Confiant’s Taha Karim has released a deep-dive into an extensive campaign from threat actor SeaFlower, where backdoored Web3 Wallets for iOS and Android mimics official cryptocurrency wallet websites intending to distribute apps that drain victims’ funds. The threat actor is likely Chinese according to the deep dive.
Chris Olson of The Media Trust had this to say:
“Cryptocurrency is rapidly becoming a battlefield for global cyber actors who target crypto owners through multiple channels. While many are waking up to the danger of email-based phishing scams, few are prepared for SEO and web-based attacks that target Internet traffic and mobile users. Aside from encouraging caution among NFT and crypto users, this incident has three implications: first, web and mobile devices are growing as threat surfaces – second, foreign actors can leverage those surfaces to target users around the world. Finally, Web3 may be vulnerable to the same threats that have made Web 2.0 unsafe for years, unless early adopters of the technology commit to minimal standards of digital safety and trust.”
There are mitigation strategies in the deep dive, along with promises of a “part 2” to this. Thus if you’re in the cryptocurrency space, you might want to stay tuned for that.
Kaiser Permanente Pwned…. Info On 70K Patients Exposed
Posted in Commentary with tags Hacked on June 13, 2022 by itnerdKaiser Permanente has issued a breach notice regarding a data breach which occurred in early April, exposing 70k patients’ names, medical record numbers, dates of service and lab test results. Although not specified in Kaiser’s breach notice, regulators from the US Department of Health and Human Services Office for Civil Rights confirms this as a result of the email security slip-up at Kaiser’s Washington unit that let threat actors get in and have a few hours of access before they were shut down. I use the words “slip-up” based on this from the breach notice:
The employee received additional training on safe email practices, and we are exploring other steps we can take to ensure incidents like this do not happen in the future.
That means that the employee was either phished or clicked on something that ran malware to allow this to happen.
Sanjay Raja, VP of Product, Gurucul:
“It is most likely that the threat actor(s) involved were already inside for some time and what was detected was the actual data being exfiltrated within hours. What is becoming more evident as we see attacks similar to the Kaiser disclosure is Identity Threat Detection and Response (ITDR) is a critical component of any security operations program. However, too many solutions are rushing to announce identity-based capabilities for XDR or SIEM, but are simply correlating Active Directory data, while claiming to offer ‘identity analytics. This does nothing to automatically detect a threat and leaves security teams to continue to manually determine if an attack is active, which also leaves them chasing a lot of false positives that can potentially waste a lot of time and resources. Incorporating a full-blown set of identity data ingestion, analytics on infrastructure activity, access privileges and entitlements, combined with user and entity behavior analytics can provide security teams with not only understanding of risky or suspicious activity, but rapidly determine if an actual attack is taking place. More importantly, the key to stopping data from being stolen is enabling identity-centric response based on a full understanding of the risk to an organization based on what the context discovered and analyzed. Unfortunately, the vendor marketing hype is in full force already.”
Hopefully Kaiser Permanente does more than just do training on one employee. Because now that this is out there, a lot of patients are going to be worried about their personal information. Which will likely lead to some of them calling their lawyers. And that won’t end well for Kaiser Permanente.
Leave a comment »