Company Blogs – Page 19 – BackBox.org News

Russia, Ukraine, China, and More: The Nations at the Center of the Cybercrime Epidemic

December 27, 2024/in Company Blogs

Overview

Cyberattacks on a country’s critical infrastructure have become a growing malicious trend globally. The surge in cybercrime threats and its growing impact on national security, businesses, and individuals has led experts to closely examine which regions face the most cyberattacks.

A recent study from the World Cybercrime Index (WCI) compiled by an international team of researchers, shed light on the most targeted countries, ranking them based on the severity of cyberattacks, the skill of the perpetrators, and the professionalism of the cybercriminals involved.

As of 2024, these countries face the highest levels of cybercrime threats, driven by a complex mix of geopolitical factors, technological infrastructure, and economic conditions. This blog explores the top 10 countries that are most impacted by cyberattacks and why they are at the forefront of the global cybersecurity challenge.

10. India: A Victim of Cybercrime Amid Rapid Digitalization

India ranks tenth in the global cybercrime index, experiencing an uptick in cyberattacks due to its rapid digital transformation. The country’s massive online population and growing e-commerce sector make it an appealing target for cybercriminals. Phishing scams, financial fraud, and ransomware attacks are common in India, with both individuals and organizations being affected. The Indian government has been working to bolster cybersecurity, but the increasing maliciousness of cybercriminals presents an ongoing challenge for the country.

9. Brazil: A Growing Cybercrime Hotspot in Latin America

Brazil, the largest economy in Latin America, has witnessed a surge in cyberattacks, particularly those targeting its financial sector and government institutions. Brazil’s growing digital economy has made it an attractive target for cybercriminals involved in fraud, data breaches, and ransomware. The WCI places Brazil ninth, citing its vulnerability to cybercrime despite efforts to improve cybersecurity regulations. Cybercriminal groups operating in Brazil often specialize in online fraud, identity theft, and other forms of financial cybercrime.

8. United Kingdom: A Rising Cyberattack Target

The United Kingdom faces major cybersecurity threats, ranking eighth on the WCI. As a major financial and technological hub, the UK is often targeted by both cybercriminals and state-sponsored actors. Ransomware attacks and data breaches have been particularly impactful, with high-profile incidents affecting public and private sector organizations. The UK government has increased its efforts to combat cybercrime, but the country remains a target due to its global standing and the increasing digitization of its economy.

7. North Korea: Cyber Warfare and Financial Theft

North Korea’s cybercriminal activities are well-documented, with the country’s state-sponsored hackers playing a prominent role in cyberwarfare and financial cybercrime. The regime has been linked to several high-profile cyberattacks, including the infamous WannaCry ransomware attack and attacks on South Korean entities.

North Korea’s cyber units, such as Lazarus Group, are involved in stealing funds through cybercrime to finance the country’s regime. Their targets are often financial institutions, cryptocurrency exchanges, and government agencies, making North Korea a critical player in the global cybercrime arena.

6. Romania: A Hotbed for Cybercrime Groups

Romania is a big player in the global cybercrime ecosystem, ranking sixth on the WCI. The country is home to several notorious cybercriminal groups involved in ransomware attacks, data theft, and financial fraud.

Romanian hackers are known for their technical expertise and ability to deploy malware across multiple sectors. The Romanian government has made efforts to crack down on cybercrime, but the country remains a hotbed for cyberattacks on countries worldwide, particularly targeting financial institutions and online businesses.

5. Nigeria: A Leading Hub for Cybercrime in Africa

Nigeria has earned a place on the list of the top cyberattack countries due to its increasing involvement in online fraud, scams, and cybercrimes. Known for its widespread involvement in “419” fraud (advance-fee fraud) and cyber scams targeting both individuals and corporations globally, Nigeria’s cybercriminal activities are a growing concern. The country is also home to highly organized cybercrime groups, some of which use cybersecurity tools to launch phishing campaigns and steal sensitive data. The lack of sufficient cybersecurity infrastructure and regulatory enforcement contributes to the persistent cybercrime problem in Nigeria.

4. United States: A Prime Target and Source of Cyberattacks

The United States is not only a major source of cyberattacks but also one of the most heavily targeted nations globally. As the world’s largest economy and a hub for technological innovation, the U.S. faces an array of cyberthreats, from cybercriminals seeking financial gain to nation-state actors pursuing espionage objectives.

The U.S. has witnessed high-profile cyberattacks, including those targeting critical infrastructure, government agencies, and multinational corporations. Ransomware attacks, data breaches, and election interference campaigns are just a few examples of the cybercrimes affecting the U.S., positioning it as one of the countries most impacted by cyberattacks.

3. China: A Major Player in Cyber Espionage

China ranks third in the global cybercrime rankings, largely due to its involvement in large-scale cyber espionage operations. The country has been accused of conducting numerous cyberattacks aimed at stealing intellectual property and accessing sensitive government and corporate data across the globe.

Chinese cybercriminals are notorious for their high level of technical skill and have been linked to various attack methods, including Advanced Persistent Threats (APT). China’s rapid technological growth and its economic prominence have made it both a source and a victim of cyberattacks, making it one of the top cyberattack countries.

2. Ukraine: A Geopolitical Hotspot for Cyberattacks

Ukraine is another country that faces immense cybercrime threats. Since the 2014 annexation of Crimea, Ukraine has been subject to numerous state-sponsored cyberattacks, primarily from Russia. The country has been the target of ransomware attacks and power grid disruptions, making it a prominent example of cyberwarfare in the 21st century.

The WCI ranks Ukraine second due to its vulnerability to cyberattacks, especially amid ongoing political tensions and military conflicts with Russia. Ukrainian government agencies, critical infrastructure, and businesses have been the focus of cyber attackers.

1. Russia: The Epicenter of Cybercrime

Russia remains the undisputed leader in terms of cybercriminal activity. Ranked number one on the World Cybercrime Index, Russia has been a hub for various cybercrime types, including state-sponsored attacks, ransomware campaigns, and hacking for espionage purposes.

The country’s role in cyberattacks on countries globally, particularly targeting political opponents, is well-documented.

The troubling nature of cybercriminal operations in Russia, coupled with their expertise in developing malware, makes the nation a constant threat to others.

Conclusion: The Global Fight Against Cybercrime

As we move into 2025, cyberattacks on countries are increasingly impacting vital sectors like government, finance, and healthcare. Countries such as Russia, Ukraine, China, and the United States are at the forefront of this growing global issue. To combat these threats, governments, organizations, and cybersecurity experts must collaborate to strengthen defenses and proactively monitor cybercriminal activities.

Cyble, a leader in AI-powered cybersecurity, is playing an important role in this effort. Cyble offers multiple threat intelligence platforms that offer real-time monitoring, which processes vast amounts of dark web data and provides actionable insights. By leveraging AI-driven platforms like Cyble, organizations and government sectors can protect their infrastructure and respond to cyberattacks more effectively, helping to ensure a more secure future.

References

https://www.ox.ac.uk/news/2024-04-10-world-first-cybercrime-index-ranks-countries-cybercrime-threat-level

https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0297312

The post Russia, Ukraine, China, and More: The Nations at the Center of the Cybercrime Epidemic appeared first on Cyble.

Blog – Cyble – Read More

China Accuses the U.S. of Hacking Back as Cyber Conflict Grows

December 27, 2024/in Company Blogs

Overview

U.S. national security and cybersecurity agencies have leveled cyber espionage accusations against the People’s Republic of China (PRC) for much of 2024, accusing the PRC of infiltrating U.S. critical infrastructure and telecom networks – possibly in preparation for a potential cyber war between the two global powers.

China has pushed back, calling such charges misinformation and accusing the U.S. of its own espionage campaigns. While the PRC’s claims merit skepticism – most notably that alleged Volt Typhoon activities have been U.S. misinformation or “false flag” operations – new claims by China that two recent sophisticated cyberattacks were carried out by the U.S. are worth examining if only for the details and security insights they provide.

We’ll examine those claims – along with an overview of the depth and breadth of PRC activities in 2024, U.S. responses, and recommendations for telecom and critical infrastructure security.

