Global Cyber News Digest

Events

Cyber Insider Podcast

Press Room

Daily News Digest

Stay current on the global cyber threat landscape and industry developments with CCOE’s daily digest and library of cybersecurity news and articles.

  • White House Warns Business Leaders To Increase Cybersecurity Against Ransomware Attacks

    • The warning comes after President Joe Biden signed a recent executive order to protect the federal government against cyberattacks and an announcement by the Department of Homeland Security concerning new cybersecurity requirements for pipeline companies. There are also provisions for beefing up the country’s cybersecurity in Biden’s American Jobs Plan.
    • 5 Recommended Best Practices
      • Backup your data, system images, and configurations, regularly test them, and keep the backups offline.
      • Update and patch systems promptly
      • Test your incident response plan
      • Check your security team's work
      • Segment your networks
    - Edward Segal | June 3, 2021
    hak-iq.us20.list-manage.comJune 3, 2021

  • White House warns companies to step up cybersecurity: 'We can't do it alone'

    • The White House warned corporate executives and business leaders on Thursday to step up security measures to protect against ransomware attacks after intrusions disrupted operations at a major meatpacking company and the biggest U.S. fuel pipeline.
    • The recent cyberattacks have forced companies to see ransomware as a threat to core business operations and not just data theft, as ransomware attacks have shifted from stealing to disrupting operations.
    • Best practices such as multifactor authentication, endpoint detection and response, encryption and a skilled security team. Companies should back up data and regularly test systems, as well as update and patch systems promptly.
    • There has been a significant hike in the frequency and size of ransomware attacks, Anne Neuberger, cybersecurity adviser at the National Security Council, said in a letter.
    • Neuberger advised that companies test incident response plans and use a third party to test the security team's work.
    - Doina Chiacu | June 3, 2021
    hak-iq.us20.list-manage.comJune 3, 2021

  • REvil, A Notorious Ransomware Gang, Was Behind JBS Cyberattack, The FBI Says

    • The world's largest meat processing company has resumed most production after a weekend cyberattack, but experts say the vulnerabilities exposed by this attack and others are far from resolved.
    • In a statement late Wednesday, the FBI attributed the attack on Brazil-based meat processor JBS SA to REvil, a Russian-speaking gang that has made some of the largest ransomware demands on record in recent months.
    • REvil has not posted anything related to the hack on its dark web site. But that's not unusual. Ransomware syndicates as a rule don't post about attacks when they are in initial negotiations with victims — or if the victims have paid a ransom.
    • JBS said late Wednesday said that it expects to resume production at all its plants on Thursday and be running at "close to full capacity" across its global operations.
    • President Joe Biden intends to confront Russia's leader, Vladimir Putin, about his nation's harboring of ransomware criminals when the two meet in Europe in two weeks.
    • JBS is the second-largest producer of beef, pork and chicken in the U.S. If it were to shut down for even one day, the U.S. would lose almost a quarter of its beef-processing capacity, or the equivalent of 20,000 beef cows, according to Trey Malone, an assistant professor of agriculture at Michigan State University.
    • The plant closures reflect the reality that modern meat processing is heavily automated, for both food- and worker-safety reasons. Computers collect data at multiple stages of the production process; orders, billing, shipping and other functions are all electronic.
    | June 3, 2021
    hak-iq.us20.list-manage.comJune 3, 2021

  • Scripps Health notifies patients of data breach after ransomware attack

    • Nonprofit healthcare provider, Scripps Health in San Diego, has disclosed a data breach exposing patient information after suffering a ransomware attack last month.
    • The attack caused the healthcare provider to suspend their IT systems, including public-facing portals, including MyScripps and scripps.org.
    • "The investigation is ongoing, but we determined that an unauthorized person did gain access to our network, deployed malware, and, on April 29, 2021, acquired copies of some of the documents on our systems," said an updated Scripps Health security incident notice.
    • When ransomware operations breach an organization, they will first silently spread throughout the network while stealing files and data. Once they gain access to a Windows admin account and the domain controller, they deploy the ransomware to encrypt devices.
    • "Importantly, this incident did not result in unauthorized access to Scripps’ electronic medical record application, Epic. However, health information and personal financial information was acquired through other documents stored on our network."
    • For those patients whose data was exposed, Scripps Health has begun mailing notification letters on June 1st, 2021.
    - Lawrence Abrams | June 3, 2021
    hak-iq.us20.list-manage.comJune 3, 2021

