Attacks

Espionage groups using social engineering tactics on government and military officials are nothing new. This campaign demonstrates the risks associated with downloading apps outside of app stores that are maintained by a trusted source. Furthermore, this highlights the importance of segmenting personal and professional devices. Compromising a personal phone, while impactful, could have a greatly reduced impact if that device doesn’t contain confidential information that an attacker could be seeking out. Source: https://thehackernews.com/2023/03/transparent-tribe-hackers-distribute.html

Read More

While many of the capabilities of this malware framework are rather typical, this “Radio Silence” mode is somewhat novel and is not seen displayed by many malware implants. Many times, malware in an environment can be identified through abnormal communications, such as a large number of connections from a host over the weekend that is typically dormant. With this feature, however, the operators can pick and choose when they want their communications to be sent,…

Read More

Binary Defense and SentinelOne advise system administrators to set Windows UAC to “Always Notify,” with the caveat that this may be excessively intrusive for some organizations. For trusted filesystem paths with trailing spaces, administrators should keep an eye out for suspicious file creations and process executions, especially in directories containing the string “Windows”. https://www.bleepingcomputer.com/news/security/old-windows-mock-folders-uac-bypass-used-to-drop-malware/

Read More

There is no indication that this attack is being carried out in the wild. Microsoft has addressed the issue with a patch but warned that there are other workarounds if needed. For anyone that cannot apply the fix for some reason, Microsoft recommends reading all emails in plain text. Another workaround is to enable the Microsoft Office File Block Policy, which prevents Office apps from opening RTF documents from unknown origins. To do this, the…

Read More

This incident follows a series of Acer security breaches that happened over the previous few years. The REvil ransomware gang attacked the computer manufacturer in March 2021, demanding a record-breaking $50,000,000 ransom payment for a decryptor. The hacker group Desorden gained access to Acer’s after-sales systems in India. As a result, over 60GB of data was compromised, including information about thousands of customers, retailer records, and distributors. https://www.bleepingcomputer.com/news/security/acer-confirms-breach-after-160gb-of-data-for-sale-on-hacking-forum/

Read More

Organizations should initiate proactive measures to ensure they are protected from ransomware. The US DHS website, stopransomware.gov, has links to resources that help organizations protect their systems from intrusions that lead to ransomware. To protect against ransomware attacks, organizations should: • Regularly back up data, air gap, and password protect backup copies offline.• Ensure copies of critical data are not accessible for modification or deletion from the system where the data resides.• Implement network segmentation.•…

Read More

According to the German police, the five suspects have ties to Russia. The DoppelPaymer ransomware operation first appeared in 2019, focusing on critical infrastructure and major corporations. Europol reported that victims based in the United States alone paid the group at least $42.4 million between May 2019 and March 2021. German authorities have also reported 37 targeted companies by the ransomware gang. Among DoppelPaymer’s major victims are Dutch Research Council (NWO), Kia Motors America, laptop…

Read More

This incident serves as a reminder of the growing threat of cyber-attacks and that no industry or organization is off limits. This also highlights the need for organizations to take proactive steps to protect their data and systems. All organizations, both public and private, should review their security practices on a regular basis and take appropriate measures to safeguard their sensitive data from cyber threats. https://www.govtech.com/security/personal-data-exposed-in-cyber-attack-on-modesto-calif-pd

Read More