Attacks

Although no one has claimed responsibility for the attack, if one actually took place, it is likely it was carried out by a pro-Ukrainian hacktivist group. Hacktivist groups have carried out multiple attacks on behalf of both Ukraine and Russia over the course of the conflict. Even though President Putin continues to erroneously blame the West and Ukraine for Russia’s invasion, multiple reports identified Russian backed cyber-attacks on Ukrainian organizations in the months leading up…

Read More

Social media sites like Facebook are common vectors for threat actors to spread malware. Due to this, it is highly recommended to avoid downloading files from social media sites, particularly in cases where the source is unknown or untrusted. Even from known sources, it is recommended to carefully vet any links or files that are shared, as the source could be compromised. It is also recommended to maintain good endpoint security controls on all devices…

Read More

This situation highlights the potential impact of cyber attacks on the food supply chain, which is a critical infrastructure that requires secure and resilient systems. The disruption of food supplies can have severe consequences for public health and safety, as well as economic and social stability. The continuance of ransomware attacks against businesses that are part of critical infrastructure emphasizes the need for organizations to continue to invest in cybersecurity and risk management processes, people,…

Read More

Advise employees not to open links arriving in unexpected SMS messages. If a business sends an unexpected text, look up their number online and call them back to verify if they sent the message. Suspicious links should only be opened in a controlled, safe environment, such as a resettable virtual machine image. That way, if the link points to malicious code, it won’t execute on a device that contains sensitive information. https://www.bleepingcomputer.com/news/security/activision-confirms-data-breach-exposing-employee-and-game-info/

Read More

Phishing continues to be a focal point of initial access for threat actors. This campaign emphasizes the importance of a phishing awareness program and monitoring processes such as PowerShell and Procdump for potential misuse or abuse. LOLBIN usage can allow attackers to blend in with normal activity. Organizations are recommended to employ detections and mitigations for the post exploitation phase of an attack to try and weed out misuse of these programs. https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/hydrochasma-asia-medical-shipping-intelligence-gathering

Read More

While patches for new vulnerabilities are released nearly every day, it is up to organizations themselves to implement these patches. Organizations are recommended to implement the recommended patch from Vmware as quickly as feasible. All patches are recommended to be tested on selected machines ahead of deployment as per standard enterprise practices. The Threat Hunting and Managed Detection and Response (MDR) services offered by Binary Defense represent an effective way to incorporate a post-exploitation focus…

Read More

To protect against ransomware attacks, organizations should:• Regularly back up data, air gap, and password protect backup copies offline.• Ensure copies of critical data are not accessible for modification or deletion• Implement network segmentation.• Implement a recovery plan to maintain and retain multiple copies of sensitive or proprietary data and servers in a physically separate, segmented, secure location• Install updates/patch operating systems, software, and firmware as soon as possible• Implement monitoring of security events on…

Read More

Binary Defense has regularly covered info stealer malware. While the user experience for Stealc seems to be particularly well developed and therefore lends itself to rapid adoption as a Malware as a Service offering (MaaS), the techniques and behaviors this malware uses are not novel. Keeping Detection and Response systems (EDR/MDR/XDR/etc.) up-to-date will go a long ways discovering campaigns like this. Additionally, netflow analysis and DNS monitoring can help detect C2 and exfiltration activity. This…

Read More