Get information on recent vulnerabilities, malware and breaches being tracked by Critical Start’s Cyber Threat Intelligence (CTI), part of our Cyber Research Unit (CRU).
Public-facing applications have become a major vulnerability, with web app exploits leading to 30 catastrophic incidents and $5.7 billion in losses. As threat actors increasingly target these applications and associated cloud infrastructure, organizations must prioritize robust protection strategies.
The rapid rise of IoT devices is a double-edged sword. While it unlocks a wave of innovation across industries, it also introduces significant security risks. Transportation, for instance, grapples with hackable ELDs in trucks, potentially compromising data and even vehicle control (as evidenced by the March 2024 ELD vulnerabilities).
ShadowSyndicate is actively scanning the internet for servers running outdated versions of aiohttp, exploiting the publicly available CVE-2024-23334 proof-of-concept. By targeting sensitive files and gaining unauthorized access, they can potentially deploy ransomware payloads, highlighting the critical importance of timely patching and robust cybersecurity measures.
While memory-safe languages like Rust offer security benefits, they also attract cybercriminals. The growing Rust community and resources potentially make it easier for attackers to develop sophisticated, hard-to-detect malware.
The shared responsibility model and remote data storage in cloud computing create security gaps. Misconfigurations and innovative hacker tactics leave data vulnerable, demanding proactive, compliant defense strategies from organizations.
Browser-based phishing attacks rose 198% in the second half of 2023, with evasive techniques now accounting for 30% of attempts. Adapting defenses is crucial to counter these evolving threats.
As the world gears up for a pivotal year of elections in 2024, an unprecedented surge in malicious cyber activity threatens the integrity of democratic processes. With cyberattacks targeting elections skyrocketing from 10% in 2015 to a staggering 26% in 2022, nation-states are increasingly seeking to influence outcomes, particularly in NATO and OECD countries. This report delves into the alarming 100% rise in malicious activity observed between 2023 and early 2024, underlining the urgent need for robust cybersecurity measures to safeguard the sanctity of elections worldwide.
Separately, Palo Alto Networks issued an informational security advisory discussing Rorschach ransomware operators using the Cortex XDR Dump Service Tool (cydump.exe) to load untrusted dynamic link libraries (DLLs) using DLL-sideloading. This is true only when the tool is removed from its installation directory; it is not possible to side-load DLLs when Cortex XDR agent is installed on Windows and is running from the installation path because Cortex XDR’s security permissions and protections prevent it. In the advisory, Palo Alto verified that Cortex XDR 7.7, and newer versions, with content update version 240 (released Nov 2021), and later content updates, detect and block the ransomware. New versions of Cortex XDR agent, capable of blocking the DLL side-loading technique, will be released next week to prevent future misuse of the software. Mac OS and Linux platforms are not affected by this issue.
—
Security researchers have discovered a new ransomware strain, called Rorschach, with unique technical features. The malware is deployed using the dynamic link library (DLL) side-loading technique via a signed component in Cortex XDR, a threat detection and incident response tool from Palo Alto Networks.
Recently, several malware operators have been spotted using OneNote attachments in their spam campaigns. OneNote is a powerful digital notebook tool offered by Microsoft. It provides users with a centralized location to store their thoughts, ideas, and notes in an organized manner. Cyber criminals have started new phishing campaigns delivering malicious OneNote attachments that deliver Formbook, Redline Stealer, AsyncRat or Qbot malware to unsuspecting victims.
State-sponsored hackers are exploiting AI tools like OpenAI for attacks. Defenses currently lag in countering these AI advancements, signaling an urgent need for innovation.
The Akira ransomware is exploiting a high-severity vulnerability in Cisco ASA/FTD software. The flaw enables access for gathering sensitive data, underscoring the need for strong vulnerability management.
New SEC regulations demand timely reporting of cyber incidents, seeking to enhance investor confidence. Organizations must proactively strengthen defenses and ensure compliance to mitigate risks from sophisticated attacks.
The education sector contains valuable sensitive data that makes it an attractive target for cybercriminals seeking financial gain or strategic advantage, and as educational institutions digitize teaching and operations, their attack surface and vulnerability expands, necessitating vigilant cybersecurity measures.
