Home Blog Page 167

India Witnessed Over 1.45 Million Cybersecurity Incidents in Five Years

Acronis Cyber Readiness Report, cyberattacks in India, cybercrime in India, India’s Private Sector

Computer Emergency and Response Team – India (CERT-In) recorded over 1.45 million cybersecurity incidents including breaches and hacks between 2015 and 2020. According to the India’s Ministry of Electronics and Information Technology (MeITY), Cert-In reported 49,455, 50,362, 53,117, 208,456, 394,499 and 696,938 cybersecurity incidents during the year 2015, 2016, 2017, 2018, 2019 and 2020 (till August) respectively.

The figures were out after the ministry was asked about growing cyberattacks targeting Indian citizens as well as commercial and legal entities. According to the Internet Crime Report for 2019, released by the U.S. Internet Crime Complaint Centre of the Federal Bureau of Investigation, India stands third in the world among the top 20 countries that are victims of internet crimes. Reports also suggest that the number of internet users in India has grown six-fold between 2012-2017 with a compound annual growth rate of 44%.

“With the proliferation in the internet and mobile phone usage, there is a rise in the number of cybersecurity incidents in the country as well as globally. Proactive tracking by CERT-In including its Cyber Swachhta Kendra and National Cyber Coordination Centre (NCCC) and improved cybersecurity awareness among individuals and organizations across sectors has led to increased reporting of incidents,” according to NITI Aayog report by member VK Saraswat.

To combat the attacks, the government has also taken up several initiatives. These include:

  • Regularly issuing alerts and advisories regarding the latest cyber threats/vulnerabilities and countermeasures.
  • Issuing guidelines for Chief Information Security Officers (CISOs) regarding their key roles and responsibilities for securing applications/infrastructure and compliance.
  • Empaneling 90 security auditing organizations to support and audit the implementation of Information Security Best Practices.
  • Formulating Cyber Crisis Management Plan for countering cyberattacks and cyber terrorism for implementation by all Ministries/ Departments of Central Government, State Governments, and their organizations and critical sectors.
  • Conducting mock drills to enable assessment of cybersecurity posture and preparedness of organizations in Government and critical sectors.
  • Conducting regular training programs for network/system administrators and Chief Information Security Officers (CISOs) of Government and critical sector organizations regarding securing the IT infrastructure and mitigating cyberattacks.
  • The government has also launched the Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre). The center is providing detection of malicious programs and free tools to remove the same.
  • Setting up of the National Cyber Coordination Centre (NCCC) to generate necessary situational awareness of existing and potential cybersecurity threats and enable timely information sharing for proactive, preventive, and protective actions by individual entities.

India Reports Twice as Many Attacks Compared to Other Countries

The recent Acronis Cyber Readiness Report 2020, from cybersecurity firm Acronis revealed how organizations are mitigating the effects caused by the pandemic to their business operations and security posture. The report revealed that 56% of organizations stated that their IT costs have increased significantly in the past months. India reported nearly twice as many cyberattacks as any other country, followed by the U.S. and the UAE.

“Adaptation of digitization is taking place at a faster pace, be it in businesses or in other walks of life. It is expected that we will be soon transiting wholly to newer technologies like cloud computing, Artificial Intelligence, Internet of Things, and 5G spectrum, which will naturally expand our dependency on digitization multifold. However, in the absence of stringent cybersecurity infrastructure, cyber threats can be disastrous for our entire social fabric. There has been a recent surge in cyberattacks on Indian digitals cape that are only increasing in scope and sophistication, targeting sensitive personal and business data and critical information infrastructure, with an impact on the national economy and security. Cyberwarfare is relentless in trying to erode the security fortification of several sectors in the country. This is certainly a wakeup call for India to have stronger policies in place,” said Nikhil Korgaonkar, Regional Director, India & SAARC at Arcserve.

Are You a Content Creator? Facebook’s New “Rights Manager” is for You!

