Normal view

There are new articles available, click to refresh the page.
Today — 18 May 2024Main stream

Hackers Target US AI Experts With Customized RAT – Source: www.databreachtoday.com

hackers-target-us-ai-experts-with-customized-rat-–-source:-wwwdatabreachtoday.com

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Fraud Management & Cybercrime , Next-Generation Technologies & Secure Development Hackers Sought Specific Generative AI Software at Leading US Firm: Proofpoint Rashmi Ramesh (rashmiramesh_) • May 17, 2024     Someone is targeting a “leading U.S.-based AI organization” with phishing emails that lead to […]

La entrada Hackers Target US AI Experts With Customized RAT – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Yesterday — 17 May 2024Main stream

China-Linked Hackers Adopt Two-Stage Infection Tactic to Deploy Deuterbear RAT – Source:thehackernews.com

china-linked-hackers-adopt-two-stage-infection-tactic-to-deploy-deuterbear-rat-–-source:thehackernews.com

Source: thehackernews.com – Author: . Cybersecurity researchers have shed more light on a remote access trojan (RAT) known as Deuterbear used by the China-linked BlackTech hacking group as part of a cyber espionage campaign targeting the Asia-Pacific region this year. “Deuterbear, while similar to Waterbear in many ways, shows advancements in capabilities such as including […]

La entrada China-Linked Hackers Adopt Two-Stage Infection Tactic to Deploy Deuterbear RAT – Source:thehackernews.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Before yesterdayMain stream

FBI/CISA Warning: ‘Black Basta’ Ransomware Gang vs. Ascension Health

13 May 2024 at 13:08
Closeup photo of street go and stop signage displaying Stop

Будет! Russian ransomware rascals riled a Roman Catholic healthcare organization.

The post FBI/CISA Warning: ‘Black Basta’ Ransomware Gang vs. Ascension Health appeared first on Security Boulevard.

Hackers Steal Credit Card Data of Deal-Seeking Shoppers – Source: www.databreachtoday.com

hackers-steal-credit-card-data-of-deal-seeking-shoppers-–-source:-wwwdatabreachtoday.com

Source: www.databreachtoday.com – Author: 1 Card Not Present Fraud , Fraud Management & Cybercrime China-Linked Criminals Processed Orders Worth $50M: Security Research Labs Rashmi Ramesh (rashmiramesh_) • May 10, 2024     These aren’t real Adidas shoes. Neither are the shoes sold by a network of fraudulent online stories dubbed BogusBazaar. (Image: Shutterstock) Hackers linked […]

La entrada Hackers Steal Credit Card Data of Deal-Seeking Shoppers – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Christie’s Website Is Brought Down by Hackers Days Before $840 Million Auctions

10 May 2024 at 12:32
The auctioneer’s website was taken offline on Thursday evening and remained down on Friday, days before its spring auctions were set to begin.

© Dia Dipasupil/Getty Images

The website of Christie’s, the auction house, was brought down just before a series of high-profile springs sales were set to get underway next week.

Hackers discover how to reprogram NES Tetris from within the game

6 May 2024 at 18:16
I can see the code that controls the Tetri-verse!

Enlarge / I can see the code that controls the Tetri-verse! (credit: Aurich Lawson)

Earlier this year, we shared the story of how a classic NES Tetris player hit the game's "kill screen" for the first time, activating a crash after an incredible 40-minute, 1,511-line performance. Now, some players are using that kill screen—and some complicated memory manipulation it enables—to code new behaviors into versions of Tetris running on unmodified hardware and cartridges.

We've covered similar "arbitrary code execution" glitches in games like Super Mario World, Paper Mario, and The Legend of Zelda: Ocarina of Time in the past. And the basic method for introducing outside code into NES Tetris has been publicly theorized since at least 2021 when players were investigating the game's decompiled code (HydrantDude, who has gone deep on Tetris crashes in the past, also says the community has long had a privately known method for how to take full control of Tetris' RAM).

