DATA BREACHES : 1.5 Million Affected by Data Breach at Insurance Broker Keenan & Associates
GOVERNMENT : US Disrupted Chinese Hacking Operation Aimed at Critical Infrastructure: Report
Security Summit
Swiss Cyber Security Days 2024
RANSOMWARE : The Ransomware Threat in 2024 is Growing: Report
WHITEPAPER : Buyer's Guide for Generative AI Code Security
Vulnerabilities : Most Linux Systems Exposed to Complete Compromise via Shim Vulnerability
Malware & Threats : New macOS Backdoor Linked to Prominent Ransomware Groups
Ransomware
State
Vulnerabilities : Exploitation of Another Ivanti VPN Vulnerability Observed
Vulnerabilities
Malware & Threats : New macOS Backdoor Linked to Prominent Ransomware Groups
Nation & State
DATA BREACHES : 1.5 Million Affected by Data Breach at Insurance Broker Keenan & Associates
GOVERNMENT : US Disrupted Chinese Hacking Operation Aimed at Critical Infrastructure: Report
Security Summit
Swiss Cyber Security Days 2024
RANSOMWARE : The Ransomware Threat in 2024 is Growing: Report
WHITEPAPER : Buyer's Guide for Generative AI Code Security
Vulnerabilities : Most Linux Systems Exposed to Complete Compromise via Shim Vulnerability
Malware & Threats : New macOS Backdoor Linked to Prominent Ransomware Groups
Ransomware
State
Vulnerabilities : Exploitation of Another Ivanti VPN Vulnerability Observed
Vulnerabilities
Malware & Threats : New macOS Backdoor Linked to Prominent Ransomware Groups
Nation & State
24 Apr, 2024
Nation & State
MITRE Hacked by State-Sponsored Group via Ivanti Zero-Days
MITRE revealed on Friday that one of its R&D networks was hacked a few months ago by a foreign state-sponsored threat actor leveraging zero-day vulnerabilities in an Ivanti product.
The attack occurred in early January, but it was only discovered this month. It targeted MITRE’s Networked Experimentation, Research, and Virtualization Environment (NERVE), an unclassified collaborative network that is used for research, development, and prototyping.
Following the discovery of the breach, MITRE took the NERVE environment offline and launched an investigation. The organization determined that the attack involved exploitation of two Ivanti Connect Secure VPN device vulnerabilities for initial access.
The vulnerabilities, tracked as CVE-2023-46805 and CVE-2024-21887, were zero-days at the time of the attack. They came to light on January 10, when cybersecurity firm Volexity warned that they had been exploited by hackers backed by the Chinese government to compromise Ivanti VPN devices.
Ivanti immediately provided mitigations, but it took the company nearly three weeks to start releasing proper patches.
Widespread exploitation of the Ivanti flaws started roughly a week after they came to light. Considering that MITRE was targeted before the zero-days were disclosed, the organization may have been targeted by the Chinese threat actors, but it has not shared any attribution details beyond saying that it was a foreign nation-state threat actor.
Google Cloud’s Mandiant is aware of several China-linked threat actors that have exploited the Ivanti VPN vulnerabilities in their attacks.
MITRE said the attackers performed reconnaissance, exploited the Ivanti zero-days, and bypassed its multi-factor authentication system using session hijacking.
“From there, they moved laterally and dug deep into our network’s VMware infrastructure using a compromised administrator account,” MITRE explained. “They employed a combination of sophisticated backdoors and webshells to maintain persistence and harvest credentials.”
MITRE’s investigation is ongoing, but at this point there is no evidence that its core enterprise network or partners’ systems are impacted by the incident.
MITRE is a not-for-profit company operating federally funded R&D centers on behalf of U.S. government sponsors. The company is widely known in the cybersecurity for its ATT&CK knowledge base of adversary tactics and techniques based on real-world cyberattack observations.
MITRE has shared information on the observed ATT&CK techniques, as well as best practice tips for detecting such attacks, and recommendations for hardening networks.
CVE-2023-46805 and CVE-2024-21887 have also been used to hack into systems belonging to the cybersecurity agency CISA, which revealed earlier this month that the incident could affect 100,000 individuals.
Late last month MITRE opened a new AI Assurance and Discovery Lab for discovering and managing risks in AI-enabled systems.
21 Feb, 2024
Swiss Cyber Security Days 2024
Shaping Cyber Resilience
Secure your place for a secure future and discover the top-class programme with representatives from NATO, the Swiss Armed Forces and ETH Zurich Space, among others, on the BERNEXPO site!
