❌

Normal view

There are new articles available, click to refresh the page.
Today — 1 June 2024Main stream

Understanding Credential Phishing

✇Security Boulevard
By: Jimmy Lin ＆#124； SlashNext Threat Lab
31 May 2024 at 19:21

Credential phishing is a type of cyberattack where attackers attempt to deceive your employees into providing their sensitive information, such as their Microsoft usernames and passwords. What is not obvious is credential phishing is the root cause of many breaches, including the recent ransomware breach at UnitedHealth subsidiary Change Healthcare. According to UnitedHealth Group CEO […]

The post Understanding Credential Phishing first appeared on SlashNext.

The post Understanding Credential Phishing appeared first on Security Boulevard.

Yesterday — 31 May 2024Main stream
Before yesterdayMain stream

‘Operation Endgame’ Hits Malware Delivery Platforms

✇Krebs on Security
By: BrianKrebs
30 May 2024 at 11:19

Law enforcement agencies in the United States and Europe today announced Operation Endgame, a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. Dubbed “the largest ever operation against botnets,” the international effort is being billed as the opening salvo in an ongoing campaign targeting advanced malware “droppers” or “loaders” like IcedID, Smokeloader and Trickbot.

A frame from one of three animated videos released today in connection with Operation Endgame.

Operation Endgame targets the cybercrime ecosystem supporting droppers/loaders, slang terms used to describe tiny, custom-made programs designed to surreptitiously install malware onto a target system. Droppers are typically used in the initial stages of a breach, and they allow cybercriminals to bypass security measures and deploy additional harmful programs, including viruses, ransomware, or spyware.

Droppers like IcedID are most often deployed through email attachments, hacked websites, or bundled with legitimate software. For example, cybercriminals have long used paid ads on Google to trick people into installing malware disguised as popular free software, such as Microsoft Teams, Adobe Reader and Discord. In those cases, the dropper is the hidden component bundled with the legitimate software that quietly loads malware onto the user’s system.

Droppers remain such a critical, human-intensive component of nearly all major cybercrime enterprises that the most popular have turned into full-fledged cybercrime services of their own. By targeting the individuals who develop and maintain dropper services and their supporting infrastructure, authorities are hoping to disrupt multiple cybercriminal operations simultaneously.

According to a statement from the European police agency Europol, between May 27 and May 29, 2024 authorities arrested four suspects (one in Armenia and three in Ukraine), and disrupted or took down more than 100 Internet servers in Bulgaria, Canada, Germany, Lithuania, the Netherlands, Romania, Switzerland, the United Kingdom, United States and Ukraine. Authorities say they also seized more than 2,000 domain names that supported dropper infrastructure online.

In addition, Europol released information on eight fugitives suspected of involvement in dropper services and who are wanted by Germany; their names and photos were added to Europol’s “Most Wanted” list on 30 May 2024.

A “wanted” poster including the names and photos of eight suspects wanted by Germany and now on Europol’s “Most Wanted” list.

“It has been discovered through the investigations so far that one of the main suspects has earned at least EUR 69 million in cryptocurrency by renting out criminal infrastructure sites to deploy ransomware,” Europol wrote. “The suspect’s transactions are constantly being monitored and legal permission to seize these assets upon future actions has already been obtained.”

There have been numerous such coordinated malware takedown efforts in the past, and yet often the substantial amount of coordination required between law enforcement agencies and cybersecurity firms involved is not sustained after the initial disruption and/or arrests.

But a new website erected to detail today’s action — operation-endgame.com — makes the case that this time is different, and that more takedowns and arrests are coming. “Operation Endgame does not end today,” the site promises. “New actions will be announced on this website.”

A message on operation-endgame.com promises more law enforcement and disruption actions.

Perhaps in recognition that many of today’s top cybercriminals reside in countries that are effectively beyond the reach of international law enforcement, actions like Operation Endgame seem increasingly focused on mind games — i.e., trolling the hackers.

Writing in this month’s issue of Wired, Matt Burgess makes the case that Western law enforcement officials have turned to psychological measures as an added way to slow down Russian hackers and cut to the heart of the sweeping cybercrime ecosystem.

“These nascent psyops include efforts to erode the limited trust the criminals have in each other, driving subtle wedges between fragile hacker egos, and sending offenders personalized messages showing they’re being watched,” Burgess wrote.

When authorities in the U.S. and U.K. announced in February 2024 that they’d infiltrated and seized the infrastructure used by the infamous LockBit ransomware gang, they borrowed the existing design of LockBit’s victim shaming website to link instead to press releases about the takedown, and included a countdown timer that was eventually replaced with the personal details of LockBit’s alleged leader.

