pandemic has forced us to stay home to save lives and has given us time to rethink our actions and prepare for a healthier future.

By Hemanta Swain, Global Head of Information Security, II-VI Inc.

Through my personal experiences and learning from COVID-19, I realize that this pandemic resonates closely with my Infosec professional life. This may not be new for cybersecurity professionals, but I will outline a few of my experiences here. In the minds of many people, this transition from physical to digital is inevitable, unstoppable, and irrevocable, even though cash is still used for most retail purchases globally (COVID-19 influence aside).

1. Basic (Health/Security) Hygiene:  The pandemic has reminded us all that the most basic of hygiene strategies, handwashing, first to be discovered to be effective against spreading disease in the 1850s, is still one of the most important ways to stop the spread of diseases in 2020.

As for cybersecurity, we should be reminded that basics cannot be ignored in our industry either. It’s not uncommon to see security professionals lagging behind in the adoption of the latest technologies that address challenges (advanced threats) and support business priorities. We are also reminded of the number of breaches that happen because of haphazard patching and other basic requirements not being met. Just like with handwashing, all cybersecurity professionals know that keeping up to date with patches is key to protecting the organization from easily avoided breaches. Moreover, we tend to overlook the basic health of our infrastructure, systems, and applications. This becomes evident during a security breach.

In my view, both are needed, but there should be a continuous effort to keep basic security hygiene intact. This is essential to build a sustainable security posture. One can and should follow CIS top 20 controls and OWASP top 10 list with secure access using multi-factor-authentication, regular patching, vendor risk assessment, email security, and endpoint security protection. But basic security hygiene is the key.

2. Segmentation (Shelter-in-place and Isolation): During this pandemic, we’ve seen, perhaps for the first time, the entire world sheltering in place simultaneously. We’ve seen how isolating people from their networks of friends and extended family drastically helps contain infection rates.

The parallels in cybersecurity are obvious: understand your business, infrastructure, applications, and the most valuable assets. Appropriately segment your network, systems, and applications to allow access to only those who require it. This is beneficial to minimize impact during a crisis, allowing you to contain any breaches and will be a foundation for your zero-trust framework.

3. Security (Health) Leadership and Culture: If this pandemic has taught us anything, it’s that when health leaders, politicians, and local culture are in line with best practices for limiting the spread of the disease, the effects of COVID-19 are minimized more quickly and with fewer deaths. When messaging to the public is unclear, valuable time is lost and local culture doesn’t shift quickly enough to impact results.

For cybersecurity, it’s imperative to clearly define roles and responsibilities to take appropriate action in a timely manner, especially during a crisis. Security leadership helps to build a security-aware culture, which is essential to reduce risk and costs related to security. Yes, there is no infinite budget, and this will impact your bottom line and resource requirements, but it is crucial to present the risks with impacts to senior leadership and come to agreements on the next steps.

Security professionals recommend options based on the risks they discover, but if senior management cannot make quick decisions, there can be significant impacts on handling crises. Security leadership reporting is very important, not only to enable a quick decision-making process but to build a security-aware culture. Employees will follow not only the CISO but also senior management because they highlight the importance of security. To be successful, create an executive security leadership council consisting of business and IT senior executives for business alignment and continuous risk management to build a security-aware culture.

4. Quick Action and Communication: Infectious disease experts have long known that quick action at the first sign of a pandemic is key to mitigating its impact. In order to act quickly, adaptable plans must be in place and teams must be trained and kept on standby in the case of a crisis. Attempting to piece together an ad-hoc plan in the middle of active pandemic wastes critical time. Having plans in place allows leaders to accurately communicate to the public what steps have been taken, what they should expect next, and what they need to do to avoid infection. Communicating on the progress of the response to the pandemic and successes and failures in a transparent way is very important to ensure public compliance with any measures they are being asked to take.

It’s obvious that this is just as true in cybersecurity. Processes should be in place to facilitate quick action in a timely manner. Security councils, senior leadership, and Boards of Directors communication protocols should be in place. Upper management must make quick decisions to minimize the impact based on security leadership recommendations. Unfortunately, security breaches are unavoidable and security professionals should be prepared to handle breaches when they occur.