Information :
Swiss Cyber Security Days
15 Feb, 2024
Security Summit
SecurityWeek’s Security Summit events are a series of topic-specific virtual conferences that allow attendees from around the world to immerse in a virtual world to discuss the latest cybersecurity trends and gain insights into security strategies and emerging cyber threats faced by businesses.
2024 Virtual Events Schedule
- Attack Surface Management Summit | February 15, 2024
- Supply Chain Security and Third-Party Risk Summit | March 20, 2024
- Ransomware Resilience & Recovery Summit | April 17, 2024
- Threat Detection and Incident Response Summit | May 22, 2024
- CISO Forum Virtual Summit – June 18-19, 2024
- Cloud Security Summit | July 17, 2024
- Identity & Zero Trust Strategies Summit | August 7, 2024
- ICS Cybersecurity Conference – October 21-24, 2024 | Atlanta + Hybrid
- Cyber AI & Automation Summit |- December 4, 2024
Information : Security Summits
12 Feb, 2024
Vulnerabilities : Exploitation of Another Ivanti VPN Vulnerability Observed
Organizations urged to hunt for potential compromise as exploitation of a recent Ivanti enterprise VPN vulnerability begins. by Ionut Arghire
Exploitation of a recently disclosed XML external entity (XXE) vulnerability impacting Ivanti enterprise VPN and network access products has commenced, multiple security researchers warned over the weekend.
Affecting the SAML component of Ivanti Connect Secure, Policy Secure, and ZTA gateway appliances and tracked as CVE-2024-22024 (CVSS score of 8.3), the issue can be exploited to access certain restricted resources without authentication.
Last week, Ivanti announced that patches for the bug were released for Connect Secure versions 9.x and 22.x, Policy Secure versions 9.x and 22.x, and ZTA gateways versions 22.x.
Attack surface management firm WatchTowr, which Ivanti eventually credited for finding the bug, says that exploitation of CVE-2024-22024 is possible with a basic, publicly available payload for out-of-bounds XXE.
WatchTowr also notes that Ivanti introduced the vulnerability in the latest versions of the affected products, when attempting to address a different vulnerability in the SAML component.
Given the increased attention Ivanti’s VPN products have been receiving lately due to the exploitation of zero-day vulnerabilities, the cybersecurity firm did not release proof-of-concept (PoC) code targeting CVE-2024-22024, but shared information on how organizations can detect the bug in their environments.
Over the weekend, however, PoC exploits for the bug were made public, and security researchers started warning organizations that they should check their logs to identify potential exploitation attempts.
Responding to Kevin Beaumont on X, security researcher David Vorel said he observed devices being compromised shortly after the latest patches were installed on them and a factory reset was performed, suggesting that the bug had been under active exploitation already.
Ivanti says that customers should apply the patches for CVE-2024-22024 regardless of whether they installed the patches released on January 31 or February 1, which address several other flaws, including two zero-days.
If those patches have been installed and a factory reset was performed, however, customers do not need to factory reset their appliances once again.
Ivanti has yet to confirm that CVE-2024-22024 is being exploited in malicious attacks.
“We have no evidence of this vulnerability being exploited in the wild as it was found during our internal review and testing of our code, and responsibly disclosed by watchTowr,” Ivanti notes, urging customers to update their appliances as soon as possible.
12 Feb, 2024
Vulnerabilities
ExpressVPN User Data Exposed Due to Bug
ExpressVPN disables split tunneling on Windows after learning that DNS requests were not properly directed. by Ionut Arghire
ExpressVPN last week disabled split tunneling on its Windows clients to prevent an issue where DNS requests were not properly directed to its servers.
The issue, introduced in May 2022 in version 12.23.1 of ExpressVPN, resulted in DNS requests remaining unprotected in certain conditions, the VPN solutions provider announced.
Normally, when a user is connected to ExpressVPN, their DNS requests are sent to the company’s servers.
Due to the bug, the requests were sent to a third party, typically the internet services provider (ISP), unless otherwise configured, which could determine the domain visited by the user, but not individual pages and other behavior.
“All contents of the user’s traffic remain encrypted by the VPN and unviewable by the ISP or any other third party,” ExpressVPN explains.
The bug impacted versions 12.23.1 through 12.72.0 of ExpressVPN for Windows, if the split-tunneling feature was used and the ‘Only allow selected apps to use the VPN’ mode was enabled.
