Nastiest Malware 2023
News, Announcements, Tech Discussions
Document IDSB24-247 The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:High: vulnerabilities with a CVSS base score of 7.0–10.0 Medium: vulnerabilities with a CVSS base score of 4.0–6.9 Low: vulnerabilities with a CVSS base score of 0.0–3.9Entries may include additional information provided by organizations and efforts sponsored by CISA. Th
The cyber threat landscape continues to evolve, with ransomware attacks becoming more sophisticated and frequent. In response, the FBI has intensified its efforts to combat these threats, especially focusing on the notorious LockBit ransomware. Contacting the IC3: A Critical Step for VictimsThe FBI strongly urges potential victims of LockBit ransomware to reach out to the Internet Crime Complaint Center (IC3). This step is crucial as it enables the FBI to gather vital information, aiding in the broader fight against cybercriminals. By reporting incidents, victims can help the FBI track and disrupt ransomware operations more effectively. This proactive measure not only assists individual victims but also contributes to the larger goal of dismantling ransomware networks (Federal Bureau of Investigation) Free Ransomware Decryption KeysIn a significant development, the FBI, in collaboration with cybersecurity firms, is offering free decryption keys to ransomware victims - most of which
I have used Webroot for years on my Windows 10 PC. No problems that I’ve seen. (I’m new to this community forum, though).I read about Microsoft Defender, which is already included in the Microsoft 365 subscription. I opened Defender and it has this message: We work with Webroot Secure AnywhereWe noticed you’re already using Webroot SecureAnywhere for anti-malware protection. Microsoft Defender works with your existing anti-malware so you can manage your security all in one place.You also get the added bonus of keeping track of your device status and alerts from any of your connected devices. So does this mean I now have BOTH Defender and Webroot protection, or just Webroot and Defender is standing around? Should I monitor security through Webroot, or “all in one place” through Defender? Is there any reason to have Defender active if I have Webroot?I checked the community posts, but any about Defender were 7-9 years old, and I’d like to hear some recent info.Webroot is reasonabl
September 2, 2024 By Bill Toulas CBIZ Benefits & Insurance Services (CBIZ) has disclosed a data breach that involves unauthorized access of client information stored in specific databases.The company informs that a threat actor exploited a vulnerability in one of its web pages and was able to steal customer data between June 2 and June 21.CBIZ is a management consulting company that provides financial and benefits and insurance services to various organizations and individual customers.The organization on June 24 discovered the intrusion and learned of the compromise following an investigation with the help of cybersecurity professionals.“On June 24, 2024, CBIZ learned that an unauthorized party may have acquired information from certain databases,” reads the notification. >>Full Article<<
Cyber attacks rose 30% in 2023, with the United States the top target September 2, 2024 By Ellen Jennings-Trace (Image credit: Future) Research from KnowBe4 reported that critical infrastructure sustained more than 420 million cyber attacks between January 2023 and January 2024, a rise of 30% from the previous year. Physical frameworks such as power grids, transportation, and communications networks are particularly at risk due to the disruption any failures would cause.As infrastructure across the globe becomes increasingly digitized, reliance on the internet leaves them vulnerable to cyber threats. Power grids in Europe and the United States, for example, are increasingly at risk from a ‘cyberattack deluge’, and have been inundated with attacks by the thousand since the start of the war in Ukraine.The infrastructure of over 160 countries has been targeted, with the primary target being the US, followed by the UK, Germany, India, and Japan. The threat actors reportedly most often ori
Successful ransomware attacks against organizations in Asia continue at peak levels in 2024 following a wave of high-profile data breaches last year. September 2, 2024 By Robert Lemos A spate of major ransomware attacks in Southeast Asia in the first half of this year was just the beginning.Companies and government agencies in Southeast Asia — especially Thailand, Japan, South Korea, Singapore, Taiwan, and Indonesia — have experienced a significant increase in attacks, outpacing the rate of ransomware growth in European nations, according to telemetry data from Trend Micro. Major incidents such as the June ransomware attack by a gang known as Brain Cipher that disrupted more than 160 Indonesian government agencies, are likely to multiply as the economies in the region grow. >>Full Article<<
September 2, 2024 By Brian Krebs Three men in the United Kingdom have pleaded guilty to operating otp[.]agency, a once popular online service that helped attackers intercept the one-time passcodes (OTPs) that many websites require as a second authentication factor in addition to passwords.Launched in November 2019, OTP Agency was a service for intercepting one-time passcodes needed to log in to various websites. Scammers who had already stolen someone’s bank account credentials could enter the target’s phone number and name, and the service would initiate an automated phone call to the target that warned them about unauthorized activity on their account. The call would prompt the target to enter a one-time passcode that was sent to the user via SMS when the thieves attempted to log in. Any codes shared by the target were then relayed to the scammer’s user panel at the OTP Agency website. >>Full Article<<
September 2, 2024 By Pierluigi Paganini The Toronto District School Board (TDSB) confirmed that student information was compromised in the June Lockbit ransomware attack.The Toronto District School Board (TDSB) confirmed that students’ information was compromised following a ransomware attack that was discovered in June. The TDSB is the largest school board in Canada with 582 schools and about 235,000 students. In June, the organization informed parents that unauthorized activity was detected in a test system used by their technology department. This test environment is separate from the board’s official networks. In response, the TDSB’s cybersecurity team quickly acted to secure data and protect critical systems.Exposed student information could include name, school name, grade, TDSB email address, TDSB student number and day/month of birth. >>Full Article<<
