Cyber Briefing: 2024.04.29

Cyber Briefing: 2024.04.29

?? What's happening in cybersecurity today?

Okta , Credential Stuffing, Proxy Services, Cactus Ransomware Gang, Qlik Servers, Microsoft Office 365 , Ukraine, Dev Popper, Fake Job Offers, RAT, Chrome 124, Web Connection Issues, Coffee County, Voter System London Drugs, FBCS , ICICI Bank , Credit Card Details, BenefitsCal, Welfare Accounts, U.S. Department of Homeland Security , AI Safety Board, UK Law, Cybersecurity Standards, IoT Devices, Meta , WhatsApp, India, Privacy, Vulnerabilities, 微软 Products, ICSpector, Industrial Cybersecurity



?Welcome to Cyber Briefing , the newsletter that informs you about the latest cybersecurity advisories, alerts, incidents and news every weekday.

First time seeing this? Please subscribe .



?? Cyber Alerts


1. Okta Flags Rise in Credential Attacks

Okta, a leading provider of Identity and Access Management (IAM) services, has issued an alert about a significant increase in credential stuffing attacks targeting online services. These attacks utilize residential proxy services, stolen credential lists, and sophisticated scripting tools, escalating in frequency and scale over the past month. Alongside reinforcing user security measures like strong passwords and two-factor authentication, Okta's findings align with a broader trend noted by Cisco's advisory of increased global brute-force attacks since mid-March 2024.


2. Cactus Ransomware Hits Qlik Servers

Since November 2023, the Cactus ransomware gang has exploited multiple vulnerabilities in Qlik Sense servers, including CVE-2023-41266, CVE-2023-41265, and CVE-2023-48365. Despite security advisories issued by Qlik, over 3,100 servers remain exposed and susceptible to these attacks. Cybersecurity teams can identify at-risk servers using tools like Nuclei templates or by querying specific server details through the "product-info.json" file, as ongoing monitoring reveals a concerning number of compromised systems globally.


3. Old Office Flaw Exploited in Ukraine Attack

Cybersecurity researchers have uncovered a targeted cyber operation against Ukraine that utilizes a seven-year-old vulnerability in Microsoft Office to deliver the Cobalt Strike malware via compromised systems. The attack, identified towards the end of 2023, begins with a PowerPoint slideshow file suspected to be distributed through Signal, a messaging app previously exploited for similar purposes. Although there's no concrete evidence linking the distribution of the malware-laden file to Signal directly, the filename suggests a possible connection.


4. Dev Popper Uses Fake Jobs to Spread RAT

The "Dev Popper" campaign is deceitfully targeting software developers with fraudulent job interviews to distribute a Python remote access trojan (RAT). Attackers engage candidates under the guise of legitimate job offers, instructing them to download and execute code from a GitHub repository as part of the interview process. This multi-stage infection involves downloading a seemingly harmless NPM package that secretly contains malicious scripts designed to compromise the developer’s system and enable attackers to gain remote access and data exfiltration capabilities.


5. Chrome 124 Update Causes Web Connection Woes

Following the release of Google Chrome 124, which includes the new quantum-resistant X25519Kyber768 encapsulation mechanism, some users are experiencing connectivity issues with websites, servers, and firewalls. This new version, which uses the Kyber768 algorithm for securing TLS 1.3 and QUIC connections, aims to protect against future quantum cryptanalysis threats. However, this upgrade has inadvertently caused disruptions for some web applications and security devices due to servers not recognizing or properly handling the expanded ClientHello messages needed for post-quantum cryptography.



?? Cyber Incidents


6. Coffee County Cuts Voter System After Hack

Georgia's Coffee County recently faced a ransomware attack, prompting officials to disconnect from the state's voter registration system, GARViS, as a precaution. The attack was identified by the federal Cybersecurity and Infrastructure Security Agency (CISA) on April 15, leading to ongoing investigations to determine the perpetrators. Although there was no direct breach of the GARViS system, the county took measures to ensure voter data security, temporarily using backup laptops and isolated networks for connectivity.


7. London Drugs Stores Close After Cyber Hit

London Drugs, a prominent retail and pharmacy chain in Western Canada, temporarily closed all its stores due to a cybersecurity incident that occurred on Sunday. The company, headquartered in British Columbia, emphasized that the closure was a precautionary measure and reassured that there was no indication of customer or employee data being compromised. While the stores remain closed, the company's pharmacists are available to assist with urgent needs, and London Drugs has engaged third-party experts to address and investigate the issue thoroughly.