China Claims Two U.S. Cyber Espionage Attacks

China’s counter charges to U.S. cyber espionage claims have largely been based on decade-old NSA leaks, so the PRC’s latest claims are notable for their focus on two recent specific incidents while avoiding those larger claims.

In a December 18 bulletin, China’s National Internet Emergency Center (CNCERT) claims it “discovered and handled two cases in which the United States launched cyber attacks on large Chinese technology companies and institutions to steal commercial secrets” [translated].

Beginning in August 2024, an “advanced material design and research unit … has been attacked by a suspected US intelligence agency,” CNCERT claims. The attackers “exploited a vulnerability in a certain electronic document security management system in China to invade the software upgrade management server deployed by the company, and delivered control Trojans to more than 270 hosts of the company through the software upgrade service, stealing a large amount of commercial secrets and intellectual property of the company.”

The second alleged attack was against “a large-scale high-tech enterprise in … smart energy and digital information.” The attackers in that case “used multiple overseas springboards to exploit Microsoft Exchange vulnerabilities, invaded and controlled the company’s mail server and implanted backdoor programs to continuously steal mail data. At the same time, the attackers used the mail server as a springboard to attack and control more than 30 devices of the company and its subsidiaries, stealing a large amount of the company’s commercial secrets.”

While it is impossible to determine the veracity of China’s latest claims, given the extent of PRC campaigns against U.S. targets, it would not be surprising if the U.S. were engaged in counter efforts. Whether those efforts would include what may be industrial espionage in these cases is perhaps less likely, unless the targets could provide important strategic information – which may be possible in the case of the smart energy company, for example. Nonetheless, there is no shortage of nation-state or financially motivated threat actors (TAs) capable of carrying out such attacks, so without technical specifics that could link the attacks to a TA, the claims are unsupported.

A Timeline of PRC Campaigns Targeting the U.S.

2024 has seen a notable increase in cyber tensions between the two countries. Here are some of the key developments.

PRC Positioning in U.S. Critical Infrastructure

In February, the U.S. and the other “Five Eyes” countries warned that “People’s Republic of China (PRC) state-sponsored cyber actors are seeking to pre-position themselves on IT networks for disruptive or destructive cyberattacks against U.S. critical infrastructure in the event of a major crisis or conflict with the United States.”

U.S. national security and cybersecurity agencies have repeated those claims a number of times since then – including speculation that China may be preparing for cyber conflict as part of its goal of having the capability to invade Taiwan by 2027.

U.S. Government Breaches

A July 2023 breach of U.S. government email accounts received a thorough accounting in 2024 in reports and hearings, including pledges from Microsoft that it would address the security failings that led to the breaches as well as make security a top priority for the company going forward.

Wiretap System and Telecom Breaches

The revelation in early October that the PRC-linked Salt Typhoon group had breached the U.S. court wiretap system was followed a few weeks later by news that the telecom network breaches behind that attack also led to attacks targeting the phone communications of U.S. officials at the highest levels.

What followed was a stark reassessment of telecom network security – some of which may not be as risk-focused as perhaps would be ideal.

Focus on Chinese Network Equipment May Overlook Other Risks

The U.S. is engaged in a $5 billion “rip and replace” effort to remove Chinese equipment from U.S. telecom networks in an effort to address those security issues.

While government intervention may well be necessary to shore up the significant gaps in telecom and critical infrastructure security, focusing narrowly on only equipment from China ignores gaps from other vulnerabilities that may be just as critical.

While not revealing details, Senator Mark Warner – a former telecom venture capitalist – recently told the Washington Post that “thousands and thousands and thousands” of vulnerable telecom network devices might need to be replaced. “The big networks are combinations of a whole series of acquisitions, and you have equipment out there that’s so old it’s unpatchable,” Warner said.

Vulnerable legacy devices, whether in telecom or operational technology (OT) networks, are at the heart of the cybersecurity crisis confronting telecom and critical infrastructure. Replacing just one source of those issues likely won’t provide a comprehensive solution.

A much broader program that emphasizes replacing legacy devices wherever possible, along with essential security practices like network segmentation and access control, will likely be required to solve persistent security vulnerabilities and threats in telecom and other critical infrastructure.

The post China Accuses the U.S. of Hacking Back as Cyber Conflict Grows appeared first on Cyble.

Blog – Cyble – Read More

NCSC Implements Key Improvements Following IPAC Review of Cyber Threats

December 26, 2024/in Company Blogs

Overview

The New Zealand’s Government Communications Security Bureau (GCSB), through its National Cyber Security Centre (NCSC), has implemented a series of measures to strengthen the country’s defenses against malicious cyber activity.

This follows a thorough review of practices concerning cyberattacks targeting members of the Inter-Parliamentary Alliance on China (IPAC), an organization committed to addressing the growing influence of China’s policies on global security and governance.

The review was initiated in May 2024 by Lisa Fong, the Deputy Director-General of Cyber Security at GCSB. Fong recognized a need for improvement after concerns arose over how the NCSC responded to a cyber incident involving IPAC members. These concerns were particularly focused on the NCSC’s handling of reports related to state-sponsored cyber activities and the broader implications of such incidents on national security.

IPAC members, who represent a coalition of lawmakers across various countries, were targeted in a large-scale cyberattack by APT31, a Chinese state-sponsored hacker group. The attack included over 1,000 emails sent to more than 400 IPAC-associated accounts, compromising the sensitive communications of numerous politicians. Despite the seriousness of the attack, many victims were not informed of the breach by their respective governments, prompting an outcry from international lawmakers.

To address these concerns and strengthen the NCSC’s cybersecurity protocols, a thorough review of the NCSC’s procedures was carried out, culminating in a report published in July 2024. The review focused on the NCSC’s handling of the cyberattack, assessing both the technical response and the broader implications for security and intelligence management.

Key Findings and Recommendations

The review highlighted several areas where the NCSC could improve its procedures. While the NCSC did not identify any successful compromises of classified information, it did detect numerous phishing attempts targeting the parliamentary email addresses of IPAC members. The review’s key recommendations included the following:

Broader Consideration of Implications: The NCSC needed to expand its focus beyond the technical response to cyber incidents. It was recommended that the NCSC develop a more comprehensive approach, one that not only addresses immediate technical threats but also considers the wider geopolitical and societal impacts of cyberattacks.

Enhanced Engagement with Targeted Individuals: The review called for greater engagement with individuals who had been targeted by foreign state-sponsored actors. This recommendation emphasized the need for a more proactive communication strategy to ensure that those affected by cyber threats are informed in a timely manner.

Improved Briefing Procedures: The review also stressed the importance of enhancing the NCSC’s process for briefing the Minister Responsible for the GCSB and their office. Effective communication at all levels of government was seen as crucial for a coordinated and quick response to cyber threats.

Public Guidance for High-Profile Individuals: As part of the review’s fourth recommendation, the NCSC developed and published new guidance on its website for New Zealanders considered “high-profile individuals.” This initiative was designed to offer advice on how to protect against cyberattacks, particularly for those in sensitive roles who might be more likely to become targets.

NCSC’s Response and Implementation

Following the review, the NCSC wasted no time in implementing the recommended changes. Lisa Fong confirmed that all identified improvements had been quickly actioned. “I’m pleased to confirm that we have put in place measures to address all recommendations outlined in the initial review,” said Fong in a statement.

The NCSC took several steps to strengthen its internal processes. These included updating procedures to ensure better alignment with international best practices, particularly in managing incidents involving foreign state-sponsored cyber activity. New internal guidance and standards were also established for NCSC staff to ensure that similar concerns do not arise in the future.

Ms. Fong further explained that while these improvements completed the review’s immediate actions, the NCSC remained committed to continuously enhancing its cybersecurity practices. “We are committed to identifying opportunities for improvement in our practices and procedures and implementing these where we have the ability to do so,” she said.

International Reactions to the Attack

The attack on IPAC members was not an isolated incident but part of a broader pattern of state-sponsored cyber activities targeting global political figures and institutions. Following the attack, several countries with IPAC members took important steps to address the breach and secure their own digital infrastructures.