Displaced Gamers explains how to reprogram NES Tetris within the game.

But a recent video from Displaced Gamers takes the idea from private theory to public execution, going into painstaking detail on how to get NES Tetris to start reading the game's high score tables as machine code instructions.

Read 10 remaining paragraphs | Comments

Six Australian MPs Confirm They were Targeted by China’s APT31 Hackers

APT31, Australian Parliament

Six Australian Members of the Parliament confirmed today that they were targeted by Chinese-state hackers APT31 in a brazen cyberattack whose aim was to gather intelligence on these individuals. The Inter-Parliamentary Alliance on China whose members were victims of this hacking attempt said, “The politicians confirmed details with both the IPAC Secretariat and the Australian Government.”
“The apparent intention [of the cyberattack] was to garner sufficient information to mount more sophisticated follow-on attacks, escalating in severity.”
Those targeted included Senator James Paterson, Senator Claire Chandler, Senator Alex Antic, David Smith MP, Daniel Mulino MP and Tim Wilson MP.

Security Agencies Chose to Remain Tight-Lipped

Australia’s security agencies reportedly received two warnings about Chinese hackers targeting Australian MPs, but they chose not to inform the lawmakers about the cyberattacks. “It is staggering that both the targeted members of parliament and the broader Australian public have been kept in the dark about a direct attempt at cyber interference against Australian parliamentarians,” Senator Claire Chandler said.
“Incredibly, despite Australian authorities being notified of this hacking attempt in 2022, agencies did not alert my colleagues and I that we had been targeted.It’s unacceptable that this information was withheld from us for two years,” Chandler added.
The Five Eyes intelligence agency reportedly alerted Australia’s security agencies in mid-2021 about attacks that occurred earlier in January. Then, in June 2022, the FBI officially notified Australian authorities about attempts by the Chinese hacking group APT31 to target six Australian MPs. However, the agencies opted against informing the Government or the affected MPs. The IPAC, consisting of 20 Australian MPs, only became aware of the attempted attack when the US Department of Justice indicted seven Chinese hackers in April this year -three years after the initial warning. The National Cyber Security Centre of the United Kingdom also called out the Chinese APT31 actors for their malicious cyber targeting of UK’s democratic institutions and parliamentarians earlier in March. Following this revelation, MPs demanded an explanation from the Australian Security Intelligence Organisation regarding the lack of notification. After receiving a briefing, they released a joint statement today expressing outrage and demanding a robust response to protect Australian sovereignty. “We were not informed by Australian agencies at any time since 2021 about this targeting,” the statement from IPAC members targeted by APT31 said.
“This was not an attack on any single party or House of Parliament. This was an attack on Australian parliamentarians from both Houses and both parties who have dared to exercise their legitimate democratic right to criticize Beijing. As such, it was an attack on Parliament as a whole and demands a robust and proportionate response,” the IPAC members’ statement said.
“It is very worrying for our democracy that elected members of parliament have been targeted by PRC-state sponsored hacking attempts specifically because we have expressed concern about the behavior of the PRC, including human rights violations in Xinjiang and coercive behavior against Australia,” Senator Claire Chandler said. “It is in Australia’s national interest for Australians to be properly informed about the behavior of the PRC government. The withholding of information about the targeting of Australian elected representatives by state-affiliated cyber criminals means that Australians have been given a misleading impression of the PRCs behavior towards our country,” Chandler added. The targeted IPAC members insisted on being informed about future attempts to target them by state-sponsored groups, for which they have received an assurance from the government.
“I welcome the assurance that in future agencies will inform MPs about any attempts by state-sponsored cyber actors to target parliamentarians,” Senator Claire Chandler said.
The Australian agencies likely refrained from informing MPs because they considered the attacks crude and unsuccessful, according to Austrlian news agency The Nightly. Moreover, they occurred during a period when MPs and the public were already being cautioned to enhance their cybersecurity. Paterson, who is also the co-chair of IPAC Australia, denounced the attempted hack.
“Targeting parliamentarians, as the CCP has done, is not the act of a friend. It is yet another obstacle to a normal bilateral relationship. We should never hesitate to call out this behavior or be afraid to impose real costs to deter it,” he tweeted.