Facebook

Facebook has just launched its “Rights Manager” tool to grant ownership control over to the user for images published on the Facebook and Instagram platforms. The Verge reports that Facebook has partnered with certain unnamed innovative tech solutions for this offering. This innovative tool will give content creators of both Facebook and Instagram platforms rights to claim ownership of their own images as it currently does for music and video rights.

How Does the “Rights Manager” Work

To access the “Rights Manager” tool, Facebook Page admins first need to apply for the content they’ve created and want to protect. Rights Manager will find matching content on Facebook and Instagram.

  1. Upload a CSV file to Facebook’s Rights Manager that contains all the image’s metadata. Adjust settings to match things like ownership applicable worldwide or only in certain locations and so on.
  2. Once you hit “Apply for Rights Manager” the internal algorithm verifies the metadata and matches the image.
  3. Once the process is complete it then displays the image and pages where it is showing up.
Facebook Rights Manager
Image Credit: Facebook
What if two parties claim ownership?

If another person claims ownership of the same image, then the two parties can dispute the claim. However, if no settlement is agreed upon, Facebook will eventually bestow it to the one who filed first. This decision can again be appealed in Facebook’s IP reporting forms.

Copyright and ownership of content has been a prolonged issue especially on social media platforms where sharing and posting is just two-clicks away. However, Facebook acknowledges the fact that quality content creation is a cumbersome task and thus, it is clearly the intellectual property of its creator. It believes that upending such solutions will put content creators in charge of their content and help clear the clutter of aggregated content (image) sharing and publishing, which at times robs them of their ownership, attribution, and credit.

DHS and CISA Warn Federal Agencies to Patch “Zerologon” Flaw

cyberthreats, bug

The U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) asked federal authorities to update all their Windows systems that are vulnerable to the CVE-2020-1472 bug. In an emergency directive, the agencies urged to update all Windows Servers with the domain controller role in any information systems which collects, processes, stores, transmits, disseminates, or maintains agency information.

The vulnerability dubbed as “Zerologon” affects Windows Server 2008 and onwards. An attacker can exploit the flaw by leveraging the Netlogon Remote Protocol to get a connection to the domain controller.

Patch Unfinished

Microsoft patched the vulnerability in its August Patch Tuesday last month. According to CISA, several proof-of-concept exploits caused widespread concern across the industry and the bug was unpatched in many government agencies. The vulnerability could allow attackers to hijack the Windows domain controller. All an attacker requires is local network access, which is also why it cannot be performed directly over the internet. However, if an attacker sets their foothold in the target environment, they can change the administrator password on any Windows Domain Controller they can reach.

CISA stated that the vulnerability may cause severe security risks to the Federal Civilian Executive Branch. The determination of the vulnerability is based on:

The availability of the exploit code in the wild increasing likelihood of any unpatched domain controller being exploited.
The widespread presence of the affected domain controllers across the federal enterprise.
The high potential for a compromise of agency information systems.
The grave impact of a successful compromise.
The continued presence of the vulnerability more than 30 days since the update was released.

“Update all Windows Servers with the domain controller role.  Apply the August 2020 Security Update to all Windows Servers with the domain controller role. If affected domain controllers cannot be updated, ensure they are removed from the network. And ensure technical and/or management controls are in place to ensure newly provisioned or previously disconnected domain controller servers are updated before connecting to agency networks,” the emergency directive added.

It’s Jail Time! Australian Government Employee Sentenced for Mining Cryptocurrency

Cryptocurrency mining

In May last year, the Australian Federal Police (AFP) pressed charges against a 33-year old former resident of New South Wales (NSW) for his alleged role in manipulating Commonwealth Scientific and Industrial Research Organisation’s (CSIRO) computer system for mining cryptocurrency and presented him in the federal court.

What Happened

CSIRO is an Australian Government agency that collaborates with leading organizations around the world in the field of scientific research. The alleged cybercriminal was hired in CSIRO as an IT contractor in January 2018. His work profile gave him access to the servers and other IT systems in the organization. The AFP later found that the cybercriminal used these servers and systems in an unauthorized manner to manipulate and carryout mining of cryptocurrency, which totaled to approximately AU$9,400 (approximately US$ 6,830).

