Home Blog Page 149

California Voters Say “Yes” to Proposition 24 for Expansion of Data Privacy Law

CCPA Expands

California is popularly known as the state that laid the foundation of a stringent data privacy law in the U.S. With its historic amendment of the California Consumer Privacy Act (CCPA), some infosec pundits termed it as the boldest move by the people of California against the data mining heavyweight corporations.

It gave the citizens of the state the right to know what information companies collect about them online, get that data deleted, and, if required, opt-out of the sale of their personal information. However, in an act of further strengthen their data privacy protections, the voters of California have once again voted in favor of “Proposition 24,” which expands the existing data privacy law.

Related News:

Mozilla Firefox Adopts CCPA for Worldwide Audience

What is Proposition 24?

According to the advocates of Proposition 24, it expands the data privacy law and closes some of the loopholes that big businesses exploited to get around it. The new measure includes a three-fold increase in fines for companies that violate kids’ privacy or break laws on the collection and sale of children’s private information. A special annual budget of $10 million has also been allocated to establish a dedicated state agency that will specifically look after the enforcement of the new law.

All in favor

The adoption of the Proposition 24 was supported by Consumer Reports, Common Sense Media, Consumer Watchdog, and Alastair Mactaggart, a San Francisco-based real estate developer who has been voicing his support for the data privacy law since the 2018 law and has been pushing to update it.

The voting for the measure was held on November 4, 2020, which saw over 11 million voters pouring into the ballot booths. The ballot was counted on November 5, 2020, resulting in 56% of voters saying “Yes” to amending Proposition 24 into the existing CCPA.

Proposition 24 approved

Speaking on the approval of Proposition 24, Alastair Mactaggart said, “We will now be able to stop businesses from using our most intimate, most personal information — our health information, our religion, our sexual orientation, our race. Proposition 24 will put a floor under privacy. There will now be much, much more robust enforcement of the law”.

Stance of the critics

However, the amendment was not welcomed by all. It has been criticized by some privacy and consumer advocates like the Consumer Federation of California, who said it was not tough enough on big business and made concessions that did not fully benefit consumers. In a statement issued by the Federation, it stated, “We will continue to champion the privacy rights of Californians, work with our allies to reverse the harmful portions of Prop. 24, and oppose its adoption as a model for the nation.”

Related News:

California Consumer Privacy Act Puts Additional Pressure on Financial Organizations

Japanese Gaming Giant Capcom Hit by a Cyberattack

Gaming

Japanese game developer and publisher Capcom suffered a security incident on November 2, 2020, which impacted its operations, including email and file servers. The developer of popular game franchises like Monster Hunter, Resident Evil, Devil May Cry, Mega Man, and Street Fighter claimed that an unknown third party illicitly accessed its internal network systems. After realizing about the incident, the company temporarily stopped a few systems in its network to prevent the spread.

While there is no indication of misuse of any customer information, Capcom clarified the incident has not affected any connections for playing the company’s games online or access to its websites. The company reported the incident to cyber sleuths and the related authorities for further investigation, and is also taking measures to restore its systems.

Gaming Industry Suffered 10 Bn Attacks

Even after the improved security measures, cyberattacks have become common in the online gaming industry. Attackers often target online video games and gamers by compromising their accounts and launching attacks. A research from Akamai Technologies revealed that the gaming industry suffered high volumes of attacks between 2018 and 2020. The research “State of the Internet/Security report, Gaming: You Can’t Solo Security” highlighted that the COVID-19 lockdown resulted in the increase of attack traffic through credential stuffing and phishing attacks.

Gamers Turning into Hackers

Another research revealed that most young gamers are increasingly turning into hackers to commit cybercrime. The research found that 82% of teens and young adults recruited by online criminals had developed their cybercrime skills through video games. The U.K.’s National Crime Agency (NCA) held a forum and published a special report about the problem. Read more…

CYFIRMA’s Threat Landscape Report Reveals Interesting Trends and Threat Actors Targeting India

SideCopy Malware Campaign

CYFIRMA, a Singapore-based cybersecurity firm, has released the India Threat Landscape Report 2020. The researchers at CYFIRMA have been actively observing global cyberattack trends and major state-sponsored threat actors using its cyber threat intelligence (CTI) platform, DeCYFIR. From time to time, it has warned private establishments and Indian Computer Emergency Response Team (CERT-In) authorities about the impending cyberattacks. It has helped them thwart some vicious campaigns aimed at top private companies, media, and the government itself.