September 2, 2024 By Sergiu Gatlan Image: Transport for London Transport for London (TfL), the city's transport authority, is investigating an ongoing cyberattack that has yet to impact its services.The agency says that, for the moment, there is no evidence that customer information was compromised during the incident."We are currently dealing with an ongoing cyber security incident," TfL's Customer Information Team warned customers over email earlier and in a statement published online today."At present, there is no evidence that any customer data has been compromised and there has been no impact on TfL services." >>Full Article<<
Researchers have identified a new ransomware variant, named LukaLocker, that has started using a new tactic of directly contacting victim organization executives by phone to demand the ransom instead of posting stolen data to a leak site. The threat actors behind LukaLocker, the Volcano Demon group have made the focus of their ransomware to avoid detection and shutdown any identified methods for detecting or analyzing the attack on the victim device before starting encryption.Fraud campaign uses 700 domains to sell fake Olympics ticketsAs the excitement for the 2024 Summer Olympic games in Paris continues to grow, so too are the number of fraudulent domains that are offering overpriced tickets to Russian-speaking individuals. While some of the fake domains have been registered since 2022, an average of 20 new domains have been created every month since then, up to more than 700 unique domains with event tickets ranging from 300 to 1,000 euros. The campaign has been dubbed Ticket Heist
September 1, 2024 By Bill Toulas A new ransomware-as-a-service (RaaS) operation named Cicada3301 has already listed 19 victims on its extortion portal, as it quickly attacked companies worldwide.The new cybercrime operation is named after the mysterious 2012-2014 online/real-world game that involved elaborate cryptographic puzzles and used the same logo for promotion on cybercrime forums. However, it is unlikely there's a connection between the two.The Cicada3301 RaaS first began promoting the operation and recruiting affiliates on June 29, 2024, in a forum post to the ransomware and cybercrime forum known as RAMP.However, BleepingComputer is aware of Cicada attacks as early as June 6, indicating that the gang was operating independently in early June.Cicada3301 ransomware operator seeking affiliates on RAMP forumsSource: Truesec >>Full Article<<
August 31, 2024 By Bill Toulas The popular Docker-OSX project has been removed from Docker Hub after Apple filed a DMCA (Digital Millennium Copyright Act) takedown request, alleging that it violated its copyright.Docker-OSX is an open-source project created by security researcher Sick.Codes that allows for the virtualization of macOS on non-Apple hardware. It can be hosted on any system that supports Docker, including Linux and Windows.The project is useful for developers who need to test software on macOS or security researchers trying out various configurations to uncover bugs or to research malware.Its popularity is reflected in its 750,000 downloads and 500 stars on Docker Hub, as well as its 40,000 stars on GitHub. >>Full Article<<
By Shunichi Imano, James Slaughter and Fred Gutierrez | August 30, 2024FortiGuard Labs gathers data on ransomware variants of interest that have been gaining traction within our datasets and the OSINT community. The Ransomware Roundup report aims to provide readers with brief insights into the evolving ransomware landscape and the Fortinet solutions that protect against those variants.This edition of the Ransomware Roundup covers the Underground ransomware. Affected platforms: Microsoft WindowsImpacted parties: Microsoft WindowsImpact: Encrypts victims' files and demands ransom for file decryptionSeverity level: High Underground Ransomware OverviewThe first sample of Underground ransomware was first observed in early July 2023, on a publicly available file scanning site. This roughly coincides with the timing of the first victim posted on its data leak site on July 13, 2023.Like most ransomware, this ransomware encrypts files on victims' Windows machines and demands a ransom to decrypt
Fortra limits access to FileCatalyst Workflow database after vendor knowledgebase article leaks default credentials. August 30, 2024 By Ionut Arghire Cybersecurity solutions provider Fortra this week announced patches for two vulnerabilities in FileCatalyst Workflow, including a critical-severity flaw involving leaked credentials.The critical issue, tracked as CVE-2024-6633 (CVSS score of 9.8), exists because the default credentials for the setup HSQL database (HSQLDB) have been published in a vendor knowledgebase article.According to the company, HSQLDB, which has been deprecated, is included to facilitate installation, and not intended for production use. If no alternative database has been configured, however, HSQLDB may expose vulnerable FileCatalyst Workflow instances to attacks. >>Full Article<<
August 30, 2024 By Bill Toulas The City of Columbus, Ohio, has filed a lawsuit against security researcher David Leroy Ross, aka Connor Goodwolf, accusing him of illegally downloading and disseminating data stolen from the City's IT network and leaked by the Rhysida ransomware gang.Columbus, the capital and most populous (2,140,000) city in Ohio, suffered a ransomware attack on July 18, 2024, which caused various service outages and unavailability of email and IT connectivity between public agencies.At the end of July, the City's administration announced that no systems had been encrypted, but they were looking into the possibility that sensitive data might have been stolen in the attack.On the same day, Rhysida ransomware claimed responsibility for the attack, alleging they stole 6.5 TB of databases, including employee credentials, server dumps, city video camera feeds, and other sensitive information. >>Full Article<<