The AFP’s Cybercrime Operations unit investigated the matter after CSIRO reported a “serious impairment of its infrastructure.” The federal police got a search warrant and raided the man’s house in Sydney on March 5, 2018. During the raid, officials seized a laptop, personal phone, employee ID cards and many data files, which later proved his involvement. The AFP pressed two charges against him:

  • Unauthorized modification of data to cause impairment, contrary to section 477.2 of the Criminal Code Act 1995 (Cth)
  • Unauthorized modification of restricted data, contrary to section 478.1 of the Criminal Code Act 1995 (Cth).

The Conviction

The alleged misuse of CSIRO’s assets had caused nearly AU$76,000 (approximately US$ 6,830) of funds impairment that was irreparable. This was the hard-earned money of common Australian tax-paying citizens that went down the drain, and thus CSIRO demanded the toughest prosecution for the accused. Although the accused had pleaded guilty for his offenses in February 2018, all angles had to be taken into consideration and a detailed investigation was necessary.

After 16 months of his first hearing, the accused has been sentenced to a 15-month imprisonment term by way of an intensive community order, which includes 300 hours of community service.

Data Security Requires a Holistic View

small businesses cyberthreats

Public and private enterprises across all verticals must be concerned with the secure handling of personally identifiable information (PII) of their employees and customers, trade secrets and intellectual property (IP), financial, product and planning information, and other data critical to their business. Mishandling of PII data can result in a violation of stringent regulations, including the General Data Protection Regulation (GDPR) and the Gramm-Leach-Bliley Act (GLBA), opening the firm to financially and reputationally damaging fines. The loss of IP and other data can damage an enterprise’s ability to compete or do business effectively and result in reputation loss.

By Grant Evans, Chairman and Chief Executive Officer, SPYRUS

The Data Protection Conundrum

Protecting data is a daunting task and requires a view towards preserving the Confidentiality, Integrity, and Availability of data — also known as the CIA triad. Data must be protected when it is in motion, at rest and in use. The mobility of an enterprise’s workforce complicates matters further. The current pandemic has extended every office environment to every home and location with a hotspot, which is likely to be the new normal.

While telecommuting offers employers the flexibility to “extend the office” into environments where employees want to work, or must when circumstances demand, it also expands the threat landscape exponentially. Whether it is a home office, local coffee shop, or a hotel lobby, employees can continue contributing to the business from anywhere in any way. Unfortunately, perceived increased productivity could quickly become detrimental. Extending the office beyond a “controlled” building also extends the company’s network, stretching security thin and opening holes for hackers. Most often, hotel, home, and coffee shop Wi-Fi networks are not secure enough to protect sensitive data used by insurance, banking, and health care companies. This exposes the company to fines stemming from violations associated with Code of Federal Regulations (CFR) Standards for Safeguarding Customer Information, Health Insurance Portability and Accountability Act (HIPAA), General Data Protection Regulation (GDPR) and the growing number of privacy regulation at Federal and Municipal levels. While securing and managing endpoints with software protection and mandatory VPN usage mitigates the risks associated with data in motion, it does not address the protection of shared data and often hinders stakeholder collaboration.

How can teams effectively collaborate on projects if employees and managers and even third-party partners cannot see who made what changes and when to presentations, whitepapers, contracts, et al.? Perhaps more importantly, how can enterprises ensure that their stakeholders only share data with authorized persons and be confident that the data is still protected at its destinations? Most data protection schemes focus on either limiting access or sharing data and hoping for the best.

SPYRUS believes a true long-term data protection solution requires a holistic approach that quickly identifies and thwarts threats without extensive financial and labor resources.

SPYRUS Solutions

SPYRUS Solutions provides a holistic approach with cost-conscious and easy to use cryptographic solutions incorporating encryption, authentication, and management. The SPYRUS DevicePatrol™ Platform comprises of hardened endpoints and endpoint cryptographic management, in a secure collaboration environment.

SPYRUS hardened endpoints are the most secure in the industry — FIPS 140-2 Level 3 validated, ensuring both physical and logical security controls resulting in an anti-tamper design that provides Military-grade encryption and multi-factor authentication for any enterprise.