The feds used the existing design on LockBit’s victim shaming website to feature press releases and free decryption tools.

The Operation Endgame website also includes a countdown timer, which serves to tease the release of several animated videos that mimic the same sort of flashy, short advertisements that established cybercriminals often produce to promote their services online. At least two of the videos include a substantial amount of text written in Russian.

The coordinated takedown comes on the heels of another law enforcement action this week against what the director of the FBI called “likely the world’s largest botnet ever.” On Wednesday U.S. Department of Justice (DOJ) announced the arrest of YunHe Wang, the alleged operator of the ten-year-old online anonymity service 911 S5. The government also seized 911 S5’s domains and online infrastructure, which allegedly turned computers running various “free VPN” products into Internet traffic relays that facilitated billions of dollars in online fraud and cybercrime.

LockBit Ransomware Group Allegedly Strikes Heras UK in Cyberattack

✇Cybersecurity News and Magazine
By: Ashish Khaitan
30 May 2024 at 04:05

Heras cyberattack

The LockBit ransomware group has targeted Heras UK, a prominent European provider of end-to-end perimeter protection solutions. The threat actor claimed the Heras cyberattack and shared a website status displaying the downtime alongside a countdown, ticking away the time until the data breach is potentially exploited. Heras, operating across 24 countries with a workforce of over 1100 skilled professionals, reportedly faces a data breach.  The Cyber Express, in pursuit of clarity on the attack, reached out to the organization for comments. However, at the time of writing this, no official statement has been issued, leaving the alleged Heras data breach unconfirmed. Despite the claims, Heras' website remains functional, showing no immediate signs of the cyber attack. It's plausible that the attackers targeted the website's backend, opting for stealth over a frontal assault like DDoS or defacement.

Alleged Heras Cyberattack Surfaces on Dark Web

[caption id="attachment_72935" align="alignnone" width="422"]Heras cyberattack Source: Dark Web[/caption] The cyberattack on Heras comes amidst a spree of cyber attacks orchestrated by the LockBit ransomware group. Notably, the group targeted Allied Telesis, Inc., a leading American telecommunication equipment supplier. While the Heras data breach purportedly occurred on May 27, 2024, the authenticity of the claims and the leaked data remains unverified.  In a bold move earlier this year, the United States imposed sanctions on affiliates of the Russia-based LockBit ransomware group. This decisive action, led by the U.S. Department of Justice and the Federal Bureau of Investigation, signals a unified stance against cyber threats. LockBit, notorious for its Ransomware-as-a-Service (RaaS) model, employs double extortion tactics to extort hefty ransoms from its victims.

Who is the LockBit Ransomware Group?

The LockBit ransomware group is a sophisticated cybercrime organization that targets enterprises and government organizations. Formerly known as "ABCD" ransomware, LockBit operates as a crypto-virus, demanding financial payment in exchange for the decryption of encrypted files. Unlike some ransomware that targets individuals, LockBit primarily focuses on large entities, seeking hefty sums from viable targets. Since its inception in September 2019, LockBit has targeted organizations globally, including those in the United States, China, India, Indonesia, Ukraine, France, the UK, and Germany. It strategically selects targets likely to have both the financial means and the urgency to resolve the disruption caused by the attack. Notably, LockBit avoids attacking systems within Russia and the Commonwealth of Independent States, possibly to evade prosecution. As for the Heras data breach, this is an ongoing story and The Cyber Express will be closely monitoring the situation and we'll update this post once we have more information on the attack or any official confirmation from the organization.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

New ‘SpiderX’ Ransomware Emerges as Successor to Notorious Diablo

✇Cybersecurity News and Magazine
By: Samiksha Jain
30 May 2024 at 03:42

SpiderX

A threat actor known as "phant0m" is promoting a new Ransomware-as-a-Service (RaaS) on OnniForums, a notorious dark web forum. The new ransomware, named "SpiderX," is designed for Windows systems and boasts a suite of advanced features that make it a formidable successor to the previously infamous Diablo ransomware. Phant0m introduced SpiderX in a detailed post titled "Introduction to the SpiderX Ransomware," claiming that after months of development, this new ransomware is ready to take the place of Diablo. The post highlighted SpiderX's ransomware-enhanced capabilities and the improvements over its predecessor. Phant0m described SpiderX as incorporating all the features of Diablo, with additional functionalities designed to make it more effective and harder to detect and remove. After a few months of hard work, | would like to announce the release of my brand new Spiderx Ransomware. It will be the successor of my Diablo which served its purpose really well but itis finally time to upgrade things to a whole new level," reads the threat actor post.