Canada was one of the countries most affected by the attack, with 18 parliamentarians targeted, including prominent figures such as Garnett Genuis MP and John McKay MP. In response, these members issued a joint statement demanding an explanation as to why they were not notified about the cyberattack sooner. Public debates, including a call for a privileged debate in the House of Commons, highlighted the urgency of addressing these security lapses.

In Belgium, lawmakers, including Representative Els van Hoof and former Prime Minister Guy Verhofstadt, were targeted. These individuals, along with others, rallied political leaders to pursue legal action, pushing for both a parliamentary inquiry and potential criminal proceedings against those responsible.

Meanwhile, in New Zealand, former IPAC co-chairs Simon O’Connor and Louisa Wall, along with other targeted figures such as academic Anne-Marie Brady, pressed the government to ensure that MPs would be informed of similar threats in the future. In response to these concerns, the GCSB initiated a public inquiry, promising to provide further assurances to the affected individuals.

Elsewhere, countries such as France, Germany, and Italy saw similar reactions from their political leaders, who demanded accountability from their respective security agencies and called for international sanctions against APT31. These coordinated international efforts reflect the growing recognition of the threat posed by foreign state-sponsored cyberattacks on democratic institutions.

Broader Cybersecurity Context

The NCSC’s actions come at a time of heightened global concern about the security of democratic institutions and their susceptibility to cyber threats. State-sponsored actors, particularly those associated with China, have increasingly targeted foreign governments, institutions, and political figures to advance geopolitical objectives. The focus on IPAC members is part of a larger trend of foreign interference in democratic processes through digital means, including espionage and disinformation campaigns.

To counter this growing threat, New Zealand’s NCSC has worked closely with international partners such as the National Cyber Security Centre (NCSC) in the United Kingdom and the Government Communications Security Bureau (GCSB) in New Zealand. These agencies have exchanged information and best practices to strengthen cyber defenses against these cyber threats.

Moreover, the NCSC is actively collaborating with the IPAC to enhance global cybersecurity cooperation, ensuring that targeted individuals and organizations receive timely and accurate information about potential threats. This international collaboration is essential to developing a unified, effective approach to defending against state-sponsored cyberattacks.

Conclusion

The review and subsequent improvements undertaken by the NCSC represent a significant step in enhancing New Zealand’s cybersecurity posture, particularly concerning foreign state-sponsored cyber activity. By acting swiftly on the recommendations of the IPAC review, the NCSC has not only addressed specific concerns raised by the targeted individuals but also ensured that its processes and practices are better aligned with international standards for cybersecurity.

As cyber threats continue to evolve, New Zealand’s commitment to continuous improvement and proactive engagement with global partners like the GCSB, NCSC, and IPAC will be an important factor in protecting the nation’s cybersecurity infrastructure and the integrity of its political institutions. As Lisa Fong emphasized, this is not the end of the journey but a part of the ongoing effort to protect New Zealand from emerging cyber risks.

References:

https://www.ncsc.govt.nz/news/ncsc-delivers-all-recommendations-following-ipac-review

https://www.ncsc.govt.nz/news/response-to-ipac-incident

https://www.ipac.global/news/lawmakers-respond-to-news-of-cyber-attack

The post NCSC Implements Key Improvements Following IPAC Review of Cyber Threats appeared first on Cyble.

Blog – Cyble – Read More

Must-Read Cyble Research Reports of 2024: Trends and Key Takeaways

December 26, 2024/in Company Blogs

Of the many reports created by Cyble’s talented team of threat researchers this year, seven stand out for their unique and comprehensive insight into the contemporary threat landscape.

We’ll examine some of the key takeaways from the reports, including the changing nature of cyber threats and some surprising solutions readers may not have considered.

Here, then, are insights from seven key Cyble research reports from 2024 that you shouldn’t miss, from broad trends to sector-specific threats that affect us all.

Brand Impersonation and Counterfeit Products

E-Commerce and Brand Monitoring examines the underappreciated risks of counterfeit products and brand impersonation. It includes statistics and case studies that should disturb companies and consumers alike.

Two data points underscore the risks for everyone: 70% of consumers have unknowingly purchased counterfeit products online within the last year, and the average company loses almost $4 billion a year in sales because of counterfeit products.

The report examines the most targeted sectors and methods – and discusses detection technologies, solutions, and actions that can help address the problem.

How Threat Intelligence Became a Core Security Technology

The Year in Cyber Threat Intelligence is a comprehensive look at threat intelligence’s emergence as a central cybersecurity technology, including eight mergers that have remade the sector and revealed its strategic importance even for established security vendors.

The leading threat intelligence platforms have evolved into external attack surface management (EASM) solutions that address risks from the network perimeter to the cloud and beyond. Harnessing AI and vast computing resources, these solutions power a growth rate that’s more than twice as fast as the cybersecurity market as a whole.

Along the way, you’ll get insights into threat intelligence use and features you might not know about, including a few practices that can prevent major cyberattacks before they happen.

Healthcare’s Tough Year

Healthcare cyber incidents in 2024 got bigger and more dramatic than ever before, with crippling ransomware attacks and massive data breaches becoming all too common.

Cyble’s mid-year Healthcare Threat Landscape report looks at incidents from the first half of 2024 – and draws important big-picture inferences and trends from the data. One critical insight: Dark web monitoring is an underappreciated tool for detecting credentials, access, and data leaks before they become much bigger cyberattacks and issues.

The report looks at 10 cases where healthcare access credentials were offered for sale on the dark web. Such breaches can be an important indicator of future attacks for any organization, but they can be particularly dangerous in the healthcare sector. The report also looks at vulnerabilities, data exposures, and ransomware attacks that hit the sector this year.

Medical Device Insecurity

A second healthcare report from Cyble is also worth reading for its insights into the unique systems, devices and challenges that make healthcare security so difficult – and breaches so expensive. In fact, healthcare data breaches are more than 50% more expensive than breaches in any other industry.

Vulnerability Management in Healthcare IoT Devices reveals why healthcare security is so difficult, with a sprawling array of unsupported and insecure devices providing critical patient care – as well as ready access for hackers. Here are some of the disturbing data points from the report:

75% of infusion pumps have unpatched security flaws.

83% of medical imaging systems run on unsupported operating systems.

98% of medical IoT device network traffic is unencrypted.

Over 50% of hospital IoT devices are vulnerable to attack.

Medical IoT devices were the root cause of 21% of all ransomware attacks in the healthcare sector.

Only 52% of companies conduct regular security audits for healthcare IoT devices.

You’ll come away from this report with new insight into healthcare security challenges – along with potential solutions.

Software Supply Chain Risks and Controls

Software supply chain attacks have become a near-daily occurrence, and attacks that come through trusted partners are particularly dangerous because of their privileged access to an organization’s data and environment.

Cyble’s Supply Chain Threats report looked at the many ways that supply chain attacks and vulnerabilities can occur, along with an extensive list of security controls organizations can use to reduce those risks.

The use of open-source components in commercial software adds to those risks, creating an opening for malicious packages and open-source vulnerabilities to enter the commercial supply chain.

As any IT vulnerability from a trusted supplier could be considered a supply chain risk, the section on controls is particularly important. A must for understanding our increasingly interconnected threat landscape.

Financial Cybersecurity

The financial sector was covered in multiple Cyble reports this year, but one stands out above the rest: Cyber Threat Intelligence for Financial Institutions is an exhaustive look at the threats facing financial services companies – along with solutions.

The nearly 5,000-word report enumerates the attack types, vulnerabilities, targets, regions, and threat groups that place the industry at high risk of attack – along with what to expect for threats, controls, and regulatory and compliance pressures in 2025. A must-read for anyone who depends on this vital engine of economic growth.

Transportation Security

The Transportation and Logistics report examines the vast cybersecurity risks that threaten to disrupt transportation and shipping – risks that have grown substantially with automation and AI.

The report looks at the specific vulnerabilities, threat groups, and hacktivists that target the transportation sector, along with the attack types the industry faces.

The report examines eight technologies that can help mitigate those risks. You’ll gain a greater appreciation for the many physical and geopolitical risks that transportation services must negotiate while getting people and goods to their intended destinations.