The most important action while handling a breach is communication. Communication with customers, partners, and supply chain networks should be considered in the planning process. Additional help from industry experts inside and outside the company should be called in to help during a crisis.

5. Quick Recovery: We’ve seen successful and botched re-openings around the world and the difference between the successes and failures seems to be how much planning and data went into each decision to re-open. Those locations that rush to re-open in order to get back to business have risked more infections and more deaths, which further hamper economic recovery. A balance must be struck in order to ensure that any re-opening is safe and appropriate for the level of recovery of the state or country.

In a breach or other cyber incident, business continuity and service recovery are extremely important to minimize the impact and return business back to normal. However, rushing to get back to business can have similar effects if the incident has not been properly remediated or fully understood. Continuously review your preparedness, including the current disaster recovery plan, and backup and restore capabilities. Have frequent tabletop exercises with stimulated security breach situations to test your recovery plan.

This story first appeared in the August 2020 issue of CISO MAG. Subscribe now!

About the Author

Hemanta Swain is the Global Head of Information Security, II-VI Inc. Hemanta has 24+ years of IT experience including 18+ years of Cybersecurity & Risk Management expertise. Hemanta performed various security technical leadership roles for companies like GE, Wipro & a few early-stage startups. Hemanta holds multiple Industry-standard technology certifications including CISM and CISSP.

Disclaimer

The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Why Network Security is Important in Today’s Digital World

importance of network security

In the current uncertain times of the ongoing COVID-19 pandemic, one of the most integral parts of our day-to-day life has significantly changed – our office and work. The pandemic has impacted the global workforce, in all aspects – the way we conduct business, communicate with our colleagues and clients, and even our work-life balance. Working virtually, there is no boundary now between home and office. Alongside this, a significant number of cyberthreats have grown exponentially targeting the remote workforce and giving the IT C-suite like the CTO, CIO, CISOs across the world sleepless nights.

The Remote Workforce

Remote working saw a huge spike in the utilization of home networks like never before. Businesses began leveraging technology to unlock a remote approach to work. The evidence of this can be found in the 70% jump in the usage of Microsoft Teams – a collaboration tool from Microsoft – in the first month of the pandemic itself. Unsecured home and public networks are now supporting business continuity plans of organizations of every scale. The increase in usage of technologies such as Blue Jeans, Microsoft Teams, Skype for Business, Virtual Private Networks (VPNs), and Zoom, on these unsecured networks, amplified the global cybercrime scene amid the pandemic.

Related News:

Remote Work Jeopardizes Corporate Network Security: Report

The IT and network security teams who were entrusted to protect the endpoints on the office networks suddenly faced a new challenge of securing the old and additional endpoints that were beyond the traditional security perimeter. As days passed, business needs grew, endpoints grew, and correspondingly, networks grew. A network engineer who many didn’t know existed in their organization until a few months back, was suddenly the go-to man for every office staff. But just having a network engineer on board is not enough. Organizations today need a network security engineer.

The Importance of Network Security

Network security is one of the most important aspects of any business. With people working from their beds and sending business emails from their couch, networks are pervasive – they are all around your home. Thus, it is now more than ever necessary to make network security your priority.

While no network is immune to attacks, a stable and efficient network security system is essential to protecting your data which is considered a gold mine. A good network security system helps businesses reduce the risk of data theft, sabotage, client mistrust, reputational and monetary damages, and the list goes on. However, like a ship needs a good captain to keep it safe, any business network needs a good network security engineer who can defend them and steer them past troubled waters.

But how does one progress from being a simple network engineer to becoming a network defender?  The answer is, become a Certified Network Defender (CND) with EC-Council’s Certified Network Defender program.

Why Sign-up for EC-Council’s CND Course

We give you not one but multiple reasons to believe this. When it comes to choosing the best career options, a network security engineer is a profile that will consolidate your position. As the world increasingly relies on digital platforms in the times to come, the demand for network security professionals is only going to rise. And hence having a certification in this field will help you lead the pack.