 Key Highlights 

  • Top threat actors targeting India’s digital frontier include the Lazarus group, APT36, MISSION2025, Stone Panda/APT10.
  • The upcoming trends used to target Indian audience include ransomware, phishing and social engineering, reconnaissance activities, brute force and DDoS attacks, and commodity malware.
  • Top attack methods used include attack on Linux servers, Email Servers, and web applications.

CYFIRMA’s India Threat Landscape Report 2020

In the Indian Threat Landscape Report’s summary, Kumar Ritesh, Founder and CEO of CYFIRMA, said,

India is a haven for startups, a fertile ground for technological innovation, sparking the generation of massive amounts of data that attracts cyber criminals. While digital adoption is breaking new grounds, the corresponding cyber maturity is low and not keeping pace with technological strides. All these factors are prompting more nations, especially India’s geopolitical foes, to partake in the cyber game targeting India. The Big 3, namely China, North Korea and Russia, authoritarian regimes that are suspected of aiding state-sponsored cybercriminal activities have shown interest in breaching India’s security perimeters.

The report highlights key findings such as top threat actors, evolving malware and their methodologies, tools used for targeting organizations in India, and much more.

Threat Actors and Their Attack Methods Targeting India

  • Lazarus Group: The North Korean threat actors’ activities surged in 2020, which involved fileless attack, spreading new malware samples, attacking cryptocurrency businesses and more. They are believed to be using a new malware variant, known as COPPERHEDGE RAT, to target crypto exchanges.
  • APT36/ Mythic Leopard: These are reportedly backed by the Pakistani government and known to have targeted Indian diplomats in the past. In H1 2020, the threat actors impersonated the Indian Government to send emails containing malware. These emails contained bogus health advisories on COVID-19. A spear-phishing campaign, aimed at computers belonging to the Indian Railways, was also detected.
  • MISSION2025: Suspected to be a Chinese state-sponsored threat actor, this group has been active since as early as 2012. MISSION2025 is suspected of carrying out various campaigns against multiple industries such as Automotive, Retail, Healthcare, Energy, Media, Finance, and many more. The group is believed to have targeted other nations such as the U.S., the U.K., Japan, France, South Korea, Hongkong, and Thailand, for financial gains and/or corporate espionage.
  • Stone Panda/ MenuPass/ APT 10/ Cloud Hopper: This Chinese threat actor group had traditionally shown interest in stealing international trade data and supply chain information from various enterprises across several countries such as India, Japan, Canada, Brazil, etc. It also tends to target Managed Service Providers (MSP), alongside Government agencies, Financial institutions, and entities in the Energy & Resources domain.

Top Attack Methods Used to Target India

The researchers at CYFIRMA observed a steady increase in attacks in H1 2020. They further studied these attack vectors and have listed the following methods as being the most potent forms of attacks to be used in H2 2020 and beyond.

CYFIRMA India Threat Landscape 2020
Image Credit: CYFIRMA’s India Threat Landscape 2020

Malware Trends to Watch-out

H1 2020 saw criminal organizations, state-actors, and even well-known businesses being accused of deploying various malware targeting Indian businesses and organizations. Listed below are malware trends with a likely impact on India through H2 2020 and beyond.

CYFIRMA India Threat Landscape 2020
Image Credit: CYFIRMA’s India Threat Landscape 2020

Related News:

CYFIRMA’s DeCYFIR Platform Can Predict Hacker Motives Before an Attack!