What’s Next from Cyble Threat Researchers?

In addition to regular reports on sector-specific and general threats, Cyble also publishes comprehensive monthly, semi-annual, and annual reports on the threat landscape that are available for free download. Cyble’s annual threat landscape report will be published in January in the Research Reports section – and will include predictions for 2025.

Cyble’s reports and blogs – along with thousands of daily bulletins sent to threat intelligence subscribers – offer critical, reasoned judgments and insights from seasoned threat researchers into the threats and vulnerabilities meriting priority attention, along with creative solutions to those challenges.

The post Must-Read Cyble Research Reports of 2024: Trends and Key Takeaways appeared first on Cyble.

Blog – Cyble – Read More

IT Vulnerability Report: Cyble Urges Fixes for Apache Struts, Qualcomm & More

December 24, 2024/in Company Blogs

Overview

Cyble’s December 19 IT vulnerability report to clients highlighted nine vulnerabilities at high risk of attack, including five under active discussion on dark web forums.

Cyble vulnerability intelligence and dark web researchers also noted threat actor claims of zero-day vulnerabilities for sale affecting Palo Alto Networks devices and Chrome and Edge browsers.

In total, Cyble researchers examined 13 vulnerabilities and 8 dark web exploits to arrive at the list of vulnerabilities that security teams should prioritize for patching. At-risk products include Apache Struts, Qualcomm digital signal processors (DSPs), a WordPress plugin, a Bluetooth flaw affecting Ubuntu, and more.

The Week’s Top Vulnerabilities

CVE-2024-53677: This file upload logic vulnerability in the Apache Struts web application framework has been rated 9.5 severity by the Apache Software Foundation but is still undergoing NVD analysis. An attacker could exploit the vulnerability to manipulate file upload parameters to enable path traversal and potentially upload a malicious file that could be used to perform remote code execution. Recently, researchers disclosed that threat actors are attempting to exploit the vulnerability using public proof-of-concept exploits to allow remote code execution, and exploitation has also been discussed on dark web forums. Cyble also published a separate blog on this vulnerability.

Cyble researchers noted that there are nearly 200,000 vulnerable Apache Struts instances exposed to the internet (image below):

CVE-2024-43047: This vulnerability affects Qualcomm’s Digital Signal Processor (DSP) service, which is utilized in many Android devices. It allows for privilege escalation and arbitrary code execution, posing significant risks to affected systems. Google Project Zero marked the vulnerability as actively exploited in October 2024 and received a fix on Android in November 2024. Researchers also observed that the Serbian government exploited Qualcomm zero-days, including CVE-2024-43047, to unlock and infect Android devices with a new spyware family named “NoviSpy.”

CVE-2024-11972: The CVE for this vulnerability has been reserved but has not yet been created. The flaw affects the Hunk Companion WordPress plugin, which is designed to enhance functionality and build visually appealing websites without extensive coding knowledge. The vulnerability allows attackers to perform unauthenticated plugin installation through unauthorized POST requests, enabling them to install and activate other plugins that may contain known vulnerabilities. According to researchers, attackers are exploiting the vulnerability to install outdated plugins with known flaws from the WordPress.org repository. This allows them to access vulnerabilities that can lead to remote code execution (RCE), SQL injection, cross-site scripting (XSS), or the creation of backdoor admin accounts, posing significant risks to site security.

CVE-2023-45866: This medium-severity vulnerability affects Bluetooth HID Hosts in systems utilizing BlueZ, particularly in Ubuntu 22.04 LTS with the BlueZ 5.64-0ubuntu1 package. This vulnerability allows an unauthenticated peripheral HID device to initiate an encrypted connection, potentially enabling the injection of Human Interface Device (HID) messages without user interaction.

Vulnerabilities and Exploits on Underground Forums

Cyble Research and Intelligence Labs (CRIL) researchers also identified the following exploits and vulnerabilities discussed on Telegram channels and cybercrime forums, raising the risk that they will be exploited in attacks.

CVE-2024-28059: This critical security vulnerability, which was identified in the MyQ Print Server in versions prior to 8.2 (patch 43), allows remote attackers to gain elevated privileges on the target server.

CVE-2024-38819: This high-severity path traversal vulnerability in the Spring Framework specifically affects applications that utilize WebMvc.fn or WebFlux.fn functional web frameworks.

CVE-2024-35250: This high-severity privilege escalation vulnerability in the Microsoft Windows operating system specifically affects the kernel-mode driver.

CVE-2024-40711: This critical vulnerability identified in Veeam Backup & Replication software allows for unauthenticated remote code execution (RCE) due to deserialization of untrusted data.

CVE-2023-27997: This heap-based buffer overflow vulnerability in certain FortiOS and FortiProxy versions may allow a remote attacker to execute arbitrary code or commands via specifically crafted requests, specifically affecting SSL VPNs.

Threat actors were also observed offering a zero-day exploit weaponizing a vulnerability claimed to be present on Palo Alto Network’s PAN-OS VPN-supported devices (asking price: $60,000) and a zero-day exploit weaponizing a vulnerability allegedly present in Chrome and Edge (asking price: $100,000).

Cyble Recommendations

To protect against these vulnerabilities and exploits, organizations should implement the following best practices:

To mitigate vulnerabilities and protect against exploits, regularly update all software and hardware systems with the latest patches from official vendors.

Develop a comprehensive patch management strategy that includes inventory management, patch assessment, testing, deployment, and verification. Automate the process where possible to ensure consistency and efficiency.

Divide your network into distinct segments to isolate critical assets from less secure areas. Use firewalls, VLANs, and access controls to limit access and reduce the attack surface exposed to potential threats.

Create and maintain an incident response plan that outlines procedures for detecting, responding to, and recovering from security incidents, including ransomware-resistant backups. Regularly test and update the plan to ensure its effectiveness and alignment with current threats.

Implement comprehensive monitoring and logging solutions to detect and analyze suspicious activities. Use SIEM (Security Information and Event Management) systems to aggregate and correlate logs for real-time threat detection and response.

Subscribe to security advisories and alerts from official vendors, CERTs, and other authoritative sources. Regularly review and assess the impact of these alerts on your systems and take appropriate actions.

Conduct regular vulnerability assessment and penetration testing (VAPT) exercises to identify and remediate vulnerabilities in your systems. Complement these exercises with periodic security audits to ensure compliance with security policies and standards.

Conclusion

These vulnerabilities highlight the urgent need for security teams to prioritize patching exploitable vulnerabilities in sensitive products and vulnerabilities that could be weaponized as entry points for wider attacks. With increasing discussion of these exploits on dark web forums, organizations must stay vigilant and proactive.

Implementing strong security practices is essential for protecting sensitive data and maintaining system integrity. A comprehensive threat intelligence solution like Cyble can monitor for threats and leaks specific to your environment, allowing you to respond quickly to events and prevent them from becoming wider incidents.

The post IT Vulnerability Report: Cyble Urges Fixes for Apache Struts, Qualcomm & More appeared first on Cyble.

Blog – Cyble – Read More

Cyble Sensors Detect Attacks on Ivanti, PHP, SAML, Network Devices, and More

December 24, 2024/in Company Blogs

Overview

Cyble honeypot sensors detected dozens of vulnerabilities under attack in the threat intelligence leader’s most recent sensor intelligence report, including fresh attacks on an Ivanti vulnerability.

Threat actors also targeted vulnerabilities affecting PHP and the Ruby SAML library. Cyble’s Dec. 19 report noted that unpatched networks and IoT devices remain popular targets for hackers looking to breach networks and add to botnets.

The report also looked at Linux and Windows exploits, common brute-force attacks, and phishing campaigns.

Vulnerabilities Under Attack

Cyble detected fresh attacks on CVE-2024-7593, a critical authentication bypass vulnerability in the authentication algorithm implementation of Ivanti’s Virtual Traffic Manager (vTM), excluding versions 22.2R1 and 22.7R2. The 9.8-severity vulnerability can allow a remote, unauthenticated attacker to bypass admin panel authentication. It was added to CISA’s Known Exploited Vulnerabilities catalog in September, one of 11 Ivanti vulnerabilities CISA has added to the KEV catalog this year.