With the SPYRUS DevicePatrol management software, endpoint activity is audited and logged even when used offline. If the endpoint activity is concerning, an enterprise administrator can “disable” the token or “destroy” the endpoint keys remotely anywhere in the world, rendering all data on the drive useless (temporarily or indefinitely).

Enterprises also need to enable secure collaboration between employees and sometimes with external parties, protecting both the critical data and critical workflow. To that end, SPYRUS offers a unique and secure collaboration environment.

Secure Data Protection and Collaboration

The SPYRUS NcryptNshare application allows for individual documents, files, and folders to include digital signatures, ensuring the shared data source. NcryptNshare also creates a secure personal vault on each user’s personal computer(s) that cannot be accessed or viewed without applying and unlocking the user’s Rosetta token that protects the encryption and authentication/signature keys in FIPS 140-2 Level 3 hardware.

NcryptNshare provides the highest level of object encryption and controlled access so that cloud or other unsecured communication locations/paths can be used with the highest levels of confidence. For example, a user can share information with only the intended recipient(s) via email, instant message, or any medium in the public cloud. A user can create secret file folders only accessible to individuals in groups who have their own Rosetta token.

The SPYRUS patented “seal” of the encrypted file prohibits any tampering (for instance, by malware), ensuring data is protected wherever it is stored. SPYRUS also provides data recovery capability that can be managed by the enterprise should a user’s key be lost, disabled, or destroyed.

NcryptNshare is powered by the SPYRUS Hardware Roots of Trust (aka “Rosetta”). Rosetta is a FIPS 140-2 Level 3 validated security controller chip embedded in all DevicePatrol tokens. In addition to being anti-tamper, Rosetta offers a comprehensive list of cryptographic functions with RSA, elliptic curves, and custom algorithms. By leveraging Rosetta’s key protection, NcryptNshare allows users to dynamically assign access to encrypted objects to enforce multifactor authentication, ensuring that only the right user(s) have access to the information being shared.

In Summary

All enterprises have a myriad of data that must be secured — both on-premise, in the Cloud environment, and at any location its stakeholders find themselves. The financial and reputational impact of not securing data can be severe. Enterprises need to embrace intuitive solutions and business practices that enhance their stakeholders’ ability to protect data in motion, at rest and in use, avoiding mishaps that exacerbate the insider threat. For more than 20 years, SPYRUS has ensured public and private enterprises have security solutions to protect their data at the highest levels of confidence by exceeding CIA requirements. The SPYRUS DevicePatrol Platform and SPYRUS NcryptNshare enable enterprises to extend the office worldwide — and secure the collaboration of its employees and key third parties.

For more information, visit www.spyrus.com.

About the Author

Grant EvansGrant Evans was named Chairman and CEO of SPYRUS in late 2018. He is a seasoned senior executive and serial CEO with nearly 30 years of operating experience. He has served as Chairman and CEO of multiple public and private companies on a global basis, including NetFortris and ActivIdentity.

Evans is a notable industry leader and has received wide acknowledgment of his contribution to the security industry. He serves and has served on multiple company and industry boards that have included NetFortris, 3VR, Bell ID, Congressman Honda’s Blue Ribbon Security Board for Homeland Security, American Electronics Executive Advisory Committee, Comdex Advisory Board on Security, Pearl Street Ventures Advisory Board and TCSV-Trans Global Secure Communications Board.

Disclaimer

All views are personal and attributed to the author. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Ransomware Alert: NCSC Warns of Attacks Against Universities

54% of Universities in the U.K. Suffered a Data Breach Last Year, Herff Jones payments card breach

The U.K.’s National Cyber Security Centre (NCSC) has warned educational institutions to be vigilant of rising cyberattacks and urged them to follow required mitigation measures. The NCSC’s warning comes after the recent surge in the number of ransomware attacks targeting schools, colleges, and other academic institutions in the country. It was also found that threat actors demanded bitcoins as ransom from the victims, and threatened to expose the stolen data of students if not adhered to.