New SEC regulations demand timely reporting of cyber incidents, seeking to enhance investor confidence. Organizations must proactively strengthen defenses and ensure compliance to mitigate risks from sophisticated attacks.
Security risks have surged with the integration of APIs in modern software development, making proactive defense strategies crucial. This situation calls for advanced measures to counteract sophisticated API attacks, which are essential for maintaining operational integrity and protecting against reputational harm.
Cybercriminals increasingly target business communication platforms like email and chat apps, attracted by sensitive data and infrastructure vulnerabilities. Organizations must prioritize security to safeguard information.
The ingenious BianLian ransomware distinguishes itself through perpetual adaptation across platforms, strategic targeting, and technical sophistication. By examining this formidable threat that evolves from Android banking trojan to ransomware, this resource equips organizations with insights on shoring up defenses, enhancing detection, and thwarting the attacks of this metamorphic foe.
The exploitation of an Okta breach to infiltrate Cloudflare’s systems exposes sobering supply chain vulnerabilities. Though customer data was spared, the attackers accessed internal tools and source code by compromising a critical supplier. This resource examines crucial security takeaways regarding network segmentation, least privilege protections, and enhanced monitoring to safeguard against adjacent supplier risk.
Insider threats surged an astounding 76% in 2023, yet only 30% of companies feel ready to handle them and 21% have comprehensive programs. This alarming gap reveals organizational vulnerability to internal breach, IP theft, and sabotage. By detailing a proactive framework across detection, access controls, and culture shifts, this report provides a blueprint for mitigating escalating insider threat risk.
DDoS attacks skyrocketed 31% in early 2023, inundating 44,000 servers daily. This report explores the perfect storm fueling the alarming rise of DDoS assaults capable of crippling infrastructure and causing extensive damage. It spotlights essential security measures every organization must have in place to weather the surging digital deluge.
Compromised login credentials played a role in 28% of cyber intrusions in 2023, yet authentication methods have vastly evolved over time. This report explores the historical development of authentication and the growing reliance of threat actors on stolen passwords. It examines emerging techniques like biometrics and passkeys that could reshape authentication’s future, providing organizations with robust defenses against attacks exploiting credentials.
Cyberattacks on file transfer services surged 48% in 2023, posing grave financial, reputational, and privacy risks. Prominent incidents like the Clop ransomware attack demonstrate how threat actors strategically exploit vulnerabilities in widely used file sharing conduits to infiltrate networks. This report contains insights on the grCyberattacks on file transfer services surged 48% in 2023, posing grave financial, reputational, and privacy risks. Prominent incidents like the Clop ransomware attack demonstrate how threat actors strategically exploit vulnerabilities in widely used file sharing conduits to infiltrate networks. This report contains insights on the growing dangers and how to safeguard your organization.owing dangers and how to safeguard your organization.
Security risks have surged with the integration of APIs in modern software development, making proactive defense strategies crucial. This situation calls for advanced measures to counteract sophisticated API attacks, which are essential for maintaining operational integrity and protecting against reputational harm.
Paying ransoms empowers cybercriminals to escalate attacks globally. Experts urge organizations to unite across sectors, implement robust defenses, report all incidents, and share intelligence to dismantle the ransomware infrastructure.
While memory-safe languages like Rust offer security benefits, they also attract cybercriminals. The growing Rust community and resources potentially make it easier for attackers to develop sophisticated, hard-to-detect malware.
The shared responsibility model and remote data storage in cloud computing create security gaps. Misconfigurations and innovative hacker tactics leave data vulnerable, demanding proactive, compliant defense strategies from organizations.
Browser-based phishing attacks rose 198% in the second half of 2023, with evasive techniques now accounting for 30% of attempts. Adapting defenses is crucial to counter these evolving threats.
As the world gears up for a pivotal year of elections in 2024, an unprecedented surge in malicious cyber activity threatens the integrity of democratic processes. With cyberattacks targeting elections skyrocketing from 10% in 2015 to a staggering 26% in 2022, nation-states are increasingly seeking to influence outcomes, particularly in NATO and OECD countries. This report delves into the alarming 100% rise in malicious activity observed between 2023 and early 2024, underlining the urgent need for robust cybersecurity measures to safeguard the sanctity of elections worldwide.