Key Features and Capabilities of SpiderX Ransomware

SpiderX is written in C++, a choice that phant0m claims offers faster execution compared to other languages like C# and Python. This language choice, combined with the ransomware's small payload size (500-600 KB, including an embedded custom wallpaper), ensures quick and efficient deployment.
ChaCha20-256 Encryption Algorithm:
One of the standout features of SpiderX is its use of the ChaCha20-256 encryption algorithm. Known for its speed, this algorithm allows SpiderX to encrypt files much faster than the commonly used AES-256, thereby reducing the time it takes for the ransomware to render a victim's files inaccessible.
Offline Functionality:
Like Diablo, SpiderX does not require an internet connection to execute its primary functions. Once initiated, it can encrypt files on the victim’s computer and connect external devices (such as USB drives) without needing to communicate with a remote server. This makes SpiderX particularly stealthy and difficult to detect during its initial attack phase.
Comprehensive Targeting:
SpiderX extends its reach beyond the main user folders on the Windows drive. It targets all external partitions and drives connected to the system, ensuring comprehensive encryption. This includes USB drives and other external storage devices that may be connected post-attack, which will also be encrypted, amplifying the attack's impact.
Built-in Information Stealer:
A new feature in SpiderX is its built-in information stealer. Once the ransomware is executed, this component exfiltrates data from the target system, compresses it into a zip file, and uploads it to MegaNz, a file transfer and cloud storage platform. This stolen data can include sensitive information, which the attacker can then exploit or sell. The process is designed to leave no traces, covering its tracks to avoid detection.
Persistence and Silent Operation:
SpiderX is designed to be fully persistent, running silently in the background to continue encrypting any new files added to the system. This persistence ensures that the ransomware remains active even if the victim tries to use the system normally after the initial attack. [caption id="attachment_72924" align="aligncenter" width="1263"]SpiderX Source: Dark Web[/caption]

Marketed to Cybercriminals

Phant0m is marketing SpiderX to other cybercriminals at a price of US$150, accepting payments in Bitcoin and Monero, which are favored for their anonymity. The affordable price and powerful features make SpiderX an attractive tool for malicious actors looking to carry out ransomware attacks with minimal effort.

Implications and Threat Assessment

The introduction of SpiderX on the dark web marks a significant escalation in the capabilities of ransomware available as a service. Its advanced features, such as the ChaCha20-256 encryption algorithm and built-in information stealer, coupled with its ability to operate offline, make it a highly effective and dangerous tool. The persistent nature of the ransomware and its comprehensive targeting of connected devices further increase its potential impact. As ransomware continues to evolve, tools like SpiderX represent a growing threat to cybersecurity. What is most concerning is the potential widespread use of SpiderX due to its low cost and high efficiency. The capabilities and ease of deployment of SpiderX ransomware highlight the need for vigilance and advanced security measures to protect against increasingly sophisticated cyber threats. Organizations and individuals are advised to enhance their cybersecurity measures, including regular data backups, updating software and systems, and employing enhanced security protocols to mitigate the risk of such attacks. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Going going gone! Ransomware attack grabs Christie’s client data for a steal – Source: www.bitdefender.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
29 May 2024 at 16:00

going-going-gone!-ransomware-attack-grabs-christie’s-client-data-for-a-steal-–-source:-wwwbitdefender.com

Views: 2Source: www.bitdefender.com – Author: Graham Cluley The world-renowned auction house Christie’s has confirmed that it has fallen victim to a ransomware attack, seemingly orchestrated by a Russia-linked cybercriminal gang. Two weeks ago the CEO of the world’s wealthiest auction house posted on LinkedIn blamed a “technology security incident” after the Christie’s website went unexpectedly […]

La entrada Going going gone! Ransomware attack grabs Christie’s client data for a steal – Source: www.bitdefender.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

The evolution of healthcare ransomware attacks – Source: www.cybertalk.org

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
29 May 2024 at 15:00

the-evolution-of-healthcare-ransomware-attacks-–-source:-wwwcybertalk.org

Views: 3Source: www.cybertalk.org – Author: slandau By Zac Amos, Features Editor, Rehack.com. In recent years, ransomware has emerged as a critical threat to the healthcare industry, with attacks growing in frequency, sophistication and impact. These cyber assaults disrupt hospital operations, compromise patient safety and undermine data integrity. Understanding how ransomware tactics have evolved — from basic phishing […]

La entrada The evolution of healthcare ransomware attacks – Source: www.cybertalk.org se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Defend Your Business: Testing Your Security Against QakBot and Black Basta Ransomware – Source: securityboulevard.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
29 May 2024 at 12:01

defend-your-business:-testing-your-security-against-qakbot-and-black-basta-ransomware-–-source:-securityboulevard.com