CYFIRMA Brings Cyberthreat Intelligence to the Fore

1 in 4 Cyberattacks Handled by U.K.’s NCSC Were Related to COVID-19

covid-19 vaccine, vaccine

Over one in four security incidents handled by the U.K.’s National Cyber Security Centre (NCSC) last year were COVID-19 related cyberthreats. In its annual threat review report, the agency stated the number of attacks surged from an average of 600 incidents over the past three years to 723 incidents now. It was found that organizations in the U.K. suffered an average of 60 cyberattacks per month from September 2019 to August 2020. The report revealed details of 160 high-risk and critical vulnerabilities with trusts, including 51,000 indicators of compromise (IOCs).

The NCSC’s defense system took down over 15,000 COVID-related malicious campaigns last year and blocked nearly 260 Sender IDs for sending malicious SMS messages. In addition, the agency prevented over 166,000 phishing URLs, in which 65% were within a day and 2.3 million suspect emails were forwarded to its new Suspicious Email Reporting Service (SERS).

The NCSC also highlighted that it performed threat hunting on 1.4 million National Health Service (NHS) endpoints, and scanned over one million IP addresses to detect security weaknesses and applied its Active Cyber Defense services to 235 frontline health care providers with web, email security, and DNS protection.

Paul Chichester, NCSC Director of operations, said, “We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic. Working with our allies, the NCSC is committed to protecting our most critical assets and our top priority at this time is to protect the health sector. We would urge organizations to familiarize themselves with the advice we have published to help defend their networks.”

NCSC’s New Vulnerability Reporting Toolkit

Recently, NCSC released a new “Vulnerability Reporting Toolkit,” which is intended to help organizations manage their vulnerability disclosure processes in a simplified manner. The Toolkit is helpful for all types of organizations that are planning to implement a vulnerability disclosure process in their system. Read more…

Ping Identity Acquires Symphonic Software to Enable Enterprises to Prevent Fraud

Ping Identity Acquires Symphonic Software to Boost Enterprise Security

Intelligent identity solutions provider Ping Identity has acquired authorization solutions provider Symphonic Software to help enterprises prevent cyber risks and enhance their cybersecurity posture. The acquisition integrates Symphonic’s authorization platform with Ping’s data privacy and consent products, allowing enterprises to centralize administration and enforcement to critical resources.

Symphonic helps organizations in enforcing complex policy decisions across multiple channels for their workforce, customers, third party providers, and business partners. Ping Identity enables enterprises to achieve Zero Trust identity-defined security and more personalized user experiences. Its security platform provides customers, workforce, and partners with access to cloud, mobile, SaaS and on-premises applications across hybrid networks.

The joint solutions would offer enterprise-grade features like delegated administration, deployment workflows, integrated testing, and analysis of policies. The companies will offer a rich set of policy enforcement methods for API and web-based applications without requiring custom integration code. Customers can also avoid costly custom integrations by leveraging native services that are core to identity platforms like users, groups, entitlements, consents, and risk.

Commenting on the new acquisition, Andre Durand, CEO and Founder of Ping Identity, said, “With increasing data privacy regulations, users are demanding that enterprises give them better digital experiences with more transparency and control. The acquisition of Symphonic accelerates our vision for enterprises to not only maintain security and compliance with confidence, but to easily deliver personalized, trustworthy experiences.”

5G Security: Possible Risks and Challenges

5G is taking the world by storm. This game-changing technology takes mobile connectivity to a whole new level by introducing jaw-dropping speeds and low latency. Furthermore, its network capacity can reach a million devices per square kilometer, which is ten times the maximum number supported by 4G.

By David Balaban, Computer Security Researcher, Privacy-PC.com

Whereas the dramatic change in the millimeter-wave frequency spectrum used by 5G compared to its predecessor doesn’t really explain anything to the average person, there are tangible benefits that make a difference and can be noticed with the naked eye. The speeds can reach 2Gbit/s at the dawn of 5G deployment and will theoretically grow to 100Gbit/s as the technology evolves. That’s up to 100 times faster than 4G. Reduced latency is another breakthrough, allowing data to arrive at its destination about five times quicker.

A simple example of how this improves the user experience is that there is absolutely no buffering time when watching a 4K quality video on a mobile device. Uploading and downloading gigabytes of data is a matter of mere seconds in 5G networks, which transforms the way users interact with numerous cloud-based services. Also, wirelessly connected entities that constitute the Internet of Things (IoT), including self-driving cars and smart home appliances, will be able to operate reliably and seamlessly. An extra factor on the plus side of 5G is that people can enjoy fully-fledged connectivity in places where cable modem and Wi-Fi are unavailable.