The split tunneling feature is meant to allow users to limit the applications that can send their traffic through the VPN solution.
According to ExpressVPN, the bug impacted less than 1% of its Windows users, given that the issue could not be reproduced without split tunneling activated or with split tunneling used in ‘Do not allow selected apps to use the VPN’ mode.
“No other VPN protections, such as encryption, were affected,” ExpressVPN explains.
Version 12.73.0 of ExpressVPN for Windows was rolled out last week to disable split tunneling entirely, and users are advised to upgrade their installations as soon as possible. The feature will remain disabled until the underlying issue is identified and addressed.
Users in urgent need of split tunneling may downgrade to version 10 of ExpressVPN for Windows, in which the feature functions as intended.
Information : ExpressVPN User Data Exposed Due to Bug
10 Feb, 2024
State
UN Experts Investigating 58 Suspected North Korean Cyberattacks Valued at About $3 Billion
U.N. experts are investigating 58 suspected North Korean cyberattacks valued at approximately $3 billion, with the money reportedly being used fund development of weapons of mass destruction. by Associated Press
U.N. experts say they are investigating 58 suspected North Korean cyberattacks between 2017 and 2023 valued at approximately $3 billion, with the money reportedly being used to help fund its development of weapons of mass destruction.
And the high volume of cyberattacks by North Korean hacking groups who report to the Reconnaissance General Bureau, North Korea’s primary foreign intelligence organization, is reportedly continuing, the panel of experts said in the executive summary of a new report to the U.N. Security Council obtained Friday by The Associated Press.
The report covering the period from July 2023 to January 2024 and reflecting contributions from unidentified U.N. member nations and other sources, was sent to the 15-member council as North Korean leader Kim Jong Un has raised tensions in the region. He is threatening to annihilate South Korea if provoked and escalating weapons demonstrations. In response, the United States, South Korea and Japan have strengthened their combined military exercises.
Amid the increased military and political tensions on the Korean Peninsula, the experts said North Korea “continued to flout (U.N.) sanctions,” further developed its nuclear weapons, and produced nuclear fissile materials – the weapons’ key ingredients.
The experts said a light-water reactor at North Korea’s main nuclear complex at Yongbyon “appeared to be operational.” South Korea’s defense minister said in late December that the reactor would likely be formally operational by the summer, amid suspicions the North may use it as a new source of fissile materials for nuclear weapons.
North Korea has long produced weapons-grade plutonium from its widely known 5-megawatt reactor at Yongbyon. The light-water reactor would be an additional source of bomb fuels, and observers say its bigger capacity could allow it to produce more plutonium. Yongbyon has a uranium enrichment facility as well.
The panel said activities at North Korea’s Punggye-ri nuclear test site “continued.” U.S. and South Korean officials have said North Korea is likely preparing to conduct its seventh nuclear test from the site, which would be the first since 2017.
Outside estimates on the size of North Korea’s nuclear arsenal vary, ranging from 20-60 to more than 100. Experts say North Korea can add six to 18 bombs each year. Since his diplomacy with the U.S. collapsed in 2019, Kim Jong Un has repeatedly vowed to build more nuclear weapons and introduce high-tech weapons to cope with what he calls intensifying U.S. hostility.
The panel said that during the six-month period ending in January, the Democratic People’s Republic of Korea or DPRK — the North’s official name — launched at least seven ballistic missiles — one a three-stage intercontinental ballistic missile, one possibly an intermediate-range missile and five short-range ballistic missiles.
After two failed attempts, the DPRK successfully placed a military observation satellite in orbit, the experts said. And a diesel submarine was retrofitted as a “tactical nuclear attack submarine” and added to the North’s military arsenal.
The panel, which monitors U.N. sanctions against North Korea, said the DPRK continues importing refined petroleum products in violation of Security Council resolutions, using “combinations of obfuscation methods” to evade maritime sanctions.
The DPRK’s recorded trade volume in 2023 surpassed the total for 2022, the experts said, including a large variety of consumer goods, “some of which could be classified as luxury items” that are banned by U.N. sanctions.
The panel said it is also investigating reports from member states about the DPRK supplying arms and ammunition in violation of U.N. sanctions.
The United States, Ukraine and six allies accused Russia last month of using North Korean ballistic missiles and launchers in a series of devastating aerial attacks against Ukraine, in violation of U.N. sanctions.
South Korea’s military said in November that it suspected North Korea had sent an unspecified number of short-range ballistic missiles, anti-tank missiles and portable anti-air missiles to Russia, in addition to rifles, rocket launchers, mortars and shells in violation of U.N. sanctions.