All the educational institutions have been asked to follow the NCSC’s guidelines to develop an incident response plan to defend against malware and ransomware attacks. “Institutions that have been infected with ransomware have seen their ability to operate effectively and deliver services significantly obstructed and, depending on an organization’s level of resilience, it can take weeks – and in some cases months – for services to return to normal,” NCSC said.

Paul Chichester, Director of Operations at the NCSC, said, “This criminal targeting of the education sector, particularly at such a challenging time, is utterly reprehensible. While these have been isolated incidents, I would strongly urge all academic institutions to take heed of our alert and put in place the steps we suggest, to help ensure young people are able to return to education undisrupted. We are absolutely committed to ensuring the U.K. academia is as safe as possible from cyber threats and will not hesitate to act when that threat evolves.”

Endless Phishing Attacks

A survey on the state of cybersecurity in the higher education sector, conducted by managed threat detection provider Redscan, revealed that nearly 54% of universities in the U.K. reported a data breach to the Information Commissioner’s Office (ICO) last year. The survey report titled “The State of Cybersecurity across U.K. Universities”  stated that around 46% of all university staff received no security training and 24% did not commission a penetration test from a third-party. Defending against the constant stream of phishing scams remains a challenge for all universities. Several universities receive millions of spam and phishing emails each year, with one institution reporting a high of 130 million.

91% of SMBs Looking for Right Cybersecurity Solutions

CISOs in remote working

Most small and medium-sized businesses (SMBs) believe they are prepared for a cyberattack, but only a few of them are ready to deal with the outcome of such incidents. However, cybersecurity remains a top priority for most SMBs globally, according to a research from ConnectWise. The research “ConnectWise SMB State of Cybersecurity” revealed that three-quarters of the respondents worried they will be the target of an attack in the next six months. Over 91% of SMBs admitted that they would use or move to a new IT service provider for the right cybersecurity solutions. While 86% of SMBs are positioning cybersecurity within the top five priorities for their organization, six in 10 organizations said they invest more in cybersecurity.

Around 68% of respondents stated that right cybersecurity offerings mean having confidence in a managed service provider’s (MSP) ability to respond to security incidents, while 58% stated it is having confidence in an MSP’s ability to minimize damage. The research also highlighted that 52% of SMBs admitted that they lack in-house security skills, which are required to handle cyber issues, and 49% of SMBs find more cybersecurity expertise as an added benefit of working with an MSP.

Jay Ryerse, CISSP, Vice President of cybersecurity initiatives for ConnectWise said, “Confidence remains a key factor for SMBs in choosing the right MSP offering for their business needs. Currently, only 13% of SMBs are having regular cybersecurity-related conversations with their MSP. Even more worrisome is the fact that 29% of SMBs talk to their MSP about cybersecurity only after they have suffered an incident. It’s clear that MSPs must work to reinforce that confidence and build closer relationships with their clients.”

The findings are based on the responses from 700 IT and security decision makers working across the U.S. (300), the U.K. (150), Canada (100), Australia, and New Zealand (150).

SMBs Rely on Free Cybersecurity Tools

A similar research from BullGuard revealed that one in three small businesses with 50 or fewer employees rely on free or consumer-grade cybersecurity tools. It also pointed out that one in five companies do not use any endpoint security whatsoever. The research, which surveyed small businesses in the U.K. and the U.S., suggested that nearly 43% SMB owners are not prepared for a potential cyberattack or breach leaving their most sensitive financial, customer, and business data at risk.

Is the Co-existence of Security and User Experience in Media Industry Possible?

Media Industry

The COVID-19 pandemic has propelled online media consumption to new heights. With people forced to stay indoors, the online engagement has blown the roof. However, the side shoot of this rise is the growing security concerns. But an added jacket of security hampers users’ experience on an online platform. So, who takes the back seat? Can security and user experience co-exist? Let us have a look at some key aspects from Akamai’s recently concluded Media Summit – APAC 2020.