CVE-2024-4577 also remains under attack. The critical PHP vulnerability impacts CGI configurations and remains vulnerable in PHP versions 8.1.* before 8.1.29; 8.2.* before 8.2.20; and 8.3.* before 8.3.8. The 9.8-severity vulnerability enables attackers to execute arbitrary commands through specially crafted URL parameters.

CVE-2024-45409, a vulnerability in the Ruby SAML library designed for implementing the client side of SAML authorization, also remains a frequent target for hackers. In versions 1.12.2 and earlier, and 1.13.0 to 1.16.0, the library fails to verify the signature of SAML Responses properly. The flaw allows an unauthenticated attacker with access to a signed SAML document (issued by the IdP) to forge a SAML Response or Assertion with arbitrary contents, enabling unauthorized login as any user within the affected system. The issue has been resolved in versions 1.17.0 and 1.12.3.

Network and IoT Devices Under Attack

Network and IoT devices remain particularly popular with threat actors, as they can provide entry points into networks as well as additional nodes in a botnet. With many devices with vulnerabilities from 2023 and earlier still unpatched, Cyble noted that the following network vulnerabilities remain particularly popular with attackers:

CVE-2023-20198, a 10.0-severity vulnerability in the web UI feature of the Cisco IOS XE operating system, is being chained with CVE-2023-20273 to gain root privileges in vulnerable devices.

CVE-2023-4966 is a sensitive information disclosure vulnerability in Citrix NetScaler ADC and NetScaler Gateways when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

CVE-2023-1389 is a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface of TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

CVE-2023-46747 could allow undisclosed requests in F5 BIG-IP to bypass the configuration utility authentication, allowing an attacker with network access to the system through the management port and/or self-IP addresses to execute arbitrary system commands.

Vulnerabilities in real-time operating systems (RTOS) and embedded devices remain extremely popular with attackers, exposing operational technology (OT) networks with vulnerable devices to attack.

One last vulnerability hackers keep returning to is CVE-2023-47643, an unauthorized GraphQL Introspection vulnerability in the SuiteCRM Customer Relationship Management (CRM) system in versions before 8.4.2. The flaw allows an attacker to access the GraphQL schema without authentication, revealing all object types, arguments, functions, and sensitive fields such as UserHash. By understanding the exposed API attack surface, attackers can exploit this information to access sensitive data.

Linux systems remain continually under attack by CoinMiner, Mirai Botnet, and IRCBot malware, while hundreds of WannaCry ransomware samples continue to be detected each week in Windows 10, Windows Server 2016, and older systems vulnerable to CVE-2017-0147.

Remote Protocols Targeted in Brute-Force Attacks

Remote access protocols, particularly VNC (port 5900), remain popular targets of brute-force attacks. Examining the ports most targeted by the top five attacker countries, attacks originating from the United States targeted ports 5900 (42%), 22 (36%), 3389 (14%), 80 (5%), and 23 (3%). Attacks originating from Russia targeted ports 5900 (81%), 445 (7%), 22 (5%), 23 (3%), and 1433 (3%). Netherlands, Jordan, and China majorly targeted ports 5900, 22, and 445.

Security analysts are advised to add security system blocks for frequently attacked ports (such as 22, 3389, 443, 445, 5900, and 3306).

New Phishing Campaigns Detected

Cyble detected 277 new scam and phishing email addresses in the most recent weekly report. Here are six notable ones, including subject lines:

E-mail Subject	Scammers Email ID	Scam Type	Description
Are you interested in investment	Dave@oig.com	Investment Scam	Unrealistic investment offers to steal funds or data
UN Compensation Fund.	zagranica@usa.com	Claim scam	Fake compensation fund claim
COMPENSATION FUND OF 5.5 MILLION DOLLARS.	Info@uba.org	Claim scam	Fake compensation fund email
Funding projects up to USD 5 Billion	noreply@order.eventbrite.com	Investment Scam	Unrealistic investment offers to steal funds or data
HOTEL AND REAL ESTATE INVESTMENTS	richardowenr928@gmail.com	Investment Scam	Fake hotel and real estate investment scam
My Donation	test@cinematajrobi.ir	Donation Scam	Fake donation mail to steal money

Recommendations and Mitigations

Cyble researchers recommend the following security controls:

Blocking target hashes, URLs, and email info on security systems (Cyble clients received a separate IoC list).

Immediately patch all open vulnerabilities listed here and routinely monitor the top Suricata alerts in internal networks.

Constantly check for Attackers’ ASNs and IPs.

Block Brute Force attack IPs and the targeted ports listed.

Immediately reset default usernames and passwords to mitigate brute-force attacks and enforce periodic changes.

For servers, set up strong passwords that are difficult to guess.

Conclusion

With many active threats against both new and older vulnerabilities, organizations need to remain vigilant and responsive, patching wherever possible and applying mitigations where patching isn’t possible. The large number of brute-force attacks and phishing campaigns show that attackers remain active even heading into the holiday season.

To protect their digital assets, organizations should address known vulnerabilities and implement recommended security controls, such as blocking malicious IPs and securing network ports. A proactive and layered security approach will be key in protecting defenses against exploitation and data breaches.

The post Cyble Sensors Detect Attacks on Ivanti, PHP, SAML, Network Devices, and More appeared first on Cyble.

Blog – Cyble – Read More

Predictive Threat Intelligence – Predictions for 2025: The Future of CTI

December 23, 2024/in Company Blogs

Cybersecurity has long been an essential element of organizational defense, with the growing complexity and frequency of cyberattacks propelling the development of cybersecurity practices. Among these practices, Threat Intelligence (TI) has become a central element, helping organizations anticipate, understand, and counter various cyber threats. As we approach 2025, however, a new evolution in threat intelligence is emerging: Predictive Threat Intelligence (PTI).

While traditional Threat Intelligence (TI) focuses on collecting, analyzing, and sharing data on cyber threats after they occur, Predictive Threat Intelligence goes a step further. It uses advanced techniques, particularly AI (artificial intelligence) and machine learning (ML), to predict cyber threats before they materialize. This field holds great promise for proactively strengthening an organization’s cybersecurity posture by providing early warnings, reducing damage from potential attacks, and enabling defense strategies based on anticipatory insights.

What Is Cyber Threat Intelligence (CTI), and how is it Different from Predictive Threat Intelligence (PTI)?

Cyber Threat Intelligence (CTI) is the practice of collecting, analyzing, and sharing data about cyber threats. By gaining insights into threat actors’ behavior and tactics, techniques, and procedures (TTPs), organizations can better understand potential cyber threats, allowing them to prepare, respond, and mitigate potential attacks.

Traditional Threat Intelligence tends to focus on reactive measures, where security teams analyze attack patterns after a breach or threat occurs. In contrast, Predictive Threat Intelligence (PTI) takes a more proactive stance. By leveraging AI and ML, PTI not only understands current cyber threats but also forecasts future attacks before they materialize.

Machine learning algorithms analyze large datasets, including historical threat data and emerging patterns, to predict the types of threats organizations might face in the near future. For example, if an AI model detects a surge in phishing attacks against a particular industry, it can alert organizations in that sector to prepare for a potential escalation in attacks. This predictive capability allows organizations to take precautionary measures before a threat becomes imminent.

Predictive Threat Intelligence enhances the traditional threat intelligence model by offering actionable, anticipatory insights that enable proactive security measures, such as patching vulnerabilities or reinforcing defenses against specific attack vectors before they are widely exploited. This shift from reactive to proactive cybersecurity is positioned to transform the way organizations approach risk management and threat mitigation.

Why Is Cyber Threat Intelligence (CTI) Important?

Understanding the importance of Cyber Threat Intelligence (CTI) is important to appreciating its role in the cybersecurity ecosystem. As cyberattacks become increasingly damaging, the need for effective threat intelligence grows. Without comprehensive CTI, organizations would be left scrambling to respond to attacks, often too late to prevent significant damage.

