The CISA, the FBI, and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released an advisory warning of TTPs Phobos ransomware attacks are using to target government and critical infrastructure entities.
“Structured as a ransomware as a service (RaaS) model, […] Phobos ransomware actors have targeted entities including municipal and county governments, emergency services, education, public healthcare, and critical infrastructure to successfully ransom several million in U.S. dollars,” the advisory said.
Attack chains typically leveraged phishing as an initial access vector, or vulnerable networks are breached by hunting for exposed RDP services and exploiting them by means of a brute-force attack.
Once successful, the threat actors deploy additional remote access tools, taking advantage of process injection techniques to execute malicious code and evade detection, and making Windows Registry modifications to maintain persistence within compromised environments.
“Additionally, Phobos actors have been observed using built-in Windows API functions to steal tokens, bypass access controls, and create new processes to escalate privileges by leveraging the SeDebugPrivilege process. Phobos actors attempt to authenticate using cached password hashes on victim machines until they reach domain administrator access,” the agencies said.
Phobos has been active since May 2019, with multiple variants identified. Cisco Talos disclosed in November that those behind 8Base ransomware are utilizing a variant of Phobos for their attacks.
BullWall Executive, Carol Volk had this to say:
“The recent Phobos advisory from CISA, the FBI, and the MS-ISAC sheds light on the continued rise of ransomware attacks targeting government and critical infrastructure sectors. As with many ransomware attacks, the Phobos attacks employed phishing and exploitation of vulnerable RDP services and highlights the importance of robust cybersecurity measures at every level.
“Organizations must prioritize implementing multi-layered defense mechanisms, including strong email security protocols and regular security awareness training to thwart phishing attempts. Additionally, securing remote access points and promptly patching vulnerabilities in RDP services can significantly reduce the risk of exploitation.
“However, we continue to see that even well prepared defenses will be breached by determined actors, so regular air-gapped backups, a ransomware containment system and MFA to protect RDP sessions should be part of the defense stack for the day your defenses are breached.”
John Benkert, CEO, Cigent follows with this:
“Broken record here. Protecting critical infrastructure from Ransomware-as-a-Service (RaaS) attacks requires a multifaceted approach that spans technological, regulatory, and educational domains. Given the increasing sophistication and accessibility of RaaS platforms, which allow even low-skilled attackers to launch ransomware campaigns, the security of essential services such as healthcare, energy, transportation, and water systems has never been more important.
“The foundational step in defending against these threats involves the implementation of robust cybersecurity measures that already exist. This includes regular software updates and patch management to close vulnerabilities, advanced threat detection systems to identify and neutralize threats early, and comprehensive data backup strategies to ensure data integrity in the event of a breach.
“Let me be clear, solutions already exist in the commercial sector to protect against these threats. Instead of cultivating these commercial solutions, the government is more concerned with putting out regulations and standards that take years to approve and become obsolete before they are published.”
This should be a clear warning that defences for critical infrastructure specifically, but all organizations and sectors in general need to be a priority. The question is, how many warnings will it take for organizations to get the message?
Former Twitter Execs Suing Elon Musk For Unpaid Severance
Posted in Commentary with tags Twitter on March 5, 2024 by itnerdRight now Elon Musk is fighting an insane number of lawsuits related to his purchase of Twitter. You can now add one more to that as a bunch of ex-execs from Twitter are suing him over unpaid severance:
Former Twitter executives including CEO Parag Agrawal, Chief Financial Officer Ned Segal, head of legal Vijaya Gadde and General Counsel Sean Edgett filed a new lawsuit against Elon Musk and X Corp. in federal court arguing that they are owed $128 million in unpaid severance.
In their complaint, lawyers for the ex-Twitter executives say that after Musk backed himself into a deal to buy Twitter, now X Corp., for $44 billion, he took revenge against these executives personally, and tried to recover some of his expenses by “repeatedly refusing to honor other clear contractual commitments.”
Musk and X Corp. have been “stiffing employees, landlords, vendors, and others” since they took over Twitter, the lawyers allege, an allusion to more than 25 vendor nonpayment lawsuits filed against the social media business by companies including software and service providers and a landlord.
“Musk doesn’t pay his bills, believes the rules don’t apply to him, and uses his wealth and power to run roughshod over anyone who disagrees with him,” the complaint says.
The complaint also alludes to comments Musk made to his official biographer, Walter Isaacson, that “he would ‘hunt every single one of’ Twitter’s executives and directors ‘till the day they die.’”
The ex-Twitter executives’ lawyers argue, “These statements were not the mere rantings of a self-centered billionaire surrounded by enablers unwilling to confront him with the legal consequences of his own choices. Musk bragged to Isaacson specifically how he planned to cheat Twitter’s executives out of their severance benefits in order to save himself $200 million.”
The suit, Agrawal et al v. Musk et al, was filed in California’s Northern District and follows news that settlement talks between X Corp. and ex-Twitter managers broke down in a related case in Delaware, Woodfield v. Twitter Inc., where $500 million in unpaid severance to former Twitter managers and engineers is in dispute.
Well, that’s likely to enrage Elon. While I am not a lawyer, I don’t see how Elon can simply continue to do this and expect to come out on the winning side. Perhaps it might be in his interest to settle these lawsuits. But Elon rarely does things that are in his interest.
Leave a comment »