APT31 Used Pixel Tracking Emails

APT31 hackers targeted MPs with pixel tracking emails from a domain pretending to be a news outlet. If opened, these emails tracked the recipients' online behavior. According to the FBI's indictment released last month, the hackers spammed various government individuals worldwide associated with IPAC, with more than 10,000 malicious emails that also exploited zero-days and resulted in potential compromise of economic plans, intellectual property and trade secrets. Last month, FBI Director Christopher Wray highlighted the magnitude of Chinese hacking, stating that it surpassed that of every other major nation combined. He underscored the overwhelming scale of Chinese cyber operations, indicating the challenges faced by law enforcement in countering these threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Germany Blames Russia for Cyberattack Targeting Ruling Party SPD

Russian hackers

A recent investigation led by the German Foreign Office has unveiled startling revelations: Russian hackers, with alleged state support, have targeted the Social Democratic Party (SPD) within the German governing coalition.

The accusations, unveiled by German Foreign Minister Annalena Baerbock during a visit to Australia, shed light on a concerning escalation of cyber warfare between Russia and Western nations.

Baerbock is the first German foreign minister to visit Australia in 13 years. She's there to meet her Australian counterpart Penny Wong, who are together set to discuss the greater cooperation in the Indo-Pacific, as well as broader geopolitical challenges, including in Europe and the Middle East. "Our two countries are working together to tackle cyber threats and climate change, to embrace the green energy transition, build supply chain resilience and improve gender equality," Wong said. Baerbock's will further visit New Zealand and Fiji, with a prime focus on security policy as China pushes for influence in the Pacific region.

Russian Hackers on Radar

According to Baerbock, the cyberattack, which occurred in 2023, was orchestrated by the Russian military intelligence service, known as the GRU. This revelation points to a deliberate effort to infiltrate and disrupt the SPD, a key political player in Germany. The attackers, identified as the group APT28, also known as Fancy Bear, are believed to be under the direct control of the GRU. This group has been linked to numerous cyberattacks worldwide, indicating a pattern of state-sponsored cyber aggression. The cyberattack, attributed to Russia's military intelligence service - the GRU, occurred in 2023 and aimed at compromising email accounts belonging to SPD executives. Reportedly, an executive of the German party SPD became victim of a hacker attack in January 2023, resulting in possible data exposure. There were concrete indications of a Russian origin of the attack, at the time.
"We've seen severe cyberattacks on members of the Social Democrats of the SPD party in Germany and the Federal Government," German Foreign Minister Annalena Baerbock said at a Friday press conference in Adelaide.
This is absolutely intolerable and unacceptable and will have consequences," Baerbock emphasized during a news conference, hinting at forthcoming actions against Russia. While she did not specify the exact nature of these consequences, her firm stance suggests that Germany is prepared to respond robustly to the cyber threat.