Source: securityboulevard.com – Author: Madison Steel Introduction Small and medium-sized businesses (SMBs) are increasingly becoming targets for sophisticated cyberattacks. One of the emerging threats observed in recent years is the combination of QakBot, Cobalt Strike, and SystemBC leading to the deployment of Black Basta ransomware. At AttackIQ, we understand the importance of proactive security measures, […]

La entrada Defend Your Business: Testing Your Security Against QakBot and Black Basta Ransomware – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Defend Your Business: Testing Your Security Against QakBot and Black Basta Ransomware

✇Security Boulevard
By: Madison Steel
29 May 2024 at 09:45

Small and medium-sized businesses are increasingly targeted by sophisticated cyberattacks like QakBot and Black Basta ransomware. Discover how AttackIQ Flex's latest package helps you test your defenses, uncover vulnerabilities, and stay ahead of these advanced threats. Enhance your security posture with real-world attack scenarios and actionable insights. Read on to learn more and register for free today!

The post Defend Your Business: Testing Your Security Against QakBot and Black Basta Ransomware appeared first on AttackIQ.

The post Defend Your Business: Testing Your Security Against QakBot and Black Basta Ransomware appeared first on Security Boulevard.

New Endpoint Protection Platform by Cigent Blocks Ransomware at the Data Level

✇SecurityWeek
By: Kevin Townsend
29 May 2024 at 07:00

The two primary components to the solution are to encrypt company data at all times, and to decrypt only when the file is required for use.

The post New Endpoint Protection Platform by Cigent Blocks Ransomware at the Data Level appeared first on SecurityWeek.

North Korean Threat Actor Deploying New FakePenny Ransomware: Microsoft

✇Cybersecurity News and Magazine
By: Mihir Bagwe
29 May 2024 at 04:22

Fakepenny ransomware, Moonstone Sleet, North Korea

Microsoft has uncovered a new “FakePenny” ransomware variant being deployed by a North Korean threat actor to target organizations in the software, information technology, education and defense industrial base sectors for both espionage and monetary gains. The threat actor, which Microsoft tracks as Moonstone Sleet, was first observed delivering a new custom ransomware variant in April, to an undisclosed company whose networks it compromised a couple of months earlier. The ransomware is straightforward and contains a loader and an encryptor module. North Korean threat actor groups have previously developed such custom ransomware, but “this is the first time we have observed this threat actor deploying ransomware,” the tech giant said.
“Microsoft assesses that Moonstone Sleet’s objective in deploying the ransomware is financial gain, suggesting the actor conducts cyber operations for both intelligence collection and revenue generation.”
FakePenny ransomware demands exorbitant ransoms, with recent demands reaching $6.6 million in Bitcoin. “This is in stark contrast to the lower ransom demands of previous North Korea ransomware attacks, like WannaCry 2.0 and H0lyGh0st,” Microsoft said. Notably, the ransom note used by FakePenny ransomware closely resembles the one employed in the infamous NotPetya ransomware attack, which is attributed to the North Korean group Seashell Blizzard. This continuity in tactics highlights the interconnected nature of North Korean cyber operations.

Moonstone Sleet’s Strategy and Tradecraft

Moonstone Sleet has a diverse set of operations supporting its financial and espionage objectives. This group has been observed creating fake companies, employing trojanized versions of legitimate tools, and even developing malicious games to infiltrate targets. Their ability to conduct concurrent operations and quickly evolve and adapt their techniques is notable. The threat actor, as noted earlier, has several different tradecrafts under its belt. In early August 2023, Moonstone Sleet delivered a compromised version of PuTTY, an open-source terminal emulator, through platforms like LinkedIn, Telegram, and freelancing websites. The trojanized software decrypted and executed the embedded malware when the user provided an IP and password mentioned in a text document contained in the malicious Zip file that the threat actor sent. The same technique was used by another North Korean actor Diamond Sleet. Moonstone Sleet has also targeted victims using malicious “npm” packages distributed through freelancing sites and social media. These packages often masqueraded as technical assessments, lead to additional malware downloads when executed. Since February 2024, Moonstone Sleet has also taken a different approach by using a malicious game called DeTankWar to infect devices. The group approached targets posing as a game developer or fake company, presenting the game as a blockchain project. Upon launching the game, additional malicious DLLs were loaded, executing a custom malware loader known as “YouieLoad.” This loader performs network and user discovery and browser data collection.