State-sponsored hackers are exploiting AI tools like OpenAI for attacks. Defenses currently lag in countering these AI advancements, signaling an urgent need for innovation.
Recently discovered Critical ScreenConnect vulnerabilities are being exploited by threat actors. Urgent patching is advised to mitigate ransomware, data theft, and persistent access risks.
The Akira ransomware is exploiting a high-severity vulnerability in Cisco ASA/FTD software. The flaw enables access for gathering sensitive data, underscoring the need for strong vulnerability management.
A highly sophisticated phishing campaign, observed since September 2023, has elevated its threat level by incorporating the PikaBot malware alongside DarkGate, becoming one of the most advanced campaigns since the dismantling of the Qakbot (Qbot) operation.
During the open enrollment period, scammers use phishing techniques to steal personal information. The Federal Trade Commission warns against sharing personal information in response to unexpected contacts.
The conflict between Israel and Palestine has resulted in cyberattacks by politically motivated hackers, commonly known as hacktivists, that have wide-ranging effects, impacting various industries. It is crucial for organizations to maintain a high threat level, as more hacking groups are likely to join the Israel-Hamas conflict.
The FBI has issued a warning about ransomware gangs adopting new tactics, including employing multiple ransomware strains in a single attack, and using destructive tools beyond encryption or theft.
Cybercriminals are leveraging artificial intelligence to craft sophisticated email threats, signifying a notable shift in the role of AI in email security.
Federal authorities have issued a warning to the healthcare sector regarding the emerging threat posed by the Akira ransomware-as-a-service group.
The FBI is warning organizations of an increase in scammers pretending to be recovery companies. Cyber recovery scams, also known as data recovery scams, play on the vulnerabilities and emotions of individuals who have experienced data loss or other digital disasters.
Since May 2023, a large phishing campaign is utilizing Quick Response (QR) codes in an attempt to collect Microsoft credentials from victims. The emails masquerade as a Microsoft security notification with a QR code embedded inside a PNG image or a PDF attachment.
As APIs become integral to modern software development, organizations must proactively address the evolving security risks they introduce. Implementing robust defense strategies and advanced measures is crucial to safeguard against sophisticated API attacks, maintain operational integrity, and protect against potential reputational harm.
As APIs become integral to modern software development, organizations must proactively address the evolving security risks they introduce. Implementing robust defense strategies and advanced measures is crucial to safeguard against sophisticated API attacks, maintain operational integrity, and protect against potential reputational harm.
With phishing attacks escalating in sophistication and frequency, staying ahead of these evolving threats is paramount. The anticipated rise in 2024 underscores the urgent need for enhanced security practices and awareness.
COM Hijacking has emerged as a prevalent and dangerous technique for malware persistence, exploiting legitimate Windows functionalities to evade detection. By manipulating the registry and leveraging trusted COM objects, attackers can stealthily execute malicious code without leaving suspicious file traces. This versatile method offers a wide attack surface, targeting diverse applications and data. As COM Hijacking techniques continuously evolve, businesses and security professionals must remain vigilant and implement robust mitigation strategies to combat this growing threat and safeguard their systems from compromise.
A devastating ransomware attack on a critical healthcare billing and payment system has exposed the sector’s vulnerability to cyber threats. The attack has caused widespread disruptions, financial strain, and potential data breaches, underscoring the urgent need for robust cybersecurity measures to protect patient data, ensure uninterrupted care, and safeguard the healthcare industry from the growing threat of cyberattacks.
APT29’s constantly evolving tactics and ability to exploit unanticipated vulnerabilities make them a formidable threat to organizations. Their adaptability allows them to infiltrate systems before detection, potentially causing widespread damage and data breaches, emphasizing the need for organizations to remain vigilant, update their defenses, and stay informed about APT29’s latest activities to maintain a robust security posture.
ShadowSyndicate is actively scanning the internet for servers running outdated versions of aiohttp, exploiting the publicly available CVE-2024-23334 proof-of-concept. By targeting sensitive files and gaining unauthorized access, they can potentially deploy ransomware payloads, highlighting the critical importance of timely patching and robust cybersecurity measures.
The DEEP#GOSU campaign showcases North Korean cyber actors’ sophisticated tactics, from targeted social engineering to multi-stage scripting. Organizations must prioritize robust cybersecurity to defend against evolving espionage and financial threats.
