Link: https://www.aljazeera.com/news/2024/3/26/new-zealand-says-chinese-state-sponsored-group-hacked-parliament
Summary: New Zealand, supported by the US and UK, has accused Chinese state-sponsored hackers of infiltrating its parliament, prompting the Foreign Minister Winston Peters to denounce the cyberattack as “unacceptable” and convey concerns directly to Beijing. Despite acknowledging a significant relationship with China, Peters emphasized New Zealand’s stance on speaking out against concerning behaviors. The Government Communications Security Bureau attributed the cyber intrusion to a state-backed hacking group known as “APT40,” linking it confidently to the People’s Republic of China. In response, the Chinese Embassy in New Zealand labeled the allegations as “groundless and irresponsible.” The incident follows similar accusations by the US and UK, prompting New Zealand’s Defence Minister Judith Collins to stress the importance of robust cybersecurity measures in light of such threats.
This article by CSO outlines how crucial cybersecurity changes within an organization can have an impact on company earnings. According to Diligent, the institution of effective cybersecurity controls and architecture can increase shareholder earnings by as much as 372% . I think this is an important topic to focus on, as while we often cover the negative impacts of insufficient IT, it’s important to specify and outline for admins and those at the top of organizations that cybersecurity has great benefits as well. Increasing financial earnings of the organization or shareholders should provide ample reason to fund and ensure that a robust cybersecurity department is employed within an organization as a whole.
A new phishing-as-a-service named ‘Darcula” utilizing 20,000 domains for spoofing brands has been spotted rising in popularity. This platform has been used against various services and organizations in the world, offering fraudsters 200+ templates to choose to attack. The platform utilizes RCS protocols for Google Messages and iMessage instead of SMS to send phishing messages.
The platform was first documented last summer but has now become more popular and prevalent in high-profile cases. The platform allows for continuous updates and features through JS, React, Docker, and Harbor to feed updated templates for malicious actors to use. Threat actors using the service select a brand and run the setup script which installs a phishing site and management through Docker. At least 20,000 domains across 11,000 IPs are linked to the service with 120 new domains being added daily, making it difficult to continuously shut down existing domains. The service uses RCS and iMessage phishing messages instead of through SMS so that messages are more likely to go through and be considered legitimate. However, there are some restrictions such as message limits and rooted Android devices not being able to send/receive RCS messages; but, these services are finding ways around through multiple Apple IDs or similar procedures. In general, be careful when receiving messages and be especially careful of unknown or suspicious messages.
Article: US offers $10 million bounty for info on ‘Blackcat’ hackers who hit UnitedHealth
Sequel to the cyberattack on UnitedHealth Group’s tech unit, Change Healthcare, the U.S. State Department has announced a reward of up to $10 million for information leading to the apprehension of the “Blackcat” ransomware gang. This attack disrupted insurance payments across the country and impacted critical infrastructure sectors globally. UnitedHealth is addressing a medical claims backlog of over $14 billion resulting from the attack, which has affected patients, doctors, and community health centers serving millions of uninsured individuals. Although reports suggest UnitedHealth paid a $22 million ransom, it remains unclear if the hackers, Blackcat, fulfilled their end of the deal.
Link: https://www.reuters.com/technology/cybersecurity/us-offers-10-million-bounty-info-blackcat-hackers-who-hit-unitedhealth-2024-03-27/
CDFA hack exposes usernames and passwords
California Department of Food and Agriculture (CDFA) experienced a security incident on March 4th that exposed sensitive and personal details to “external users. The breach exposed personally identifiable information (PII) such as names and last names, addresses, phone numbers, and email addresses, as well as the site’s users’ usernames and passwords. CDFA advised users to change their password to prevent unauthorized access.
I tried to find the cause of the attack or who was behind it, but I could not find any information.
AT&T has acknowledged a significant data breach that affected 73 million customers after data appeared on a hacker forum. Initially denying the data’s origin, AT&T’s confirmation highlights a substantial security lapse affecting many current and former customers. This event underscores the ongoing challenges in safeguarding personal information in the digital age.
I found this interesting article about data protection and why it is important.
It talks about the principle and purpose of data protection, data portability, disaster recovery and back ups, enterprise data protection strategies amongst others.