CTI provides essential insights into cyber threats, including information about threat actors, their motives, and the vulnerabilities they exploit. With this knowledge, organizations can develop more rugged defense mechanisms and avoid becoming targets for specific types of attacks.

The most compelling reason for investing in CTI is its ability to elevate organizational security beyond reactive measures. By enabling organizations to recognize online threats early, CTI empowers security teams to adopt a proactive security posture. Proactive defense strategies allow vulnerabilities to be patched before they can be exploited and preparations to be made for impending threats, all of which contribute to reducing the overall risk of a breach.

How Does Predictive Threat Intelligence Work?

Predictive Threat Intelligence works by combining AI, machine learning, and advanced analytics to analyze vast amounts of historical and real-time threat data. By understanding the TTPs of cyber adversaries, these tools can identify patterns that signal emerging threats. Here’s how it works in practice:

Data Collection: Predictive threat intelligence platforms collect data from diverse sources, including the surface web, deep web, and dark web, as well as intelligence from private threat-sharing organizations and public cybersecurity resources. These datasets provide crucial insights into potential vulnerabilities and attack vectors.

Data Processing and Analysis: AI models and machine learning algorithms process the collected data, identifying potential threats based on historical attack patterns and emerging trends. For instance, if a surge in phishing attacks targeting a specific industry is detected, AI models can recognize similar characteristics or tactics that might indicate future attacks.

Threat Forecasting: Predictive intelligence platforms then forecast potential threats based on identified trends. For example, AI can predict that a new form of ransomware is gaining traction among cybercriminals, alerting organizations to prepare for a possible attack.

Proactive Response: Once potential threats are identified, the predictive system provides actionable intelligence to help organizations bolster their defenses. These could include patching known vulnerabilities, updating defense strategies, and alerting stakeholders to prepare for specific attack scenarios.

The Role of Artificial Intelligence and Machine Learning in Predictive Threat Intelligence

While Predictive Threat Intelligence (PTI) involves more than just AI, artificial intelligence and machine learning play a crucial role in its development. AI’s strength lies in its ability to analyze massive volumes of data, recognize patterns, and make predictions about future events, including cyberattacks.

However, despite the potential, AI and ML alone are not enough to guarantee a fully predictive threat intelligence model. Predictive intelligence is complex, and building reliable, actionable insights requires a balanced integration of human intelligence and automated systems.

The role of AI and machine learning in predictive intelligence includes:

Threat Detection: AI can identify anomalous behavior in network traffic, suggesting potential attack attempts.

Risk Analysis: By analyzing attack vectors and patterns, AI models can prioritize potential risks based on the severity of the threats and their likelihood of occurring.

Automation: Machine learning models can automate certain security functions, such as scanning for vulnerabilities and patching security gaps, without the need for human intervention.

The Challenge of Implementing Predictive Threat Intelligence

While predictive threat intelligence is a highly promising approach, it faces several challenges, especially in terms of implementation.

Data Availability: One of the primary hurdles is the availability of quality data. AI and machine learning models require large, diverse datasets to learn and predict threats accurately. However, data is often fragmented and may not be available in a standardized format, making it difficult for predictive systems to integrate and analyze it effectively.

Complexity of Predictive Models: Predicting future threats is an inherently complex task. As with any prediction, there is a degree of uncertainty, and not every forecast will be accurate. The dynamic nature of cybersecurity means that there will always be a level of unpredictability when it comes to forecasting attacks.

Human Expertise: Although AI and machine learning are powerful tools, human expertise is still necessary to interpret the data and provide context. Human analysts play a critical role in identifying nuanced threats and validating AI predictions to ensure the intelligence is actionable.

Data Privacy and Sharing: Threat intelligence requires data from multiple sources, including potentially sensitive or confidential data. Therefore, sharing threat intelligence can raise privacy concerns, especially in industries like finance or healthcare. Developing systems that allow for safe and ethical sharing of threat data is essential for the success of PTI.

The Future of Predictive Threat Intelligence in 2025

As we look toward 2025, the role of Predictive Threat Intelligence (PTI) in cybersecurity will become increasingly important. By predicting threats before they materialize, PTI will enable organizations to stay one step ahead of cybercriminals, minimizing the risks of cyber threats.

In the near future, advancements in AI-powered threat intelligence will allow organizations to:

Improve the automation of cybersecurity workflows, enabling faster, more accurate threat detection and mitigation.

Enhance the integration of AI and human expertise, creating a more effective hybrid threat intelligence model.

Develop better predictive models that consider a wider array of threat actors and attack vectors, leading to more accurate forecasts.

Better share threat intelligence across industries, increasing collaboration and improving overall cybersecurity resilience.

Cyble, an industry leader in Cyber Threat Intelligence, has been at the forefront of this evolution. Cyble’s Cyber Threat Intelligence Platform provides real-time insights into potential threats, combining historical threat data with AI-driven analysis to deliver actionable, predictive intelligence. By integrating diverse data sources, Cyble enables organizations to identify potential threats, prioritize risks, and take proactive measures to mitigate potential breaches.

Why Choose Cyble?

Cyble offers a comprehensive cyber threat intelligence solution that empowers organizations to tackle cyber threats more effectively. With features like dark web monitoring, vulnerability management, and AI-driven analysis, Cyble helps companies not only detect threats but also predict and prevent them before they cause damage.

Cyble’s platform integrates seamlessly with your existing security infrastructure, enabling you to:

Gather intelligence from various sources, including the deep and dark web, to identify emerging threats.

Augment data with contextual insights for better decision-making.

Receive timely notifications about potential threats and vulnerabilities, enabling proactive defense strategies.

Cyble is ready to help businesses understand and walk through this dynamic landscape and stay protected against cyber threats in 2025 and beyond.

Conclusion: Stay Ahead with Cyble

Predictive Threat Intelligence is the future of threat Intelligence. By leveraging advanced technologies like AI and machine learning, organizations can anticipate threats before they emerge, minimizing the damage caused by cyberattacks. As we move towards 2025, Predictive Threat Intelligence will be an essential tool in every cybersecurity strategy.

If you want to strengthen your organization’s defenses and stay protected from upcoming threats, Cyble’s threat intelligence platform is your go-to solution. Schedule a demo today and discover how Cyble can help you proactively secure your assets against the threats of tomorrow.

The post Predictive Threat Intelligence – Predictions for 2025: The Future of CTI appeared first on Cyble.

Blog – Cyble – Read More

5 Major Cyber Attacks in December 2024

December 23, 2024/in Company Blogs

The cybersecurity research team of ANY.RUN found and analyzed a bunch of emerging threats with the help of our mighty Interactive Sandbox and Threat Intelligence Lookup.

We’ve been sharing their findings via X and in our blog. Here is a summary on the most interesting insights from December 2024.

Phishing Campaigns targeting Microsoft’s Azure Blob Storage

Original post on X

*Phishing page: HTML document with a characteristic attribute*

Cyber criminals are abusing Microsoft’s cloud-based file storage solution by hosting phishing pages on the service, employing techniques like HTML smuggling.

The phishing pages are HTML documents that contain a block input element with the ID attribute “doom”. The pages include information about users’ software obtained via JScript (OS and browser), to make them more convincing.

Phishing pages on Azure Blob Storage typically have a short lifespan. Attackers may host pages with redirects to phishing sites. With minimal suspicious content, these pages can evade detection slightly longer.

See the analysis session in the ANY.RUN sandbox.

*User’s credentials get stolen from fake sign-in form*

Threat actors leverage the *.blob.core.windows[.]net subdomain to store documents.
Company logos are extracted using email address parsing and loaded from the logo[.]clearbit[.]com service.
To collect and store stolen data, an HTTP POST request is sent to nocodeform[.]io for collecting form submissions.

*AI-generated summary of the attack in the sandbox*

Use the following Threat Intelligence Lookup query to find threats targeting the set of requested domains:

domainName:”.blob.core.windows.net” and domainName:”aadcdn.msauth.net” and domainName:”cdnjs.cloudflare.com” and domainName:”www.w3schools.com”

domainName:”.blob.core.windows.net” and domainName:”aadcdn.msauth.net” and domainName:”cdnjs.cloudflare.com” and domainName:”www.w3schools.com”

*See the Tasks tab in the search results for sandbox sessions with malicious URLs*

And this search request to find links to HTML pages hosted on Azure Blob Storage.