During the six-month period, the experts said, “trends include DPRK targeting of defense companies and supply chains, and increasingly sharing infrastructure and tools.”
The panel said it also investigated reports of numerous DPRK nationals working overseas, including in information technology, restaurants and construction, and earning income in violation of U.N. sanctions.
And in another sanctions violation, they said, “The DPRK continues to access the international financial system and engage in illicit financial operations.”
U.N. sanctions are not supposed to hurt ordinary North Koreans, but the panel said “there can be little doubt that U.N. sanctions and their implementation have unintentionally affected the humanitarian situation and some aspects of aid operations.” But it said “their relative role remains impossible to disaggregate from many other factors.”
09 Feb, 2024
Malware & Threats : New macOS Backdoor Linked to Prominent Ransomware Groups
Written in Rust, the new RustDoor macOS backdoor appears linked to Black Basta and Alphv/BlackCat ransomware. By Ionut Arghire
A newly identified macOS backdoor written in Rust appears linked to the prominent ransomware families Black Basta and Alphv/BlackCat, cybersecurity firm Bitdefender reports.
The malware, dubbed RustDoor, impersonates Visual Studio, supports both Intel and Arm architectures, and appears to have been circulating since November 2023, remaining undetected for roughly three months.
Bitdefender has identified several variants of the malware, all sharing the same backdoor functionality, albeit with minor variations.
All analyzed samples support multiple commands to harvest and exfiltrate files and to gather details about the infected machine. The information is sent to a command-and-control (C&C) server to generate a victim ID that is used in subsequent communication.
The first variant of the backdoor, which appeared in November 2023, was likely a test version that lacked a complete persistence mechanism and also contained a plist file named ‘test’.
First seen at the end of November, the second variant had larger files and contained a complex JSON configuration and an Apple script for the exfiltration of specific documents from the Documents and Desktop folders, along with the user’s notes.
The malware copies the documents to a hidden folder and compresses them to a ZIP archive before sending them to the C&C server.
Bitdefender discovered that RustDoor’s configuration file contains options to impersonate different applications, with options to customize a spoofed administrator password dialog.
ADVERTISEMENT. SCROLL TO CONTINUE READING.
Learn about Process Mining
“Some configurations also include specific instructions about what data to collect, such as the maximum size and maximum number of files, as well as lists of targeted extensions and directories, or directories to exclude,” Bitdefender explains.
The JSON configuration also references four persistence mechanisms, using cronjobs, using the LaunchAgents (resulting in execution at login), by modifying a file to ensure execution when a new ZSH session is opened, and by adding the binary to the dock.
Bitdefender also identified a third variant of the backdoor, which appears to be the original one. First seen on November 2, it lacks complexity, the Apple script, and the embedded configuration.
RustDoor, Bitdefender says, uses three C&C servers previously associated with Black Basta and Alphv/BlackCat ransomware campaigns. First seen in November 2021, BlackCat is the first file-encrypting ransomware written in the Rust programming language. It was taken down in December 2023.
09 Feb, 2024
Malware & Threats : New macOS Backdoor Linked to Prominent Ransomware Groups
Written in Rust, the new RustDoor macOS backdoor appears linked to Black Basta and Alphv/BlackCat ransomware. by Ionut Arghire
A newly identified macOS backdoor written in Rust appears linked to the prominent ransomware families Black Basta and Alphv/BlackCat, cybersecurity firm Bitdefender reports.
The malware, dubbed RustDoor, impersonates Visual Studio, supports both Intel and Arm architectures, and appears to have been circulating since November 2023, remaining undetected for roughly three months.
Bitdefender has identified several variants of the malware, all sharing the same backdoor functionality, albeit with minor variations.
All analyzed samples support multiple commands to harvest and exfiltrate files and to gather details about the infected machine. The information is sent to a command-and-control (C&C) server to generate a victim ID that is used in subsequent communication.
The first variant of the backdoor, which appeared in November 2023, was likely a test version that lacked a complete persistence mechanism and also contained a plist file named ‘test’.
First seen at the end of November, the second variant had larger files and contained a complex JSON configuration and an Apple script for the exfiltration of specific documents from the Documents and Desktop folders, along with the user’s notes.
The malware copies the documents to a hidden folder and compresses them to a ZIP archive before sending them to the C&C server.
Bitdefender discovered that RustDoor’s configuration file contains options to impersonate different applications, with options to customize a spoofed administrator password dialog.