Related News:

EC-Council Unveils the Certified Ethical Hacker Hall of Fame 2021

As per Cybersecurity Ventures, it is expected that by 2021, there will be 3.5 million unfilled cybersecurity jobs worldwide. And if you believe in numbers, then be rest assured that there’s a growing demand for cybersecurity professionals. With a network security engineering certification, you will be on the radar of recruiters. Add to this, the lucrative salary you can draw. As per Glassdoor, the base pay of a network security engineer starts from $83,114, and it only goes skywards from here, with some earning up to an average of $167,500.

Now talking about the course structure, Certified Network Defender (CND) v2 has been designed by industry experts to help IT Professionals play an active role in the protection of digital business assets. It covers all aspects right from detection to the response of cyberthreats, by leveraging threat intelligence to predict incidents before they happen.

So, take the leap and become a Certified Network Security Engineer.
For more information on EC-Council’s next-gen Certified Network Defender training and certification, hit the button below!

EC-Council’s Certified Network Defender Course

Over 6,700 VMware Servers Vulnerable to Takeover Attacks

Data breach in 100 U.S. cities

Cybersecurity researchers from threat intelligence firm Bad Packets revealed that enterprise software provider VMware’s 6,700 servers are exposed online and vulnerable to cyberattacks. Threat actors can exploit the unsecured servers to deploy the malware into unpatched devices and compromise entire corporate networks.

Researchers claimed that they’ve identified mass scanning activity of cybercriminals targeting vulnerable VMware servers. Besides, a Chinese security researcher published a proof-of-concept code for a vulnerability “CVE-2021-21972” in VMware servers.

Affected products from CVE-2021-21972 flaw include:

  • VMware ESXi
  • VMware vCenter Server (vCenter Server)
  • VMware Cloud Foundation (Cloud Foundation)

VMware Fixes the Issues

VMware issued security fixes for multiple flaws including CVE-2021-21973, CVE-2021-21974, and CVE-2021-21972. “Multiple vulnerabilities in VMware ESXi and vSphere Client (HTML5) were privately reported to VMware. Updates are available to remediate these vulnerabilities in affected VMware products,” VMware said.

The remote code execution vulnerabilities in the vCenter Server plugin could allow a malicious actor with network access to port 443 to execute commands with unrestricted privileges on the underlying operating system that hosts the vCenter Server.

VMware stated that more than 6,700 vCenter servers online are now vulnerable to takeover attacks if administrators failed to apply the patches. The company urged customers to update their systems as early as possible to avoid any cyber risks.

Ransomware Operators Exploit VMWare Flaws

According to a recent report, ransomware operators are reportedly exploiting two previously known vulnerabilities in VMWare ESXi logged under CVE-2019-5544 and CVE-2020-3992 to target their victims’ virtual hard disks. ESXi is a solution that allows multiple virtual machines to share the same hard drive storage. Read more…

Lazarus Group Hits Defense Industries with “ThreatNeedle” Malware

Konni Malware, North Korean threat actors target AstraZeneca

Security experts found the North Korean-backed advanced persistent threat (APT) group Lazarus is targeting the defense industry across multiple countries since 2020. According to researchers at Kaspersky, the attackers are using a malware payload dubbed “ThreatNeedle” to penetrate corporate network systems. The malware can access and steal critical data from segmented portions of a network that is not connected to the internet.

“We have seen Lazarus attack various industries using this malware cluster before. In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscript (a.k.a. NukeSped). While investigating this activity,” Kaspersky said.

How ThreatNeedle Affects

Kaspersky claimed that the ongoing ThreatNeedle malware campaign leverages a multistep approach that begins with a spear-phishing attack to eventually gain control over the victim’s device.

Before launching an attack, attackers research the targeted organization to identify and create similar email addresses belonging to various departments of the company. The phishing emails, with a malicious link or infected Microsoft Word Document attachment, are sent to several employees in various departments. Upon opening the malicious document, the malware is dropped and proceeds to a multistage deployment procedure to compromise the victim’s device.

