alt=Digital illustration of a secure network with a glowing shield and padlock icons, symbolizing cybersecurity protection.
Cyber security
2025-06-05 Post a Comment

Do I need an antivirus and a VPN?

Story by Sead Fadilpašić

The best antivirus acts as most people’s go-to for device protection, but as I have already discussed, there are some threats that antivirus can’t protect against.

With online threats are becoming ever more prevalent, an increasing number of people have an “it won’t happen to me” attitude about their security.

<cs-card “=”” class=”card-outer card-full-size ” card-fill-color=”#565656″ card-secondary-color=”#272727″ gradient-angle=”112.05deg” id=”native_ad_inarticle-1-64134ab6-2d50-42da-bedb-6fc7674dd9eb” size=”_2x_1y” part=””>

Ad

Try a FTMO Free Trial

It’s easy to understand why – the web standards have drastically increased over the years, and vanilla browsers and operating systems have become better at identifying all kinds of dangers.

However, with the rising sophistication of cyberthreats (and an uptick in hybrid working environments), a robust antivirus software in combination with a VPN is necessary for complete protection of your computers.

The new threats emerging

Artificial intelligence is, unfortunately, ushering in an era of more sophisticated malware and phishing attacks. If AI-generated phishing emails that are indistinguishable from the real thing weren’t bad enough, cybercriminals can now use AI to modify malware in real time, making it more likely to slip under the radar.

<cs-card “=”” class=”card-outer card-full-size ” card-fill-color=”#565656″ card-secondary-color=”#272727″ gradient-angle=”112.05deg” id=”native_ad_inarticle-2-d3d3d8fa-c295-46e9-860b-a6ee84d66367″ size=”_2x_1y” part=””>

Ad

Cegal Cetegra Cloud Platform – Effective Cost Management – Low-Emission Data Centers

There’s also a major uptick in ransomware. In the past, threat actors would implant malware that would encrypt the data and demand a ransom in exchange for decryption. Now, they exfiltrate the data and threaten to leak it on the dark web.

Not only are ransomware kits freely available for purchase, thus lowering the barrier of entry for cybercrime, but attackers also use AI to optimize their methods and choose their next target.

Remote work environments are simply adding fuel to the fire. Hackers will often compromise unsecured home or public networks to gain access to company systems through vulnerable personal and work devices.

Unfortunately, not all cybersecurity risks happen at the hands of a shady external individual. People also have to contend with internal threats, such as children or the elderly who may inadvertently expose systems to malicious actors.

<cs-card “=”” class=”card-outer card-full-size ” card-fill-color=”#565656″ card-secondary-color=”#272727″ gradient-angle=”112.05deg” id=”native_ad_inarticle-3-5418d5e3-1943-4bc7-8698-c1199978e7ee” size=”_2x_1y” part=””>

Ad

9 Enneagram Types Test – Best Enneagram Test – Free Enneagram Test

Again, people that enjoy remote working practices get the short end of the stick. Companies that allow staff to connect to the company network with personal devices may get their system decimated by malware on the employee’s own device.

Regardless of the nature of the threat, your entire home network including your personal device can completely fall apart due to a cyberattack, and the financial toll can lead to some serious headaches.

How an antivirus can help

While safeguarding your computer from the wide scope of emerging cyber threats requires continuous effort, a dedicated antivirus software is the bare minimum.

It protects your devices from malware and viruses by scanning files and applications, as well as keeping an eye on the network. In other words, a good AV can stop viruses and malware before they cause damage to your device and files.

Now, we get what you may be thinking – modern devices usually have pre-installed antivirus software like Windows Defender. However, such solutions fall short of the comprehensive security that you might need to face modern threats.

For instance, even the best free antivirus may not have a centralized dashboard for monitoring security across different devices on your network. Windows Defender also doesn’t protect against sophisticated threats like targeted attacks or zero-day exploits, and is notorious for its slow response time. Put differently, it may not recognize the malware immediately, and if it does, it may only identify the attack when a device is already infected.

On the other hand, a robust antivirus will safeguard your information and offer additional security layers. Modern tools also implement AI to identify issues more quickly, allowing you to proactively boost your network security.

It’s also worth noting that investing in antivirus software is cost-effective, especially when you compare it to all the expenses that a cyberattack could incur.

How a VPN can help

A VPN (virtual private network) is a piece of software that routes your data through an encrypted tunnel to a secure server, encrypting your data in the process. In even simpler terms, it changes your IP address and makes internet traffic unreadable by third parties, even if they somehow manage to intercept the connection.

This simple tool is vital as it helps protect your sensitive data regardless of how secure the network it travels over is, thus allowing you to also securely access your company’s network and resources, or your cloud storage, in a safe and responsible way.

Compared to an antivirus, implementing a VPN is one of the cheapest ways to strengthen your cybersecurity. To put things into perspective, NordLayer, TechRadar’s top choice for the best VPN, can be snagged for just $3.39 per month. That’s practically nothing when you consider the benefits it brings to the table, and costs far less than a potential data breach.