  • Here’s What Universities Need to Know About Cyber-Attacks

    • Universities have learnt to operate entirely remotely and now that learning may resume in person, a hybrid education model will likely continue. The transition from physical to online models happened so quickly that it left many IT networks exposed to serious harm from outside forces.
    • Universities operate large corporate-sized networks, but without the budgets to match. Add to that, teachers and students aren’t given training to use and connect their technology in a safe way.
    • Three lessons universities need to quickly take on board:
      • Your Research is Valuable to Cyber-Criminals
        • There is a hefty price tag on some of the research conducted by universities, which makes it particularly attractive to cyber-criminals.
      • Personal Information of Students and Staff Can Easily Fall into the Wrong Hands
        • Attackers use phishing to break into university networks and sneak around, undetected, in search of data they believe has the highest value – both to the victim and to other cyber-criminals who might pay good money for it. Quite often, this information is sold or published on the dark web, which can lead to staff and students becoming victims of further crimes, such as identity theft.
      • A Cyber-attack Can Knock Everything Offline
        • With some students still studying remotely, an attack could see students left sitting at home, unable to access course materials, online tools and any of the other resources they need to get on with their work. For university students paying £9,000 a year and facing some of the most important exams of their lives, the implications of a cyber-attack are enormous on both a financial and personal level.
    - Jonathan Lee | June 1, 2021
    hak-iq.us20.list-manage.comJune 1, 2021

  • Ransomware Is Everywhere — Here’s What You Need To Consider

    • There have been more than 4,000 ransomware attacks every day since 2016, according to an interagency U.S. government report.
    • If you pay the ransom, you’re sending out a dangerous message to criminals that you will play ball. The inevitable consequence is that they’re far more likely to target your sector or attack your organization again in the future.
    • An issue that’s often missed in this scenario is that paying the ransom usually means you’ll receive a functioning decryption tool. This doesn’t instantly return things to normal, and you will have to allocate more resources to recover properly. Apart from the risk that the tool doesn’t work, you may face a logistically tricky task in simply entering all the keys on your various devices. Once this is done, there’s still the pressing concern of tracing and mitigating the original breach that led to ransomware gaining a foothold in your network.
    • There are several preventive measures and precautions you can take to reduce the risk of a ransomware attack:
      • Maintain a proper backup
      • Patch continuously
      • Maintain an up-to-date asset list
      • Plan and rehearse recovery
      • Consider cyber insurance
    - Steve Durbin | June 1, 2021
    hak-iq.us20.list-manage.comJune 1, 2021

  • SolarWinds Hackers Return, Launch Phishing Campaign Using Compromised Account of US Foreign Aid Agency

    • The SolarWinds hackers are back again, this time leveraging the stolen email account of a United States federal agency to run a phishing campaign against 150 government entities in 24 countries. The attack is particularly high risk as the credentials could have allowed the phishing emails to sail straight into the inboxes of thousands of recipients with sensitive job titles.
    • A blog post from Microsoft refers to the phishing campaign as resulting in “limited damage” without “any significant number of compromised organizations.”
    • The group wasted little time in distributing authentic-looking phishing emails to contacts associated with a  Constant Contact marketing email account belonging to the United States Agency for International Development (USAID), a federal government agency responsible for about half the foreign aid that the US distributes around the world.
    • It was packed with a disguised link leading to an attack site that installed the NativeZone malware. NativeZone allows for surreptitious remote control of infected systems and can be used to quietly exfiltrate sensitive data.
    • The SolarWinds hackers made attempts on some 3,000 email accounts belonging to about 150 organizations. The campaign ran through May, changing targeting and delivering techniques several times in an attempt to foil detection.
    • WHAT WE KNOW - the SolarWinds hackers have a focus on first compromising trusted sources (software updates, email accounts) and then using them to phish high-value government targets.
    • Wired is now reporting that the SolarWinds hackers are members of the SVR foreign intelligence agency, a claim that the head of the agency has denied.
    • While this relatively blunt approach was the main technique used in the phishing campaign, the hackers did alter their strategy for certain recipients with iPhones or iPads. These recipients were targeted with a zero-day vulnerability that Apple patched back in late March.
    - Scott Ikeda | May 31, 2021
    hak-iq.us20.list-manage.comMay 31, 2021