8. FBCS Data Breach Affects 2 Million People

Financial Business and Consumer Solutions (FBCS), a debt collection agency, recently disclosed a data breach impacting approximately 2 million individuals. Discovered on February 26, 2024, the breach involved unauthorized access to certain systems, with sensitive data such as Social Security numbers and account information potentially compromised. FBCS has initiated free credit monitoring for affected individuals and is working with third-party forensics specialists to further secure their systems and understand the full extent of the breach.


9. ICICI Bank Glitch Exposes Credit Card Info

ICICI Bank, a prominent private bank in India, inadvertently exposed the sensitive data of thousands of new credit cards due to a glitch in its mobile banking app, 'iMobile.' The error resulted in customers accessing credit card details, such as card numbers, expiry dates, and CVVs, of other users. In response, the bank has blocked 17,000 affected cards and is reissuing new ones to ensure customer security, promising compensation for any potential financial loss.


10. California Welfare Accounts Breached by Hack

Over 19,000 online accounts on BenefitsCal, a California state platform that handles welfare programs, were compromised due to reused passwords. The breach occurred between March 1, 2023, and February 13, 2024, with unauthorized access detected on February 9, 2024. In response, BenefitsCal deactivated affected accounts and introduced additional security measures, including 2FA and mandatory multi-factor authentication during login, to enhance protection against future cyber threats.



?? Cyber News


11. DHS Forms AI Safety Board with Top Execs

The Department of Homeland Security (DHS) has established a new Artificial Intelligence Safety and Security Board, aimed at steering the safe implementation of AI technologies within U.S. critical infrastructure sectors. DHS Secretary Alejandro Mayorkas highlighted that the board, featuring leaders from OpenAI, Microsoft, Nvidia, and IBM, will develop practical guidelines for responsible AI use across sectors such as defense, energy, and IT. The board's formation, directed by President Joe Biden, includes industry CEOs, government figures, and civil rights advocates, and is set to meet quarterly starting in May to address AI's security risks and opportunities.


12. UK Law Sets Cyber Rules for IoT Devices

Starting April 29, a new UK law under the Product Security and Telecommunications Infrastructure (PSTI) Act will mandate IoT manufacturers, retailers, and importers to adhere to basic cybersecurity practices. This legislation requires that IoT products do not come with default passwords, offer a way to report vulnerabilities, and disclose the duration of security support. Violations of these new standards could result in fines up to £10 million or 4% of global annual revenue, aiming to boost security for devices like smart speakers, cameras, and more.


13. Meta May Exit India Over Privacy Demands

Meta has announced that it might discontinue WhatsApp services in India if the government persists in demanding changes to its encryption and user data policies. Representing WhatsApp, Tejas Karia argued in the Delhi High Court against the 2021 IT rules that require social media to trace the origin of messages, stating this would violate privacy by necessitating the decryption and storage of millions of messages. The Indian government insists these measures are crucial for combating fake news and hate speech, but Meta emphasizes that such regulations threaten the core privacy guarantees that define their service.


14. 2023 Sees 1200+ Microsoft Product Flaws

In 2023, cybersecurity experts at BeyondTrust identified 1,228 vulnerabilities in Microsoft products, a slight decrease from previous years but still significant given Microsoft's extensive use in both corporate and personal environments. Windows, Edge, Office, and Windows Server remained key areas of concern, with critical vulnerabilities in Windows and Windows Server notably impactful. Despite the overall reduction, new types of vulnerabilities like Denial of Service and spoofing saw sharp increases, indicating evolving threats even as Microsoft continues to secure its products by retiring older, less secure versions and embracing more robust technologies.


15. Microsoft Debuts ICSpector for Cybersecurity

Microsoft has introduced ICSpector, an open-source security tool designed to enhance threat analysis in industrial control systems amid rising nation-state attacks on critical infrastructure. The tool, which operates on an open-source framework, focuses on examining programmable logic controllers (PLCs) essential for operating utilities like water and power grids. Available on GitHub, ICSpector aids in detecting malicious modifications, extracting modification timestamps, and outlining task execution flows, thereby bolstering defenses against sophisticated cyber threats targeting operational technology.



Subscribe and Comment.

Copyright ? 2024 CyberMaterial . All Rights Reserved.

Follow CyberMaterial on:

LinkedIn , Twitter , Reddit , Instagram , Facebook , YouTube , and Medium .




Ralph Kachur

President of ROATI Technologies Inc. | 30+ Years in Electronic Components

7 个月

Industry continues to believe in talking to cyber experts, who continually design systems which continually get hacked. Am the only one who sees the lunacy in this. For a new malware protection discovery in need of support. ROATI.com/bio ROATI.com/factsheet Ralph Kachur (905) 846-1233

回复

要查看或添加评论,请登录

CyberMaterial的更多文章

社区洞察

其他会员也浏览了