ThreatNeedle Traits

Once the final payload of ThreatNeedle malware is deployed on the victim’s system, it allows a remote attacker to execute multiple functions including:

  • Manipulate files/directories
  • System profiling
  • Control backdoor processes
  • Enter sleeping or hibernation mode
  • Update backdoor configuration
  • Execute received commands

“Our investigation showed that the initial spear-phishing attempt was unsuccessful due to macros being disabled in the Microsoft Office installation of the targeted systems. To persuade the target to allow the malicious macro, the attacker sent another email showing how to enable macros in Microsoft Office. The document contains information on the population health assessment program and is not directly related to the subject of the phishing email (COVID-19), suggesting the attackers may not completely understand the meaning of the contents they used,” Kaspersky added.

India Becomes the Second Most Cyberattacked Country in APAC in 2020

Acronis Cyber Readiness Report, cyberattacks in India, cybercrime in India, India’s Private Sector

The recent surge in technological innovations due to the Indian Government’s “Make in India” and “Atmanirbhar Bharat” (self-reliant India) campaigns along with a shift towards digital transformation due to the ongoing COVID-19 pandemic meant that a parallel surge in the number of cyberattacks was anticipated. However, the spike would be so high that India would grab the second spot in the list of “Most cyberattacked country in the APAC” was beyond expectation. IBM Security released a report titled the 2021 X-Force Threat Intelligence Index, which made the following key revelations highlighting the threat landscape in India:

  • India was the second most cyberattacked country in the APAC, only behind Japan.
  • 7% of all attacks, which X-Force (IBM’s proprietary security product) observed in Asia, were targeted towards India.
  • Finance and insurance industries were the most targeted industries (60%), closely followed by manufacturing and professional services.
  • Ransomware topped the attack type list in India, making up roughly 40% of the attacks.
  • India has been considering a digital currency of its own for some time now, however, X-Force observed that digital currency mining and server access attacks hit many Indian companies last year.
  • In 2020, most of the attacks on Indian companies occurred between May to July.

Talking about the findings from the study, Sudeep Das, Security Software Technical Sales Leader, IBM Technology Sales, India/South Asia, said “The 2020 threat landscape in India was largely shaped by the pandemic. As the pandemic’s timeline of events and progress unfolded, so did the attack trends. Ransomware was the top attack type in India with a 40% share in the overall threat landscape which although is not surprising yet, beyond expectation. We also witnessed cybercriminals using relief efforts and public health information as spam lures including targeted attacks on critical components of the vaccine supply chain.”

Related News:

IBM Fixes Critical Vulnerabilities in Java Runtime, Planning Analytics Workspace

When asked what Indian organizations expect in 2021 and how they can overcome threats, Das added, “All these issues will remain in 2021 as well.  Hence, organizations need to harden their cloud environments with a zero-trust approach to their security strategy and leverage AI to monitor, detect and contextualize dynamic behaviors and movements across hybrid cloud environments, to verify the legitimacy (or lack of) of a threat and automate a response.

Furthermore, we need to use Confidential Computing for a higher level of isolation for secure enclaves of data. It encrypts data during processing, whereas before, data had to be decrypted just before being processed, leaving it potentially vulnerable. In other words, even if cloud environments are compromised, the data would be futile/inaccessible to a malicious actor with technologies like Confidential Computing.”

Other Findings

The findings in this report are based on data analyzed from multiple sources within IBM, including IBM Security X-Force Threat Intelligence and Incident Response, X-Force Red, IBM Managed Security Services and additional data provided by Quad9 and Intezer. Some of the key findings from the global level analysis include:

  • Accelerated use of Linux Malware: An increase of 40% in Linux-related malware families was observed in 2020.
  • Shift in Top Spoofed Brands: Amid a year of social distancing and remote work, brands offering collaboration tools such as Google, Dropbox, and Microsoft, or online shopping brands such as Amazon and PayPal, made the top 10 spoofed brands in 2020. Adidas was another surprising entrant to this list at the No.7 spot.
  • Ransomware became a profitable business model: Ransomware was the cause of nearly one in four attacks that IBM’s X-Force responded to in 2020. The majority of them exercised double extortion tactics. Using this model, X-Force found that Sodinokibi operators – the most observed ransomware group in 2020 – had a very profitable year. The report estimates that the group made over $123 million in the past year, with approximately two-thirds of its victims paying a ransom.

To download the complete report, click here.

Related News:

Rushing to the Cloud to Support Remote Workers Poses New Security Risks: IBM Study

1...111112113...410Page 112 of 410