Veeam moves HQ to Seattle area, tops $1.5B in recurring revenue (geekwire.com)
Veeam moves HQ to Seattle area, tops $1.5B in recurring revenue (geekwire.com)
This article goes over how Veeam, a data protection giant, is moving its HQ from Ohio to Seattle. Veeam r4eecently just joined a five – yar partnership with Microsoft to develop AI services while integrating Veeam’s products with Microsoft Copilot and other AI services and also selling Veeam Data Cloud with Microsoft 365 and Azure. Their goal is to be in close proximity of the other data giants in the area which wills strengthen relationships but also become more significant to adoption. I feel that you will see in the next ten years, this company being bought out my Microsoft.
AT&T data breach overview:
Who: A hacker released around 73 million AT&T customers’ personal data nearly three years after claiming to have stolen it.
Why: The dataset includes names, home addresses, phone numbers, Social Security numbers and birthdates.
Where: The AT&T data breach affects consumers nationwide.
A hacker leaked around 73 million AT&T customers’ personal information nearly three years after claiming the theft.
Several malicious Android apps that turn mobile devices running the operating system into residential proxies (RESIPs) for other threat actors have been observed on the Google Play Store. There were up to 29 applications that was in question. Google has since removed the questionable apps.
“Massive Phishing Campaign Strikes Latin America: Venom RAT Targeting Multiple Sectors”
TA558, a threat actor active since 2018, has launched a large phishing campaign across various sectors in Latin America and other regions to deploy Venom RAT, a malware that steals sensitive data and controls systems remotely. This campaign particularly affects industries in Spain, Mexico, the United States, Colombia, Portugal, Brazil, the Dominican Republic, and Argentina. Besides, cybersecurity researchers have observed increased use of DarkGate malware loader and various other malware types post-QakBot’s takedown, targeting financial institutions in Europe and the U.S. Additionally, a surge in video malvertising attacks has been noted, where ScamClub has been actively redirecting users to scam pages through video ads, mostly affecting users in the U.S. and other countries.
URL: https://thehackernews.com/2024/04/massive-phishing-campaign-strikes-latin.html
This article was interesting to me because it would be assumed that Microsoft, of all companies, would be at the top of their game in terms of cybersecurity. However according to this article, a government advisory board released a report stating that an attack Microsoft faced was preventable. The article states that in July of last year, hackers associated with the Chinese government were found in the cloud networks of Microsoft, going through email boxes of numerous organizations. This article shows how politics can interfere with cybersecurity even if you are associated with a corporation.
Google is testing a new Chrome feature called Device Bound Session Credentials (DBSC) to counter session cookie theft by malware, aiming to disrupt the cookie theft industry by binding authentication sessions to the device. DBSC aims to disrupt cookie theft by binding authentication sessions to the device, making cookie exfiltration less valuable to attackers. Implemented via an API, DBSC uses cryptographic methods to tie sessions to device-specific public keys stored locally on the device, enhancing security against session hijacking techniques. The initiative aligns with Google’s broader efforts to enhance user security, complementing plans to phase out third-party cookies and engaging with server providers, identity providers, and other browser vendors to expand DBSC’s adoption.
Link: https://www.aljazeera.com/news/2024/3/26/new-zealand-says-chinese-state-sponsored-group-hacked-parliament
Summary: New Zealand, supported by the US and UK, has accused Chinese state-sponsored hackers of infiltrating its parliament, prompting the Foreign Minister Winston Peters to denounce the cyberattack as “unacceptable” and convey concerns directly to Beijing. Despite acknowledging a significant relationship with China, Peters emphasized New Zealand’s stance on speaking out against concerning behaviors. The Government Communications Security Bureau attributed the cyber intrusion to a state-backed hacking group known as “APT40,” linking it confidently to the People’s Republic of China. In response, the Chinese Embassy in New Zealand labeled the allegations as “groundless and irresponsible.” The incident follows similar accusations by the US and UK, prompting New Zealand’s Defence Minister Judith Collins to stress the importance of robust cybersecurity measures in light of such threats.
