The IT Nerd

Analysts at the NCC Group report that the March ransomware victim numbers were the highest in any month over the past three years. The February to March numbers surged 91% from 240 to 459 due largely to the highly publicized GoAnywhere MFT vulnerability that the CLOP ransomware group exploited as a zero-day across 130 known victims in just ten days.

The month’s activity surge in ransomware attacks continues the upward trend NCC has observed since the beginning of the year and illustrates a 62% increase, year-on-year, when compared to March of 2022.

At 147, the industrial sector received the most ransomware attacks, accounting for 32% of all recorded attacks. Though this was an 87% increase in the number from January, proportionally it remained within 1% of all attacks, confirming that the industrial sector remains the most popular target for ransomware.

“Industrials contains possibly the widest variety of industries that provide threat actors with opportunities to extort PII/IP and cause operational disruption to incentivize ransom payments” reads the report.

Naveen Sunkavalley, Chief Architect, Horizon3.ai:

   “A significant proportion of vulnerabilities, including CVE-2023-0669, have been exploited by threat actors as zero-days. This will continue to be the case. This means that, no matter how well companies harden their perimeter, they must be prepared for the eventuality of being breached. 

   “The NCC report lists several tactical steps to protect against the GoAnywhere MFT vulnerability. But the real question is, what are you doing to prepare for the next zero-day? We recommend all companies take a hard look at their internal networks to shore up their threat detection and defense-in-depth practices to prevent a ransomware-type event after breach.”

This number of attacks is crazy high. And it shows that more needs to be done to ensure that IT environments are as secure as possible to bring this number back down to a more “sane” level.

DFIR Report member Kostas Tsale Tweeted this over the weekend:

If you didn’t read the entire thread, here’s the TL:DR. He’s seeing threat actors using the Action1 RMM platform for reconnaissance activity and executing commands, scripts and binaries on network hosts. After installing the Action1 agent, they create policies to automate the execution of binaries (e.g. Process Monitor, PowerShell, Command Prompt) required in the attack.
 
Action1 is available at no cost for up to 100 endpoints, which is the only restriction in the free version of the product.
 
The exploit appears to be used in ransomware attacks from multiple threat actors, as the product has been seen leveraged in the initial stages of recent ransomware attacks using distinct malware strains.

Christopher Peacock, Principal Detection Engineer, SCYTHE:

   “Remote monitoring and management (RMM) tools have been increasingly common in attacks because threat actors can rely on its functionality instead of using malware that could trigger antivirus alarms. It’s, therefore, essential organizations block and alert for unapproved remote monitoring and management tools, which could indicate a threat actor.”

To Action1’s credit, they said this on Twitter:

Let’s see if this mitigates this threat vector in the medium and long term.

You might have heard that the FBI is warning everyone about “Juice Jacking” via Tweets like this one:

This has caught the attention of the media and has generated a lot of phone calls and emails from my clients to me. But what isn’t helping is that there really isn’t a good explanation of what “Juice Jacking” is and why or if you should care. This is where this article comes in as I hope will explain what this threat is and what you can do to protect yourself.

First, let me explain what this attack is. “Juice Jacking” is theoretical type of attack on devices like phones and tablets which use the same cable for charging and data transfer, typically a USB cable. The goal of the attack is to either install malware on the device, or to surreptitiously copy potentially sensitive data. Now I use the word theoretical because I have yet to hear of an actual attack using this method. Now to be clear, that doesn’t mean that it hasn’t happened. But there has been no proof that this has happened in the wild. Having said that, I am aware of proof of concept attack demonstrations, as well as cables and other hardware that are available that could be used to execute these attacks. Thus if you want my opinion, you should be concerned about these attacks. There’s also the fact that recent versions of Android and iOS will prompt you in terms allowing a device to connect to something. Thus if you’re paying attention and see one of these prompts, you may want to think twice about connecting to whatever it is you’re connecting to. But the threat actors I suspect are counting on the fact that you’re not paying attention in order to make this attack work.

Based on that, how do you protect yourself? That part is easier than you think. Here’s some random suggestions that I came up with:

• Don’t use public charging stations, EVER. Instead, use a power bank to keep your devices charged. If you must recharge something via a public charging station, charge the power bank instead of the phone. Another option is to always carry your own charger.
• Don’t use “promo” or “free” cables to charge your gear. Instead, you should buy good quality cables from known brand names and always keep them on hand. Yours truly for example always has a cable on my keychain, and a couple in my tech sling bag along with my own charger.
• Consider using a “charging only” cable which does not send data over the wire. That in theory should make you safe from this attack if you must use a public charging staging. Buy good quality cables from known brand names and always keep them on hand.