“Some configurations also include specific instructions about what data to collect, such as the maximum size and maximum number of files, as well as lists of targeted extensions and directories, or directories to exclude,” Bitdefender explains.
The JSON configuration also references four persistence mechanisms, using cronjobs, using the LaunchAgents (resulting in execution at login), by modifying a file to ensure execution when a new ZSH session is opened, and by adding the binary to the dock.
Bitdefender also identified a third variant of the backdoor, which appears to be the original one. First seen on November 2, it lacks complexity, the Apple script, and the embedded configuration.
RustDoor, Bitdefender says, uses three C&C servers previously associated with Black Basta and Alphv/BlackCat ransomware campaigns. First seen in November 2021, BlackCat is the first file-encrypting ransomware written in the Rust programming language. It was taken down in December 2023.
Information : New macOS Backdoor Linked to Prominent Ransomware Groups
09 Feb, 2024
Ransomware
Ransomware Payments Surpassed $1 Billion in 2023: Analysis
The payments made by victims in response to ransomware attacks doubled in 2023 compared to 2022, according to Chainalysis. By Eduard Kovacs
The payments made by victims of ransomware attacks doubled in 2023 compared to the previous year, exceeding $1 billion, according to blockchain analysis firm Chainalysis.
The company has looked at the cryptocurrency wallets known to be used by cybercrime groups to receive ransom payments from victims and found a total of $1.1 billion, up from $557 million in 2022.
It’s worth noting that these amounts are “conservative estimates” and they may increase as new cryptocurrency wallet addresses are identified. For instance, when it published its 2022 report, Chainalysis only identified $457 million in ransom payments, but that number has since gone up by $100 million. The number for 2021 increased from $766 million to $983 million over the past year.
It’s also worth pointing out that these figures only represent the actual ransom payments, not other damages suffered by companies hit by ransomware.
Chainalysis highlighted in its report for 2022 that ransomware payments had dropped, attributing it to the increasing use of data backups, cyberinsurance policy changes, and fear of sanction violations.
Now the company says 2022 was an anomaly, not a trend, and 2023 was a record high.
“In 2023, the ransomware landscape saw a major escalation in the frequency, scope, and volume of attacks,” Chainalysis said.
The number of threat actors involved in ransomware attacks increased in 2023, with threat intelligence firm Recorded Future seeing 538 new ransomware variants. In addition, cybercriminals are making more money due to increasingly focusing on big game hunting, which involves targeting high-value organizations from which they can demand bigger ransom payments.
Ransomware-as-a-service, where affiliates get many of the resources they need from the ransomware operators, has been making it increasingly easy to carry out attacks. In addition, initial access brokers (IABs) have also made it easier for cybercriminals to conduct data theft and file-encryption attacks.
07 Feb, 2024
Vulnerabilities : Most Linux Systems Exposed to Complete Compromise via Shim Vulnerability
A critical vulnerability in Shim could allow a network attacker to bypass secure boot and take over a vulnerable Linux system.
Shim is a small application containing certificates and code to verify the bootloader, and is used by most Linux distributions during the boot process, to support secure boot.
Identified in Shim’s HTTP protocol handling, the vulnerability leads to an out-of-bounds write, which could be exploited for remote code execution.
The flaw is tracked as CVE-2023-40547 and, according to a NIST advisory, has a CVSS score of 9.8. Red Hat, however, assesses the bug as being ‘high severity’, with a CVSS score of 8.3.
“The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete system compromise,” Red Hat’s advisory reads.
An attacker could intercept the HTTP traffic between the victim system and the server delivering files to support the HTTP boot, supply chain risk management firm Eclypsium explains in a technical writeup.
“The attacker could be located on any network segment between the victim and the legitimate server,” the firm says.
A local attacker with enough privileges to modify EFI variables or EFI partition data, such as by using a live Linux USB drive, could change boot order to load a vulnerable shim and execute privileged code without disabling secure boot.
ADVERTISEMENT. SCROLL TO CONTINUE READING.
Learn about Process Mining
According to Eclypsium, an attacker on the same network as the target system could manipulate PXE to chain-load a vulnerable Shim bootloader.
“An attacker exploiting this vulnerability gains control of the system before the kernel is loaded, which means they have privileged access and the ability to circumvent any controls implemented by the kernel and operating system,” Eclypsium notes.
Resolving the vulnerability, the firm explains, requires not only updating Shim to a patched version, but also updating the secure boot chain of trust, by refreshing the UEFI Secure Boot DBX (revocation list).