In early 2023, the threat actors behind the BumbleBee malware shifted to a new delivery method, opting to use malicious online ads to spread the downloader.
The Critical Start Cyber Threat Intelligence Team is aware of and monitoring a trend in malware being developed to specifically target Linux systems. Targeting of Linux systems has been relatively scarce and primitive in comparison to other proprietary operating systems.
The FBI recently released a warning to avoid free public charging stations as they are potentially being compromised by threat actors. Cyber criminals are using public charging stations to infect devices with malware or monitoring software that enables the threat actor to access your phone, tablet, or computer, also referred to as “Juice Jacking.”
A new, harder-to-detect variant of the Redline Stealer trojan has surfaced, disguising itself as a software installer and employing Lua bytecode to evade security software. Once installed, it steals user data and exploits Windows processes to maintain persistence on infected systems, underscoring the need for robust security measures.
The rapid rise of IoT devices is a double-edged sword. While it unlocks a wave of innovation across industries, it also introduces significant security risks. Transportation, for instance, grapples with hackable ELDs in trucks, potentially compromising data and even vehicle control (as evidenced by the March 2024 ELD vulnerabilities).
The promise of generative artificial intelligence (GenAI) is undeniable. From automating tasks and personalizing experiences to generating creative content, GenAI offers organizations a wealth of opportunities. However, this powerful technology comes with a hidden cost – a new wave of security challenges.
Palo Alto Networks is facing a serious security threat. A critical vulnerability (CVE-2024-3400) has been discovered in their PAN-OS firewall software that could allow attackers to seize complete control of your firewall. This vulnerability specifically targets PAN-OS versions 10.2, 11.0, and 11.1, but only if two specific features are enabled:
Python’s widespread adoption has created a double-edged sword for both developers and cybercriminals. On the one hand, its large user base presents a vast potential target pool for attackers. Even a minor infection rate can translate into a significant number of victims due to the sheer number of Python users worldwide.
eFile.com, an IRS approved software service, was recently found to be delivering JavaScript malware. The service was a conduit for the filing of more than 66 million tax returns in 2022. The malware was loaded on nearly every page of the website prompting users to click on the malicious file to download.
Chinese advanced persistent threat (APT) actor, Mustang Panda (a.k.a. Earth Preta, RedDelta or BRONZE PRESIDENT) is delivering lure archives via spear-phishing emails and Google Drive links.
Research has revealed that the Cisco Wireless Access Point products and Cisco Meraki products with wireless capabilities have a vulnerability in the WiFi protocols built–in power save mechanism that could allow an adversary to meddle with traffic, client connections, and more.
A critical flaw in MOVEit Transfer is under active exploitation, allowing attackers to bypass authentication. Immediate updates and security measures are essential to prevent severe consequences.
The Cloud Development Kit (CDK) attack poses significant threats to AWS CDK users through code injection, misconfigurations, and supply chain vulnerabilities. Implementing strict access controls and regular audits are crucial for defense.
The recent cyber-attack on MITRE, a leading cybersecurity organization, has sent tremors through the industry. This brazen breach shatters the illusion of invulnerability, emphasizing that even the most well-resourced organizations are not immune to determined attackers exploiting zero-day vulnerabilities, as seen with the Ivanti software in this case.
The recently discovered TunnelVision technique poses a significant risk to organizations and individuals relying on VPNs for secure remote access. By exploiting a vulnerability in the DHCP, attackers can manipulate routing tables and redirect VPN traffic through a server under their control, effectively bypassing encryption and exposing sensitive data.
The Federal Bureau of Investigation (FBI) released an advisory on cyber criminals tampering and switching legitimate QR codes. Since October 2022, the use of QR codes within phishing scams has risen.
A critical Cisco NX-OS vulnerability (CVE-2024-20399) is being exploited by the China-linked hacking group Velvet Ant, posing significant risks to organizations. This exploitation can lead to network disruption, data theft, and persistent access, particularly threatening sectors like government, finance, technology, and healthcare.
The Fourth of July weekend presents heightened cybersecurity risks for travelers, with public Wi-Fi snooping affecting 33% of surveyed respondents. Social media hacks, phishing scams, and identity theft also pose significant threats to holidaymakers.