Since the FBI came out with this warning, I will assume that they are doing this because they found evidence that this is a threat that we all need to be worried about. So it makes sense that we should all take some precautions based on that. And fortunately those precautions are simple. If I hear about any actual attacks, I’ll be sure to post them here as I am sure that knowing that these are more than theoretical attacks would be helpful for us all.

Kaspersky reported yesterday that since April 2020, threat actor Lazarus Group has had an evolution in its techniques and procedures shifting to targeting defense companies instead of crypto businesses as part of their “DeathNote” campaign. 

The payload relies on trojanized open-source PDF viewer software and weaponized documents to collect and report the victim’s information. Initially, the malware author used decoy documents that were related to cryptocurrency but has now switched all the decoy documents to job descriptions related to defense contractors and diplomatic services. 

The focus began to shift:

• Early 2020 – EU automotive and academic organizations linked to the defense industry
• May 2021 – IT company that provides solutions for monitoring network devices and servers
• May 2021 – Defense contractor in Latin America
• July of 2022 – Defense contractor in Africa 
• March 2022 – Several similar victims in South Korea

All relied on the same DLL side-loading technique observed in the crypto targeted programs.

Christopher Peacock, Principal Detection Engineer, SCYTHE had this to say:

   “Often governments shift capabilities to address their needs and requirements, so there may have been a strategic shift from targeting crypto businesses for money to more classical espionage attempting to collect defense information.”

This is one of these situations where education and prudent use of tools would make a difference in terms of defending against attacks like these. Hopefully we’ll see defenders make that shift just like Lazarus has made a shift.

According to PwC, 65% of executives expect to grow their cybersecurity spending in the near term as 50% of businesses say they are most worried about a “catastrophic cyber attack”, ahead of recession, inflation, supply chain issues and geo-political conflicts, to name a few and simultaneously reacting to a new regulation landscape where only 9% feel highly confident that they can effectively manage to all the new requirements and disclosures.
 
Of the threat scenarios, executives say they expect the following types of attacks to increase in 2023:

• 33% – Business email compromise / Account takeovers
• 32% – Ransomware
• 31% – Attacks against cloud management interfaces
• 30% – Hack-and-leak operations
• 29% – Third-party breach

To combat these threats, organizations surveyed say spending in 2023 will be focused on the following top strategies:

• 39% – Technology solutions
• 37% – Coordination with engineering / OT teams
• 36% – Upskilling and hiring of cyber talent
• 33% – Governance, risk and compliance

I have two views on this. The first is from Roy Akerman, Co-Founder & CEO, Rezonate:

   “As we learn from the study, securing identities remains a top priority for security teams. With the increasing number of identities to manage, both human and machine, the attack surface is continuously growing, the infrastructure is constantly changing, and ownership is distributed across different teams.

   “Attackers can exploit identity gaps and gain access faster than security teams can respond. This change requires a change in approach as well as the introduction of new tools. Technologies that go beyond visibility to provide a complete understanding of enterprise-wide identities, their behaviors, potential gaps and can stop active attacks to truly reduce cybersecurity risk.”

The second is from Byron Rashed, Sr. Director, SCYTHE:

“Cyber attacks have increased in volume and sophistication over the past few years and now more than ever C-Levels are focusing on mitigating these risks since they are now viewed as a true business risk. Non-compliance, reputation damage, liabilities, litigations and decreased revenue are all issues that arise if the organization suffers a successful cyber attack. Executives are becoming more aware of the holistic approach to combat cyber threats and are now realizing how important it is to have a high cyber security posture within their organizations.”

I am glad that businesses are finally getting the message that they have to spend money in order to protect themselves. Businesses for too long have tried to fly under the radar when it comes to cybersecurity. And that approach appears to finally be changing.

The 2023 Ransomware Insights report published by Barracuda Networks focused on an interesting fact: Pay the ransom, get hit again. Their study showed that while 31% of organizations hit just once with a ransom attack had paid the ransom, 34% of those hit twice had paid the first time and 42% hit three or more times had paid the other times. Quite the trend.

Of the respondents, targets that paid the ransom to restore their data: 

• 31% got hit once
• 34% of those were hit twice 
• 42% of those were affected three times or more

Multiple attacks reported by sector include: 

• 53% Energy, oil/gas, and utility firms
• 46% of financial services
• 29% healthcare

“The relatively high proportion of repeat victims suggests that security gaps are not fully addressed after the first incident.” said Fleming Shi, CTO, Barracuda.

And with 27% of organizations not feeling fully prepared for a ransomware attack, the report brings into question the effectiveness of cyber insurance. 

