Malware

CPR’s analysis revealed that the gang has already targeted several organizations, including a large US-based medical testing laboratory, and a multinational pharmaceutical company, among others. The group’s modus operandi involves exfiltrating data, encrypting it, and then publishing it on their data leak site if the victim refuses to pay the ransom. CPR warns that BianLian’s shift in tactics could inspire other ransomware groups to follow suit, creating more problems for organizations already grappling with the…

Device owners should install patches for these vulnerabilities as soon as they are made available by the vendor. It was also recommended to disable Wi-Fi calling and Voice-over-LTE to mitigate the impact of the vulnerabilities until patches are released. https://www.bleepingcomputer.com/news/security/google-finds-18-zero-day-vulnerabilities-in-samsung-exynos-chipsets/

While it isn’t necessarily a novel tactic to utilize legitimate resources to aid in phishing campaigns, it is an effective one. Often when an end-user receives a phishing email from a legitimate source such as Adobe Sign, it makes them much more likely to fall for it as many users don’t know how to properly identify a phishing email. Many times, training around phishing states to look for things such as a suspicious title, suspicious…

Phishing techniques have a high prevalence in the current threat landscape and are often employed as an initial attack vector by threat groups. Archive files hiding malicious payloads are also frequently utilized by threat groups. Additionally, YoroTrooper makes use of open source and on-the-market tools to make attribution more difficult. However, these tactics also present an opportunity for defenders and researchers to develop detections for an attacker’s toolkit by focusing on open source offensive tools.…

Customers of Latitude Financial should consider taking the following steps to reduce the chance of further damage occurring as a result of the breach. 1. Monitor financial accounts: Check bank and credit card statements regularly to ensure that there are no unauthorized transactions. If any suspicious activity is noticed, it should be reported immediately. 2. Change passwords: Although Latitude has stated that no passwords were compromised in the attack, it is always a good practice…

One of the best methods to prevent brute force attacks from succeeding is to have strong passwords implemented across all systems. Creating passwords that are 20+ characters in length, with a random mix of uppercase and lowercase characters, special characters, and numbers is an efficient way to prevent a brute force attack from allowing a malicious user to gain access to a system. Limiting login attempts is another way to prevent brute force attacks from…

To protect best against a campaign such as this, it is recommended to provide user education into common phishing tactics as well as overall emerging cybersecurity risks and vulnerabilities. It is important to employ a defense-in-depth strategy to detect this activity at a different portion of the attack chain, such as detecting lateral movement or reconnaissance activity. Binary Defense’s MDR and Threat Hunting services are an excellent solution to assist with such a program. https://www.bleepingcomputer.com/news/security/medusa-ransomware-gang-picks-up-steam-as-it-targets-companies-worldwide/