← Cybersecurity Today
Cybersecurity Today
Hackers Move From Data Theft To Complete Destruction: Cyber Security Today For Wednesday, December 4, 2024
00:10:33
Cybersecurity Today: From Data Theft to Total Destruction In today's episode, we cover the latest shifts in cybercrime as hackers move from data theft to complete system destruction, impacting businesses on a massive scale. We discuss Palo Alto...
Loading summary
Transcript1 lines
- [00:01]
Jim Love
Hackers shift from data theft to total destruction. VEEAM patches a critical vulnerability in its service provider console. Privacy commissioner of Saskatchewan recommends an increase in credit monitoring to 10 years. Russia sentences a cyber criminal leader to life in prison and Europeans take down another major cyber crime network. This is CYBERSECURITY today. I'm your host Jim Love. As more and more companies have developed effective backup strategies, cybercriminals are evolving their attacks, moving beyond traditional ransomware attacks to focus on highly destructive campaigns that render systems inoperable. According to a recent report from Palo Alto Networks, these attacks go beyond stealing or encrypting data. They aim to cripple businesses entirely by corrupting systems and halting operations. Unlike traditional ransomware, which holds data hostage for payment, these newer tactics involved wiping data, corrupting virtual machines, and deploying malware designed to destroy key operational systems. Sam Rubin of Palo Altos unit 42 explains that attackers are now targeting large software vendors and service providers, knowing they can disrupt hundreds of connected businesses through a single breach. One of the groups known to have made this pivot is Scattered Spider, the group behind the MGM and Caesars attacks. One example involved hackers forcing the company to disconnect over 100 customers for weeks to ensure safety even if they weren't directly compromised. In another case, a company lost millions of dollars daily from a complete shutdown and quickly paid a ransom to stop the bleeding. These attacks often leverage sophisticated entry points, including phishing, exploiting unpatched software vulnerabilities, and social eng engineering. The differences lie in their intent and execution. Rather than merely demanding money for restored access, they aim to cause such severe operational disruption that the victim faces immense financial and reputational pressure to simply pay up. Rubin noted that this approach demands more preparation from the attackers. They must research a company's dependencies, understand its vendors, and exploit vulnerabilities across a broader ecosystem. While these tactics require greater effort and cost, the payoff can be massive due to the high stakes involved. Paolo Alto warns that such attacks are likely to increase, especially as hackers adopt generative AI tools to uncover new vulnerabilities. While companies need to have strategies to deal with these attacks, they also have to be cognizant of the risks they have from suppliers and software as a service vendors veeam, a company that provides backup and recovery as a service, has issued security updates that address two vulnerabilities in in its service provider console. VSPs, including a critical remote code execution, or RCE, flaw, rated 9.9 out of 10 in severity. The RCE vulnerability identified as CVE2024 2448 could allow attackers to execute arbitrary code from the VSPC Management Agent machine. A second, flawless CVE2024. 42449 could enable attackers to steal NTLM hashes and delete files on affected servers. These vulnerabilities impact VSPC versions 8.1.0.21377 and earlier, including builds 7 and 8. While these flaws require the management agent to be authorized on the server, Veeam urges service providers using supported versions to update immediately. Unsupported versions are also likely vulnerable and should be upgraded to the latest release. Veeam's products are widely used by over 550,000 customers worldwide, including 74% of global 2,082% of Fortune 500 companies. The company has had a number of critical software vulnerabilities over the last year and has been targeted with a number of recent ransomware campaigns. Maybe a wise thing to check to make sure you've got this one up to date. A ransomware attack on Inmar Strategies in Saskatchewan, A subsidiary of firm called Sencora exposed the sensitive personal information of 7,293 people in Saskatchewan. Compromised information includes health records, medication details and personal identifiers, according to a report by the Saskatchewan Information and Privacy Commissioner, Ronald J. Kruzynski. The breach discovered in February, prompted Sencora to notify affected individuals by May and implement measures like system segmentation to prevent future attacks. The company also offered two years of free credit monitoring. Krusaninski recommends, though extending it to 10 years, warning that stolen data can be exploited