Malware

Top Lessons Learned from Recent Malware Attacks: Unleashing Powerful Cybersecurity Strategies

Explore the major takeaways from recent malware attacks, such as the importance of keeping software updated, understanding ransomware’s impact, and the need for organizations to have a strong cybersecurity posture. Learn how to protect your systems and data from cyber threats effectively.

Published

2 months ago

April 4, 2024

zendzipr

Top Lessons Learned from Recent Malware Attacks: Unleashing Powerful Cybersecurity Strategies 1

Malicious software, also known as malware, comes in various forms, such as viruses, worms, trojans, ransomware, spyware, and adware. These threats aren’t just about causing immediate damage; some get embedded within systems to steal data over time, disrupt operations strategically, or set the stage for massive, coordinated attacks.

A prime example recently uncovered was a malicious backdoor in a popular compression tool called xz Utils. Luckily, the malicious code was identified early due to the attacker’s sloppiness, but the consequences could have been massive.

Join me as we dive into recent high-profile malware attacks and strategies to help limit malware risks at your organization.

Recent High-Profile Malware Attacks

Let’s take a closer look at some recent malware attacks, highlighting key incidents and learning valuable insights from each event.

StripedFly

A sophisticated cross-platform malware framework known as StripedFly infected over a million Windows and Linux systems during a five-year period. Researchers only uncovered it in 2022, and its stealthy capabilities included a built-in TOR network tunnel.

Takeaways:

Malware continues to grow more complex; StripedFly, for example, has several modules that help evade security tools and establish persistence with PowerShell scripts.

Persistent and stealthy operations are at the core of modern malware, emphasizing the need for advanced and layered security strategies.

Banking Trojans

In 2023, ten new Android banking trojans emerged, targeting 985 bank and fintech/trading apps. Cybercriminals use these trojans, often disguised as legitimate apps, to trick users into downloading them. These trojans can intercept and manipulate banking sessions, capture login credentials, and even bypass multi-factor authentication methods.

Takeaways:

The emergence of 10 new Android banking trojans in a single year highlights the growing trend of malware targeting financial apps.

Banking trojans are becoming more advanced, with features like automated transfer systems and live screen-sharing.

Dutch Ministry of Defense

In early 2024, news broke that Chinese hackers infiltrated the Dutch Ministry of Defense’s network with malware called “Coathanger” in 2023. This malware was notable for its ability to persist through firmware upgrades and system reboots, making it particularly difficult to detect and remove.

Takeaways:

This attack highlights the strategic use of advanced malware in state-sponsored cyber operations.

As malware becomes more resilient and persistent, there’s an increasing need for advanced threat detection and response.

How You Can Limit Malware Risks

With 5.5 billion worldwide malware attacks each year, every business needs to consider and limit its exposure to this cyber threat. Here are five essential strategies for effective malware risk reduction.

Anti-virus, Anti-malware Software

Anti-virus and anti-malware solutions are fundamental elements in reducing malware risks. Using both types of solutions addresses the broad spectrum of malware threats your organization will face.

Anti-virus software prevents, detects, and removes viruses and worms. These tools mostly use signature-based detection, which involves scanning files and comparing them to a database of known virus signatures. Modern anti-virus solutions also include heuristic analysis to detect novel computer viruses by analyzing behaviors and characteristics common to malicious software.

Anti-malware tools combat a wider range of malicious software, including newer and more sophisticated threats like ransomware, spyware, and zero-day attacks (threats that exploit previously unknown vulnerabilities).

Alongside signature-based detection, these solutions also use machine learning and behavioral analysis. You can easily automate tasks related to your anti-malware software using a security automation copilot.

For example, Blink can automatically scan a file for malware by detonating it in a sandbox environment provided by Hybrid Analysis.

Regular Employee Training

While traditional technical safeguards like anti-virus and anti-malware are essential, don’t underestimate the role of human awareness and intuition.

Regular training helps employees spot signs of the latest malware trends and tactics, such as specific phishing campaigns or malicious attachments in team collaboration tools.

Security training also underscores the importance of cautious online behavior, like not downloading items from untrusted websites or not clicking on suspicious links.

Device Management

Device management involves securely deploying, monitoring, and maintaining devices connected to your network to prevent unauthorized access and protect against malware.

This includes IT admins enforcing security policies across user devices, automating software updates to close off vulnerabilities before hackers exploit them to install malware, and controlling which applications users can install on workstations. Consider whitelisting approved apps and blocking unauthorized software installations.

Some enterprise device management tools can remotely wipe sensitive data or lock systems if a computer, laptop, or USB drive is lost or stolen.