Separately, Palo Alto Networks issued an informational security advisory discussing Rorschach ransomware operators using the Cortex XDR Dump Service Tool (cydump.exe) to load untrusted dynamic link libraries (DLLs) using DLL-sideloading. This is true only when the tool is removed from its installation directory; it is not possible to side-load DLLs when Cortex XDR agent is installed on Windows and is running from the installation path because Cortex XDR’s security permissions and protections prevent it. In the advisory, Palo Alto verified that Cortex XDR 7.7, and newer versions, with content update version 240 (released Nov 2021), and later content updates, detect and block the ransomware. New versions of Cortex XDR agent, capable of blocking the DLL side-loading technique, will be released next week to prevent future misuse of the software. Mac OS and Linux platforms are not affected by this issue.
—
Security researchers have discovered a new ransomware strain, called Rorschach, with unique technical features. The malware is deployed using the dynamic link library (DLL) side-loading technique via a signed component in Cortex XDR, a threat detection and incident response tool from Palo Alto Networks.
In 2022, a spike in targeting third-party vendors almost doubled from 2021, with 63 attacks on vendors being reported and 298 victims. This trend of increasing attacks on third-party vendors has only continued in Q1 of 2023 as several third-party vendors have reported being attacked by malicious campaigns. There are several dangers when third-party vendors are attacked.
Business Email Compromise (BEC) attacks have become a major cybersecurity concern, with losses 80 times greater than ransomware. FBI reports show BEC incidents nearly doubled from 2019 to 2023, causing $12.5 billion in losses and posing a threat to global economies.
With ~40% of U.S. employees working remotely or in hybrid arrangements, organizations face increasing cybersecurity risks. While remote work offers numerous benefits, it also necessitates robust security measures to protect against threats targeting VPNs, mobile devices, and unprotected networks.
Two-step phishing attacks are on the rise as threat actors become more sophisticated in targeting potential victims and evading detection. These phishing attacks use legitimate vendors that the threat actor has previously compromised.
Educational institutions have become prime targets for cybercriminals, facing a 37% surge in ransomware attacks since 2023. With average recovery costs reaching $2.73 million per incident, 48% higher than the global average, the need for robust cybersecurity measures in education has never been more critical.
Microsoft disclosed a new zero-day vulnerability in Outlook identified as CVE-2023-23397. This flaw is an elevation-of-privilege (EoP) vulnerability that enables remote code execution capability as threat actors can steal NTLM credentials of Microsoft Outlook users.
After a brief hiatus, Emotet threat actors have re-commenced operations as of early March 2023. Originally tracked as a banking trojan, Emotet has evolved into a multi-purpose dropper/downloader malware.
Sharp Panda, (also known as APT19, Emissary Panda, or Iron Tiger) is a sophisticated Chinese Advanced Persistent Threat (APT) group. The group has been active since at least 2012 and is known for sharing tools and infrastructure with other Chinese APT groups.
Public-facing applications have become a major vulnerability, with web app exploits leading to 30 catastrophic incidents and $5.7 billion in losses. As threat actors increasingly target these applications and associated cloud infrastructure, organizations must prioritize robust protection strategies.
Recently, several malware operators have been spotted using OneNote attachments in their spam campaigns. OneNote is a powerful digital notebook tool offered by Microsoft. It provides users with a centralized location to store their thoughts, ideas, and notes in an organized manner. Cyber criminals have started new phishing campaigns delivering malicious OneNote attachments that deliver Formbook, Redline Stealer, AsyncRat or Qbot malware to unsuspecting victims.
Russian-based ransomware group LockBit continues to expand its arsenal with the addition of a new variant, LockBit Green. The acquisition of Green comes less than a year after the deployment of LockBit Black. Threat researchers at SentinelOne indicated a large portion of this variant overlaps with the Conti ransomware version whose source code was leaked last year. LockBit is expected to continue to dominate the ransomware arena as the operators make strides to increase its capabilities and versatility.
Adversary-in-the-middle (AiTM) phishing campaigns are a growing threat because they are highly effective and can bypass even the most advanced security measures. They are particularly dangerous when they target large organizations, which can have a significant impact on the organization’s operations and reputation. Phishing remains to be one of the most common techniques attackers use in their attempts to gain initial access to organizations. It remains important for organizations to be vigilant and aware of this type of attack and take steps to protect themselves.