Microsoft’s OneDrive also fell victim to HTML Blob Smuggling Campaign

The original post on X

As in the attack above, threat actors make victims believe they are logging into a legitimate platform.

*Phishing page disguised as OneDrive login form*

Using ANYRUN’s MITM feature, we extracted base.js from the traffic and decoded it. The attack begins with a bait placed on OneDrive. After clicking the link, the user is redirected to the main page containing the HTML Blob Smuggling code. After entering their credentials, victims are redirected to a legitimate website.

Stolen credentials are sent via an HTTP POST request to the C2 server.

*Attack details: image sources, stolen data route*

The website’s design, background, and icons are stored on IPFS, while lure images, mimicking real services, are hosted on imgur .com.

View the attack unfold in the wild: one, other, or yet another sandbox session.

Phishing links in Microsoft Dynamics 365 web forms

Original post on X

And again, a Microsoft service utilized for malicious activity. Phishers create forms with embedded links on *.microsoft.com subdomains. The links that users receive look legitimate, so people feel safe opening them.

With TI Lookup, we uncovered a link that tricked users into attempting to access a non-existent PDF file hosted on a Microsoft website.

Phishing URL: hxxps://customervoice.microsoft[.]com/Pages/ResponsePage.aspx?id=N_pyUL0QJkeR_KiXHZsVlyTB1Qoy7S9IkE8Ogzl8coFUNVIzNlI5MEhCNlBPRFMwMklUV0JZVTkxVS4u

*Malicious page looks like a document hosted within Microsoft service*

Use this simple query for TI Lookup to find attacks employing this technique and view them unveiled in our sandbox.

*URLs engaged in the attack, found by TI Lookup*

Anatomy of a fresh LogoKit

Original post on X

LogoKit is a comprehensive set of phishing tools known for using services that offer logos and screenshots of target websites. Our team has researched the algorithm of such an attack.

*Icons, pictures, backgrounds, forms: LogoKit-powered fake page*

Let’s look at the example run in our sandbox.

The company’s logo is fetched from a legitimate logo storage service: hxxps://logo.clearbit[.]com/<Domain>.
The background is retrieved via request to a website screenshot service, using the following template: hxxps://thum[.]io/get/width/<DPI>/https://<Domain>.

The domain chain is led by a decoder-redirector: hxxps:// asiangrocers [.]store/fri/?haooauvpco=bWlubmllQGRpc25leS5jb20. It is a fake Asian food store website built on a #WordPress template, with a domain age of around four years. The template contains email addresses filled with typos.

The decoder-redirector shields the page from analysis and redirects the victim to the actual phishing page.

In our example, the real content of the phishing page and the associated scripts are hosted on the Cloudflare Pages platform. They are stored in the assets/ folder, which contains styles, images, and scripts

Three scripts with random 10-character names are designed to protect the page from analysis and send stolen data to the threat actors:

assets/js/e0nt7h8uiw[.]js
assets/js/vddq2ozyod[.]js
assets/js/j3046eqymn[.]js

The stolen authentication data is sent to a remote Command and Control server controlled by the attackers via an HTTP POST request containing the following parameters: fox=&con=

Manufacturers, beware: an attack combining Lumma and Amadey is targeting you

The cybercriminals’ tactics of attacking the manufacturing industry are recently evolving from data encryption to snatching control over critical infrastructure and stealing sensitive information.

The consequences of such attacks can be severe, leading to theft of intellectual property, disruption of operations, financial losses, and compliance violations. Businesses need to take the threat most seriously, understand it and get prepared.

*Attack used Emmenhtal loader to facilitate infection*

This December, we have analyzed a new attack aimed at industrial market players. The mechanics are based on Lumma Stealer and Amadey Bot. The former hunts for valuable information, the latter takes control over the infected systems. View analysis.

It all starts with phishing emails with URLs leading users to download LNK files disguised as PDFs;
The malicious LNK file, once activated, initiates PowerShell via an ssh.exe command. Following a chain of scripts, a CPL file is downloaded;
PowerShell and Windows Management Instrumentation (WMI) commands are utilized to collect detailed information about the victim’s system.

For the details, read our blog post, view analysis session in our sandbox and dive deeper with TI Lookup. Use the search query with the name of the threat and the path to one of the malicious files used in the attack.

About ANY.RUN

ANY.RUN helps more than 500,000 cybersecurity professionals worldwide. Our intera c tive sandbox simplifies malware analysis of threats that target both Windows and Linux systems. Our threat intelligence products, TI Lookup, YARA Search and Feeds, help you find IOCs or files to learn more about the threats and respond to incidents faster.

With ANY.RUN you can:

Detect malware in seconds
Interact with samples in real time
Save time and money on sandbox setup and maintenance
Record and study all aspects of malware behavior
Collaborate with your team
Scale as you need

Get 14-day free trial of ANY.RUN’s Interactive Sandbox →

The post 5 Major Cyber Attacks in December 2024 appeared first on ANY.RUN’s Cybersecurity Blog.

ANY.RUN’s Cybersecurity Blog – Read More

Crypto scam: seed phrases shared publicly | Kaspersky official blog

December 23, 2024/in Company Blogs

“I have a question. I have USDT stored in my wallet, and I have the seed phrase. How to transfer my funds to another wallet?” — we found a comment like this under a finance-related video on YouTube. And the seed phrase was revealed in full in the comment.

This looked suspicious: even a complete cryptocurrency beginner should know better than to share their seed phrase with the entire world. We were wary, and for a good reason — this comment turned out to be a scam.

Keep reading to find out what can go wrong if you somehow come across someone’s seed phrase…

“I give you the seed phrase, and you help me transfer my money to another wallet”

Let’s start with the basics. A seed phrase is a randomly generated unique sequence of dictionary words that together form a phrase needed to recover access to a cryptowallet. When someone shares their seed phrase — essentially the key to their wallet — it looks extremely suspicious. We then discovered similar comments, each containing the same recovery phrase and a request for help transferring funds to another platform. Notably, all these messages were posted from newly created accounts.

In similar comments written from newly created accounts, supposedly “crypto newbies” generously share their seed phrases

Now, let’s imagine for a second that someone reading one of these comments is a little unscrupulous and, instead of helping the newbie, decides to take a peek inside the wallet (after all, they have the key). Upon opening the wallet, they’re pleasantly surprised to find it stuffed with USDT: a TRC20 token on the TRON network tied to the value of the US dollar. The wallet contains the equivalent of eight thousand dollars. Well, what to do next? The correct answer would be to remember that there’s no such thing as a free lunch, and steer well clear of the wallet.

Finding several thousand US dollars in someone else’s wallet looks like a lucky chance to get rich for a immoral person

However, the scam assumes that our nefarious passerby will want to appropriate all or at least part of the cryptocurrency. But to withdraw USDT, a small fee must be paid in another currency: TRX (the TRON cryptocurrency token). Unfortunately, the wallet doesn’t have enough TRX, so the thief tries to transfer TRX from their own personal wallet — only to discover that the tokens they transferred immediately ended up in a completely different, third wallet.

The list of transactions details the scammers’ earnings

The catch is that the bait is set up as a multi-signature wallet. To authorize outgoing transactions in such wallets, approval from two or more people is required, so transferring USDT to a personal wallet won’t work — even after paying the “commission”.

So, the scammers are impersonating beginners who foolishly share access to their cryptowallets, tricking equally naive thieves — who end up becoming the victims. In this scenario, the scammers are something like digital Robin Hoods, as the scheme primarily targets other crooked individuals. But this twist is nothing new — we’ve previously covered a much more elegant crypto fraud scheme, also aimed at unprincipled people.

How to protect yourself from crypto scams

The way to protect against the above-described scam is quite simple: just be a decent person and don’t try to get into other people’s cryptowallets — even if the seed phrase is left in the comments of your favorite YouTube channel or even slipped under your front door.