Five other high- and medium-severity vulnerabilities in Shim were disclosed recently, leading to crashes, denial-of-service (DoS), or leakage of sensitive data during system boot.
10 Jan, 2024
GOVERNMENT : US Disrupted Chinese Hacking Operation Aimed at Critical Infrastructure: Report
US government reportedly disabled parts of a botnet-powered cyber campaign conducted by the Chinese threat actor Volt Typhoon. by Eduard Kovacs
The United States government has disrupted parts of a major hacking campaign attributed to a threat actor linked to China, according to Reuters.
The news giant learned from unnamed Western security officials and one person familiar with the matter that the FBI and the Justice Department have been authorized to remotely disable some aspects of a Chinese cyber operation named Volt Typhoon, which has been known to target critical infrastructure.
The disruption attempt reportedly took place in recent months, but no details are available on exactly what was targeted or what actions were taken.
Volt Typhoon came to light in May 2023, when Microsoft warned that Chinese government hackers had been stealing data from critical infrastructure in the US territory of Guam.
In December, the hacking operation was linked to what was described as an ‘unkillable’ botnet powered by many routers and other IoT devices, predominantly easy-to-hack products that had reached end of life.
Cybersecurity firm SecurityScorecard reported earlier this month that it had found evidence suggesting that the UK and Australian governments have also been targeted by Volt Typhoon.
SecurityScorecard’s research found that the hackers had compromised many vulnerable Cisco routers between late-November and early January. The fact that these router hijacking attacks are very recent indicates that the hackers are likely still active even after the US’s disruption attempt.
The threat actor has been around since at least mid-2021, targeting organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, IT, and education sectors.
Reuters reported that the White House has asked the private sector for assistance in tracking Volt Typhoon. National security experts told the news service that attacks such as the ones conducted by this group could enable China to “remotely disrupt important facilities in the Indo-Pacific region that in some form support or service US military operations”.
Some of Reuters’ sources raised concerns that the hackers’ goal may be to disrupt the readiness of the United States in case China invades Taiwan.
“This actor is not doing the quiet intelligence collection and theft of secrets that has been the norm in the US. They are probing sensitive critical infrastructure so they can disrupt major services if, and when, the order comes down,” John Hultquist, chief analyst at Mandiant Intelligence, which is part of Google Cloud, told SecurityWeek.
Hultquist previously discussed the activities of Volt Typhoon and the threat posed by the hacker group at SecurityWeek’s 2023 ICS Cybersecurity Conference.
Information : US Disrupted Chinese Hacking Operation Aimed at Critical Infrastructure: Report
30 Aug, 2023
DATA BREACHES : 1.5 Million Affected by Data Breach at Insurance Broker Keenan & Associates
Insurance brokerage firm Keenan & Associates says personal information stolen in an August 2023 cyberattack. by Ionut Arghire
Insurance consulting and brokerage firm Keenan & Associates is informing more than 1.5 million individuals that their personal information was stolen in an August 2023 cyberattack.
The incident, the company said in a notification on its website, was discovered on August 27, when disruptions occurred on some of its servers, and was contained within hours.
Keenan’s investigation into the cyberattack revealed that “an unauthorized party gained access to certain Keenan internal systems at various times between approximately August 21, 2023 and August 27, 2023.”
During that time, the attackers exfiltrated some data from the company’s systems, including personal information that Keenan had received and utilized to provide services to its clients.
According to the company, the exposed personal information varies by individual but includes names in combination with dates of birth, Social Security numbers, driver’s license numbers, passport numbers, health insurance information, and general health information.
Keenan says it has notified the impacted clients and has started sending out written notifications to the individuals whose data may have been compromised.
“While we are not aware of any evidence that your personal information has been misused, we wanted to make you aware of the incident and provide you with additional information on steps you may consider taking,” the company said in the notification letter sent to the impacted individuals.
The insurance broker informed the Maine Attorney General’s Office that more than 1.5 million individuals had their personal information compromised in the incident.
30 Jan, 0024
WHITEPAPER : Buyer's Guide for Generative AI Code Security
Although AI is a technology that has been around for decades, it’s only fairly recently that we’ve seen an explosion in adoption of AI. This recent uptick can be attributed to a combination of different factors, including advancements in hardware, algorithms, data availability, advancements in deep learning, and the availability of pre-trained AI models like ChatGPT.
In this Buyer's Guide, we will cover:
- How to properly educate your teams on generative AI tools and usage.
