January 05, 2024 – Cyber Briefing

👉 What’s going on in the cyber world today?

Crypto Mining, Malware, Python Repositories, NIST, AI, Cyber Adversaries, Exploit, CISA, Vulnerabilities, Ivanti, RCE Flaw, DeFi Protocol, Gamma Strategies, Canadian Senator, San Bernardino Housing Authority, Monti Ransomware, Diablo Valley Oncology, Kershaw County School, FTC, Voice Cloning Misuse, US Cyber National Mission Force, Apple’s AirTags, Stalking Lawsuit, BreachForums, NJ Medical Practice.

🚨 Cyber Alerts

1. Python Packages Deploy Linux Crypto Miner

Three recently discovered malicious Python packages, namely modularseven, driftme, and catme, have been found to deploy a cryptocurrency miner on Linux devices. These packages collectively garnered 431 downloads within the past month before being removed. The malware conceals its payload, reducing detectability by hosting it on a remote URL and incrementally releasing it in various stages, executing its malicious activities in the background to ensure persistence and evade detection.

2. NIST Identifies Major AI Vulnerabilities

The National Institute of Standards and Technology (NIST) has identified four significant cyber threats that can manipulate the behavior of AI systems. NIST’s guidance emphasizes the exploitation of AI vulnerabilities through tactics like introducing untrustworthy data, leading to system malfunctions. The publication underscores the importance of developing robust defenses as existing measures lack assurances to fully mitigate risks, considering the increasing role of AI in critical functions such as autonomous vehicles and medical diagnoses.

3. Cyber Deception via Caching Exploits

Trellix Email Security recently uncovered a novel tactic exploiting caching, a foundational security mechanism. This method involves deploying seemingly innocuous URLs in emails, cloaking malicious payloads by redirecting to trusted sites during security analysis, and exploiting the cached “safe” verdict to bypass subsequent security checks, ultimately compromising unsuspecting users. Understanding and addressing such intricate manipulation of caching mechanisms is crucial for effective cybersecurity mitigation.

4. Industrial Control Systems Vulnerabilities

Advisories from the Cybersecurity and Infrastructure Security Agency (CISA) highlight critical vulnerabilities in industrial control systems (ICS), affecting Rockwell Automation, Mitsubishi Electric, and Unitronics. The vulnerabilities range from out-of-bounds writes to observable timing discrepancies, potentially leading to remote code execution and unauthorized access. Organizations worldwide, especially in critical manufacturing and water and wastewater sectors, are urged to take immediate action to secure their systems against potential exploitation.

5. Ivanti Fixes Critical Endpoint Vulnerability

Ivanti has addressed a critical remote code execution (RCE) vulnerability in its Endpoint Management software (EPM), posing a risk of hijacking enrolled devices or the core server. The flaw affects all supported Ivanti EPM versions, and the fix is available in version 2022 Service Update 5. Unauthenticated attackers with internal network access can exploit the vulnerability, potentially leading to arbitrary SQL queries and control over machines running the EPM agent, with a possible impact on the core server’s security if configured to use SQL express.

💥 Cyber Incidents

6. Gamma’s DeFi Loss Hits $3.4M

Blockchain security firm PeckShield discovered a vulnerability in Gamma’s Ethereum-based vaults, resulting in a $3.4 million loss. Gamma responded by halting vault deposits and initiating negotiations with the exploiter for a potential bounty. The decentralized finance protocol plans a third-party code review before reopening deposits and vows to maximize recovery for affected users.

7. Canadian Senator’s X Account Hacked

Amina Gerba, a Quebec senator in Canada, faced a X account hack, confirmed by her office. The incident involved the account being renamed “LFG” and used to promote a scam leveraging Gerba’s followers. Although the account was restored, questions linger about the security measures in place, and this follows previous social media account breaches of Canadian parliamentarians, highlighting potential vulnerabilities in their online presence.