Fake Companies and Work-for-Hire Schemes

Since January 2024, Moonstone Sleet has created several fake companies, including StarGlow Ventures and C.C. Waterfall, to deceive targets. These companies posed as software development and IT service firms, often related to blockchain and AI, to establish trust and gain access to organizations. Moonstone Sleet has also pursued employment opportunities in legitimate companies, which is consistent with reports of North Korea using remote IT workers to generate revenue. Recently, U.S. charged North Korean job fraud nexus that was amassing funds to support its nuclear program. The nexus scammed more than 300 U.S. companies and accumulated at least $6.8 million. This employment tactic could also provide another avenue for gaining unauthorized access to organizations. Moonstone Sleet’s notable attacks include compromising a defense technology company to steal credentials and intellectual property and deploying ransomware against a drone technology firm.
“Despite being new, Moonstone Sleet has demonstrated that it will continue to mature, develop, and evolve, and has positioned itself to be a preeminent threat actor conducting sophisticated attacks on behalf of the North Korean regime.”

Defending Against Moonstone Sleet

To defend against Moonstone Sleet, Microsoft recommends endpoint detection and response (EDR), implementing attack surface reduction rules to block executable content from email clients and webmail, preventing executable files from running unless they meet specific criteria, use advanced protection against ransomware, and block credential stealing from LSASS. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Black Basta Ransomware Attack: Microsoft Quick Assist Flaw – Source: securityboulevard.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
28 May 2024 at 11:01

black-basta-ransomware-attack:-microsoft-quick-assist-flaw-–-source:-securityboulevard.com

Source: securityboulevard.com – Author: Wajahat Raja Recent reports claim that the Microsoft Threat Intelligence team stated that a cybercriminal group, identified as Storm-1811, has been exploiting Microsoft’s Quick Assist tool in a series of social engineering attacks. This group is known for deploying the Black Basta ransomware attack. On May 15, 2024, Microsoft released details […]

La entrada Black Basta Ransomware Attack: Microsoft Quick Assist Flaw – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Black Basta Ransomware Attack: Microsoft Quick Assist Flaw

✇Security Boulevard
By: Wajahat Raja
28 May 2024 at 03:00

Recent reports claim that the Microsoft Threat Intelligence team stated that a cybercriminal group, identified as Storm-1811, has been exploiting Microsoft’s Quick Assist tool in a series of social engineering attacks. This group is known for deploying the Black Basta ransomware attack. On May 15, 2024, Microsoft released details about how this financially motivated group […]

The post Black Basta Ransomware Attack: Microsoft Quick Assist Flaw appeared first on TuxCare.

The post Black Basta Ransomware Attack: Microsoft Quick Assist Flaw appeared first on Security Boulevard.

Threat landscape for industrial automation systems, Q1 2024 – Source: securelist.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
27 May 2024 at 13:00

threat-landscape-for-industrial-automation-systems,-q1-2024-–-source:-securelist.com

Source: securelist.com – Author: Kaspersky ICS CERT Global statistics Statistics across all threats In the first quarter of 2024, the percentage of ICS computers on which malicious objects were blocked decreased by 0.3 pp from the previous quarter to 24.4%. Compared to the first quarter of 2023, the percentage decreased by 1.3 pp. Percentage of ICS […]

La entrada Threat landscape for industrial automation systems, Q1 2024 – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Newly discovered ransomware uses BitLocker to encrypt victim data

✇Ars Technica
By: Dan Goodin
24 May 2024 at 18:06
Stock photo of ransom note with letters cut out of newspapers and magazines.

Enlarge (credit: Getty Images)

A previously unknown piece of ransomware, dubbed ShrinkLocker, encrypts victim data using the BitLocker feature built into the Windows operating system.

BitLocker is a full-volume encryptor that debuted in 2007 with the release of Windows Vista. Users employ it to encrypt entire hard drives to prevent people from reading or modifying data in the event they get physical access to the disk. Starting with the rollout of Windows 10, BitLocker by default has used the 128-bit and 256-bit XTS-AES encryption algorithm, giving the feature extra protection from attacks that rely on manipulating cipher text to cause predictable changes in plain text.

Recently, researchers from security firm Kaspersky found a threat actor using BitLocker to encrypt data on systems located in Mexico, Indonesia, and Jordan. The researchers named the new ransomware ShrinkLocker, both for its use of BitLocker and because it shrinks the size of each non-boot partition by 100 MB and splits the newly unallocated space into new primary partitions of the same size.

Read 10 remaining paragraphs | Comments

UK Government ponders major changes to ransomware response – what you need to know – Source: www.exponential-e.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
24 May 2024 at 16:00

uk-government-ponders-major-changes-to-ransomware-response-–-what-you-need-to-know-–-source:-wwwexponential-e.com

Source: www.exponential-e.com – Author: Graham Cluley What’s happened?  Recorded Future has reports that the British Government is proposing sweeping change in its approach to ransomware attacks. The key proposed changes are: Mandatory reporting. All organisations and individuals hit by ransomware would be required to report the attack to the government. Licensing for extortion payments. All […]

La entrada UK Government ponders major changes to ransomware response – what you need to know – Source: www.exponential-e.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Black Basta Ascension Attack Redux — can Patients Die of Ransomware?

