CYBERSECURITY / DEFENSE / INTELLIGENCE

  • In a digital age where information is the new currency, the recent global hack has once again highlighted the urgent need for enhanced cybersecurity measures.

    The breach was identified as Midnight Blizzard, from the Russian state-sponsored actor known as NOBELIUM. It has affected Millions of individuals and government agencies worldwide, underscoring the far-reaching consequences of cyberattacks and the critical importance of protecting sensitive information.

    The Scope of the Breach

    The scale of the global hack is staggering. Hackers gained unauthorized access to databases containing a wealth of personal data, including financial records, social security numbers, email addresses, and passwords.

    The exposed information poses a significant risk of identity theft, financial fraud, and other forms of cybercrime.

    The breach has impacted individuals across various sectors, including government agencies, businesses, and private citizens, highlighting the pervasive nature of cyber threats.

    Implications for Individuals

    The fallout from a hack can be devastating for individuals whose data has been compromised.

    Identity theft, in particular, poses a significant threat. Hackers use stolen information to open fraudulent accounts, make unauthorized purchases, or even commit acts of impersonation.

    Moreover, the exposure of sensitive personal information can erode trust and privacy, leaving individuals vulnerable to exploitation and manipulation.

    Response and Accountability

    After the breach, affected organizations must take swift and decisive action to mitigate the damage and restore trust.

    This includes implementing robust cybersecurity measures, notifying affected individuals, and cooperating with law enforcement agencies to identify and apprehend the perpetrators.

    Additionally, those responsible for the breach must be held accountable, whether they are individuals, criminal organizations, or state-sponsored actors. Holding perpetrators accountable prevents future attacks and conveys that protecting personal data is paramount.

    Safeguarding Privacy in an Era of Cyber Threats

    While the global hack serves as a sobering reminder of the dangers posed by cyberattacks, it also underscores the importance of proactive cybersecurity practices.

    Individuals and organizations alike must remain vigilant in safeguarding sensitive information and adopting best practices for data protection.

    This includes using strong, unique passwords, encrypting sensitive data, regularly updating security software, hiring the right cybersecurity company for monitoring, and being cautious when sharing personal information online.

    Moreover, governments and regulatory bodies must enact robust data protection laws and regulations to hold organizations accountable for safeguarding personal data and provide recourse for individuals affected by breaches.

    Hack Aftermath

    The recent global hack exposed personal data, serving as a wake-up call for individuals, businesses, and governments alike. Cybersecurity must be a top priority in an interconnected world where data is increasingly valuable and vulnerable.

    That is whyΒ Axios Security GroupΒ believes that by implementing robust security measures, fostering a culture of accountability, and advocating for more robust data protection laws, can be implemented together to mitigate the risks of cyber threats and safeguard the privacy and security of personal information.

    Only through collective action can we effectively confront cybercrime and ensure a safer, more secure digital future.

    About Axios Security Group

    Axios Security Group is a trusted leader in comprehensive security solutions, offering organizations physical and digital protection.

    With a dedicated team of experts, Axios created tailored security strategies to safeguard assets, personnel, and data.

    Its physical security services range from on-site personal security to cutting-edge surveillance technologies, while our cybersecurity experts provide robust digital defenses, including threat detection and incident response.

    Axios collaborates closely with each client to ensure our solutions align with their unique needs, industry regulations, and budgetary constraints.

    Axios Security Group provides a vCSO (Virtual Security Officer) program in addition to physical and cyber security.

    A vCSO (Virtual Chief Security Officer) is a C-suite-level security expert who enhances your company’s security. They bring strategic vision, devising comprehensive security plans encompassing digital information and physical asset protection.

    By collaborating closely with your leadership team, a vCSO tailors security solutions to your unique needs, aligning them with your organizational goals and industry regulations.

    This approach ensures that your organization is well-prepared to navigate the ever-evolving landscape of security challenges, creating a robust, adaptable, and resilient security infrastructure.

    A vCSO provides all the same security expertise and protections for your organization at a 1/3 of the cost of a full-time CSO (Chief Security Officer.)

    Contact usΒ to learn how Axios Security Group can protect one of your most considerable corporate assets.