  • Cybersecurity attack hits world's largest meat supplier JBS' IT systems in the U.S. and Australia

    • JBS USA, the world's largest meat supplier, says it was the target of an “organized cybersecurity attack."
    • In a statement, JBS, which has its U.S. headquarters in Greeley, Colorado, said the attack affected some of its servers supporting its North American and Australian IT systems.
    • "The company took immediate action, suspending all affected systems, notifying authorities and activating the company's global network of IT professionals and third-party experts to resolve the situation," the company said in its statement. "The company’s backup servers were not affected, and it is actively working with an Incident Response firm to restore its systems as soon as possible."
    - Kelly Tyko | May 31, 2021
    hak-iq.us20.list-manage.comMay 31, 2021

  • Why Air India Breach is an Eye-Opener for Every CISO

    • The cybersecurity vulnerability within the Indian tech ecosystem is growing wider and more apparent by the day. Three months after air transport data major SITA reported a data breach, Air India said last week that personal data of about 4.5 million passengers had been compromised following the incident at SITA.
    • Air India said that CVV data of credit cards were not held by SITA, as it urged passengers to change passwords “wherever applicable to ensure safety of their personal data.”
    • The struggling airline, which is surviving on taxpayer money, claimed that it had investigated the security incident, secured the compromised servers, engaged with unnamed external specialists, notified the credit card issuers, and had reset passwords of its frequent flyer program.
    • The lesson from such breaches as Sonit Jain, CEO of GajShield Infotech observed, “While organization spend a lot of effort securing their enterprise network, risk assessment of partner networks is rarely done, leaving a big gap open to be compromised. As attackers start mapping supply chain providers of an organization, we will see an increase in the number of such attacks. Lack of visibility and control will leave a blind spot ready to be used.” “Cyber defenses now need to be extended beyond an organization’s network and cover their partner network, processes, and employees too,” he said.
    • When the world went into lockdown in March 2020, the total number of bruteforce attacks against remote desktop protocol (RDP) jumped from 93.1 million worldwide in February 2020 to 277.4 million 2020 in March—a 197 per cent increase.
    • “It obviously becomes essential for enterprises to regularly train their non-IT staff and create an awareness in order to protect their consumer’s data from being exposed in a data breach incident due to threats like phishing, malware and brute force attacks. Regular system updates and proactive disclosure of such incidents also help businesses in creating a stronger strategy to fight against data breaches,” he said.
    - Sohini Bagchi | May 25, 2021
    hak-iq.us20.list-manage.comMay 25, 2021

  • How to deal with a data breach at your company

    • With the increasing risks of data breaches, organizations should not only work on mitigating but also develop a plan to deal with such occurrences.
    • While it is important to protect and prevent your business from a data breach, finding a recovery plan following a breach is important.
      • Contain the Breach - begin by isolating the affected systems to prevent them from spreading to your entire network. This includes disconnecting any breached accounts and shutting down targeted departments.
      • Assess Degree of Damage - Identifying how the attack occurred is important to prevent future attacks using the same tactics. You should also thoroughly assess the affected systems to uncover any malware left by the hacker. During the assessment, identify the attack vector, social engineering methods used, and sensitivity of breached data.
      • Inform the Affected - You should notify the relevant authorities, individuals, and third-party organizations affected. Ensure that you craft the data breach notification letter openly and sincerely. Inform both internal and external affected persons about the type of data breach that occurred, records affected, possible losses incurred, plans for mitigating the damage, and how you intend to prevent a recurrence.
      • Conduct a Security Audit - With or without a data breach, regular security audits are important.
      • Improve Your Cybersecurity Systems
        • Using data encryption
        • Multi-factor authentication
        • Training employees
    - Chris Smith | May 25, 2021
    hak-iq.us20.list-manage.comMay 25, 2021

451 A Street, Suite 500
San Diego, CA 92101

[email protected]

CONNECT WITH US

Linkedin Twitter

Cyber Center of Excellence is a San Diego-based nonprofit dedicated to growing the regional cyber economy and creating a more secure digital community for all.

JOIN US
Linkedin Twitter
Cyber Center of Excellence | Privacy Policy  |  Terms & Conditions
Linkedin Twitter
Privacy Policy  |  Terms & Conditions
© 2024 Cyber Center of Excellence