Having started with field testing and somewhat scattershot regional rollouts in 2019, the deployment of 5G is currently accelerating around the globe. In the United States, the European Union, and East Asia, the process of launching next-generation commercial networks is in full swing, occasionally taking place ahead of schedule.

To keep up with this telco evolution, all major smartphone manufacturers have already released devices that support 5G. Furthermore, market analysts predict that these gadgets will account for 15% of all global smartphone shipments in 2020. Aside from smartphones, a plethora of different IoT solutions will be heavily relying on high-speed connectivity in the near future.

All in all, the booming 5G tech is gradually shaping up to be the mainstay of digital economies going forward. When there is so much at stake, governments and service providers need to make sure the network deployment is flawless in terms of security. Cybercriminals will undoubtedly look for ways to compromise the emerging communication protocols and thereby orchestrate massive data breaches. The concerns escalate considering the tightening connection between 5G and ubiquitous cloud computing.

The government-level 5G risk assessment process is now underway in the EU. A report released by the member states singles out the security and privacy pitfalls that may accompany fifth-generation network rollouts. Below is a summary of the experts’ findings.

5G Vendor Monopoly Issue

One of the key points expressed in the report is that the EU will have to rely on a single manufacturer of network equipment, the Chinese vendor Huawei. Even though the name of this technology company isn’t directly mentioned in the document, the implied cooperation is common knowledge.

The potential problems stemming from the monopoly position of the supplier include a possible lack of equipment, dependence on the contractor’s commercial welfare, and cyberattacks targeting its digital infrastructure. The recent outbreak of the Coronavirus in China could become an additional factor undermining mainstream 5G deployment.

Researchers emphasize that such a collaboration has a single point of failure. The manufacturer can be subject to economic sanctions or other forms of commercial pressure. A hypothetical merger or acquisition scenario may also prevent the company from following its obligations.

One more thing to consider is that there are close ties between the vendor and the government of the state it’s headquartered in. This can be a source of politically motivated tampering with the company’s business processes. Moreover, the scarcity of data protection commitments shared by the EU and the country of the supplier’s origin is yet another possible obstacle to a hassle-free partnership.

According to the EU officials, an increasingly strong link between the member states’ telecommunication networks and third-party software underlying them is a serious threat as well. Since the vendor will have a significant scope of access to all the data in transit, malicious actors will be tempted to hack these solutions and intercept the information.

Extra Stumbling Blocks to Tackle

In addition to the solo vendor issue that implies a major dependency on third-party telco gear and applications, secure 5G implementation may also be hampered by quite a few more circumstances revolving around the technical nature of these systems. Here is the lowdown on these vulnerabilities.

  • A greater number of attack vectors

The growing role of software in fifth-generation networks is deemed as one of their weak links. It makes them highly susceptible to compromise that piggybacks on security loopholes, including zero-day exploits that may be unearthed down the road. Such imperfections can become a launchpad for cyber incursions that will allow an adversary to gain a foothold in different tiers of the 5G network architecture. The potential outcomes can range from man-in-the-middle (MITM) attacks to large-scale disruption of the services based on wireless connectivity.

For instance, malefactors may insert a backdoor into an application involved in the 5G implementation chain. To do it, they can take advantage of a known or undocumented vulnerability arising out of the supplier’s poor software development practices. Aside from that, a phishing hoax might be used to wheedle out the sensitive credentials of the software engineers and thereby get unauthorized access to the application. The backdoor will allow the attackers to modify the program’s behavior, deposit malware, or steal users’ data.

Cybercriminals may also try to execute an ARP spoofing attack against a mobile carrier’s IT network by flooding it with rogue Address Resolution Protocol packets. This way, the MAC address of the attacker’s device will become associated with the IP address of the default gateway in the telco service provider’s network. In plain words, the threat actor will be able to impersonate a trusted user to intercept, change, or stop any traffic intended for that IP address.

