September 30 2024 – Cyber Briefing

👉 What’s happening in cybersecurity today?

UK, US, Iran, Spear Phishing, Ransomware, Embargo Group, Cloud, GorillaBot, DDoS, Rhadamanthys, Infostealer, AI Threats, Cryptocurrency, Louse, APT Group, Malware, China, Israel, Beirut Airport,Hack, Personal Data, Dutch, Police, Cyberattack, France, News Agency, AFP, Bedrock, $2 Million, Theft, Walters Art Museum, Maryland, Breach, California, Governor Newsroom, AI Safety Bill, India, National Security Council Secretariat, Cybersecurity, Watchdog, Healthcare, Bill, Corporate, Accountability, Hospitals, US, Iranian Nationals, Cybercrimes, Election, Interference, Meta, Fine, Ireland, Data Protection Commission.

Listen to the full podcast

🚨 Cyber Alerts

1. UK Issues Warning on Rising Iranian Phishing

The UK’s National Cyber Security Centre (NCSC) and US agencies, including the FBI and US Cyber Command, have issued a joint advisory warning of an escalating spear-phishing campaign linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). The campaign targets individuals involved in Iranian and Middle Eastern affairs, as well as US political campaigns, using deceptive tactics to steal login credentials. Threat actors impersonate family members, professional contacts, and journalists to lure victims into clicking malicious links, often bypassing two-factor authentication.

2. Embargo Ransomware Expands Attacks to Cloud

Microsoft has raised concerns about the ransomware group Storm-0501, which has intensified its attacks by targeting hybrid cloud environments with Embargo ransomware. Originally identified as an affiliate of the Sabbath ransomware operation, Storm-0501 has evolved to deploy various malware from groups such as Hive, BlackCat, and LockBit. The group exploits weak credentials and known vulnerabilities to gain access to sensitive networks, subsequently moving laterally and leveraging stolen Microsoft Entra ID credentials to infiltrate cloud infrastructures.

3. New GorillaBot Reigns Over DDoS Attacks

NSFocus analysts have identified a new botnet named “GorillaBot,” which has rapidly emerged as a significant threat in the realm of Distributed Denial of Service (DDoS) attacks. This modified version of the Mirai malware has launched an unprecedented campaign, issuing over 300,000 attack commands in just 24 days and impacting 113 countries, with the highest activity recorded in China, the United States, Canada, and Germany. GorillaBot supports various CPU architectures and employs multiple attack methods, including UDP Flood and ACK BYPASS Flood.

4. Rhadamanthys Infostealer Threatens Crypto

A new and advanced version of the Rhadamanthys Infostealer has emerged, posing a significant threat to cryptocurrency security. This updated malware leverages artificial intelligence (AI) to perform optical character recognition (OCR), allowing it to extract cryptocurrency wallet seed phrases from images. By recognizing seed phrases on the client side, the malware can transmit this sensitive information to its command-and-control (C2) server for further exploitation.

5. Louse APT Group Targets China with Malware

The Louse APT group, also known as Patchwork or Dropping Elephant, has initiated a new malware campaign aimed at Chinese entities, employing a sophisticated attack vector. This campaign begins with a malicious LNK file, likely delivered via phishing emails, which triggers a PowerShell script to download a decoy PDF and a harmful DLL. Utilizing DLL sideloading techniques, the malware decrypts and executes shellcode, ultimately deploying a new payload named Nexe, specifically designed to exfiltrate sensitive information from compromised systems.

💥 Cyber Incidents

6. Israeli Army Hacks Beirut Airport Tower

On September 28, 2024, the Israeli army reportedly hacked into the control tower of Beirut’s Rafic Hariri International Airport, issuing threats against an Iranian civilian aircraft attempting to land. In response to these threats, the Lebanese Ministry of Transport instructed airport authorities to prevent the Iranian plane from entering Lebanese airspace. Israeli army spokesman Daniel Hagari warned that the military would not allow any weapons transfers to Hezbollah through the airport, emphasizing that it should remain exclusively for civilian use.