- The tools necessary for effectively leveraging and securing AI generated code.
- The importance of using the right tool for the job–securing your AI generated code.
Information : Snyk
30 Jan, 0024
RANSOMWARE : The Ransomware Threat in 2024 is Growing: Report
Anyone who believes ransomware will go away doesn’t understand the nature of criminality. Extortion has and always will be a primary criminal business plan. by by Kevin Townsend
Almost all aspects of ransomware worsened in 2023 compared to 2022. Noticeably, criminals are increasingly focused on data extraction without necessarily using encryption payloads. The implication is the ransomware threat will continue to increase and evolve in 2024.
This is the only conclusion possible from a survey report published by Delinea. More than 300 US IT and security decision makers in multiple verticals were surveyed, and 2023’s results compared with the previous year’s survey.
The biggest problem with any survey is the degree of subjectivity involved in the analysis, and the inevitably small sample used, making it scientifically unfounded. At the same time, purely coincidentally, all surveys tend to recommend the publisher’s own products as a solution to the issues raised by the survey. We cannot escape from the reality that surveys are produced primarily for marketing purposes.
For such reasons, SecurityWeek has largely applied its own subjective analysis to the respondent facts surfaced by the survey.
The volume of ransomware attacks is not a constant and can be affected by many short term factors (take downs, criminal retirements, retooling, etcetera). 2022 showed a reduction, and some commentators suggested that the tide was turning against ransomware. 2023 has demonstrated this was a false dawn, with more than twice the number of victims in 2023 compared to 2022.
Anyone who believes ransomware will go away doesn’t understand the nature of criminality. Extortion has and always will be a primary criminal business plan. The current Delinea report demonstrates that the delivery of extortion can be fine-tuned (the evolution from encryption to data exfiltration), but the purpose remains the same, and the incidence will continue to increase.
The success of this business plan is demonstrated by an increase in the number of victims who have paid the ransom — up from 68% to 76% (and remember that is 76% of a higher number of victims). What cannot be measured is the effect of cyberinsurance on ransomware delivery and response. Some commentators believe that attackers look for victims with cyberinsurance, and the report notes, “One reason for the willingness to pay may be the rise of cyberinsurance.”
Insurance provides a financial safety net, making the decision to pay an easy option. This safety net may also partly explain why security budgets have increased more for ransomware prevention than recovery, something also highlighted by the report. Prevention can lead to lower premiums and may be an insurance condition, while the recovery costs are offset by insurance claims. If this assumption is correct, it helps to explain the increase in ransomware defense budgets coinciding with a decrease in recovery budgets – the latter now comes out of a possibly separate insurance budget.
Delinea’s analysis of ransomware attacks in 2022 and 2023 also demonstrates the basic reactionary problem for cybersecurity practitioners. Victims cannot escape negative effects from an attack, but the response to those attacks comes after the attack. For example, lost revenue increased from 56% to 62% and reputational damage increased from 43% to 48% during 2022 and 2023. However, security budget increases simultaneously decreased from 76% to 61% in the same period — perhaps partly in response to the lower attack levels of the previous year than the current situation.
It is also noticeable that board-level concern is currently high (although sadly there is no comparison with the previous year’s figures). Fifty percent of respondents report that executive leadership always has ransomware as an item on the agenda, while a further 26% say it is a top priority that is frequently discussed. What we can’t tell from the survey is whether this concern is static, increasing or decreasing.
Interestingly, Delinea comments on this: “Executives and Boards are listening but not all are acting.” There are no details to justify this statement. It may well be true, but it is not proven by the survey.
One of the most interesting sections of Delinea’s survey reports on the criminal motivations (in addition, of course, to gaining money). The answers are subjective, but come from people in the trenches of ransomware defense. Data exfiltration has increased from 46% to 64%, while a simple ‘money grab’ has decreased from 69% to 34%. This clearly reflects the criminals’ fine-tuning of the extortion process.
Other motivations include supply chain attacks up from 44% to 55% (reflecting increasing criminal professionalism in choosing the potentially most rewarding paths); creating chaos (up from 39% to 51%) and geopolitics and activism (up from 26% to 32%).