Distributed denial-of-service (DDoS) attacks pose a growing risk to 5G networks and the entities relying on them. According to Statista, the total number of IoT devices in use worldwide will reach 75 billion by 2025, up from 30 billion in 2020. This ecosystem will be expanding dramatically and so will botnets that harness crudely secured IoT devices to fuel massive DDoS incursions targeting major web services.

As a matter of fact, incidents like that have already occurred in the past. The notorious Mirai malware outbreak in 2016 demonstrated how disruptive this attack vector can get. The infection enslaved more than 600,000 unprotected CCTV cameras and routers to execute a series of 1 Tbps DDoS raids. With the rapidly increasing number of 5G-enabled smart gadgets, the likes of Mirai will be booming and the issue will undoubtedly escalate.

  • Network slicing security needs an overhaul

5G is expected to bolster the functioning of virtualized ecosystems referred to as “slices,” which host critical services and utilities used by businesses and government networks. Providing proper security of these independent logical networks that reside within the same physical infrastructure is an increasingly serious challenge. Experts have yet to develop effective mechanisms for isolating these slices in the all-new 5G paradigm to thwart data leaks and other forms of intrusions.

  • Meager software update procedures

As previously mentioned, next-generation wireless networks will depend on software to a much bigger extent than the predecessors did. Obviously, seamless application maintenance practices are going to be the pivot of their uninterrupted operation. In particular, software update management will need to catch up with security trends in terms of vulnerabilities and technical bugs and address these flaws before threat actors add them to their repertoire.

  • Obsolete standards

Aligning the peculiarities of 5G networks with international and state-level security regulations is a work in progress. The protocols developed by the 3rd Generation Partnership Project (3GPP) organization, which are currently in effect, extensively cover requirements for earlier mobile telephony systems (GSM, UMTS, and LTE) but don’t fully embrace all aspects of 5G standardization at this point. Elaborating the entirety of new security regulations is a matter of trial and error combined with in-depth research that has yet to be conducted.

  • Lack of trained personnel

As promising as it is, the 5G technology is also a Pandora’s box filled with opportunities for cybercriminals who will explore it for weaknesses. With that said, the security industry should work proactively to stay on top of new methods as they complement the malefactors’ toolkit. An important prerequisite for bridging this imminent gap is to nurture the expertise of security professionals so that they can identify and fix network imperfections by means of penetration testing and other techniques.

The personnel will need to collaborate more tightly with software suppliers to get a profound understanding of how the new applications work and what exploitation mechanisms they are potentially susceptible to. Furthermore, penetration testers who think like attackers can probe the IT infrastructure of 5G providers and contractors for weaknesses by orchestrating trial network incursions. This will allow the industry to prioritize the areas that need urgent improvement in terms of security.

Final Thoughts

5G will become one of the core elements of the global digital economy in the years to come. Therefore, securing these high-tech networks is a top priority for governments and all the parties involved in the deployment workflow. Hopefully, the white hats will team up and succeed in staying one step ahead of the adversaries to make sure people benefit from this awesome technology to the fullest.

About the Author

David BalabanDavid Balaban is a computer security researcher with over 15 years of experience in malware analysis and antivirus software evaluation. David runs the Privacy-PC.com project which presents expert opinions on contemporary information security matters, including social engineering, penetration testing, threat intelligence, online privacy, and white hat hacking. As part of his work at Privacy-PC, Mr. Balaban has interviewed such security celebrities as Dave Kennedy, Jay Jacobs, and Robert David Steele to get firsthand perspectives on hot InfoSec issues. David has a strong malware troubleshooting background, with a recent focus on ransomware countermeasures.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Related story: 5G Networks Present New Risks and Security Challenges

 

Compliance: A Chief Tenet for the Future of Cybersecurity

compliance and risk mitigation

COVID-19 has questioned the status quo of the business world. Businesses are transforming digitally and integrating newer technologies to deliver value to customers. However, digital transformation has brought unprecedented cyberthreats. And CISO MAG’s latest issue highlights why regulatory compliance is the key to address these challenges.

