Malware
Exposed Secrets: Unmasking Data Breaches, Stolen Credentials & Illicit Dark Web Bazaars
Infostealer malware is a significant and often underestimated threat to corporate information security teams. These malicious programs infect computers, steal credentials saved in browsers, along with active session cookies and other data, and send it back to the attacker’s command and control infrastructure. In some cases, the malware even self-terminates after completing its mission.
In this article, we’ll discuss how cybercriminals use stolen credentials to gain unauthorized access to privileged IT infrastructure, leading to data breaches and ransomware attacks. But infostealers aren’t the only threat; leaked credentials from more traditional sources continue to pose substantial risks to organizations.
It’s no secret that people often reuse the same password across multiple applications, creating a perfect opportunity for hackers to brute force their way into software-as-a-service (SaaS) and on-premises applications.
At IT Services, we currently monitor over forty million stealer logs. This number is growing by millions every month, with an expected increase in 2024. Additionally, we monitor over 14 billion leaked credentials found in data dumps across the dark web.
This unique perspective allows us to see firsthand how threat actors acquire, distribute, and use leaked credentials.
Understanding Leaked Credentials
To better comprehend leaked credentials, we can categorize them into tiers based on the method of leakage and the risk they pose to organizations. This approach, pioneered by Jason Haddix, helps security professionals clearly communicate credential leak risks to managers and corporate executives.
Tier 1 Leaked Credentials
Tier 1 leaked credentials result from third-party application or service breaches. When these breaches occur, all users of the affected service have their passwords compromised and distributed in a data dump on the dark web. This is the most common type of leaked credential.
For example, imagine a fictional corporation called Scatterholt with user logins for hundreds of thousands of consumers. If attackers breach Scatterholt and access the identity and access management system, they could steal these credentials and leak them onto the dark web.
Scatterholt could force a password reset for all users, but it’s likely that many users have reused the same password across other services. This leak gives threat actors the opportunity to use brute force techniques to gain access to other applications that share the same password.
Defending Against Tier 1 Leaked Credentials
Organizations can employ several well-researched defenses to reduce risk. First and foremost: monitor a leaked credentials database for corporate employee emails. This single action can make a massive difference as threat actors deliberately target passwords associated with corporate email addresses to facilitate data breaches.
Secondly, require users to routinely reset passwords on a schedule, ensuring that if a specific password is breached, they will have already rotated other corporate credentials.
Finally, we recommend using a password manager with a policy requiring employees to randomize passwords for various applications and store them securely, reducing the risk of employees making only minor changes to passwords.
The Special Case of Combolists
Combolists are collections of credential pairs, organized by service or geographically, used by cybercriminals in combination with brute force tools to attempt to gain access to various services.
Source: IT Services
These credentials often come from previous known breaches, stealer logs, or are entirely fabricated. The exact source is never entirely clear, but the sheer volume of credentials available through combolists, combined with frequent password reuse, makes them a significant attack vector.
Tier 2 Leaked Credentials
Tier 2 leaked credentials pose a unique risk to companies. These credentials are harvested directly from users through infostealer malware that steals all passwords saved in the browser.
We consider tier 2 leaked credentials to be of significantly increased risk to both the company and the user for the following reasons:
- A single stealer log will contain all of the credentials the user saved in their browser. This creates a perfect opportunity for threat actors to socially engineer the victim, the IT help desk, or even the company using the victim’s information.
- These logs contain the plain text username, password, and host for the credentials, often for hundreds of different logins. Threat actors have an enormous advantage when they can see dozens of password variations that the user uses.
- These logs often contain form-fill data with answers to secret questions, which can be effectively used to bypass websites with secret questions.
Source: IT Services
Tier 3 Leaked Credentials
This tier of leaks, also from stealer logs, poses an extreme risk to organizations. Fresh stealer logs often contain active session cookies, which threat actors can easily use for session hijacking attacks. In these attacks, they impersonate the victim and potentially bypass two-factor authentication (2FA) and multi-factor authentication (MFA) controls.
Discovering a fresh stealer log with corporate credentials should immediately prompt an incident investigation, as it’s highly likely that the passwords are working and that threat actors could directly access corporate resources.
Source: IT Services
Defending Against Tier 3 Leaked Credentials
Limit the time-to-live (TTL) for corporate applications to reduce the risk of session cookies remaining valid if distributed as a result of an infostealer infection.
Multi-Factor Authentication Isn’t a Silver Bullet
Not monitoring leaked credentials likely means that many of your employees use single-factor authentication, as their passwords may have been exposed. Many people believe that enabling 2FA is sufficient protection against stolen credentials, but the reality is that threat actors are aware of the obstacle 2FA presents and have developed techniques to overcome it.
Whether through social engineering of employees, using 2FA bots to capture one-time codes/passwords from victims, or even SIM-swapping, there are many ways to bypass MFA controls that are actively used in the wild.
The best defense against these types of attacks involves using authenticator apps, which feature temporary rotating codes instead of one-time passwords received via email or SMS. These applications are usually more secure and ensure that the user controls a second device to some extent.