long after a breach. Previously, Kruzanisky had been asking for five years, but he's decided since then, at least in this case, that amount of time was insufficient. More than 600,000 individuals have had their personal information exposed in a data breach involving SL Data Services, another background check company. The breach included sensitive records such as full names, addresses, email addresses, employment details, social media accounts, criminal records, and property ownership reports stored in unprotected PDF files totaling over 713 gigabytes. The vulnerability was discovered by cybersecurity researcher Jeremiah Fowler, who reported that the database lacked encryption and password protection. It remained publicly accessible for a week before SL Data Services secured the information. The data raised concerns about potential access by malicious actors, though no evidence has yet emerged of exploitation. Like the larger national public data breach affecting 2.9 billion people, this breach poses risks of social engineering attacks. Victims may not be aware that they were even affected as Background checks are often conducted without their direct involvement. While no Social Security numbers or payment information were included, experts warn that the breadth of exposed data could still enable scams and identity theft. Russia has sentenced Stanislav Zimoisev, leader of the Hydra Dark Web market, to life in prison for his role in running the world's largest illicit online marketplace. Moiseyev was also fined 4 million rubles. His 15 accomplices received sentences ranging from 8 to 23 years in penal colonies and fines totaling 16 million rubles. The group was convicted of producing and selling nearly a ton of drugs across Russia and Belarus. Hydra market, active until 2022, was a major hub for drug sales, money laundering and cybercrime services, serving 17 million users and generating $1.35 billion annually. German and US authorities dismantled its servers in a joint operation, seizing 51 million in cryptocurrency. The platform's Bitcoin bank mixer further obscured transactions, complicating law enforcement efforts. This case is part of an unusual crackdown by Russian authorities on cybercriminals. While Russia typically avoids prosecuting hackers targeting foreign entities, it has taken action in select cases. For example, the R Evil ransomware group was shut down after its 2021 Colonial Pipeline attack disrupted U.S. fuel supplies. The sentencing of Moiseyev and arrests of other cybercriminals have led to a lot of speculation as to why Russia appears to be changing its approach to cybercrime. One theory has been that President Joe Biden has specifically intervened, requesting that Russia take action, something Russia has denied. Another is that these groups may not have been paying their tax to the Russian authorities. Whatever the reasoning, this marks a potential shift in Russia's handling of high profile cybercrime operations, and it's worth seeing how this develops. An international law enforcement operation has dismantled Matrix, an encrypted messaging platform used by at least 8,000 criminal accounts to coordinate illegal activities. The operation, codenamed Operation Passion Flower, involved Europol, Eurojust and authorities from multiple European countries, including France, the Netherlands and Germany. Police discovered Matrix while investigating the phone of a suspect involved in the 2021 shooting of journalist Peter R. De Vries. Over three months, authorities intercepted 2.3 million messages sent through the platform, which provided encrypted messaging, video calls and anonymous browsing, as well as transaction tracking. Users would pay up to $1,700 for customized Google Pixel devices and subscriptions to the service. Simultaneous raids across four countries resulted in the shutdown of 40 servers. The arrests of five suspects, including a 52 year old Lithuanian believed to be the platform's operator and the seizure of 970 encrypted phones, €645,000 in cash and cryptocurrency, and four vehicles. Matrix has been marketed under several names, including Matrix and Total sec. Authorities warn Matrix users that their communications may be exposed. However, those who use the service for privacy rather than illegal activities can request exemptions from investigations. The takedown follows similar operations against platforms like encroachat and sky ecc, which have led to thousands of arrests for crimes including drug trafficking and money laundering. This follows on our story on Monday, where we noted another European takedown of a digital piracy service that was also funding money laundering and cybercrime. Score another one for the good guys. That's our show for today. You can find links to reports and other details in our show notes@technewsday.com we welcome your comments, tips and the occasional bit of constructive criticism@editorialechnewsday.ca I'm your host, Jim Love. Thanks for listening.