7. Hackers Steal Data of Dutch Police Officers

Hackers have stolen the names and contact details of all Dutch police officers, including undercover agents, in a significant data breach confirmed by Minister of Justice and Security David van Weel. The breach included email addresses, names, and positions from the “entire organization,” though van Weel assured that no sensitive data related to ongoing investigations or officers’ personal details had been leaked. Police Chief Janny Knol stated that the breach occurred through a hacked police account, while the exact number of affected individuals remains undisclosed.

8. Cyberattack Hits French News Agency AFP

French news agency Agence France-Presse (AFP) confirmed it was the target of a cyberattack that impacted its IT systems, particularly affecting transmission technology to customers. The attack, discovered on Friday, led AFP to activate its technical department and seek assistance from the National Cybersecurity Agency of France (ANSSI). While the breach temporarily disrupted some services, AFP assured its clients that global reporting continued as usual.

9. Hacker Exploits Bedrock to Steal $2 Million

The crypto liquid restaking protocol Bedrock recently fell victim to a significant security breach, resulting in the theft of approximately $2 million due to a vulnerability in its smart contract. Discovered by Web3 security firm Dedaub, the flaw affected multiple uniBTC vaults, but despite prior warnings, Bedrock failed to address the issue in time, allowing the hacker to exploit it.

10. Walters Art Museum Suffers Data Breach

The Walters Art Museum in Baltimore has issued a notice regarding a data breach that may have compromised the personal information of certain individuals. The breach occurred between October 10 and November 18, 2023, when unauthorized access to the museum’s computer systems was detected. Following an investigation, it was revealed that the personal information potentially affected includes names, dates of birth, contact details, demographic data, financial records, medical information, and government-issued identification such as Social Security numbers.

📢 Cyber News

11. California Governor Vetoes AI Safety Bill

California Governor Gavin Newsom has vetoed a highly debated artificial intelligence safety bill designed to mandate developers implement measures to prevent critical harms associated with AI technologies. The bill, authored by Democratic Senator Scott Wiener, sought to require AI companies developing models costing at least $100 million to rigorously test the safety of their products before public release. While acknowledging the bill’s good intentions, Newsom argued it lacked the flexibility needed to effectively address potential catastrophic risks and overly imposed stringent standards even on basic AI functionalities.

12. India Names NSCS as Cybersecurity Watchdog

The Indian government has officially designated the National Security Council Secretariat (NSCS) as the primary agency for managing the country’s cybersecurity challenges. Under Prime Minister Narendra Modi’s leadership, the NSCS will provide overall coordination and strategic direction to enhance national cybersecurity efforts. This restructuring clarifies the roles of various ministries, including the Ministry of Telecommunications, which will oversee telecom network security, and the Ministry of Electronics and Information Technology, tasked with addressing cybersecurity under the IT Act.

13. Healthcare Cyber Bill Boosts Accountability

A new healthcare cybersecurity bill, introduced by Senators Ron Wyden and Mark Warner, aims to enhance security mandates within the healthcare sector. Titled the Health Infrastructure Security and Accountability Act, the proposed legislation would provide funding to assist hospitals in adopting stringent security measures while also lifting the cap on HIPAA enforcement fines. Moreover, it holds top executives accountable, imposing financial penalties and potential prison time for those who falsely attest to their organization’s compliance during security audits.

14. US Charges Iranian Nationals for Cybercrimes

U.S. federal prosecutors have unveiled criminal charges against three Iranian nationals Masoud Jalili, Seyyed Ali Aghamiri, and Yasar Balaghi allegedly linked to the Islamic Revolutionary Guard Corps (IRGC) for their involvement in a cyber operation targeting current and former U.S. officials. The Department of Justice (DoJ) accuses them of hacking into the accounts of officials, media members, and individuals associated with U.S. political campaigns, aiming to undermine the electoral process and steal sensitive information.

15. Meta Fined $101M for 2019 Password Breach

Meta has been fined $101 million by the Irish Data Protection Commission (DPC) following a security lapse in which millions of Facebook and Instagram passwords were stored in plaintext. The investigation revealed that Meta violated several articles of the European Union’s General Data Protection Regulation (GDPR) by failing to promptly notify the DPC of the breach and not implementing adequate technical measures to protect user data. This security oversight, which involved sensitive passwords dating back to 2012, raised significant concerns about user account safety.