    Contact
    Contributor
    Robin Carter
    News Break
    clientservices@axiossecuritygroup.com
    8004853983

    The post Personal Data Exposed in Massive Global Hack: Understanding the Implications & Guarding Privacy- Axios Security Group appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • The service is using a power granted by lawmakers in the 2024 NDAA.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Security researchers have uncovered a “credible” takeover attempt targeting the OpenJS Foundation in a manner that evokes similarities to the recently uncovered incident aimed at the open-source XZ Utils project. “The OpenJS Foundation Cross Project Council received a suspicious series of emails with similar messages, bearing different names and overlapping GitHub-associated emails,” OpenJS

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Helping Kyiv is less costly than the alternative.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Ahmed exploited a vulnerability in a decentralized cryptocurrency exchange’s smart contract by injecting fabricated pricing data, which triggered the generation of inflated fees totaling $9 million, which he subsequently withdrew in cryptocurrency. 

    Following the theft, Ahmed attempted to extort the exchange, proposing the return of a portion of the stolen funds ($7.5 million) on the condition that they refrain from involving law enforcement. 

    He exploited a vulnerability in Nirvana Finance’s smart contracts to buy cryptocurrency at a significantly discounted price and then resold it back to Nirvana at market value, draining $3.6 millionβ€”almost all their funds. 

    To hide the stolen funds, he employed various laundering techniques by converting the stolen crypto into different tokens (token-swap transactions) and then “bridged” these funds from the Solana blockchain to the Ethereum blockchain, essentially moving them across different networks. 

    At last, he converted everything to Monero, a privacy-focused cryptocurrency, and used anonymous exchanges and mixers to further obfuscate the trail.

    Document
    Stop Advanced Phishing Attack With AI

    AI-Powered Protection for Business Email Security

    Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

    Knowledge of Blockchain Security

    Capitalizing on his in-depth knowledge of blockchain security, AHMED, a US citizen and senior security engineer at a prominent international technology company, carried out successful cyberattacks against two cryptocurrency exchanges. 

    His professional background in reverse engineering smart contracts, which involves analyzing and understanding their code to identify potential weaknesses, and blockchain auditing, a process focused on ensuring the security of blockchain transactions, provided him with the perfect toolkit for exploiting vulnerabilities within the exchanges’ smart contracts. 

    The vulnerabilities, which stemmed from flaws in the code governing the exchanges’ operations, allowed AHMED to manipulate data for his own gain and by executing these sophisticated attacks, he was able to steal over $12 million in cryptocurrency.

    A New York resident, Ahmed (34), received a three-year prison sentence and three years of supervised release for exploiting vulnerabilities in cryptocurrency exchanges.

    The court further mandated the forfeiture of $12.3 million and an undisclosed amount of cryptocurrency. 

    He is liable for over $5 million in restitution for the compromised exchanges and Homeland Security Investigations and the Internal Revenue Service’s Criminal Investigation Unit were commended for their contributions to the case.  

    According to the Justice Government, Shakeeb Ahmed, a former security engineer, was sentenced to 3 years in prison for hacking two decentralized cryptocurrency exchanges (DEXs) in a first-ever conviction for a smart contract hack. 

    He used his expertise in reverse engineering and blockchain audits to exploit vulnerabilities in the smart contracts and was also ordered to forfeit $12.3 million and a significant amount of cryptocurrency, along with $5 million in restitution to the affected DEXs. 

    The case highlights the collaborative effort between the Illicit Finance and Money Laundering Unit and the Complex Frauds and Cybercrime Unit to address cryptocurrency-related cybercrime.Β 

    Secure your emails in a heartbeat! To find your ideal email security vendor, Take aΒ Free 30-Second Assessment.

    The post Ex-Security Engineer Jailed For Hacking Decentralized Cryptocurrency Exchanges appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • The threat actor tracked as TA558 has been observed leveraging steganography as an obfuscation technique to deliver a wide range of malware such as Agent Tesla, FormBook, Remcos RAT, LokiBot, GuLoader, Snake Keylogger, and XWorm, among others. “The group made extensive use of steganography by sending VBSs, PowerShell code, as well as RTF documents with an embedded exploit, inside

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • New cybersecurity research has found that command-line interface (CLI) tools from Amazon Web Services (AWS) and Google Cloud can expose sensitive credentials in build logs, posing significant risks to organizations. The vulnerability has been codenamed LeakyCLI by cloud security firm Orca. “Some commands on Azure CLI, AWS CLI, and Google Cloud CLI can expose sensitive information in

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • Omni Hotels & Resorts has revealed that it was the target of a recent cyberattack, which resulted in the theft of customer information.

    The hospitality giant has been working closely with a leading cybersecurity response group to investigate the incident and mitigate the impact on its guests.

    Limited Customer Data Compromised

    According to the company’s statement, the attack has impacted a subset of Omni’s customers.