In all other cases, crypto asset owners can follow these universal tips and recommendations:

Learn about the latest scams aimed at stealing cryptocurrency to stay aware of current trends.
Secure your devices with reliable protection.
Double-check any information received from strangers: scammers can pose both as beginners in the crypto world or as experienced trading sharks.

Kaspersky official blog – Read More

Top 10 Ransomware Trends Observed in 2024: A Look Ahead to 2025

December 23, 2024/in Company Blogs

Ransomware attacks have evolved into one of the most significant threats to global cybersecurity. These attacks have shifted from mere opportunistic schemes to advanced operations targeting businesses, critical infrastructure, and even governments. The year 2024 saw ransomware actors innovating at an unprecedented pace, leveraging new technologies and tactics to inflict maximum damage.

With ransomware incidents causing an average cost of $4.54 million per breach—excluding ransom payments—it is imperative for organizations to stay informed and prepared.

This article delves into the top 10 ransomware trends observed in 2024 and provides predictions for what lies ahead in 2025.

1. Double and Triple Extortion Schemes

In 2024, ransomware actors moved beyond simple file encryption to adopt double and triple extortion tactics. These methods involve not only encrypting a victim’s data but also exfiltrating it and threatening to release it publicly unless a ransom is paid. Triple extortion adds another dimension: threatening to disrupt business operations or targeting customers and third parties associated with the victim.

Example: A leading healthcare provider in the U.S. fell victim to a triple extortion scheme where attackers encrypted sensitive patient records, exfiltrated the data, and launched Distributed Denial of Service (DDoS) attacks until the ransom was paid. This resulted in financial losses and severe reputational damage.

Prediction for 2025: Expect these multi-layered extortion methods to become the norm as attackers seek greater leverage and higher payouts. Organizations will need to strengthen their data security measures and incident response plans to mitigate these risks.

2. Ransomware-as-a-Service (RaaS) Proliferation

The Ransomware-as-a-Service (RaaS) model gained significant traction in 2024, enabling even low-skilled cybercriminals to launch ransomware attacks. Under this model, ransomware developers provide affiliates with ready-to-use tools and infrastructure in exchange for a share of the profits.

Example: Groups like LockBit, BlackCat, and Play have turned RaaS into a booming industry, offering technical support, user manuals, and even marketing strategies to affiliates.

Prediction for 2025: The RaaS ecosystem will expand further, with more criminal groups entering the market. This will likely result in a surge in ransomware incidents targeting small and medium-sized businesses (SMBs) that lack advanced cybersecurity defenses.

3. Data Exfiltration as a Standard Tactic

Stealing sensitive data before encrypting systems has become a standard tactic in ransomware operations. This not only increases the ransom demand but also amplifies the reputational and regulatory consequences for victims.

Example: In 2024, a global financial institution faced a ransomware attack where attackers exfiltrated millions of customer records. The breach led to legal consequences and a loss of customer trust, despite the organization’s efforts to recover.

Prediction for 2025: With stricter data privacy regulations like GDPR and CCPA, data exfiltration attacks will pose an even greater risk. Organizations will need to implement stronger encryption and data loss prevention (DLP) solutions to counteract these threats.

4. Zero-Day Exploits and Advanced Phishing

Ransomware groups are increasingly using zero-day vulnerabilities and highly targeted phishing campaigns to gain initial access to victim networks.

Example: In 2024, a large technology company was breached when employees fell for an advanced phishing email disguised as a legitimate communication from a trusted vendor. The attackers exploited a zero-day vulnerability to deploy ransomware, causing significant operational downtime.

Prediction for 2025: As more organizations adopt digital transformation initiatives, the attack surface for ransomware groups will expand. Expect more zero-day exploits and socially engineered phishing campaigns aimed at high-value targets.

5. Living Off the Land (LotL) Techniques

Ransomware actors are employing Living Off the Land (LotL) techniques to evade detection by using legitimate tools and processes already present in the victim’s network.

Example: In a 2024 attack on a healthcare organization, attackers used PowerShell and Remote Desktop Protocol (RDP) to move laterally within the network without triggering traditional security alarms.

Prediction for 2025: LotL techniques will become more prevalent, making it essential for organizations to implement advanced endpoint detection and response (EDR) solutions and conduct regular audits of privileged accounts.

6. Critical Infrastructure as a Prime Target

Critical infrastructure sectors, including healthcare, energy, and government, have become top targets for ransomware groups. These sectors often lack strong cybersecurity defenses, making them vulnerable to attacks with far-reaching consequences.

Example: In 2024, a North American energy provider suffered a ransomware attack that caused widespread power outages and operational disruptions.

Prediction for 2025: With geopolitical tensions on the rise, ransomware attacks on critical infrastructure are expected to increase. Governments and private sectors will need to collaborate on improving the resilience of these essential systems.

7. Industrial Ransomware Targeting Manufacturing

The manufacturing and industrial sectors have seen a rise in ransomware attacks, disrupting production lines and supply chains.

Example: In 2024, a global automotive manufacturer was hit by ransomware that halted production for weeks, leading to millions in losses and delayed product deliveries.

Prediction for 2025: As industrial control systems (ICS) and IoT devices become more interconnected, ransomware targeting these environments will grow. Organizations must prioritize securing operational technology (OT) networks.

8. Decline in Average Ransom Payment but Higher Incident Costs

While the average ransom payment dropped from $850,000 to $569,000 in 2024, the overall cost of ransomware incidents has risen due to operational disruptions, data recovery expenses, and reputational damage.

Example: A mid-sized retail company paid a lower ransom in 2024 but incurred over $3 million in total costs due to lost sales, customer churn, and recovery efforts.

Prediction for 2025: Organizations may see lower ransom demands, but the indirect costs of ransomware attacks will continue to climb. This highlights the importance of proactive defenses and comprehensive incident response plans.

9. Evolving Ransomware Variants

New ransomware variants with enhanced capabilities emerged in 2024, including Akira and BlackCat, which feature advanced encryption and stealth techniques.

Example: Akira ransomware targeted a European bank, using multi-layered encryption that rendered recovery nearly impossible without paying the ransom.

Prediction for 2025: Ransomware variants will continue to evolve, focusing on bypassing traditional defenses and targeting cloud environments and hybrid work setups.

10. Increased International Collaboration and Crackdowns

Law enforcement agencies and cybersecurity organizations have intensified their efforts to combat ransomware through international collaboration. In 2024, several high-profile ransomware groups were dismantled, and stolen funds were recovered.

Example: A joint operation by the FBI and Europol in 2024 disrupted a major ransomware operation, recovering $20 million in ransom payments.

Prediction for 2025: While these crackdowns are promising, ransomware groups will adapt and find new ways to evade law enforcement. Continued international collaboration will be critical to countering these threats.

Looking Ahead to 2025

As we move into 2025, the ransomware landscape will continue to evolve. Here are some key predictions:

AI-Powered Ransomware: Attackers will leverage artificial intelligence to automate ransomware campaigns and improve phishing success rates.

Focus on Cloud Environments: With more businesses migrating to the cloud, ransomware groups will target cloud-native applications and services.

Stricter Regulations: Governments will implement more stringent reporting and compliance requirements for ransomware incidents.

Cyber Insurance Challenges: The cost of cyber insurance will rise, with stricter conditions for coverage related to ransomware.

Post-Attack Recovery Services: Organizations will invest more in post-attack recovery services, such as takedown solutions and data restoration.

To Sum Up

The ransomware trends of 2024 highlight threat actors‘ adaptability and ingenuity. To stay ahead of these evolving threats, organizations must adopt a proactive approach, including strong cybersecurity measures, employee awareness programs, and collaborative efforts with industry peers and law enforcement.

By understanding the tactics and strategies employed by ransomware groups, businesses can better prepare for the challenges that lie ahead in 2025 and beyond.

Source:

https://cyble.com/knowledge-hub/ransomware-tactics-adopted-by-threat-actors-in-2024/

https://www.statista.com/topics/4136/ransomware/#topicOverview

Monthly Ransomware Threat Intelligence 2027.pdf

The post Top 10 Ransomware Trends Observed in 2024: A Look Ahead to 2025 appeared first on Cyble.

Blog – Cyble – Read More