✇Security Boulevard
By: Richi Jennings
24 May 2024 at 13:45
Psychedelic doctor image, titled “Bad Medicine”

Inglorious Basta(rds): 16 days on, huge hospital system continues to be paralyzed by ransomware—and patient safety is at risk.

The post Black Basta Ascension Attack Redux — can Patients Die of Ransomware? appeared first on Security Boulevard.

CISO Cite Human Error as Top IT Security Risk – Source: securityboulevard.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
24 May 2024 at 11:00

ciso-cite-human-error-as-top-it-security-risk-–-source:-securityboulevard.com

Source: securityboulevard.com – Author: Nathan Eddy Human error is responsible for most cybersecurity risks, with nearly three-quarters (74%) of chief information security officers (CISOs) identifying it as their most significant vulnerability. In response, 87% of CISOs are adopting AI-powered technology to protect against human error and to block advanced human-centric cyber threats. These were among […]

La entrada CISO Cite Human Error as Top IT Security Risk – Source: securityboulevard.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Here’s yet more ransomware using BitLocker against Microsoft’s own users – Source: go.theregister.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
23 May 2024 at 22:00

here’s-yet-more-ransomware-using-bitlocker-against-microsoft’s-own-users-–-source:-gotheregister.com

Source: go.theregister.com – Author: Team Register Yet more ransomware is using Microsoft BitLocker to encrypt corporate files, steal the decryption key, and then extort a payment from victim organizations, according to Kaspersky. The antivirus maker’s Global Emergency Response team spotted the malware, dubbed ShrinkLocker, in Mexico, Indonesia, and Jordan, and said the code’s unnamed operators […]

La entrada Here’s yet more ransomware using BitLocker against Microsoft’s own users – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

ShrinkLocker: Turning BitLocker into ransomware – Source: securelist.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
24 May 2024 at 18:53

shrinklocker:-turning-bitlocker-into-ransomware-–-source:-securelist.com

Views: 0Source: securelist.com – Author: Cristian Souza, Eduardo Ovalle, Ashley Muñoz, Christopher Zachor Introduction Attackers always find creative ways to bypass defensive features and accomplish their goals. This can be done with packers, crypters, and code obfuscation. However, one of the best ways of evading detection, as well as maximizing compatibility, is to use the […]

La entrada ShrinkLocker: Turning BitLocker into ransomware – Source: securelist.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern – Source:thehackernews.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
23 May 2024 at 15:00

ransomware-attacks-exploit-vmware-esxi-vulnerabilities-in-alarming-pattern-–-source:thehackernews.com

Source: thehackernews.com – Author: . May 23, 2024NewsroomRansomware / Virtualization Ransomware attacks targeting VMware ESXi infrastructure following an established pattern regardless of the file-encrypting malware deployed. “Virtualization platforms are a core component of organizational IT infrastructure, yet they often suffer from inherent misconfigurations and vulnerabilities, making them a lucrative and highly effective target for threat […]

La entrada Ransomware Attacks Exploit VMware ESXi Vulnerabilities in Alarming Pattern – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Stopping ransomware in multicloud environments – Source: go.theregister.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
23 May 2024 at 00:00

stopping-ransomware-in-multicloud-environments-–-source:-gotheregister.com

Source: go.theregister.com – Author: Team Register Sponsored Survey and Live Event What are the biggest risks to your organization posed by ransomware and what security defenses does it have in place to protect its sensitive data from cyber criminals? We recently put these questions and more to readers of The Register as we sought to […]

La entrada Stopping ransomware in multicloud environments – Source: go.theregister.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Human Error and AI Emerge as Key Challenges in Survey of CISOs

✇Security Boulevard
By: Tony Bradley
22 May 2024 at 16:02

The 2024 Proofpoint “Voice of the CISO” report is a useful barometer for understanding the current cybersecurity landscape, providing valuable insights from 1,600 CISOs globally. This year’s findings reveal a complex picture where heightened concerns coexist with a growing sense […]

The post Human Error and AI Emerge as Key Challenges in Survey of CISOs appeared first on TechSpective.

The post Human Error and AI Emerge as Key Challenges in Survey of CISOs appeared first on Security Boulevard.