Hit by a ransomware attack:

• With Insurance – 77% hit
• No Insurance – 65% hit
• 39% of the companies with cyber insurance paid the ransom
• 22% of organizations without cyber insurance paid the ransom
• 70% of organizations that were affected by multiple attacks had cyber insurance

Christopher Peacock, Principal Detection Engineer, SCYTHE has this comment:

   “The conclusion section of the report has two critical highlights I see for protecting against the deployment of ransomware. The first point is to patch public-facing vulnerabilities, which means organizations must first identify what services are public facing to the internet. 

   “The second point says, “The release of ransomware is often the final stage of attack and can be preceded, for example, by lateral movement, data exfiltration, the installation of additional tools, and more. If you can detect and block the attack at these earlier stages, you might be able to prevent the full impact of the ransomware.” Though prevention is ideal, we see actors continue to get through the cracks, so organizations must have robust alerting capabilities for the precursors before the ransomware deployment. Furthermore, alerts aren’t helpful unless they trigger a response, so having a process to verify that process for common ransomware precursors is paramount.

   “This approach was recently highlighted in the Red Canary Yearly Report in their statement, “We focus on trying to detect ransomware precursor activity in the initial access, reconnaissance, and lateral movement phases and help our customers stop it before it gets to exfiltration or encryption. The result is that we see many more so-called ransomware precursors than we do actual ransomware payloads.” 

Morten Gammelgaard, EMEA, co-founder, BullWall follows up with this: 

   “The Barracuda Ransomware Insights report suggests that paying the ransom doesn’t prevent future attacks, and in fact industries like energy, financial services, and healthcare are still more prone to suffer from multiple attacks. 

   “Companies can learn from this report by prioritizing their cybersecurity measures, improving their security posture and having a proactive approach to security. Cyber insurance is not a guarantee, and in fact may be encouraging attacks. Companies should have an incident response plan in place and run regular attack simulations to be prepared. Finally, organizations should collaborate with industry peers and share best practices to stay ahead of cyber threats.”

The best defence from being pwned ransomware is not to get pwned. But if you do get pwned, you need to make sure that you get pwned again. It really looks bad on any organization that is in that position, which means that you should not be that guy.

Yesterday, the FDA published new guidelines strengthening the cybersecurity levels of products used by healthcare providers that are connected to the internet. This comes after years of concerns that these devices could be hit by attacks endangering lives, which was highlighted by a September 2022 report by Proofpoint’s Ponemon Institute that linked a 20% increase in mortality rates due to cyber-attacks targeting healthcare organizations.

According to a guidance, applicants seeking approval for new medical devices must:
 

• Submit a plan designed to address possible cybersecurity issues
• Outline a process to provide regular security updates and patches
• Provide “a software bill of materials,” including commercial, open-source and off-the-shelf software components

The new FDA guidelines come a couple of months after security experts at Sonar found three vulnerabilities in OpenEMR, and more recently, KillNet was observed targeting healthcare applications hosted using the Microsoft Azure infrastructure.

George McGregor, VP, Approov had this to say:

“This is a major step forward in strengthening cybersecurity defenses in healthcare in the USA (something that we have been campaigning for as a leading provider of mobile security solutions)  A key element of the guidelines for medical devices is that companies must have a plan in place for “postmarket”  runtime protection.  

“Another welcome aspect of the requirements is that they explicitly state that cyber defenses must be able to be updated rapidly if and when required. This requires security administration to be a key element of the operational plan, including the ability to update policies as new vulnerabilities are uncovered and rotate secrets and keys quickly in the event that they are stolen. “

I am glad to see that the FDA is taking this step as attacks on healthcare are are thing as evidenced by the attack on Sick Kids hospital last year. Because sooner or later one of these attacks will affect patient care in a severe way if nothing is done.

According to report by ENISA, ransom attacks more than doubled in the EU transportation sector in 2022 v. 2021.  This new report analyzes the cyber security landscape in the EU in relation to aviation, maritime, railway and road transport covering the period of January 2021 to October 2022.

                                                    2021                 2022

        Ransomware Incidents        13%                 25%

        Data breaches/leaks              21%                  9%

        Malware Reports                   11%                   6%

55% of incidents were financially motivated while hacktivists accounted for 23%. DDoS attacks increased from 2% to 13%.

15% of the attacks targeted State-backed entities and were largely aimed at the maritime sector and government transport authorities. European airports, railways and transport authorities were among other victims of those attacks, ENISA said.

ENISA acknowledges that its analysis likely under-represents the reality as the non-disclosed incidents may outweigh those made public. despite mandatory reporting.

Jan Lovmand, CTO, BullWall had this to say:

   “People in the transportation industry and governments should take the recent report by ENISA seriously and make immediate efforts to improve their cybersecurity measures. Attacks are increasing in frequency, and it is important for organizations to take proactive measures to mitigate the risk of a successful attack.