By Mihir Bagwe, Tech Writer at CISO MAG

The Transformation

The media and entertainment industry has witnessed a dramatic transformation in the past few years, especially with new emerging trends that include the short-form video applications like TikTok, Instagram Reels, and numerous other over–the–top media services (OTT) platforms worldwide. The pandemic has further accelerated the internet penetration rate more than ever – for work, socializing, and most of all, entertainment – with consumers signing up for multiple streaming services and consuming an unprecedented volume of digital content.

However, the two most important pillars in the success of this digital medium is “Quality Content” and “User Experience” (UX). Without quality and value for money, content and user experience on a media and entertainment platform cannot gain popularity or become successful. So why exactly is user experience so critical?

To Prove: Better UX = Higher Digital Success

Remember how spiral buffering or loading icon that keeps going round in circles on your screen to annoy you? Reports from Google confirm that 53% of mobile site visits are abandoned if it takes longer than three seconds to load the webpage. It also revealed strong correlations between page speed and other key performance indicators like revenue, bounce rate, session duration, and viewability. The study stated that sites loading in under five seconds generated twice the revenue and recorded 25% higher viewability than those loading in 19 seconds. This difference in numbers can make or break the deal for customer retention. Thus, in the mathematical language of proving LHS = RHS, Better UX = Higher Digital Success.

The Shaky Third Pillar

A flourishing domain often attracts an evil eye, and the evil eye are the threat actors trying to target these video and media platforms for malicious and financial gains. People often tend to reuse login credentials across various mediums, and this increases the risk of compromise. The current supply chain is so stretched and unlimited that a compromise through a third-party can virtually lead to a leak of your customers’ credentials or personally identifiable information (PII). Once leaked, these credentials are sold on the dark web ranging from a few dollars (for simple site login) to thousands of dollars per user (in case of medical data). Due to the vulnerability of users reusing credentials across different channels, threat actors then carry out credential stuffing attacks using these leaked credentials.

According to Akamai’s State of the Internet Security Report, credential stuffing attacks against the media industry has seen a huge spike in the Q1 of 2020, especially in the month of March where more than six billion malicious login attempts were observed. Correspondingly, Akamai’s research also found a 98% YoY increase in credential stuffing attacks between 2018 to 2019.

security and user experience in media industry

Thus, the security of these populous video and media platforms is now an ever-growing concern. However, added security, such as a CAPTCHA or any other MFA process, during the login increases the number of steps and often leads to a degraded UX that eventually leads to a higher bounce rate. So, how do we solve this problem?

What Akamai’s Expert Says

Speaking at the Akamai’s Media Summit APAC 2020, Sid Deshpande, Security Technology & Strategy Director, Akamai Technologies, stressed that a good user experience is necessary for any platform’s digital success, however, better security is utmost critical in generating consumers trust and loyalty.

Consent is the new Currency

According to Sid, media consumers expect three important measures when it comes to the security of their online accounts or presence. They are:

  1. Transparent security controls
  2. Personal / PII data security
  3. Prevention of account/credential abuse

All these expectations collectively point to the fact that users are now demanding more control over their own data. As Sid correctly says, “Consent is the new currency.” A user’s consent in securing, collecting, and storing their data is very important.

Security architects need to design for the least common denominator of security awareness and work with the assumption that the user may not be in a position to make the correct security related decisions related to their accounts.

Best possible security measures for users’ data can only be achieved by collaborating with the users for the common good. Choosing between security and user experience is always a tug of war. Thus, we asked Sid whether media platforms and applications should give users an option to choose between security and UX, like we now choose which cookies can be stored and used under the GDPR compliance to render additional control of user consent. He answered, “I think to a certain degree it is good to give advanced/tech-savvy users some degree of choice in the deployment of advanced or value-added security features. However, security architects need to design for the least common denominator of security awareness and work with the assumption that the user may not be in a position to make the correct security-related decisions related to their accounts.”