Article: Report suggests cybersecurity investment, board involvement linked to better shareholder returns
This article by CSO outlines how crucial cybersecurity changes within an organization can have an impact on company earnings. According to Diligent, the institution of effective cybersecurity controls and architecture can increase shareholder earnings by as much as 372% . I think this is an important topic to focus on, as while we often cover the negative impacts of insufficient IT, it’s important to specify and outline for admins and those at the top of organizations that cybersecurity has great benefits as well. Increasing financial earnings of the organization or shareholders should provide ample reason to fund and ensure that a robust cybersecurity department is employed within an organization as a whole.
Link: https://www.csoonline.com/article/2075262/report-suggests-cybersecurity-investment-board-involvement-linked-to-better-shareholder-returns.html
A new phishing-as-a-service named ‘Darcula” utilizing 20,000 domains for spoofing brands has been spotted rising in popularity. This platform has been used against various services and organizations in the world, offering fraudsters 200+ templates to choose to attack. The platform utilizes RCS protocols for Google Messages and iMessage instead of SMS to send phishing messages.
The platform was first documented last summer but has now become more popular and prevalent in high-profile cases. The platform allows for continuous updates and features through JS, React, Docker, and Harbor to feed updated templates for malicious actors to use. Threat actors using the service select a brand and run the setup script which installs a phishing site and management through Docker. At least 20,000 domains across 11,000 IPs are linked to the service with 120 new domains being added daily, making it difficult to continuously shut down existing domains. The service uses RCS and iMessage phishing messages instead of through SMS so that messages are more likely to go through and be considered legitimate. However, there are some restrictions such as message limits and rooted Android devices not being able to send/receive RCS messages; but, these services are finding ways around through multiple Apple IDs or similar procedures. In general, be careful when receiving messages and be especially careful of unknown or suspicious messages.
https://www.bleepingcomputer.com/news/security/new-darcula-phishing-service-targets-iphone-users-via-imessage/
Article: US offers $10 million bounty for info on ‘Blackcat’ hackers who hit UnitedHealth
Sequel to the cyberattack on UnitedHealth Group’s tech unit, Change Healthcare, the U.S. State Department has announced a reward of up to $10 million for information leading to the apprehension of the “Blackcat” ransomware gang. This attack disrupted insurance payments across the country and impacted critical infrastructure sectors globally. UnitedHealth is addressing a medical claims backlog of over $14 billion resulting from the attack, which has affected patients, doctors, and community health centers serving millions of uninsured individuals. Although reports suggest UnitedHealth paid a $22 million ransom, it remains unclear if the hackers, Blackcat, fulfilled their end of the deal.
Link: https://www.reuters.com/technology/cybersecurity/us-offers-10-million-bounty-info-blackcat-hackers-who-hit-unitedhealth-2024-03-27/
State Department offers $10M reward for information on BlackCat hackers. The State Department has issued a reward for information that could help identify or locate people working with BlackCat or ALPHV, the cybercriminal gang behind the attack on Change Healthcare’s systems.
https://thehill.com/policy/healthcare/4560115-state-department-offers-10-million-reward-for-info-on-unitedhealthcare-hackers/
I realize another student, Chidiebere Okafor actually posted this same breach before me, I had to repost another 0ne.
CDFA hack exposes usernames and passwords
California Department of Food and Agriculture (CDFA) experienced a security incident on March 4th that exposed sensitive and personal details to “external users. The breach exposed personally identifiable information (PII) such as names and last names, addresses, phone numbers, and email addresses, as well as the site’s users’ usernames and passwords. CDFA advised users to change their password to prevent unauthorized access.
I tried to find the cause of the attack or who was behind it, but I could not find any information.
https://cybernews.com/news/california-department-food-agriculture-breach/
https://www.bleepingcomputer.com/tag/data-breach
AT&T has acknowledged a significant data breach that affected 73 million customers after data appeared on a hacker forum. Initially denying the data’s origin, AT&T’s confirmation highlights a substantial security lapse affecting many current and former customers. This event underscores the ongoing challenges in safeguarding personal information in the digital age.
I found this interesting article about data protection and why it is important.
