You are here

Home » Cybersecurity

Cybersecurity

Security Awareness – Cyber Criminal Groups Expand Working Relationship

Security researchers have uncovered technological and financial links between the Karakurt cyber crime group and the Conti and Diavol ransomware gangs, allowing these threat actors to expand their operations and target additional victims. Karakhurt is a financially motivated threat actor, first identified last summer, and it was previously believed that the group focused exclusively on data exfiltration. However, the group’s link to Conti and Diavol suggest it is expanding its tactics and operations.

Joint Cybersecurity Advisory – North Korean State-Sponsored APT Targets Blockchain Companies

The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI, and the U.S. Department of Treasury, have published a joint Cybersecurity Advisory on tactics, techniques, and procedures associated with a North Korean state-sponsored advanced persistent threat (APT) group as well as warning that the group is targeting blockchain companies. This North Korean APT group, commonly tracked as the Lazarus Group, uses spear phishing and social engineering to trick individuals into downloading trojanized cryptocurrency applications onto their operating system.

Lockbit Attack on Regional US Agency Comes After Months of Access

Sophos has posted a blog providing an insightful look into the activity of threat actors loitering on victim networks before finally executing a Lockbit ransomware attack. Researchers described how an unknown threat actor spent over five months exploring a “regional US government agency’s” networks after gaining access to them. Their activity was initially amateurish and lackadaisical, before turning professional in the weeks before the ransom, potentially indicating that a novice attacker had penetrated the network and eventually sold the access to a more sophisticated group.

Threat Awareness - Tarrask Malware

Security researchers at Microsoft have uncovered a new malware being employed by the Chinese-state sponsored Hafnium group, that maintains persistence on compromised Windows devices by creating and obfuscating scheduled tasks. The Hafnium group was linked to last year’s worldwide exploitation of the ProxyLogon zero-day flaws that impacted Microsoft Exchange Servers. These threat actors have targeted organizations in multiple critical infrastructure sectors.

Microsoft Advises to Patch Now to Address Critical Remote Code Execution Vulnerability for MS-RPC

Action Recommended: Members are strongly encouraged to advise their system administrators to address Microsoft security updates for April 2022. This month’s round of patches includes a critical remote code execution (RCE) vulnerability for an extremely important component of the operating system that allows for arbitrary code execution without authentication or user interaction.

Six Steps to Go Passwordless at Your Organization

While still the most popular method of authentication, passwords suffer significant drawbacks in terms of security and cost as we continue to struggle at creating less crackable ones. Dark Reading has written a piece describing six steps organizations can take to transition to passwordless authentication methods to help reduce the reliance on humans to create strong enough passwords to reduce the occurrence of information and data leaks. First, passwordless programs must start small, instead of attempting to switch the entire organization over at once.

Research Shows BEC Attacks Increased by 84% Between First and Second Half of 2021

Abnormal Security released a blog post on its research into BEC trends, which details the significant rise they’ve observed in BEC attacks between the first and second halves of 2021. Between July and December 2021, 84% more Abnormal customers’ inboxes were targeted by BEC lures, though the tactic itself stayed relatively uncommon, hitting less than one out of one thousand inboxes.

Threat Awareness – Qbot/Qakbot Changes Delivery Tactics

Security researchers have observed the Qbot/Qakbot botnet distributing malware payloads via a new delivery method. The technique involves sending a phishing email that includes a password-protected ZIP archive attachment containing malicious MSI Windows Installer packages. Qakbot, which WaterISAC has reported on numerous times, is a highly modular malware used for many malign activities such as credential harvesting and dropping ransomware.

Pages

Subscribe to Cybersecurity