Effective version currency management is crucial for mitigating cyber threats. By consistently updating systems and leveraging threat intelligence, organizations can better protect their assets from both known and emerging vulnerabilities.
OpenSSL published an advisory detailing two new vulnerabilities CVE-2022-3786 (“X.509 Email Address Variable Length Buffer Overflow”) and CVE-2022-3602 (“X.509 Email Address 4-byte Buffer Overflow”); both classified as high. Although initially assessed as a critical vulnerability, CVE-2022-3602, was downgraded to high due to unlikely remote code execution in common configurations. These vulnerabilities impact OpenSSL 3.0.0-3.0.6 ONLY. Users should upgrade to 3.0.7 as soon as possible. Those unable to immediately update should disable TLS client authentication. Currently there are no known exploits in the wild.
Our CTI team will continue to monitor these known vulnerabilities and work closely with the Threat Detection Engineering (TDE) team and the SOC to implement any relevant detections. For future updates the CTI team will continue to post on the Intelligence Hub and give updates via ZTAP bulletins.
October 31, 2022
Critical Start CTI team is aware of a new OpenSSL vulnerability that will be disclosed tomorrow, November 1st. Details and characteristics of the flaw have not been released, however due to the critical classification of the vulnerability we recommend updating to the new version of OpenSSL (version 3.0.7) being released on Tuesday, November 1st. The CTI team will be working closely with the Threat Detection Engineering (TDE) team and the SOC to implement any relevant detections. Critical Start CTI team will continue to monitor the situation.
In early June 2022, CISA published a Joint Cybersecurity Advisory (CSA) highlighting espionage activity related to Chinese state-sponsored advanced persistent threat (APT) groups targeting telecommunications companies. Furthermore, there has been an increase in open and closed-source identification and reporting of Chinese threat actor activities over the last month. Critical Start Cyber Threat Intelligence analysts will be monitoring this situation closely as it evolves.
Critical Start supports the CISA backed recommended actions listed below:
The ransomware group formerly known as Conti is currently shut down.
The admin panel of the gang’s official website, Conti News, is shut down as is the negotiations service site. Meanwhile the rest of the infrastructure, to include chatrooms, messengers, servers, and proxy hosts are going through a massive reset. This was an intentional decision, months in the making, to attempt to shed some of the group’s toxic branding.
For over two months, the Conti collective silently created subdivisions that began operations before the start of the shutdown process. These subgroups either utilize existing Conti alter egos and locker malware or took the opportunity to create new ones. The group is adopting a network organizational structure, more horizontal and decentralized than the previously rigid Conti hierarchy.
The new network will include the following types of groups:
This model is more flexible and adaptive than the previous Conti hierarchy but is more secure and resilient than Ransomware-as-a-Service (RaaS).
The other major development for this new ransomware model is the transition from data encryption to data exfiltration. Relying on pure data exfiltration maintains most major benefits of a data encryption operation, while avoiding the issues of a locker altogether. Most likely, this will become the most important outcome of Conti’s re-brand.
Chinese cyber actors have intensified their operations, employing sophisticated tactics for espionage and disruption. Recent incidents, including the exploitation of vulnerabilities to deploy backdoors, highlight the growing threat landscape and the need for comprehensive defensive strategies.
The Critical Start CTI team observed a pattern of breaches over the last five weeks related to higher education being targeted by ransomware. Two out of the four southern schools, Florida International University and North Carolina A&T University, have been linked to BlackCat (a.k.a., ALPHV). No threat actors have claimed responsibility for the latest, Austin Peay State University, reported on by Critical Start CTI earlier this month, but the school is still investigating. Around the country there have been at least 13 reported attacks against U.S. universities and colleges in 2022 so far. These include Kellogg Community College, targeted last week, Ohlone College, Savannah State University, University of Detroit Mercy, Centralia College, Phillips Community College of the University of Arkansas and National University College, to name a few.