   “Organizations should review their existing cybersecurity programs and assess the effectiveness of their current defenses against ransomware attacks. They should also ensure that all employees are aware of the threat and trained in basic cybersecurity practices, such as keeping software up-to-date and using strong passwords.

   “Cybersecurity measures, such as multi-factor authentication, intrusion detection systems, and advanced threat intelligence and containment systems for detecting and responding to potential threats are table stakes in this threat environment.

   “In addition, governments should collaborate with industry organizations to develop and implement best practices for cybersecurity in the transportation sector. This includes providing guidance on cybersecurity risk assessments, establishing industry standards, and promoting information sharing to help organizations better understand the evolving threat landscape.”

What is clear from these numbers is that ransomware is what all the cool threat actors are doing. No shock there. That means that you have to make sure that you’re not a target of the cool threat actors. That will make these threat actors less cool and the world a safer place.

The FDIC is reporting disappointing results after the Office of Inspector General performed an audit of its controls for securing and managing its Microsoft Windows Active Directory which it uses for central management of all IT system user credentials.

According to auditors, privileged system users didn’t practice simple password hygiene such as:

• Reusing their passwords 
• Sharing passwords across multiple accounts
• Failing to change passwords for over a year

In addition, the probe found that, in over 900 cases, the accounts of users were not removed after prolonged inactivity. They also found three FDIC IT accounts with privileged access that remained privileged for almost a year after the access was no longer required for their positions.

Since the audit findings, the FDIC IG has made 15 recommendations to the agency for improving security controls such as providing password training and the removal of unnecessary privileges. This brings into question what training may have been up until now for password and credential controls, and other widely-used cybersecurity issues such as phishing, for example. 

Details of the cybersecurity concerns come as the financial regulator headlines the SVB failure, and following another report published earlier this year also by the OIG, which found that the FDIC is not doing enough to monitor cyber risks within the institutions it regulates.

Oh boy.

I have there comments on this rather shambolic audit. The first is from

Naveen Sunkavalley, Chief Architect at Horizon3.ai had this comment: 

   “The issues highlighted in the audit – password re-use, excessive account privileges, and the failure to deactivate stale accounts – are very serious and commonly exploited by threat actors. These issues make it easier for an attacker to compromise an account and then use that single account to take over many other accounts and elevate privileges, ultimately leading to full compromise of AD and all AD-managed assets.

   “The FDIC is not alone though. We see the same problems in many of the organizations we work with. And the problems can easily recur after being fixed once, as users join or leave an organization, or users change passwords. We recommend regular security assessments of Active Directory environments to identify issues and address them as soon as possible. 

Baber Amin, COO at Veridium had this to say:

This report highlights two fundamental problems.

1. Reliance on knowledge based credentials and trusting that humans will not follow the path of least resistance. Training is important, but we now have the means to eliminate passwords for the most part. The report continues to focus on password quality rather than asking for removal of passwords. Strong passwords that are not shared or reused actually do not need to rotate or update often. There is ample evidence on this.
   • Multi factor authentication should also play a larger role than how it is treated in the report. This is the first line of defense.

Action:  Don’t put a training band aid, eliminate the problem, eliminate passwords.

2. Orphan accounts and access, and overarching entitlements
   • I put these under the access umbrell  Organizations need to embrace the concept of least privileged access and grant only the minimal amount of access necessary for the minimal amount of time. We have multiple entitlement management products and services that can root out orphan accounts, access sprawl, and even unused or orphan access grants.  These tools need to be used on a regular basis.

Action: Limit access grants, use privileged access management tools to monitor privileged activity, use smart entitlements to limit overarching access, use smart monitoring to identify probes, and anomalies.

Morten Gammelgaard, EMEA, co-founder of BullWall had this to say:

   “The fact that privileged users were found to be reusing passwords and sharing them across accounts, as well as failing to change passwords for extended periods, indicates a lack of awareness about the importance of good password hygiene practices.

   “Moreover, the incorrect account configurations, and the discovery that user accounts were not removed after prolonged inactivity, reveals a lack of oversight in managing user accounts. These are common weaknesses that leave agencies vulnerable to cyber attacks, particularly ransomware attacks, which have only increased year over year.

   “For all their potential resources, government agencies clearly need to prioritize cybersecurity best practices and implement robust security controls. This includes providing password training to users, regularly reviewing user accounts and privileges, and removing unnecessary elevated domain privileges.”

It’s bad enough that smaller businesses suffer from these sorts of issues. But for the FDIC to have these sorts of issues is insane. Hopefully this is the wake up call that they need to move them into a much better place. And everybody else should read this report and ensure that they don’t have any of these issues as well.