OmniVision disclosed a data breach after the 2023 Cactus ransomware attack – Source: securityaffairs.com

✇CISO2CISO.COM & CYBER SECURITY GROUP
By: CISO2CISO Editor 2
22 May 2024 at 13:00

omnivision-disclosed-a-data-breach-after-the-2023-cactus-ransomware-attack-–-source:-securityaffairs.com

Source: securityaffairs.com – Author: Pierluigi Paganini OmniVision disclosed a data breach after the 2023 Cactus ransomware attack The digital imaging products manufacturer OmniVision disclosed a data breach after the 2023 ransomware attack. OmniVision Technologies is a company that specializes in developing advanced digital imaging solutions. In 2023, OmniVision employed 2,200 people and had an annual revenue […]

La entrada OmniVision disclosed a data breach after the 2023 Cactus ransomware attack – Source: securityaffairs.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Challenging Times Remain Among the Ever-Evolving Email Landscape

✇Security Boulevard
By: Usman Chaudhary
20 May 2024 at 18:53

Criminals are successfully using email to scam, infiltrate networks, and unleash malicious payloads. We’re continuing to witness bad actors relentlessly exploit human vulnerabilities and software flaws, circumventing email gateways and security measures with alarming precision. Robust email and endpoint defenses […]

The post Challenging Times Remain Among the Ever-Evolving Email Landscape appeared first on TechSpective.

The post Challenging Times Remain Among the Ever-Evolving Email Landscape appeared first on Security Boulevard.

Void Manticore: Iranian Threat Actor Targeting Israel and Beyond with Data Wipers

✇Cybersecurity News and Magazine
By: Mihir Bagwe
20 May 2024 at 09:59

Void Manticore

An Iranian threat actor affiliated with the Ministry of Intelligence and Security (MOIS) is using destructive data wiping attacks combined with influence operations to target Israel and Albania. Tracked as Void Manticore, aka Storm-842, the threat actor operates under multiple online personas in which the primary alias includes “Homeland Justice” for attacks in Albania and "Karma" for those in Israel. Since October 2023, Check Point Research monitored Void Manticore's activities targeting Israeli organizations with destructive attacks using wipers and ransomware. The group employs five different methods for disruptive operations, including custom wipers for both Windows and Linux operating systems, as well as manual deletion of files and shared drives. Void Manticore’s activities in Israel are marked by the use of a custom wiper named “BiBi,” after Israeli Prime Minister Benjamin Netanyahu. The group also uses a persona named "Karma" to leak stolen information, portraying themselves as an anti-Zionist Jewish group. This persona gained prominence during the Israel-Hamas conflict in late 2023. Void Manticore threat actor employs relatively simple and direct techniques, often using basic publicly available tools. Their operations typically involve lateral movements using Remote Desktop Protocol (RDP) and the manual deployment of wipers. One of their prominent tools is “Karma Shell,” a homebrewed web shell disguised as an error page. This malicious shell is capable of directory listing, process creation, file uploads, and service management.

The Destructive Wiper Capabilities of Void Manticore

Void Manticore utilizes various custom wipers in their attacks:
  1. Cl Wiper: First used in attacks against Albania, this wiper uses the ElRawDisk driver to interact with files and partitions, effectively erasing data by overwriting physical drives with predefined buffers.
  2. Partition Wipers: These wipers remove partition information, leading to the loss of all data on the disk by corrupting the partition table, resulting in a system crash during reboot.
  3. BiBi Wiper: Deployed in recent attacks against Israel, this wiper exists in both Linux and Windows variants. It corrupts files and renames them with specific extensions, causing significant data loss.
Apart from automated wipers, Void Manticore engages in manual data destruction using tools like Windows Explorer, SysInternals SDelete and the Windows Format utility, furthering their impact on targeted systems.