Tensions Amid International Support for Ukraine

The accusations come at a time of heightened tensions between Russia and NATO member states, particularly Germany, which has been actively supporting Ukraine in its conflict against Russian aggression. NATO Allies have voiced deep concern over Russia's hybrid activities, including cyber interference, disinformation campaigns and acts of violence, targeting several member states. Allies stand united in addressing these threats and bolstering resilience against Russian hybrid actions, reaffirming their commitment to supporting Ukraine despite Russia's provocative behavior. "We will continue to boost our resilience and to apply and enhance the tools at our disposal to counter and contest Russian hybrid actions and will ensure that the Alliance and Allies are prepared to deter and defend against hybrid actions or attacks," NATO said. "We condemn Russia's behaviour, and we call on Russia to uphold its international obligations, as Allies do theirs. Russia's actions will not deter Allies from continuing to support Ukraine." The cyberattack on the SPD adds another layer to the complex web of hostilities between Russia and Western nations. In response to the revelations, Australian Foreign Minister Penny Wong expressed solidarity with Germany, condemning the cyber activities attributed to Russia. Australia stands in solidarity with Germany in calling out states that act contrary to the norms of responsible state behavior in cyberspace," Wong affirmed, echoing the global concern over state-sponsored cyber warfare. "Australia is deeply troubled by the new activity that Minister Baerbock has referenced today," Wong said. Backing her support, Wong added that Australia has previously joined the United States, UK, Canada and New Zealand in attributing malicious cyber activity to APT28 and shall continue calling out such instances in the future. APT28 has been implicated in numerous cyberattacks worldwide, operating as a tool of Russian state-sponsored cyber warfare. APT28 also has a history of targeting elections in the U.S. and Europe and in a recent Mandiant report, the cybersecurity firm said it expects the same forecast this election season. The implications of the latest cyberattack are profound, signaling a new era of digital conflict where political entities are increasingly vulnerable to sophisticated cyber intrusions. As Germany grapples with the aftermath of this cyberattack, the world watches closely, mindful of the broader implications for international cybersecurity and diplomatic relations. Updated on May 3, 4:45 PM IST to reflect additional official remarks from Annalena Baerbock, Penny Wong and NATO. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

UnitedHealth’s CEO Slammed Over Cyberattack

Several lawmakers questioned whether the company had become so large — with tentacles in every aspect of the nation’s medical care — that the effects of the hack were outsize.

© Ting Shen for The New York Times

Andrew Witty, the chief executive of UnitedHealth Group, acknowledged before the Senate Finance Committee that hackers had found a weakness in its cybersecurity that forced the shutdown of a vast billing and payments system.

Russian State Hackers Biggest Cyber Threat to US, UK and EU Elections

26 April 2024 at 08:57

biggest cyber threat to election security

With more than 2 billion voters ready to cast a vote this year across 60 plus nations -including the U.S., U.K. and India - Russian state hackers are posing the biggest cyber threat to election security, researchers said. Google-owned Mandiant in a detailed report stated with “high confidence” that Russian state-sponsored cyber threat activity poses the greatest risk to elections in regions with Russian interest.
“Multiple Russian groups have targeted past elections in the U.S., France, and Ukraine, and these groups have continued to demonstrate the capability and intent to target elections both directly and indirectly,” Mandiant said.

Why Russia is the Biggest Cyber Threat to Election Security

Russia's approach to election interference is multifaceted, blending cyber intrusion activities with information operations aimed at influencing public perceptions and sowing discord. State-sponsored cyber threat actors, such as APT44, better known as the cyber sabotage unit Sandworm, and APT28 have a history of targeting elections in the U.S., and Europe. These actors employ hybrid operations, combining cyber espionage with hack-and-leak tactics to achieve their objectives. The 2016 U.S. presidential election is a prime example of Russia's cyber interference capabilities, as per Mandiant. APT28, linked to Russia intelligence unit - the GRU, compromised Democratic Party organizations and orchestrated a leak campaign to influence the election's outcome. Similarly, in Ukraine, APT44 conducted disruptive cyber operations during the 2014 presidential election, aiming to undermine trust in the electoral process. Jamie Collier, Mandiant senior threat intelligence advisor said, “One group to watch out for is UNC5101 that has conducted notable hybrid operations in the past.” Mandiant reports UNC5101 engaging in cyber espionage against political targets across Europe, Palestinian Territories, and the U.S. The actor has also used spoofed Ukrainian government domains to spread false narratives directly to government employees' inboxes. Before Russia's 2023 and 2024 elections, UNC5101 registered domains related to opposition figures like Alexei Navalny and conducted likely information operations to deceive voters. Russian state-aligned cyber threat actors target election-related infrastructure for various reasons including applying pressure on foreign governments, amplifying issues aligned with Russia's national interests, and retaliating against perceived adversaries. Groups like APT28 and UNC4057 conduct cyber espionage and information operations to achieve these objectives, Mandiant said.

