Security News
ESET has published details of an advanced persistent threat crew that appears to have deployed recent supply chain attack methods against targets including "Electronics manufacturers," although it didn't specify which. "Victims of its campaigns are located in East Asia as well as the Middle East and include governments, religious organizations, electronics manufacturers and universities," said ESET in a research report published today that names the APT crew as Gelsemium.
Belgium's Federal Public Service Interior has suffered a "Complex, sophisticated and targeted cyberattack." When Microsoft released out-of-band security updates for Exchange Server in early March to fix zero-day vulnerabilities exploited by the Hafnium threat actor, the FBS Interior called in the Center for Cybersecurity Belgium to help with the patching of their Exchange servers.
Each one of these supply chain attacks targeted a different piece of implicitly trusted infrastructure-infrastructure that you may or not be paying attention to as a potential target in your organization. Package squatting via software package repositories.
More than one year into the pandemic, banks, insurers, and other financial institutions report costly consequences to falling short of protecting their massive data troves from cloud-based attacks and network disruptions. Biggest cybersecurity issues for financial institutions Data breaches are an increasingly significant cost burden for the industry: Worldwide, financial firms that experienced a data breach reported estimated average losses of roughly $4.2 million per attack, with U.S. organizations hit hardest at $4.7 million in estimated losses.
Microsoft detected a large-scale business email compromise campaign that targeted more than 120 organizations using typo-squatted domains registered a few days before the attacks started. BEC scammers use various tactics to compromise business email accounts, later used to redirect payments to bank accounts under their control or target employees in gift card scams.
HashiCorp, an open-source company whose Terraform product is widely used for automated cloud deployments, has revealed a private code-signing key was exposed thanks to the compromised Codecov script discovered earlier this month. Specifically, it said "a subset of HashiCorp's CI pipelines used the affected Codecov component" and "The GPG private key used for signing hashes used to validate HashiCorp product downloads... was exposed."
Most educational organizations experienced phishing attempts, while 33% were victims of an account compromise attack, and 27% were hit by ransomware in 2020, according to a new report from cybersecurity vendor Netwrix. Fewer than half of non-education sector organizations experienced the same level of attack.
The U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency has released a new tool to help with the detection of potential compromise within Microsoft Azure and Microsoft 365 environments. Dubbed Aviary, the new tool is a dashboard that makes it easy to visualize and analyze output from Sparrow, the compromise detection tool that was released in December 2020.
Image: CISA. The Cybersecurity and Infrastructure Security Agency has released a companion Splunk-based dashboard that helps review post-compromise activity in Microsoft Azure Active Directory, Office 365, and Microsoft 365 environments. CISA's new tool, dubbed Aviary, helps security teams visualize and analyze data outputs generated using Sparrow, an open-source PowerShell-based tool for detecting potentially compromised applications and accounts in Azure and Microsoft 365.
A vulnerability residing in the "Domain Time II" network time solution can be exploited in Man-on-the-Side attacks, cyber-security firm GRIMM warned on Tuesday. Developed by Greyware Automation Products, Inc., Domain Time II is a time synchronization software designed to help enterprises ensure accurate time across their networks.