Attacks

08 Nov

Medibank Refuses to Pay Ransom, Ransomware Gang Threatens to Release Customer Data

Attacks, Malware

Companies have a few options when it comes to detecting unauthorized access of files, which may have helped catch the attack before a significant amount of customer data was exfiltrated in this case. Canary tokens can be leveraged to create files that appear highly valuable but create an alert when accessed. Companies can also implement canary accounts, baiting attackers into logging into accounts that trigger an alert on a successful login, that appear to be…

Read More
08 Nov

W4SP Stealer Found in Dozens of Python Packages in the PyPI registry

Attacks, Malware

PyPI is often treated as a very trustworthy source of packages; in reality, anyone can upload a package to be distributed by PyPI. It is recommended to install python libraries using built-in operating system package managers where possible. For example, on Debian based Linux systems using apt(8), it is recommend to use: apt install python3-. Repositories maintained by Linux operating system developers typically have more stringent requirements for new packages.In the event that using an…

Read More
08 Nov

Azov Ransomware Identified as Wiper Malware

Attacks, Malware

Downloading software from illegitimate sources always carries a risk. In this case, the malware is being spread via pirated software. Whenever software is being downloaded, it should be from a legitimate source. As a rule of thumb, any paid software being advertised for free is highly likely to include a type of malware or adware with it. Windows Applocker and other security solutions can assist in defining an allow list for software within a secured…

Read More
08 Nov

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

Attacks, Insights, Malware

Original release date: November 8, 2022 CISA has added seven vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risk to the federal enterprise. Note: to view the newly added vulnerabilities in the catalog, click on the arrow in the “Date Added to Catalog” column, which will sort by descending dates. Binding Operational Directive (BOD) 22-01:…

Read More
08 Nov

Hacker threatens to release data stolen from 9.7m Medibank customers

Attacks, Data Breaches

A threat to release 200GB worth of data stolen from Australian health insurance company Medibank has been posted to a site backed by Russian ransomware group, REvil. The threat comes after Medibank made a public statement that it would not be paying the ransom demanded by the hacker. In the message, the supposed hacker quotes Confuscious, implying Medibank is making a “mistake” by not paying the ransom. The malicious actor then said that they would…

Read More
07 Nov

Hacktivist Use of DDoS Activity Causes Minor Impacts

Attacks, Malware

DDoS attacks are of varying lengths of time and can be identified by:• Unusually slow network performance (opening files or accessing websites).• Unavailability of a particular website or the inability to access any website.To mitigate a DDoS attack:• Enroll in a Denial-of-Service protection service that detects abnormal traffic flows and redirects traffic away from the network.• Create a partnership with the local internet service provider (ISP) prior to an event and work with the ISP…

Read More
07 Nov

Boeing Subsidiary Jeppesen Suffers Cyberattack

Attacks, Malware

To minimize the effect of ransomware attacks, organizations should regularly back up their data and keep secure copies offline. It is also important to keep systems up to date with patches and anti-virus software. A 24/7 monitoring solution like the one that is offered by Binary Defense and the Security Operations Center should be considered when determining a defense solution as well. Monitoring for network intrusions and reporting suspicious activity can greatly reduce the effects…

Read More
07 Nov

Experts Say Security Scanner Leaks Sensitive Data

Attacks, Malware

The investigation also discovered that misconfigured security products submit every link they receive via emails to urlscan.io as a public scan. A malicious actor may use the scan results to launch password reset links for the compromised email addresses, capture the URLs, and use those links to take control of the accounts. The adversary can look up the specific services registered using the target email addresses on data breach reporting websites, like Have I Been…

Read More
07 Nov

Medibank refuses pay ransom after 9.7m customers’ details stolen

Attacks, Data Breaches

Australian health insurance company Medibank has said that it will not be paying a ransom to the hacker that accessed the personal details for 9.7m current and former customers.  The data breach took place after a hacker gained unauthorized access to Medibank’s internal servers on October 13. Originally, Medibank believed that no customer information had been stolen during the hack, however the company was then contacted on October 16 by the supposed hacker, who threatened…

Read More
04 Nov

As Twitter Brings on $8 Fee, Phishing Emails Target Verified Accounts

Attacks, Malware

Standard phishing defense tactics apply in this situation. Users should always take a close look at the sender’s display name when checking the legitimacy of an email. Most companies use a single domain for their URLs and emails, so a message that originates from a different domain is a red flag. It is also important to check for mismatched URLs. While an embedded URL might seem perfectly valid, hovering above it might show a different…

Read More