Psychological Warfare and Collaboration with Scarred Manticore

Void Manticore’s strategy also includes psychological operations, aiming to demoralize and disrupt their targets by publicly leaking sensitive information. This dual approach amplifies the impact of their cyberattacks, making them a formidable threat. Notably, there is a significant overlap and cooperation between Void Manticore and another Iranian threat group, Scarred Manticore (aka Storm-861). Analysis shows a systematic handoff of victims between these two groups. For instance, Scarred Manticore might establish initial access and exfiltrate data after which Void Manticore executes the destructive data wiping attack. This collaboration enables Void Manticore threat actor to leverage Scarred Manticore’s advanced capabilities and gain access to high-value targets. “In the case of one victim, we discovered that after residing on the targeted network for over a year, Scarred Manticore was interacting with the infected machine at the exact moment a new web shell was dropped to disk. Following the shell’s deployment, a different set of IPs began accessing the network, suggesting the involvement of another actor – Void Manticore,” the researchers said. “The newly deployed web shell and subsequent tools were significantly less sophisticated than those in Scarred Manticore’s arsenal. However, they led to the deployment of the BiBi wiper, which is linked to Karma’s activity.” Void Manticore represents a significant cyber threat, particularly in the context of geopolitical tensions involving Iran. Iranian President Ebrahim Raisi died in a helicopter crash in a remote area of the country. Rescuers identified Raisi's body early Monday after searching in the mountainous northwest near the Azerbaijan border. Since his election in 2021, Raisi had tightened morality laws, cracked down on antigovernment protests and resisted international oversight of Tehran’s nuclear program. Israel’s war in Gaza has escalated conflicts with Iran-backed groups like Hezbollah in Lebanon and the Houthis in Yemen. Last month, Iran and Israel exchanged direct strikes. It is still unclear whether Raisi’s death is also linked to Israeli operations. Meanwhile, the recent escalations meant that Void Manticore’s coordinated operations with Scarred Manticore, combines their dual approach of technical destruction and psychological manipulation and positions them as a highly dangerous actor. Their activities not only target infrastructure but also aim to influence public perception and political stability, underlining the multifaceted nature of modern cyber warfare. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Response to CISA Advisory (AA24-131A): #StopRansomware: Black Basta

✇Security Boulevard
By: Francis Guibernau
17 May 2024 at 13:54

AttackIQ has released a new attack graph in response to the recently published CISA Advisory (AA24-131A) which disseminates known Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) associated to Black Basta ransomware, a ransomware variant whose operators have encrypted and stolen data from at least 12 out of 16 critical infrastructure sectors, including the Healthcare and Public Health (HPH) Sector.

The post Response to CISA Advisory (AA24-131A): #StopRansomware: Black Basta appeared first on AttackIQ.

The post Response to CISA Advisory (AA24-131A): #StopRansomware: Black Basta appeared first on Security Boulevard.

FBI Seizes BreachForums Website

✇Security Boulevard
By: Bruce Schneier
17 May 2024 at 07:09

The FBI has seized the BreachForums website, used by ransomware criminals to leak stolen corporate data.

If law enforcement has gained access to the hacking forum’s backend data, as they claim, they would have email addresses, IP addresses, and private messages that could expose members and be used in law enforcement investigations.

[…]

The FBI is requesting victims and individuals contact them with information about the hacking forum and its members to aid in their investigation.

The seizure messages include ways to contact the FBI about the seizure, including an email, a Telegram account, a TOX account, and a dedicated page hosted on the FBI’s Internet Crime Complaint Center (IC3)...

The post FBI Seizes BreachForums Website appeared first on Security Boulevard.

FBI Seizes BreachForums Website

✇Schneier on Security
By: Bruce Schneier
17 May 2024 at 07:09

The FBI has seized the BreachForums website, used by ransomware criminals to leak stolen corporate data.

If law enforcement has gained access to the hacking forum’s backend data, as they claim, they would have email addresses, IP addresses, and private messages that could expose members and be used in law enforcement investigations.

[…]

The FBI is requesting victims and individuals contact them with information about the hacking forum and its members to aid in their investigation.

The seizure messages include ways to contact the FBI about the seizure, including an email, a Telegram account, a TOX account, and a dedicated page hosted on the FBI’s Internet Crime Complaint Center (IC3).

“The Federal Bureau of Investigation (FBI) is investigating the criminal hacking forums known as BreachForums and Raidforums,” reads a dedicated subdomain on the FBI’s IC3 portal.

“From June 2023 until May 2024, BreachForums (hosted at breachforums.st/.cx/.is/.vc and run by ShinyHunters) was operating as a clear-net marketplace for cybercriminals to buy, sell, and trade contraband, including stolen access devices, means of identification, hacking tools, breached databases, and other illegal services.”

“Previously, a separate version of BreachForums (hosted at breached.vc/.to/.co and run by pompompurin) operated a similar hacking forum from March 2022 until March 2023. Raidforums (hosted at raidforums.com and run by Omnipotent) was the predecessor hacking forum to both version of BreachForums and ran from early 2015 until February 2022.”

Ransomware Attacks Evolve as Average Ransom Demand Tops $1.26 Million

✇Security Boulevard
By: Nathan Eddy
17 May 2024 at 07:00
an upset woman looking at a laptop screen.

Overall ransomware frequency grew by 64% in 2023, with increases in both direct and indirect ransomware. Victims paid $282,000 in ransom on average, a 77% drop in price, and half the companies avoided paying a ransom completely.

The post Ransomware Attacks Evolve as Average Ransom Demand Tops $1.26 Million appeared first on Security Boulevard.

❌
❌