About BlackCat
BlackCat, (aka ALPHVM, ALPHV, and Noberus) is a newly emerged ransomware-as-a-Service (RaaS) group assessed to be a re-branding of BlackMatter and DarkSide groups. BlackCat ransomware emerged in November 2021 and is developed in Rust, a cross-compilation language allowing for rapid development of malware for Windows and Linux. The ransomware executable is highly customizable, with different encryption methods (AES, ChaCha20) and options allowing for attacks on a wide range of corporate environments. Common TTPs include the use of a signed binary proxy to download the ransomware, access token manipulation and UAC bypass for privilege escalation, deleting files and logs on host for defense evasion purposes, and the use of SMB and PsExec for lateral movement.
We Recommended That You
Rhysida, a new ransomware-as-a-service operation, targets critical infrastructure with double extortion tactics. Their recent attack on the Port of Seattle demonstrates the group’s growing threat to global operations and underscores the urgent need for enhanced cybersecurity measures.
BazarCall was used by Ryuk and Conti in 2020/2021 and has made a reappearance in March 2022 targeting several companies across multiple industries. Using the BazarCall Tactic, Conti creates a fake call center from which calls are made to potential victims convincing them to open malicious email attachments. These malicious attachments exploit Atera remote monitoring software, Cobalt Strike, and Sliver C2 Framework, then delivers BazarLoader.
It’s important to note that phone calls are made following extensive social engineering and reconnaissance activities. Previous breaches involving these tactics have provided evidence that call center personnel have convincing information regarding target company operations.
We recommend that you:
CTO Randy Watkins provides more information about the group behind the breach in this informal breakdown of what we know now.
March 23, 2022
Critical Start is monitoring the recent breach against Okta and the associated third-party
service providers that support Okta’s operations.
Okta says 366 corporate customers, or about 2.5% of its customer base, were impacted by a security breach that allowed hackers to access the company’s internal network. The company only acknowledged the compromise after the Lapsus$ hacking and extortion group posted screenshots on Monday, nearly two months after the hackers first gained access to its network.
Key points to know:
Critical Start always recommends customers enable MFA for all user accounts. Passwords alone do not
offer the necessary level of protection against attacks. We strongly recommend the usage of hard keys,
as other methods of MFA can be vulnerable to phishing attacks.
Threat actors increasingly leverage legitimate system tools in malware-free Living Off the Land (LoTL) attacks to evade detection. Recent analysis reveals the critical importance of behavior analytics in identifying these sophisticated attacks that exploit common IT administration tools.
Advanced Persistent Threat groups are increasingly leveraging AI and Large Language Models to enhance their cyberattacks. This evolution in threat tactics enables more sophisticated phishing campaigns and automated attacks, presenting new challenges for cybersecurity professionals.
Social engineering attacks have evolved beyond traditional phishing to include sophisticated techniques like angler phishing on social media platforms. The integration of AI and automation has enabled cybercriminals to deploy more precise, large-scale attacks across multiple communication channels, highlighting the urgent need for enhanced security measures.
The holiday shopping season brings heightened cybersecurity risks, with cybercriminals exploiting online sales platforms through sophisticated fraud schemes. The FBI reported over 50,000 non-payment complaints in 2023, resulting in $309 million in losses, underscoring the critical need for robust multilayered security measures.
The holiday shopping season brings heightened cybersecurity risks, with cybercriminals exploiting online sales platforms through sophisticated fraud schemes. The FBI reported over 50,000 non-payment complaints in 2023, resulting in $309 million in losses, underscoring the critical need for robust multilayered security measures.
The January-April tax filing season creates prime opportunities for cybercriminals targeting the 90% of returns filed electronically. Attackers impersonate trusted institutions and use sophisticated social engineering tactics to compromise personal data, potentially gaining unauthorized access to corporate networks.
Log4Shell is a Remote Code Execution vulnerability with the Open Source Apache Log4j framework that is part of the Apache Logging Project. This is the most widely used logging framework on millions of systems worldwide and many governments have rated the risk a 10 out of 10, or "red" level risk of the highest severity.
To put this event into layman's terms: If 95% of all garage doors installed from 2016-2021 could be opened from any Internet Web Browser...from anywhere around the world... This is the significance of Log4shell.
Critical Start takes a closer look at the SolarWinds breach through two January information sessions.
With the breach linked back to the use of Solarwinds' updater as the distribution mechanism for the backdoor, finding out who had been affected was easy, and the results were devastating.