    The stolen data includes customer names, email addresses, mailing addresses, and information related to the company’s Select Guest Loyalty program.

    The compromised data does not include sensitive financial information, such as payment details or social security numbers.

    Omni Hotels & Resorts has reported the matter to law enforcement and is collaborating with cybersecurity experts to address the situation.

    Document
    Stop Advanced Phishing Attack With AI

    AI-Powered Protection for Business Email Security

    Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

    The company has taken swift action to shut down its systems and contain the data breach, with most of its systems now restored to full functionality.

    Commitment to Guest Experience and Security

    Despite the disruption caused by the cyberattack, Omni Hotels & Resorts has remained committed to maintaining its exceptional guest experience.

    The company has continued to welcome guests and accept new reservations online and through its customer care center.

    In a statement, Omni emphasized its dedication to the security of its systems and data, stating, “We take the security of our systems and data very seriously, and while this remains an ongoing investigation, Omni continues to collaborate with a leading cybersecurity response group and deploy all available resources to address the situation.”

    The hospitality industry has been a frequent target of cyberattacks in recent years, underscoring the importance of robust cybersecurity measures and vigilance in protecting customer information.

    Omni’s swift response and commitment to transparency in this incident serve as a reminder of the critical role that organizations play in safeguarding their customers’ trust.

    Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP

    The post Omni Hotels & Resorts Hack: Attackers have Stolen Customer Information appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

  • A new exploit campaign has emerged, targeting organizations that utilize Fortinet’s FortiClient EMS.

    Dubbed “Connect:fun” by Forescout Research – Vedere Labs, this campaign leverages a critical vulnerability identified as CVE-2023-48788.

    The campaign has been active since at least 2022 and has recently been observed exploiting the security management solution with increased vigor.

    The Vulnerability: CVE-2023-48788

    CVE-2023-48788 is an SQL injection vulnerability found within Fortinet’s FortiClient EMS. SQL injection is a type of attack that allows an adversary to interfere with an application’s database queries.

    It can be used to view data that the attacker cannot normally retrieve, such as user information, or to manipulate database information.

    Fortinet published an advisory about this vulnerability on March 12, 2024, and the proof of concept (PoC) for the exploit was made publicly available on March 21, 2024.

    This disclosure seemingly acted as a catalyst for increased exploitation attempts by threat actors.

    Document
    Stop Advanced Phishing Attack With AI

    AI-Powered Protection for Business Email Security

    Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .

    The Connect:fun campaign is particularly notable for its use of ScreenConnect and Powerfun as post-exploitation tools, marking it as Vedere Labs’ first-ever named campaign.

    The incident that brought this campaign to light involved a media company whose FortiClient EMS was vulnerable and exposed to the internet.

    The attack was not an isolated event. Scanning activity from the IP address 185[.]56[.]83[.]82 was observed targeting FortiClient EMS across various customer networks.

    This activity began on March 21 and persisted through several days, indicating a concerted effort by the attackers to exploit the vulnerability across multiple potential victims.

    The exploitation of CVE-2023-48788 poses a significant threat to organizations, as it can lead to unauthorized access and control over the FortiClient EMS.

    This control can result in further malicious activities, including data theft, lateral movement within the network, and potentially a full-scale breach of the organization’s cyber defenses.

    Mitigation and Defense Strategies

    In response to the Connect:fun campaign, organizations are urged to take immediate action to protect their networks:

    • Apply the Patch: Fortinet has released a patch to address CVE-2023-48788. Organizations should apply this patch without delay to close the vulnerability.
    • Monitor Traffic: It is crucial to monitor the traffic reaching FortiClient EMS for signs of exploitation. An intrusion detection system (IDS) can be instrumental in identifying and responding to malicious activities.
    • Web Application Firewall (WAF): Deploying a WAF can help block potentially malicious requests and provide an additional layer of security.
    • Leverage IoCs and TTPs: Indicators of Compromise (IoCs) and Tactics, Techniques, and Procedures (TTPs) shared by cybersecurity researchers can be used to detect and prevent attacks.

    Organizations using Fortinet’s FortiClient EMS must take proactive measures to secure their systems against this and other similar threats.

    Secure your emails in a heartbeat! To find your ideal email security vendor, Take aΒ Free 30-Second Assessment.

    The post Connect:fun Attacking Organizations Running Fortinet’s FortiClient EMS appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

    Go to source

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ

    ΒΆΒΆΒΆΒΆΒΆ