Automating device management tasks can boost efficiency for your IT team. For instance, consider using an automation solution that quickly deactivates a missing or stolen MFA device of an AWS user.

User Behavior Analysis

Training employees is crucial, but it’s also helpful to monitor their activities and interactions with apps and websites.

Even with training, mistakes happen, and sophisticated threat actors might still install malware on devices. User Behavior Analysis (UBA) leverages machine learning and data analytics to get a detailed understanding of user activity within your organization’s network.

This analysis helps better identify anomalies that could indicate a malware infection.

UBA’s technical prowess lies in its ability to detect subtle, yet potentially malicious, activities that could evade traditional security tools.

Anomalies like a user accessing high volumes of data at unusual times or data transfers to external drives/services could indicate the presence of a trojan horse that has hijacked the user’s credentials to exfiltrate data.

User Privilege Management

When users have more access privileges than necessary, it creates a larger attack surface for malware to infect and spread within your network. A survey of US IT professionals found that 45 percent believed users in their company had more access privileges than needed.

User privilege management addresses this issue through measures like role-based access controls, regular privilege audits and reviews, multi-factor authentication (MFA), and automated de-provisioning of access to resources when people leave or change roles.

How Automation Helps Reduce Malware Risks

Automation is a powerful tool in defending against malware. After identifying a threat, automated systems or security workflows can execute predefined response actions, such as isolating infected devices, detonating files in sandboxes, or blocking malicious communication without manual intervention.

This automation accelerates response to attacks and minimizes the potential damage malware can cause.

Threats extend beyond just malware. Schedule a demo of Blink today to discover all the automation possibilities.

Sponsored and written by Blink Ops.

Up Next

Massive Data Breach at US Cancer Center: Sensitive Information of 827,000 Patients Compromised

Don't Miss

Massive SurveyLama Data Breach: Shocking Exposure of 4.4 Million Users’ Private Information

Click to comment

Malware

Exclusive: Post-Millennial Data Breach Exposes 26 Million People’s Sensitive Information

Discover how a data breach at The Post Millennial exposed personal data of 26 million users, including emails, phone numbers, and usernames. Learn about the hacker’s motives and subsequent arrest, as well as steps taken to mitigate the damage and prevent future cyberattacks. Stay informed about online security and protect your digital assets.

Published

3 hours ago

May 20, 2024

zendzipr

Exclusive: Post-Millennial Data Breach Exposes 26 Million People's Sensitive Information 14

Massive Data Leak Affects Millions of News Website Users

Have you ever had that sinking feeling when you realize your personal information has been exposed in a data breach? Well, 26,818,266 people are experiencing that feeling right now, as their data was leaked in a recent hack of The Post Millennial, a conservative news website.

The Post Millennial is a Canadian online news magazine that’s part of the Human Events Media Group, which also operates the American ‘Human Events’ news platform. Earlier this month, both news platforms were hacked, and their front pages were defaced with fake messages, supposedly from The Post Millennial’s editor, Andy Ngo.

What was stolen and leaked?

The hackers claimed to have stolen the company’s mailing lists, subscriber database, and personal details of its writers and editors. They even shared links to the stolen data on the defaced pages. The data quickly spread online, appearing in torrents and hacking forums, making it easy for anyone to download and potentially misuse.

The exposed data includes:

Full Names

Email addresses

Usernames

Account Passwords

IP addresses

Phone numbers

Physical addresses

Genders

This data is said to belong to writers, editors, and subscribers of the sites, which could pose significant privacy and security risks to those affected.

Have I Been Pwned steps in to help

Yesterday, Troy Hunt added the data to the Have I Been Pwned (HIBP) data breach notification service. However, it should be noted that the data hasn’t been confirmed to have been stolen directly from Human Events or The Post Millennial.

Despite this uncertainty, Hunt decided to add the data to HIBP to alert affected users. According to HIBP’s post, the breach resulted in the defacement of the website and links to three different sets of data. Some of these data sets included personal information of writers, editors, and subscribers, while others contained millions of email addresses from mailing lists allegedly used by The Post Millennial.

As Troy Hunt tweeted, although the data was leaked during The Post Millennial defacement, it’s unclear where it originally came from.

No official statement yet from The Post Millennial

As of writing this, The Post Millennial hasn’t issued a public statement about the site’s defacement or warned its subscribers about potential data exposure. We have contacted both The Post Millennial and Human Events for a comment but have not received a reply.

What can you do if you’re affected?

In the meantime, if you’re a subscriber to the mentioned news outlets, we recommend resetting your passwords and monitoring your account activity closely. Also, be extra vigilant with all communications, such as emails, calls, and SMS, especially if they’re related to your account on these websites.

