Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Following the July 3, 2021 news of a ransomware attack targeting Kaseya, a US-based software developer that supplies managed service providers (MSP), more information about the incident, including additional indicators of compromise (IOC) have now been shared. Reportedly the "biggest ransomware attack on record" according to some, initial reports suggested that Kaseya themselves were compromised and their network management software, VSA, was compromised to deploy a ransomware threat to their customers.

Whilst originally thought to be a local privilege escalation vulnerability in the Windows Print Spooler, identified as CVE-2021-1675 and patched during Microsoft's June Patch Tuesday, Microsoft increased the severity of this issue on June 21 as well as reclassifying it as a 'remote code execution' (RCE) threat.

News has been surfacing throughout the day on July 3, 2021, of a seemingly large ransomware attack affecting hundreds of organizations following a software supply chain compromise at the supplier of software to managed service providers (MSPs).

Business decision-makers are inundated today with messages about the importance of digital transformation and innovation. If you want to stay ahead of the competition, you're told, you need to take full advantage of the cloud, move to microservices, replace your VMs with containers and so on. Yet what often gets lost or overlooked in those conversations is the digital risk that goes hand-in-hand with digital transformation.

Commencing just before 1000hrs UTC on June 8, 2021, widespread reports of high-profile websites being unavailable began to surface with visitors to these sites receiving ominous looking error messages (Figure 1). Figure 1 - Example outage message 'gov.uk' Initially, many of these error messages returned a HTTP error '503', advising the user that the service is unavailable, and these originated from a 'Varnish cache server' HTTP accelerator that was attempting to serve the intended content.

Updated as of June 7th 2021 It's an excellent time to be an online retailer. In 2021, over 230 million Americans will be shopping digitally, positioning the United States as one of the leading e-commerce markets. Social platforms are highly influential with millennials, teens, and Gen Z consumers; 50 percent of college students have purchased on Instagram, and 48% of U.S. internet users aged 18 to 34 years have purchased through social media this year.

SMS-based phishing attacks are nothing new. They’ve been around in one form or another since the technology became mainstream in the mid-90s, and more so since the introduction of smartphones a decade and a half ago. However, in their latest incarnation, AKA Smishing, such attacks are progressively executed on a scale never seen before. In the last couple of months, Cyberint has seen an increase of SMS phishing attacks targeting the customers of retail companies.

The AXA Group has been targeted by Ransomware and the threat actors have publicly announced this incident. AXA Group’s IT Operations were affected regionally in the Philippines, Thailand, Malaysia and Hong Kong. The hostaged data, amounting to approximately 3 terabytes, consisted of customers’ personally identifiable information, health records, medical claims, patients’ personal health conditions, photos of IDs and passports, bank documents, and hospital invoices.

Threat intelligence solutions provide security teams with critical context on cybersecurity vulnerabilities and the threat actors seeking to exploit them. This helps organizations to respond proactively and efficiently to threats. Yet while all threat intelligence tools offer the core feature of basic information about cybersecurity threats, they vary significantly in the ways they make available that data.

First observed in 2019 and advertised (Figure 1) as a 'Malware-as-a-Service' (MaaS) threat on various cybercriminal forums, Raccoon is an information stealer targeting victim credentials and cryptocurrency wallets. Seemingly favored by some threat actors due to its simplicity, the malware element of Raccoon omits advanced features, such as those used to evade detection, and instead focuses on the 'stealer' task in hand.