Closing Notes

The debate between security and user experience in media industry will always feel like slacklining on a tight rope. Shift of weight on either side will lead to the downfall of the platform. In such a case, Sid Deshpande suggests three key prepositions for media CISOs and/or CIOs:

  1. Manageable security architecture: Design the security architecture as per the needs and usage of the respective media platform. Do not do too little or too much.
  2. Understand the attacker: Think like an attacker and you will get the answers for finding the weak spots in your network/architecture.
  3. Demonstrate the business value of security: Security helps in building loyalty, which in turn increases customer retention and eventually affects the growth of your media platform.
About the Author
CISO MAG Writer - Mihir Bagwe
Mihir Bagwe is a Tech Writer and part of the editorial team at CISO MAG. He writes news features, technical blogs, and conducts interviews on latest cybersecurity technologies and trends.

 

Other Posts from the Author:

Iranian Expats Under Radar of ‘Rampant Kitten’ Cyber Espionage for Six Years

Log4j, Iranian Ransomware Actors, SpoofedSccholars, second-tier targets, NIOPDC

Check Point Research uncovered a cyber espionage campaign linked to an Iranian hacker group targeting expats and dissidents in Iran for almost six years. The surveillance campaign dubbed as “Rampant Kitten” targeted government dissidents including resistance group Mujahedin-e Khalq, the Azerbaijan National Resistance Organization, Iranian minorities, and other anti-regime organizations to exfiltrate sensitive information from their Windows systems, Telegram apps, and SMSes.

“The conflict of ideologies between those movements and the Iranian authorities makes them a natural target for such an attack, as they align with the political targeting of the regime,” Check Point said.

Attack Vectors

  • Check Point researchers found four variants of Windows info-stealers intended to steal the victim’s personal documents as well as access to their Telegram Desktop and KeePass account information.
  • Android backdoor that extracts two-factor authentication codes from SMS messages and records the phone’s voice surroundings.
  • Telegram phishing pages, distributed using fake Telegram service accounts.

Malware Analysis

Hackers used multiple malware payloads to obtain data from the targeted devices including:

Information Stealer: Once uploaded on the victim’s device, this malware allows the attackers to make full usage of the victim’s Telegram account. It steals information from the KeePass application, uploads any file it finds, which ends with pre-defined extensions. It also logs clipboard data and takes desktop screenshots.

Module Downloader: This malware downloads and installs several additional modules.

Unique Persistence: This malware implements a persistence mechanism based on Telegram’s internal update procedure.

“The backdoor’s functionality and the emphasis on stealing sensitive documents and accessing KeePass and Telegram accounts shows that the attackers were interested in collecting intelligence about those victims, and learning more about their activities,” Check Point added.

Attacks via Dharma Ransomware

Recently, Group-IB researchers detected attacks on multiple companies across the globe that are carried out by Iranian newbie threat actors for financial gain. These attacks have been actively orchestrated since at least June 2020. The threat actors are using Dharma ransomware along with a set of other publicly available tools to target companies specifically in Russia, Japan, China, and India. Once compromised, the gang typically demands a ransom between 1-5 Bitcoins (BTC). The threat actors seem to be naïve since they did not have a fixed plan about what to do with the compromised networks.

Cybersecurity in Times of a Pandemic [INFOGRAPHIC]

COVID-19 Cyberthreats

The COVID-19 pandemic has disrupted global health, the economy, and social systems. From emptying office spaces to dispersing the workforce, corporates have yet ensured seamless delivery of services. However, remote work environment has also led to a surge in unseen threats in the digital space. Threat actors are prying on potential victims to deploy cyberattacks on home and public networks.

Phishing emails are formulated in the name of the World Health Organization (WHO) and other regulatory bodies, using social engineering tools, to target vulnerable victims. These phishing emails contain documents with embedded links that result in ransomware attacks.

Here are myriad cyberthreats posed by the pandemic:

Ciso Mag Covid-19 info

Click here to view the infographic on a full screen!

To subscribe to the September issue of CISO MAG, click https://cisomag.com/magazine/

About the Authors

About the Authors

Pooja Tikekar is a Feature Writer, and part of the editorial team at CISO MAG. She writes news and feature stories on cybersecurity trends.

More from the author.

 

Rudra Srinivas

Rudra Srinivas is a Senior Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.

 

 

1...166167168...410Page 167 of 410