Beijing’s Interest in Information Operations

Collier noted that state threats to elections are far more than just a Russia problem.
“For instance, we have seen pro-China information operations campaigns carry out election-related activity in the US, Taiwan, and Hong Kong,” Collier said.
China's approach to election cybersecurity focuses on intelligence collection and influence operations that promote narratives favorable to the Chinese Communist Party (CCP). State-sponsored actors like TEMP.Hex have targeted elections in Taiwan, using cyberespionage to gather critical information and using information operations to shape public discourse, Mandiant’s analysis found. In the lead-up to Taiwan's 2024 presidential election, Chinese threat actors intensified cyber espionage activities, targeting government, technology, and media organizations. Concurrently, pro-PRC information operations sought to discredit candidates perceived as unfriendly to China, using fabricated leaks and disinformation campaigns to sway public opinion, which even the Taiwanese government confirmed.

Watch-Out for Iran’s Espionage and Influence Campaigns

Iranian state hackers are another group of threat actors to keep an eye on for their cyber espionage and influence campaigns, Mandiant noted.
“[Irans’s] campaigns will rise as elections approach in key nations of interest to the Islamic Republic, such as counterparts in the currently stalled nuclear negotiations, and countries offering support to Israel during current fighting in Gaza,” Mandiant said.
During the 2020 U.S. presidential election, Iran attempted to compromise state voter registration websites and disseminate false information. The U.S. Department of Justice charged two Iranian nationals in 2021 for their involvement in this campaign. Pro-Iranian influence campaigns, including Liberty Front Press and Roaming Mayfly, target global audiences with anti-U.S. and anti-Israeli propaganda, amplifying partisan divisions and fostering distrust in democracies, Mandiant said.

Diverse Targets Multiple Vectors

Securing elections requires protecting not only voting machines and voter registries but also a wide range of entities involved in the electoral process. Political parties, news media, and social media platforms are frequent targets of cyber operations, which also comes under the attack surface of elections. [caption id="attachment_65433" align="aligncenter" width="551"]biggest cyber threat to election security Credit: Mandiant[/caption] Cyber threat actors are increasingly employing hybrid operations, combining multiple tactics to amplify their impact. Examples from past elections, such as the Ukrainian presidential election in 2014, illustrate how they are using a combination of cyber intrusions, data leaks, and DDoS attacks to disrupt electoral processes. Owing to this Mandiant detailed likely threat vectors that could be used in the upcoming election season: [caption id="attachment_65432" align="aligncenter" width="819"]biggest cyber threat to election security Credit: Mandiant[/caption] The threats posed by Russian, Chinese, and Iranian state actors to election cybersecurity are complex and multifaceted. By understanding the tactics and objectives of these actors, election organizations can develop effective mitigation strategies to safeguard democratic processes. However, addressing these threats requires a concerted effort involving international cooperation and a commitment to upholding the integrity of democratic elections worldwide. In-line with this, the U.S. agencies recently released guidance to defending the integrity of democratic processes. The guidance extensively details common tactics seen in foreign malign influence operations, offering real-world instances and suggesting possible countermeasures for stakeholders in election infrastructure. Though many of these tactics aren't new, the widespread use of generative artificial intelligence (AI) has notably amplified adversaries' ability to produce and spread persuasive malicious content, the guidance said. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Microsoft Uncovers GooseEgg Malware: A New Weapon in Russian State Hackers’ Arsenal

By: Editorial
23 April 2024 at 07:09

GooseEgg malware

Microsoft researchers uncovered a new tool in the Russian state hackers’ arsenal that helped them gain elevated access, pilfer credentials and allowed lateral movement within compromised networks. Dubbed GooseEgg malware, this sophisticated tool exploits a vulnerability identified as CVE-2022-38028 in the Windows Print Spooler service, responsible for managing printing processes. Redmond fixed the vulnerability that gave attackers system privileges in its October 2022 Patch Tuesday stating the bug’s exploitation is “most likely.” It is yet to flag the flaw as actively exploited in its assessment. 