Concerned about Credentials? We Can Help
IT Services monitors more than 14 billion leaked credentials distributed on the dark web and hundreds of millions leaked through infostealer malware.
Our platform sets up in 30 minutes and provides robust detection for leaked employee credentials across hundreds of forums, channels, and marketplaces.
Sponsored and written by IT Services.
Malware
Massive Cyberattack at French Hospital: Health Data of 750,000 Patients Compromised
A cyberattack on a French hospital exposed the health data of 750,000 patients. The incident highlights the growing risk of cyber threats targeting healthcare organizations, with sensitive patient information being increasingly sought by hackers. Ensure your organization’s data is protected with robust cybersecurity measures and stay informed on the latest threats.
A data breach at a French hospital has led to the exposure of 750,000 patients’ medical records. The culprit, a threat actor going by the name ‘nears’, claims to have attacked multiple healthcare facilities in France, potentially gaining access to over 1.5 million patient records.
This attacker claims to have breached MediBoard, an Electronic Patient Record (EPR) solution by Softway Medical Group. The group has confirmed that a MediBoard account was indeed compromised, but it was not due to a software vulnerability or misconfiguration. Instead, the breach occurred through stolen hospital credentials.
How did this happen?
Softway Medical Group explained that the exposed data was not directly managed by them but was hosted by the hospital. They emphasized that their software was not responsible for the breach. Instead, a privileged account within the hospital’s infrastructure was compromised.
This situation highlights the importance of ensuring that all staff members, especially those with privileged access to sensitive systems, follow strict security protocols to prevent unauthorized access.
What’s at stake?
The threat actor began selling what they claimed was access to the MediBoard platform for multiple French hospitals. This access allegedly allowed the buyer to view sensitive healthcare and billing information, patient records, and even the ability to schedule and modify appointments or medical records.
To prove their claim, the hacker put the records of 758,912 patients from an unnamed French hospital up for sale. These records contain sensitive information, including full names, dates of birth, contact information, and even health card history.
The data was offered for purchase to three users, and currently, no buyers have been declared on the sale listing. However, even if the data isn’t sold, there’s always a risk of it being leaked online for free, making it accessible to the broader cybercrime community.
The dangers of exposed data
The type of data exposed in this incident raises the risk of phishing, scamming, and social engineering for impacted individuals. As a result, it’s crucial for healthcare providers to prioritize cybersecurity and invest in proper security measures to protect their patients’ sensitive information.
For patients, it’s essential to be vigilant and aware of potential scams and phishing attempts. Be cautious with any communication that seems suspicious or requests sensitive information, and never hesitate to verify the authenticity of a message.
What can you do to protect yourself?
With cyber threats constantly evolving, it’s essential to stay informed about cybersecurity best practices. As an IT Services company, we’re dedicated to helping people like you understand the risks and take appropriate action to protect your personal information and online security.
Don’t leave your cybersecurity to chance. Keep coming back to learn more about the latest threats, best practices, and how to keep yourself and your loved ones safe online. Together, we can build a more secure digital world for everyone.
Malware
Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan
Fintech firm Finastra is probing a potential data breach following a hacking incident involving its SFTP server. The breach, which may have exposed sensitive user data, has prompted the company to bolster its security measures and notify affected customers.
Did you know that even the largest and most successful financial software companies can fall victim to cyberattacks? Recently, Finastra, a company that serves over 8,000 institutions across 130 countries, experienced a cybersecurity incident that put their customers’ sensitive data at risk.
The Incident at Finastra
Finastra is a global financial software company that counts 45 of the world’s top 50 banks and credit unions among its clients. With over 12,000 employees and a revenue of $1.7 billion last year, it’s a major player in the finance sector. On November 7, 2024, a cyber attacker managed to access one of Finastra’s Secure File Transfer Platform (SFTP) systems using compromised credentials.
So far, the company’s investigation, supported by external cybersecurity experts, has not found evidence that the breach extended beyond the SFTP platform. But the attack has raised concerns about the security of the company’s software services, which include lending solutions, payment processing, cloud-enabled retail and banking platforms, and trading risk management tools.
How We Learned About the Breach
Brian Krebs first reported the security breach after seeing a data breach notification sent to an impacted person. The attack appears to be linked to a post on a hacking forum, where a threat actor named “abyss0” claimed to be selling 400GB of data stolen from Finastra.
When we asked Finastra about the forum post, they wouldn’t confirm or deny if the data belonged to them. However, they did acknowledge a limited-scope security breach and are currently evaluating its impact. They also stressed that the compromised SFTP platform was not used by all their customers and was not their default file exchange platform.
What’s Next for Finastra and Its Customers?
The exact impact and scope of the breach are still under investigation. It may take some time to determine who has been affected, but Finastra has assured that those who are deemed impacted will be contacted directly. As a result, public disclosures from the company are not expected.
Interestingly, the threat actor who published the data samples earlier this month has since deleted the post. It’s unclear whether the data was sold to a buyer or if “abyss0” became concerned about the sudden publicity.
