Attacks

09 Feb

#StopRansomware – Ransomware Attacks on Critical Infrastructure Fund DPRK Espionage Activities

Attacks, Insights, Malware

Original release date: February 9, 2023 CISA, the National Security Agency (NSA), the Federal Bureau of Investigation (FBI), the Department of Health and Human Services (HHS), and Republic of Korea’s Defense Security Agency and National Intelligence Service have released a joint Cybersecurity Advisory (CSA), Ransomware Attacks on Critical Infrastructure Fund DPRK Espionage Activities, to provide information on ransomware activity used by North Korean state-sponsored cyber to target various critical infrastructure sectors, especially Healthcare and Public…

Read More
09 Feb

OpenSSL Releases Security Advisory

Attacks, Insights, Malware

Original release date: February 9, 2023 OpenSSL has released a security advisory to address multiple vulnerabilities affecting OpenSSL versions 3.0.0, 2.2.2, and 1.0.2. An attacker could exploit some of these vulnerabilities to obtain sensitive information. CISA encourages users and administrators to review the OpenSSL advisory and make the necessary updates. This product is provided subject to this Notification and this Privacy & Use policy.

Read More
09 Feb

What is business email compromise?

Attacks, Data Breaches

In this article, Cyber Security Hub explores how cyber attackers use threat vectors like phishing, social engineering and ransomware to enact business email compromise (BEC). Cybercrime is an ever-growing issue across virtually every industry. Expected to have a global cost as much as US$10trn by 2025, companies must fight to combat malicious actors seeking to gain from cyber attacks against them. Threat actors increasingly use multiple threat vectors during attacks to overwhelm companies and make…

Read More
08 Feb

CISA and FBI Release ESXiArgs Ransomware Recovery Guidance

Attacks, Insights, Malware

Original release date: February 8, 2023 Today, CISA and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory, ESXiArgs Ransomware Virtual Machine Recovery Guidance. This advisory describes the ongoing ransomware campaign known as “ESXiArgs.” Malicious cyber actors may be exploiting known vulnerabilities in unpatched and out-of-service or out-of-date versions of VMware ESXi software to gain access to ESXi servers and deploy ESXiArgs ransomware. The ransomware encrypts configuration files on ESXi servers, potentially rendering…

Read More
08 Feb

New QakNote Attacks Push Qakbot Malware via Microsoft OneNote Files

Attacks, Malware

Since the disabling of Office macros by Microsoft, a variety of new techniques have arisen to gain remote code execution on a host, with OneNote attachments becoming one of the more prominent techniques seen. As it is rather uncommon for OneNote files to be sent through email, many researchers recommend blocking these extensions altogether. However, for organizations where that is not possible, other options are available. One potential monitoring solution would be to monitor all…

Read More
08 Feb

Research Reveals 12% of Online Stores Expose Backup Data

Attacks, Malware

Administrators of websites, and especially online stores, should regularly evaluate possible data exposure on their sites. Any time sensitive data is found by an administrator, passwords should be rotated for not only users but databases as well. Enabling two-factor authentication (2FA) can help mitigate any exposure of administrator login information. Analyzing logs for the web-server software in use can reveal unusually high activity from individual IP addresses. Rate limiting based on IP addresses and using…

Read More
08 Feb

CISA Releases Recovery Script for ESXiArgs Ransomware Victims

Attacks, Malware

To assist users in recovering their servers, CISA released an ESXiArgs-Recover script on GitHub to automate the recovery process. “CISA is aware that some organizations have reported success in recovering files without paying ransoms. CISA compiled this tool based on publicly available resources, including a tutorial by Enes Sonmez and Ahmet Aykac,” explains CISA. “This tool works by reconstructing virtual machine metadata from virtual disks that were not encrypted by the malware.” While the GitHub…

Read More
08 Feb

What is the difference between cyber risk management and cyber resilience?

Attacks, Data Breaches

Cyber Security Hub speaks to Sourabh Haldar, threat policy implementation lead of information and cyber security at Standard Chartered Bank about the importance of cyber resilience in the face of emerging threats. Cyber Security Hub: What do you think will be the biggest threat vector and/or threat target in 2023? Sourabh Haldar: From a sector-wide perspective, phishing and social engineering-based attacks are definitely a concern. Phishing is the easiest way for malicious actors to gain…

Read More
07 Feb

CISA Releases ESXiArgs Ransomware Recovery Script

Attacks, Insights, Malware

Original release date: February 7, 2023 CISA has released a recovery script for organizations that have fallen victim to ESXiArgs ransomware. The ESXiArgs ransomware encrypts configuration files on vulnerable ESXi servers, potentially rendering virtual machines (VMs) unusable. CISA recommends organizations impacted by ESXiArgs evaluate the script and guidance provided in the accompanying README file to determine if it is fit for attempting to recover access to files in their environment. Organizations can access the recovery…

Read More
07 Feb

VMware ESXi Servers Targeted by Linux Variant of Royal Ransomware

Attacks, Malware

Hypervisors like ESXi continue to become more ubiquitous due to the power and convenience of managing virtual machines rather than physical ones. Unfortunately, that power and convenience also attract threat actors. The compromise of a hypervisor also implies the compromise of every virtual machine housed within. In a single stroke, dozens to hundreds of critical virtual machines could be encrypted and held for ransom. ESXi servers are particularly vulnerable, inciting the recent trend of ransomware…

Read More