It talks about the principle and purpose of data protection, data portability, disaster recovery and back ups, enterprise data protection strategies amongst others.
https://www.techtarget.com/searchdatabackup/definition/data-protection
https://www.geekwire.com/2024/data-protection-giant-veeam-moves-hq-to-seattle-region-tops-1-5b-in-annual-recurring-revenue/
Veeam moves HQ to Seattle area, tops $1.5B in recurring revenue (geekwire.com)
Veeam moves HQ to Seattle area, tops $1.5B in recurring revenue (geekwire.com)
This article goes over how Veeam, a data protection giant, is moving its HQ from Ohio to Seattle. Veeam r4eecently just joined a five – yar partnership with Microsoft to develop AI services while integrating Veeam’s products with Microsoft Copilot and other AI services and also selling Veeam Data Cloud with Microsoft 365 and Azure. Their goal is to be in close proximity of the other data giants in the area which wills strengthen relationships but also become more significant to adoption. I feel that you will see in the next ten years, this company being bought out my Microsoft.
Saudi Arabia, UAE Top List of APT-Targeted Nations in the Middle East
Government, manufacturing, and the energy industry are the top targets of advanced, persistent threat actors, with phishing attacks and remote exploits the most common vectors.
https://www.bing.com/search?pglt=41&q=Soudi+Arabia%2C+UAE+top+list+of+APT+targeted+in+the+middle+east&cvid=570cb2f613e04f4cba5f86524005ff92&gs_lcrp=EgZjaHJvbWUyBggAEEUYOdIBCTY0NjkyajBqMagCALACAA&FORM=ANNTA1&PC=HCTS
AT&T data breach overview:
Who: A hacker released around 73 million AT&T customers’ personal data nearly three years after claiming to have stolen it.
Why: The dataset includes names, home addresses, phone numbers, Social Security numbers and birthdates.
Where: The AT&T data breach affects consumers nationwide.
A hacker leaked around 73 million AT&T customers’ personal information nearly three years after claiming the theft.
https://topclassactions.com/lawsuit-settlements/privacy/data-breach/data-of-73m-att-customers-leaked-online/
Erskine Payton
In the News Article- Week 11
MIS 5214
Temple University
Malicious Apps Caught Secretly Turning Android Phones into Proxies for Cybercriminals
https://thehackernews.com/2024/04/malicious-apps-caught-secretly-turning.html?m=1
Several malicious Android apps that turn mobile devices running the operating system into residential proxies (RESIPs) for other threat actors have been observed on the Google Play Store. There were up to 29 applications that was in question. Google has since removed the questionable apps.
“Massive Phishing Campaign Strikes Latin America: Venom RAT Targeting Multiple Sectors”
TA558, a threat actor active since 2018, has launched a large phishing campaign across various sectors in Latin America and other regions to deploy Venom RAT, a malware that steals sensitive data and controls systems remotely. This campaign particularly affects industries in Spain, Mexico, the United States, Colombia, Portugal, Brazil, the Dominican Republic, and Argentina. Besides, cybersecurity researchers have observed increased use of DarkGate malware loader and various other malware types post-QakBot’s takedown, targeting financial institutions in Europe and the U.S. Additionally, a surge in video malvertising attacks has been noted, where ScamClub has been actively redirecting users to scam pages through video ads, mostly affecting users in the U.S. and other countries.
URL: https://thehackernews.com/2024/04/massive-phishing-campaign-strikes-latin.html
https://www.axios.com/2024/04/03/microsoft-security-practices-government-review
This article was interesting to me because it would be assumed that Microsoft, of all companies, would be at the top of their game in terms of cybersecurity. However according to this article, a government advisory board released a report stating that an attack Microsoft faced was preventable. The article states that in July of last year, hackers associated with the Chinese government were found in the cloud networks of Microsoft, going through email boxes of numerous organizations. This article shows how politics can interfere with cybersecurity even if you are associated with a corporation.
Google Chrome Beta Tests New DBSC Protection Against Cookie-Stealing Attacks
https://thehackernews.com/2024/04/google-chrome-beta-tests-new-dbsc.html
Google is testing a new Chrome feature called Device Bound Session Credentials (DBSC) to counter session cookie theft by malware, aiming to disrupt the cookie theft industry by binding authentication sessions to the device. DBSC aims to disrupt cookie theft by binding authentication sessions to the device, making cookie exfiltration less valuable to attackers. Implemented via an API, DBSC uses cryptographic methods to tie sessions to device-specific public keys stored locally on the device, enhancing security against session hijacking techniques. The initiative aligns with Google’s broader efforts to enhance user security, complementing plans to phase out third-party cookies and engaging with server providers, identity providers, and other browser vendors to expand DBSC’s adoption.