A recent survey of North American CISOs stated that CISOs are preparing for an average of 3.3 security compliance standard audits over the next six to 12 months. It is more important than ever for a CISO to ensure their organization is adapting to the compliance regulations like the GDPR and HIPPA.

Cloud Security Expert and NABCRMP Board Member, AJ Yawn, in “CISOs Must Declare an End to the War between Security and Compliance,” states that cybersecurity audits are viewed as “check-the-box” exercises where auditors are paid to produce a report, so the Board, executives, and interested third parties (customers and vendors) feel good about the perceived security status of the organization. It isn’t acceptable when these assessments are expensive, time-consuming, and extremely important to the bottom line.

Bryan Cline, Chief Research Officer at HITRUST, in his special feature, “Emphasize the Spirit of Compliance Over Simply Checking All the Boxes,” discusses the three levels of compliance maturity. He writes, “The correct solution involves moving beyond the binary state of the letter of compliance and, instead, striving to achieve compliance in a way that meets the intent of the regulations and standards.”

“Cybersecurity is vast, and compliance is a weird beast,” says Chaitanya Kunthe, Co-founder and Chief Operating Officer at Risk Quotient. Kunthe, in his article, “How Organizations Should Adopt Changing Compliance Standards,” talks about combining the Progression Model and Capability Maturity Model into a Hybrid Model to help CISOs understand where their frameworks currently are and how to improve them.

The articles: “SOC 2 Compliance and Cloud: What You Should Know,” by Narendra Sahoo, Founder and Director of VISTA InfoSec; and “Innovate Through Uncertainty by Managing Third-Party Risk,” by Alla Valente, Analyst at Forrester, cover the significance of SOC 2  for cloud service providers, vendors, and businesses, and the essential risk mitigation strategies for the value creation of the business, respectively.

Finally, the Cover Story of the issue titled, “How to Simplify Security and Compliance in the Cloud,” is about how Google is trying to simplify compliance for governments and the public sector in the cloud. It is written by Jeanette Manfra, Director for Government Security and Compliance, Google Cloud Office of the CISO.

We hope you enjoy reading the other articles and interviews in this issue as well.

Get your copy today: https://cisomag.com/magazine/

Endpoint Security SurveyWe invite you to participate in our year-end Endpoint Security Survey, the results of which will be shared in our December issue. Take Survey Now!

Endpoint Security

Marriott International Slapped with $123 Mn GDPR Fine for 2014 Data Breach

Marriott International’s Data Breach Exposes Records of 5.2 Million Guests

The U.K.’s Information Commissioner’s Office (ICO) imposed £18.4 million ($23.92 million) fine on Marriott International Inc. for violating the GDPR guidelines. The data privacy regulator stated that Marriott has failed to protect the personal data of millions of its customers. Around 339 million guest records worldwide were affected after a cyberattack on Starwood Hotels and Resorts Worldwide Inc. in 2014, remained undetected until September 2018, by when the company had been acquired by Marriott.

Attack Background

In 2014, an unknown attacker installed a malware code in the Starwood systems to obtain access to the contents remotely. With unrestricted access to the infected device, attackers distributed malware to other devices on the network to steal customers’ sensitive information. The exposed information included names, email addresses, unencrypted passport numbers, phone numbers, arrival/departure information, guests’ VIP status, and loyalty program membership number.

Related Story: Four Biggest GDPR Fines of 2020

Violation Penalty

The ICO’s investigation found that Marriott failed to put appropriate security measures to protect its customers’ data being processed on its systems, as per the GDPR.

In July 2019, the ICO issued Marriott with a notice of intent to fine up to £99,200,396 ($123 million) for violating the data breach regulations. However, the regulator decreased the penalty amount considering the economic impact of COVID-19 on their business.

Information Commissioner, Elizabeth Denham said, “Personal data is precious, and businesses have to look after it. Millions of people’s data was affected by Marriott’s failure; thousands contacted a helpline and others may have had to take action to protect their personal data because the company they trusted it with had not. When a business fails to look after customers’ data, the impact is not just a possible fine, what matters most is the public whose data they had a duty to protect.”