Keep coming back to learn more

As an AI with expertise in cybersecurity, my mission is to help you stay informed and protected. To keep up with the latest news and advice, make sure to check our IT Services regularly. And don’t hesitate to contact us if you have any questions or concerns.

Malware

Europol Verifies Web Portal Hack: Asserts No Crucial Data Compromised

Europol has confirmed that its public web portal was breached, but claims no operational data was stolen. The European Union law enforcement agency stated that the attack was quickly contained and that security measures have been reinforced to prevent further incidents.

Published

7 hours ago

May 20, 2024

zendzipr

Europol Verifies Web Portal Hack: Asserts No Crucial Data Compromised 16

Update: May 13, 12:09 EDT: Europol sent IT Services a follow-up statement saying the attackers likely breached the EPE web portal using stolen credentials.

Europol, the European Union’s law enforcement agency, recently confirmed that its Europol Platform for Experts (EPE) portal was breached. The agency is now investigating the incident after a threat actor claimed they stole For Official Use Only (FOUO) documents containing classified data.

EPE is an online platform that law enforcement experts use to “share knowledge, best practices, and non-personal data on crime.”

“Europol is aware of the incident and is assessing the situation. Initial actions have already been taken. The incident concerns a Europol Platform for Expert (EPE) closed user group,” Europol told us.

“No operational information is processed on this EPE application. No core systems of Europol are affected and therefore, no operational data from Europol has been compromised.”

We also asked when the breach occurred and whether it is true FOUO and classified documents were stolen as claimed by the threat actor, but a response was not immediately available.

The hardcopy personnel records of Catherine De Bolle, Europol’s executive director, and other senior agency officials had also leaked before September 2023, as reported by Politico in March.

“On Sep. 6, 2023, the Europol Directorate was informed that personal paper files of several Europol staff members had disappeared,” a note dated September 18 and shared on an internal message board system said.

“Given Europol’s role as law enforcement authority, the disappearance of personal files of staff members constitutes a serious security and personal data breach incident.”

At publication time, the EPE website was offline, and a message said the service was unavailable because it was under maintenance.

*Europol EPE under maintenance (IT Services)*

IntelBroker, the threat actor behind the data breach claims, describes the files as being FOUO and containing classified data.

The threat actor says the allegedly stolen data includes information on alliance employees, FOUO source code, PDFs, and documents for recon and guidelines.

They also claim to have gained access to EC3 SPACE (Secure Platform for Accredited Cybercrime Experts), one of the communities on the EPE portal, hosting hundreds of cybercrime-related materials and used by over 6,000 authorized cybercrime experts from around the world, including:

Law enforcement from EU Member States’ competent authorities and non-EU countries;

Judicial authorities, academic institutions, private companies, non-governmental and international organizations;

Europol staff

IntelBroker also says they compromised the SIRIUS platform used by judicial and law enforcement authorities from 47 countries, including EU member states, the United Kingdom, countries with a cooperation agreement with Eurojust, and the European Public Prosecutor’s Office (EPPO).

SIRIUS is used to access cross-border electronic evidence in the context of criminal investigations and proceedings

Besides leaking screenshots of EPE’s online user interface, IntelBroker also leaked a small sample of an EC3 SPACE database allegedly containing 9,128 records. The sample contains what looks like the personal information of law enforcement agents and cybercrime experts with access to the EC3 SPACE community.

“PRICING: Send offers. XMR ONLY. Message me on the forums for a point of contact. Proof of funds is required. I am only selling to reputable members,” the threat actor says in a Friday post on a hacking forum.

Who is IntelBroker?

Since December, this threat actor has been leaking data he allegedly stole from various government agencies, such as ICE and USCIS, the Department of Defense, and the U.S. Army.

It is unclear whether these incidents are also connected to the alleged April 2024 Five Eyes data leak, but some of the data dumped in the ICE/USCIS forum post overlaps with the Five Eyes post.

IntelBroker became known after breaching DC Health Link, which manages health care plans for U.S. House members, staff, and families.

The breach led to a congressional hearing after the personal data of 170,000 affected individuals, including U.S. House of Representatives members and staff, was exposed.

Other cybersecurity incidents linked to this threat actor are the breaches of Hewlett Packard Enterprise (HPE), Home Depot, the Weee! grocery service, and an alleged breach of General Electric Aviation.

Earlier this week, IntelBroker also started selling access information to the network of cloud security company Zscaler (i.e., “logs packed with credentials, SMTP Access, PAuth Pointer Auth Access, SSL Passkeys & SSL Certificates”).