Hackers Leverage the GooseEgg Malware to Exploit Windows Devices

GooseEgg malware is exclusively used by a group that the tech giant tracks as “Forest Blizzard,” which the United States and United Kingdom governments closely links to the Unit 26165 of Russia’s military intelligence agency, the GRU.  Forest Blizzard, also known as Fancy Bear and APT28, has deployed GooseEgg since at least June 2020, targeting state, non-governmental, educational and transportation entities across Ukraine, Western Europe and North America, Microsoft said.  “The use of GooseEgg in Forest Blizzard operations is a unique discovery that had not been previously reported by security providers,” Redmond said. Upon gaining access to a target device, Forest Blizzard used GooseEgg to escalate privileges within the network. Although GooseEgg itself functions as a basic launcher application, it enables attackers to execute remote code, implant backdoors and traverse compromised networks laterally.

The Rise of Forest Blizzard Hackers

Forest Blizzard additionally exploits other vulnerabilities including CVE-2023-23397, which impacts all versions of Microsoft Outlook software on Windows devices and is known to be exploited. This critically rated bug allows attackers to steal the Net-NTLM hash from the victims, enabling the attackers to assume a victim identity and to move deeper into the organization.  In a December warning, Microsoft cautioned that Forest Blizzard was leveraging the Microsoft Outlook bug to illicitly access email accounts within Microsoft Exchange servers since April 2022.   Forest Blizzard primarily targets government, energy, transportation and non-governmental organizations in the United States, Europe and the Middle East but Microsoft said it had observed the GRU hackers focus shift to media, information technology, sports organizations and educational institutions worldwide.   “Forest Blizzard continually refines its footprint by employing new custom techniques and malware, suggesting that it is a well-resourced and well-trained group posing long-term challenges to attribution and tracking its activities,” Microsoft said.   Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

MITRE Hit in Massive Supply Chain Attack: State-Backed Hackers Exploit Zero-Days

MITRE Data Breach

The MITRE Corporation revealed on April 19 that it was one of over 1700 organizations compromised by a state-backed hacking group in January 2024. The MITRE data breach, which involved chaining two Ivanti VPN zero-days, highlights the evolving nature of cyber threats and the challenges organizations face in defending against them.

The MITRE data breach was detected after suspicious activity was noticed on MITRE's Networked Experimentation, Research, and Virtualization Environment (NERVE), an unclassified collaborative network used for research and development. [caption id="attachment_63933" align="aligncenter" width="609"]MITRE Data Breach Source: X[/caption]

MITRE DATA Breach Discovery and Response

Following the detection, MITRE promptly took NERVE offline and launched an investigation with the assistance of both internal and external cybersecurity experts. "Following detection of the incident, MITRE took prompt action to contain the incident, including taking the NERVE environment offline, and quickly launched an investigation with the support of in-house and leading third-party experts. The investigation is ongoing, including to determine the scope of information that may be involved," reads the Official notice. MITRE CEO Jason Providakes emphasized that "no organization is immune from this type of cyber attack, not even one that strives to maintain the highest cybersecurity possible." Providakes highlighted the importance of disclosing the incident in a timely manner to promote best practices and enhance enterprise security. “We are disclosing this incident in a timely manner because of our commitment to operate in the public interest and to advocate for best practices that enhance enterprise security as well as necessary measures to improve the industry’s current cyber defense posture. The threats and cyber attacks are becoming more sophisticated and require increased vigilance and defense approaches. As we have previously, we will share our learnings from this experience to help others and evolve our own practices,” said Providakes. Charles Clancy, MITRE's Chief Technology Officer, provided additional insights, explaining that the threat actor compromised the Ivanti Connect Secure appliance used to provide connectivity into trusted networks. Clancy stressed the need for the industry to adopt more sophisticated cybersecurity solutions in response to increasingly advanced threats. MITRE outlined four key recommendations:
  1. Advance Secure by Design Principles: Hardware and software should be inherently secure.
  2. Operationalize Secure Supply Chains: Utilize software bill of materials to understand threats in upstream software systems.
  3. Deploy Zero Trust Architectures: Implement micro-segmentation of networks in addition to multi-factor authentication.
  4. Adopt Adversary Engagement: Make adversary engagement a routine part of cyber defense to provide detection and deterrence.
MITRE has a long history of contributing to cybersecurity research and development in the public interest. The organization has developed frameworks like ATT&CK®, Engage™, D3FEND™, and CALDERA™, which are used by the global cybersecurity community.