A History of Cybersecurity Incidents
This isn’t the first time Finastra has experienced a cybersecurity incident. In March 2020, the company was hit by ransomware actors and forced to take parts of its IT infrastructure offline, causing service disruptions. At the time, reports highlighted Finastra’s lackluster vulnerability management strategy, as they were using older versions of Pulse Secure VPN and Citrix servers.
What Can We Learn From This?
The Finastra breach is a stark reminder that no organization is immune to cyber threats. As technology continues to evolve, so do the tactics and techniques used by cybercriminals. It’s crucial for companies, large and small, to prioritize cybersecurity and invest in the latest security measures to protect their customers’ data.
And for you, as a reader and potential customer, it’s important to stay informed about the latest cybersecurity news and best practices. That’s where we come in. We’re committed to providing you with the most up-to-date information on cybersecurity, so you can stay one step ahead of the bad guys. So why not reach out to us and keep coming back to learn more about how you can protect yourself and your business from cyber threats?
Malware
Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure
Ford has denied allegations of a data breach, assuring customers that their information remains secure. The automaker responded to claims made by a security researcher who discovered a vulnerability in their systems, stating that no sensitive data was accessed or exposed. Ford is working closely with the researcher to investigate and resolve the issue.
As someone who cares about cybersecurity, I can’t help but feel concerned about the recent news that Ford is investigating allegations of a data breach. A threat actor going by the name ‘EnergyWeaponUser’ claimed on a hacking forum to have leaked 44,000 customer records. They also implicated another hacker, ‘IntelBroker,’ who supposedly took part in the breach back in November 2024.
What’s in the leaked data?
The leaked information includes Ford customer records containing personal details such as full names, physical locations, purchase details, dealer information, and record timestamps. While this data might not be extremely sensitive, it still contains personally identifiable information (PII) that could be used in phishing and social engineering attacks targeting the affected individuals.
What’s interesting is that the threat actors didn’t try to sell the dataset. Instead, they offered it to registered members of the hacker forum for eight credits, equivalent to just a little over $2.
Ford’s response and investigation
We reached out to Ford to validate the claims, and a spokesperson confirmed that they are actively investigating the allegations. They stated, “Ford is aware and is actively investigating the allegations that there has been a breach of Ford data. Our investigation is active and ongoing.”
Is there credibility to these allegations?
The involvement of IntelBroker in the breach lends some credibility to the threat actor’s allegations. This hacker has a track record of confirmed breaches, including recent ones at Cisco’s DevHub portal, Nokia (through a third party), Europol’s EPE web portal, and T-Mobile (via a vendor).
The data samples leaked by the threat actors include locations from around the world, with the United States being one of them.
How to protect yourself from potential risks
In light of this potential data exposure, it’s crucial to treat unsolicited communications with caution and reject requests for revealing more information under any pretense. Keep an eye out for any suspicious emails, messages, or phone calls that might use this leaked information to manipulate or deceive you.
An important update from Ford
After our initial report, Ford provided us with an additional statement based on new findings from their ongoing investigation. They said, “Ford’s investigation has determined that there was no breach of Ford’s systems or customer data. The matter involved a third-party supplier and a small batch of publicly available dealers’ business addresses. It is our understanding that the matter has now been resolved.” – A Ford spokesperson
Stay informed and stay safe
Keeping up to date with cybersecurity news and best practices is crucial in today’s digital world. Continue to check back with us for the latest information and advice on protecting yourself and your data. Remember, knowledge is power, and staying informed is the first step in defending against potential threats.
Massive Cyberattack at French Hospital: Health Data of 750,000 Patients Compromised
Finastra Battles Massive Data Breach: Unraveling the SFTP Hack Impact on Fintech Titan
Ford Dismisses Data Breach Accusations, Asserts Customer Information Remains Secure
Flagstar Bank’s Latest Data Breach: 800,000 Customers Impacted, Marking the Third Incident of 2021
Blackbaud: Taking Responsibility with a Landmark $49.5 Million Settlement for Devastating Ransomware Data Breach
Top Data Protection Officer Certification Courses Reviewed
Malware1 year agoFlagstar Bank’s Latest Data Breach: 800,000 Customers Impacted, Marking the Third Incident of 2021
- Malware1 year ago
Blackbaud: Taking Responsibility with a Landmark $49.5 Million Settlement for Devastating Ransomware Data Breach
- Data Protection Regulations1 year ago
Top Data Protection Officer Certification Courses Reviewed
- Security Audits and Assessments1 year ago
Mastering Healthcare Data Security: 5 Essential Audit Tips
- Data Protection Regulations1 year ago
Top 11 Data Protection Training Programs for Compliance
- Data Protection Regulations1 year ago
Navigating Data Protection Laws for Nonprofits
- Data Protection Regulations1 year ago
9 Best Insights: CCPA’s Influence on Data Security
- Security Audits and Assessments1 year ago
HIPAA Security Risk Assessment: Essential Steps Checklist