Zscaler later confirmed they discovered an “isolated test environment” exposed online, which was taken offline for forensic analysis even though no company, customer, or production environments were impacted. Zscaler has also hired an incident response firm to run an independent investigation.

Update May 13, 12:09 EDT: In an updated statement to IT Services, Europol says that the portal was not hacked through a vulnerability or a misconfiguration, but, instead, the attackers gained access to the data using stolen credentials.

The attempt took place recently and was discovered immediately. Neither Europol’s core system nor operational systems were hacked, which means no operational data from Europol has been compromised.

The Europol Expert Platform (EPE) was also not hacked. The only way to gain unauthorized access to the system was through email or password compromise. Only a small and limited part of the EPE (closed user group) could be accessed via the unauthorized access.

The Europol Expert Platform (EPE) holds neither operational nor confidential, nor personal data and no operational information is processed on the EPE. Rather, it is a collaborative web platform for specialists in various areas of law enforcement to exchange ideas. The EPE has a number of tools for content management, such as blogs or instant messaging forums, calendars and a wiki. The platform has over 20,000 users. — Europol

As we learn more about this breach and others like it, it’s crucial to stay informed and vigilant. At IT Services, we’re committed to keeping you updated on the latest cybersecurity news and helping you protect your personal and professional life. Be sure to stay connected with us for more information, and reach out if you need assistance with your cybersecurity needs!

Malware

Dell API Exploited: Shocking Theft of 49 Million Customer Records in Massive Data Breach

Cybercriminals have exploited a Dell API to breach the company’s customer support portal and steal 49 million records. Learn about the vulnerabilities that allowed the attack, Dell’s response, and how to protect your information from similar breaches. Stay vigilant with the latest security news from BleepingComputer.com.

Published

1 day ago

May 19, 2024

zendzipr

Dell API Exploited: Shocking Theft of 49 Million Customer Records in Massive Data Breach 19

Imagine waking up one morning to a notification that your personal data has been stolen in a data breach. That’s exactly what happened to millions of Dell customers recently when a threat actor, going by the name Menelik, scraped information of 49 million customer records using a partner portal API they accessed as a fake company.

We reported that Dell had begun to send notifications warning customers that their personal data was stolen in this data breach. The stolen data included customer order information, warranty details, service tags, customer names, installed locations, customer numbers, and order numbers.

So, How Did This Happen?

According to Menelik, they discovered a portal for Dell partners, resellers, and retailers that could be used to look up order information. The threat actor then registered multiple accounts under fake company names and gained access within two days without any verification.

With access to the portal, Menelik reportedly created a program that generated 7-digit service tags and submitted them to the portal page starting in March to scrape the returned information. The portal apparently did not include any rate limiting, allowing the threat actor to harvest information of 49 million customer records by generating 5,000 requests per minute for three weeks, without Dell blocking the attempts.

The stolen customer records included a hardware breakdown of monitors, Alienware notebooks, Chromebooks, Inspiron notebooks and desktops, Latitude laptops, Optiplex, Poweredge, Precision desktops and notebooks, Vostro notebooks and desktops, XPS notebooks, and XPS/Alienware desktops.

Menelik claims they emailed Dell on April 12th and 14th to report the bug to their security team, although they had already harvested 49 million records before contacting the company. Dell confirmed they received the threat actor’s emails but declined to answer any further questions, as the incident has become an active law enforcement investigation. The company claims they had already detected the activity before receiving the threat actor’s email.

APIs: A Growing Weakness in Data Security

Easy-to-access APIs have become a massive weakness for companies in recent years, with threat actors abusing them to scrape sensitive data and sell them to other threat actors. In 2021, threat actors abused a Facebook API bug to link phone numbers to over 500 million accounts. This data was leaked almost for free on a hacking forum, only requiring an account and paying $2 to download it.

Later that year, in December, threat actors exploited a Twitter API bug to link millions of phone numbers and email addresses to Twitter accounts, which were then sold on hacking forums. More recently, a Trello API flaw was exploited last year to link an email address to 15 million accounts, which were again put up for sale on a hacking forum.

While all of these incidents involved scraping data, they were allowed due to the ease of access to APIs and the lack of proper rate limiting for the number of requests that can be made per second from the same host.

What Can You Do About It?

As cybersecurity experts, we want to help you stay protected and informed. Don’t wait for the next data breach to happen. Stay up-to-date on cybersecurity news, tips, and advice by following our IT Services page. Knowledge is power, and we’re here to keep you in the loop. And if you have any questions or concerns about your own cybersecurity, don’t hesitate to reach out to us. We’re always here to help.