Details of the MITRE Data Breach

The MITRE data breach involved two zero-day vulnerabilities: an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887). These vulnerabilities allowed threat actors to bypass multi-factor authentication defenses and move laterally through compromised networks using hijacked administrator accounts. The attackers utilized sophisticated webshells and backdoors to maintain access to hacked systems and harvest credentials. Since early December, the vulnerabilities have been exploited to deploy multiple malware families for espionage purposes. Mandiant has attributed these attacks to an advanced persistent threat (APT) known as UNC5221, while Volexity has reported signs of Chinese state-sponsored actors exploiting the zero-days. Volexity discovered over 2,100 compromised Ivanti appliances, affecting organizations of various sizes globally, including Fortune 500 companies. The scale and severity of the attacks prompted the Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive on January 19, instructing federal agencies to mitigate the Ivanti zero-days immediately. MITRE's disclosure serves as a reminder of the ongoing threat posed by cyber adversaries and the critical need for organizations to continually enhance their cybersecurity defenses. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

The 2024 Paris Olympics Prepares For Cyberattacks

17 April 2024 at 00:07
“We will be attacked,” the official responsible for fending off cyberthreats said. To prepare, organizers have been hosting war games and paying “bug bounties” to hackers.

© Pierre-Philippe Marcou/Agence France-Presse — Getty Images

The head of cyberattack preparations for the 2024 Paris Olympics said he expected to face billions of probing attacks against the Games’ computer networks.

Introducing the Digital Footprint Portal

10 April 2024 at 09:01

Digital security is about so much more than malware. That wasn’t always the case. 

When I started Malwarebytes more than 16 years ago, malware was the primary security concern—the annoying pop-ups, the fast-spreading viruses, the catastrophic worms—and throughout our company’s history, Malwarebytes routinely excelled against this threat. We caught malware that other vendors missed, and we pioneered malware detection methods beyond the signature-based industry standard.  

I’m proud of our success, but it wasn’t just our technology that got us here. It was our attitude.  

At Malwarebytes, we believe that everyone has the right to a secure digital life, no matter their budget, which is why our malware removal tool was free when it launched and remains free today. Our ad blocking tool, Browser Guard is also available to all without a charge. This was very much not the norm in cybersecurity, but I believe it was—and will always be—the right thing to do.  

Today, I am proud to add to our legacy of empowering individuals regardless of their wallet by releasing a new, free tool that better educates and prepares people for modern threats that abuse exposed data to target online identities. I’d like to welcome everyone to try our new Digital Footprint Portal.  

See your exposed data in our new Digital Footprint Portal.

By simply entering an email address, anyone can discover what information of theirs is available on the dark web to hackers, cybercriminals, and scammers. From our safe portal, everyday people can view past password breaches, active social media profiles, potential leaks of government ID info, and more.  

More than a decade ago, Malwarebytes revolutionized the antivirus industry by prioritizing the security of all individuals. Today, Malwarebytes is now also revolutionizing digital life protection by safeguarding the data that serves as the backbone of your identity, your privacy, your reputation, and your well-being online.  

Why data matters 

I can’t tell you how many times I’ve read that “data is the new oil” without reading any explanations as to why people should care.  

Here’s my attempt at clarifying the matter: Too much of our lives are put online without our control.  