8. Housing Authority Cyber Breach

The Housing Authority of the County of San Bernardino in California has notified nearly 19,000 individuals of a data breach, revealing that names and Social Security numbers were compromised in a cyberattack that occurred in June. The attack involved unauthorized access to an employee email account, prompting immediate action, including a password reset and forensic investigation. While the extent of the breach was limited, affected individuals will receive one year of free credit monitoring services, and the housing authority has reported the incident to regulators in Maine and California.

9. Monti Ransomware Hits Healthcare Provider

The Monti ransomware group has targeted Diablo Valley Oncology, a comprehensive cancer care provider, adding them to their list of victims. While details about the extent of the breach and motives are undisclosed, this cyberattack follows their previous hits, including the Auckland University of Technology in 2023. Unlike typical ransomware groups, Monti claims to engage in ethical hacking, exposing vulnerabilities in corporate networks rather than focusing solely on financial gain.

10. Kershaw School Hit by Ransomware

The Kershaw County School District in the United States is reportedly grappling with a cyberattack attributed to the Black Suit ransomware group. The threat actors claim to have successfully breached the school’s systems, leading to the unauthorized exfiltration and subsequent exposure of a substantial 17.5 GB of sensitive data. This incident underscores the ongoing challenges faced by schools in securing their digital infrastructure against evolving cyber threats.

📢 Cyber News

11. FTC Contest Targets Voice Cloning Risks

The Federal Trade Commission (FTC) has initiated a contest to encourage the development of strategies and products aimed at safeguarding consumers from the malicious misuse of voice cloning technology. Voice cloning, powered by advancements in text-to-speech AI, has legitimate applications but is also exploited by scammers for impersonation. The FTC contest seeks multidisciplinary approaches to monitor and prevent scammers from harming consumers through voice cloning, offering a $25,000 prize for innovative solutions.

12. US Cyber Command’s New CNMF Chief

Marine Corps Maj. Gen. Lorna Mahlock assumes command of the Cyber National Mission Force, succeeding Army Maj. Gen. William Hartman. The CNMF, comprising 39 joint cyber teams, is a crucial element of U.S. Cyber Command’s operations and was authorized to become a permanent organization within the command in 2022. Mahlock, the first Black woman to achieve the rank of brigadier general in the Marine Corps, brings a wealth of experience, having served as the first military deputy director for combat support for the National Security Agency’s Cybersecurity Directorate.

13. Apple Faces Negligence Claims

A San Francisco federal judge expressed a tentative view that Apple may have been negligent in the design and oversight of its AirTags tracking product, indicating a leaning towards denying the dismissal of a class-action lawsuit by stalking victims. The judge believed that the plaintiffs adequately alleged a negligence claim and suggested that Apple could be potentially culpable for product liability damages. AirTags, marketed as a way to locate lost items, have faced criticism for facilitating stalking, and the judge indicated that Apple should have foreseen the problem, an essential element in a negligence claim.

14. Cybercrime Forum Administrator Rearrested

The administrator of the now-defunct cybercrime forum BreachForums, Conor Brian Fitzpatrick, has been arrested for violating parole. Fitzpatrick, known as “pompompurin,” was initially arrested last March for running BreachForums, a prominent cybercrime forum for buying and selling stolen data. He had pleaded guilty to charges related to the forum and child pornography, but he violated parole by using a computer and VPN services without court-mandated monitoring software. Fitzpatrick now faces potential decades in prison for his involvement in cybercrimes.

15. HHS Settles NJ Medical Record Access Case

In a recent enforcement action, the Department of Health and Human Services has reached a $160,000 settlement with Optum Medical Care of New Jersey, formerly known as Riverside Medical Group, for violating HIPAA’s “right of access” provision. Patients experienced delays of up to seven months in accessing their medical records, prompting the HHS’ Office for Civil Rights to take action. The multi-specialty practice, with about 150 locations, must now implement a corrective action plan to prevent future HIPAA violations and distribute revised policies while providing training on the individual right of access to protected health information.