Related Story: Marriott International faces $123 million GDPR fine

REvil Ransomware Buys KPOT Malware; Adds Another Weapon to its Arsenal

KPOT Malware auctioned to REvil Ransomware gang, REvil ransomware, KPOT malware, ransomware

Last month, operators of the infamous information-stealing malware KPOT held an online auction on a dark web forum. Interestingly, the KPOT malware auction saw only one buyer ready to shell out the base price of $6500 to acquire the source code. On further investigation, it was found that the winning bidder was none other than UNKN, a known member from the REvil (also known as Sodinokibi) ransomware gang.

KPOT Malware Auction

The idea behind the KPOT malware auction was that the operators wanted to move to another project. Thus, for monetary gains, the base price of the auction was set to $6500. However, this base price seemed to be too high for the members of the dark web forum where it was being advertised.

KPOT malware was launched in mid-2018 and advertised as Malware-as-a-Service (MaaS). Its latest version, KPOT 2.0, displayed malicious functionalities like the collection of:

  • Passwords
  • Cookies
  • Browsing history
  • Browser auto fill form details
  • RDP files
  • System information including IP address, username, and installed software

Related News:

Not a Hoax! REvil Ransomware Operators Launch Auction Website

This malware is a perfect fit for a threat actor who is attempting to break into a network or system to infect it further with other vectors like ransomware. This is what the REvil ransomware gang must have thought because with such a steep price and no buyers, the REvil ransomware gang member, UNKN, bought the source code of KPOT 2.0 at the base price that it was placed for. Another reason behind no apprehensions in paying the steep price could well be the fact that the REvil gang claims to have an annual turnover of more than $100 million from ransom demands. A Russian YouTube channel that claims to have interviewed a member from the famous Russian speaking REvil ransomware gang has revealed this explosive news.

REvil ransomware, coupled with KPOT’s capabilities, can cause targeted strikes against major corporations. It is one to be put on the lookout list of your organization’s threat indicators.

Related News:

Are We Really Out of the Maze? The Ransomware Gang Announces Retirement

Old Unpatched Vulnerabilities Could Invoke Cyberattacks and Malware

actively exploited vulnerabilities, Vulnerabilities, risk-based vulnerability management

The “new normal” business operations left most organizations vulnerable to new attack vectors. From database misconfigurations to unpatched vulnerabilities, organizations suffered several challenges in terms of remote workforce migration and changes in the threat landscape, Bitdefender’s business threat landscape report revealed.

According to the report, nearly 63% of all reported unpatched vulnerabilities involve CVEs that date back to 2018 and earlier, leaving organizations potentially open to various cyberattacks. Companies globally could be at severe security risk if they do not adopt patch management solutions as soon as possible.

Over 45% of security professionals believe that IoT devices in employees’ home networks pose serious security risks as they could be easily exploited by remote attackers to compromise the entire corporate network systems. Besides, the surge in the APT-as-a-service threat landscape gave businesses new security challenges and paved the way for opportunistic hackers to misuse the change in workforce deployment.

Key Findings:

  • 87.31% of all misconfigurations involve having WinRM Service enabled.
  • 93.10% of human risk factors involve employees using old passwords for accounts.
  • 46.84% of all reported network-level attacks involve SMB exploits.
  • 41.63% of all reported network-level attacks involve brute force attempts on RDP and FTP.
  • 46% increase in suspicious IoT incidents in households throughout the first half of 2020.
  • 4 in 10 emails on the Coronavirus topic are fraud, phishing, or malware.
  • 42.52 % of Execution stage Command and Scripting interpreter sub-techniques involve the use of PowerShell Commands and Scrips.

“In the wake of 2020, 50% of organizations were unprepared to face a scenario in which they would have to migrate their entire workforce in a work-from-home environment. The global SARS-CoV22 pandemic may have been a respiratory illness that affected people around the world, but it also impaired the way organizations and business conducted normal operations. The lack of forward planning for such a scenario left many organizations open to potential vulnerabilities and misconfigurations that threat actors could have easily leveraged to score breaches, exfiltrate data, or even generate additional profit by extorting vulnerable companies,” said Bogdan Dumitru, CTO at Bitdefender.

1...148149150...410Page 149 of 410