Creating a social media account requires handing over your full name and birthdate. Completing any online shopping order requires detailing your address and credit card number. Getting approved for a mortgage requires the exchange of several documents that reveal your salary and your employer. Buying a plane ticket could necessitate your passport info. Messaging your doctor could involve sending a few photos that you’d like to keep private.  

As we know, a lot of this data is valuable to advertisers—this is what pundits focus on when they invoke the value of “oil” in discussing modern data collection—but this data is also valuable to an entirely separate group that has learned to abuse private information in novel and frightening ways: Cybercriminals.  

Long ago, cybercriminals would steal your username and password by fooling you with an urgently worded phishing email. Today, while this tactic is still being used, there’s a much easier path to data theft. Cybercriminals can simply buy your information on the dark web.  

That information can include credit card numbers—where the risk of financial fraud is obvious—and even more regulated forms of identity, like Social Security Numbers and passport info. Equipped with enough forms of “proof,” online thieves can fool a bank into routing your money elsewhere or trick a lender into opening a new line of credit in your name.  

Where the risk truly lies, however, is in fraudulent account access.  

If you’ve ever been involved in a company’s data breach (which is extremely likely), there’s a chance that the username and password that were associated with that data breach can be bought on the dark web for just pennies. Even though each data breach involves just one username and password for each account, cybercriminals know that many people frequently reuse passwords across multiple accounts. After illegally purchasing your login credentials that were exposed in one data breach, thieves will use those same credentials to try to log into more popular, sensitive online accounts, like your online banking, your email, and your social media.  

If any of these attempts at digital safe-cracking works, the potential for harm is enormous.  

With just your email login and password, cybercriminals can ransack photos that are stored in an associated cloud drive and use those for extortion. They can search for attachments that reveal credit card numbers, passport info, and ID cards and then use that information to fool a bank into letting them access your funds. They can pose as you in bogus emails and make fraudulent requests for money from your family and friends. They can even change your password and lock you out forever. 

This is the future of personal cybercrime, and as a company committed to stopping cyberthreats everywhere, we understand that we have a role to play in protecting people.  

We will always stop malware. We will always advise to create and use unique passwords and multifactor authentication. But today, we’re expanding our responsibility and helping you truly see the modern threats that could leverage your data.  

With the Digital Footprint Portal, who you are online is finally visible to you—not just cybercriminals. Use it today to understand where your data has been leaked, what passwords have been exposed, and how you can protect yourself online.  

Digitally safe 

Malwarebytes and the cybersecurity industry at large could not have predicted today’s most pressing threats against online identities and reputations, but that doesn’t mean we get to ignore them. The truth is that Malwarebytes was founded with a belief broader than anti-malware protection. Malwarebytes was founded to keep people safe.  

As cybercriminals change their tactics, as scammers needle their way onto online platforms, and as thieves steal and abuse the sensitive data that everyone places online, Malwarebytes will always stay one step ahead. The future isn’t about worms, viruses, Trojans, scams, pig butchering, or any other single scam. It’s about holistic digital life protection. We’re excited to help you get there.  

Andres Freund, el ingeniero que previno un posible ciberataque global

5 April 2024 at 03:00
Un ingeniero de Microsoft notó que algo andaba mal en un software en el que había trabajado. Pronto descubrió que probablemente alguien intentaba acceder a computadoras en todo el mundo.

© Jon Han

Did One Guy Just Stop a Huge Cyberattack?

3 April 2024 at 16:09
A Microsoft engineer noticed something was off on a piece of software he worked on. He soon discovered someone was probably trying to gain access to computers all over the world.

© Jon Han

4 Things You Need to Know About Health Care Cyberattacks

Despite the explosion in ransomware hacks like the one against Change Healthcare, regulation is spotty and few new safeguards have been proposed to protect patient data, vulnerable hospitals and medical groups.

© Unitedhealth Group, via Reuters

UnitedHealth Group’s headquarters in Minnetonka, Minn.
❌
❌