Overall, Delinea’s State of Ransomware 2024 (PDF) report tells us that ransomware quite closely parallels the overall cybersecurity ecosphere: it’s getting worse. This is perhaps not surprising when ransomware is a tool used by both cybercriminal groups (who are getting more professional and more sophisticated), and nation-state actors (who are becoming more active in an era of extreme geopolitical tensions).
information : The Ransomware Threat in 2024 is Growing: Report
30 Jan, 0024
RANSOMWARE : The Ransomware Threat in 2024 is Growing: Report
Anyone who believes ransomware will go away doesn’t understand the nature of criminality. Extortion has and always will be a primary criminal business plan. by by Kevin Townsend
Almost all aspects of ransomware worsened in 2023 compared to 2022. Noticeably, criminals are increasingly focused on data extraction without necessarily using encryption payloads. The implication is the ransomware threat will continue to increase and evolve in 2024.
This is the only conclusion possible from a survey report published by Delinea. More than 300 US IT and security decision makers in multiple verticals were surveyed, and 2023’s results compared with the previous year’s survey.
The biggest problem with any survey is the degree of subjectivity involved in the analysis, and the inevitably small sample used, making it scientifically unfounded. At the same time, purely coincidentally, all surveys tend to recommend the publisher’s own products as a solution to the issues raised by the survey. We cannot escape from the reality that surveys are produced primarily for marketing purposes.
For such reasons, SecurityWeek has largely applied its own subjective analysis to the respondent facts surfaced by the survey.
The volume of ransomware attacks is not a constant and can be affected by many short term factors (take downs, criminal retirements, retooling, etcetera). 2022 showed a reduction, and some commentators suggested that the tide was turning against ransomware. 2023 has demonstrated this was a false dawn, with more than twice the number of victims in 2023 compared to 2022.
Anyone who believes ransomware will go away doesn’t understand the nature of criminality. Extortion has and always will be a primary criminal business plan. The current Delinea report demonstrates that the delivery of extortion can be fine-tuned (the evolution from encryption to data exfiltration), but the purpose remains the same, and the incidence will continue to increase.
The success of this business plan is demonstrated by an increase in the number of victims who have paid the ransom — up from 68% to 76% (and remember that is 76% of a higher number of victims). What cannot be measured is the effect of cyberinsurance on ransomware delivery and response. Some commentators believe that attackers look for victims with cyberinsurance, and the report notes, “One reason for the willingness to pay may be the rise of cyberinsurance.”
Insurance provides a financial safety net, making the decision to pay an easy option. This safety net may also partly explain why security budgets have increased more for ransomware prevention than recovery, something also highlighted by the report. Prevention can lead to lower premiums and may be an insurance condition, while the recovery costs are offset by insurance claims. If this assumption is correct, it helps to explain the increase in ransomware defense budgets coinciding with a decrease in recovery budgets – the latter now comes out of a possibly separate insurance budget.
Delinea’s analysis of ransomware attacks in 2022 and 2023 also demonstrates the basic reactionary problem for cybersecurity practitioners. Victims cannot escape negative effects from an attack, but the response to those attacks comes after the attack. For example, lost revenue increased from 56% to 62% and reputational damage increased from 43% to 48% during 2022 and 2023. However, security budget increases simultaneously decreased from 76% to 61% in the same period — perhaps partly in response to the lower attack levels of the previous year than the current situation.
It is also noticeable that board-level concern is currently high (although sadly there is no comparison with the previous year’s figures). Fifty percent of respondents report that executive leadership always has ransomware as an item on the agenda, while a further 26% say it is a top priority that is frequently discussed. What we can’t tell from the survey is whether this concern is static, increasing or decreasing.
Interestingly, Delinea comments on this: “Executives and Boards are listening but not all are acting.” There are no details to justify this statement. It may well be true, but it is not proven by the survey.
One of the most interesting sections of Delinea’s survey reports on the criminal motivations (in addition, of course, to gaining money). The answers are subjective, but come from people in the trenches of ransomware defense. Data exfiltration has increased from 46% to 64%, while a simple ‘money grab’ has decreased from 69% to 34%. This clearly reflects the criminals’ fine-tuning of the extortion process.
Other motivations include supply chain attacks up from 44% to 55% (reflecting increasing criminal professionalism in choosing the potentially most rewarding paths); creating chaos (up from 39% to 51%) and geopolitics and activism (up from 26% to 32%).
Overall, Delinea’s State of Ransomware 2024 (PDF) report tells us that ransomware quite closely parallels the overall cybersecurity ecosphere: it’s getting worse. This is perhaps not surprising when ransomware is a tool used by both cybercriminal groups (who are getting more professional and more sophisticated), and nation-state actors (who are becoming more active in an era of extreme geopolitical tensions).
information : The Ransomware Threat in 2024 is Growing: Report