Plus, VPNs often offer applications for different devices, including smartphones – useful if you require protection across all platforms.

Do you need both?

The more the merrier also applies to your cybersecurity. While implementing just one measure is definitely a step in the right direction, both a VPN and an antivirus are necessary if you want to cover all your bases.

In short, a VPN protects the data transmitted over the internet and the connection itself. An antivirus is great against threats attempting to infiltrate the system. You can see a thread develop here, but these solutions are complementary and will lead to a better security posture.

For example, even if you’re using a VPN, you might still fall prey to phishing and download an infected file. What’s more, the opposite is equally dangerous. You may have solid AV protection, but if you connect to a public network, a hacker may be able to intercept the data in transit.

Should you invest in more advanced types of software?

Both an antivirus and a VPN are the essentials when it comes to protecting personal devices. However, businesses are more prone to cyberattacks, and need therefore need to stay on top of the latest developments. A good upgrade is the best endpoint protection solutions, which are becoming the golden standard in digital security.

For consumers this is definitely overkill, as I have discussed before. Most of the time, the combination of antivirus, VPN, and one of the best password managers is enough to secure you against most threats. But it is worth understanding the capabilities an EPP can provide.

Whereas an antivirus is limited to a single endpoint and uses signature-based detection (rendering it useless against fileless malware or threats that don’t use a signature), an endpoint security suite scans all devices connected to the network for suspicious behavior. Put differently, it continuously scans all endpoints and can recognize threats a lot faster.

Investing in such a solution may often end up being more economical in the long run for many businesses. EPP can include a VPN, as well as the basic AV functionality (such is the case with Avast Business Security), which centralizes the protection of the entire network and eliminates the need to deploy separate applications.

You can also get some extra goodies like USB protection, which disables the use of unauthorized removable storage devices. Other providers also employ advanced correlation engines that help identify green zone threats that a regular antivirus might overlook.

The good thing is that despite the advanced nature of an endpoint security software, it’s as easy to implement as a traditional antivirus. You can get it up and running in a few minutes and instantly start protecting thousands upon thousands of endpoints.

Are these tools enough?

Despite being rather effective, the trio of antivirus, VPN, and endpoint security software may not erase all the vulnerabilities in your system, and that’s a fact. We can go as far as to claim they may be dangerous if they lull you into a false sense of security.

Look at it this way:

VPNs and antivirus software are just tools and will always be fallible unless you implement the right personal practices and cybersecurity awareness.

For individuals, this includes being wary of dodgy websites and questionable emails, and also making sure that what your are downloading is legal and from a reputable source. There are many horror stories of people looking to dodge paying for a game or service and being greeted with ransomware the second they launched their new ‘software’.

For businesses on the other hand, training to recognize fake login pages and phishing emails goes a long way in preventing you from becoming a target of a cybercrime. In addition to all the technological gizmos, you also need to work on your password policy by creating strong passwords and enabling multi-factor authentication on all accounts that support it.

Once you minimize the possibility of human error (which is still the leading source of cyberattacks), your VPN and AV will be a lot more effective in your hands, and significantly help you avoid becoming a cyberattack statistic.

read more
alt=3D render of a stylized black and red checkers board with abstract pieces.
Cyber security
2025-02-11 Post a Comment

Huge cyber attack under way – 2.8 million IPs being used to target VPN devices

By 

 

  • Millions of devices, likely infected with malware, are being used in a hacking campaign
  • Researchers spotted brute-force attacks against VPN and other internet-connected devices
  • The majority of the IP addresses are located in Brazil

A wide range of Virtual Private Network (VPN) and other networking devices are currently under attack by threat actors trying to break in to wider networks, experts have warned.

Threat monitoring platform The Shadowserver Foundation warned about the ongoing attack on X, noting someone is currently using roughly 2.8 million different IP addresses to try and guess the passwords for VPNs and similar devices built by Palo Alto Networks, Ivanti, SonicWall, and others.

Besides VPNs, the threat actors are going for gateways, security appliances, and other edge devices connected to the public internet.

Brute force

To conduct the attack, the threat actors are using MikroTik, Huawei, Cisco, Boa, and ZTE routers and other internet-connected devices, likely compromised with malware, or broken into themselves, thanks to weak passwords.

Speaking to BleepingComputer, The Shadowserver Foundation said that the attack recently increased in intensity.

From those 2.8 million, the majority (1.1 million) are located in Brazil, with the rest split between Turkey, Russia, Argentina, Morocco, and Mexico.

This is a typical brute-force attack, in which threat actors try to log into a device by submitting an enormous amount of username/password combinations, until one succeeds. Brute-force attacks are usually successful against devices protected with poor passwords (those that don’t have a strong combination of uppercase and lowercase letters, numbers, and special symbols). The whole process is automated, making it possible on a grander scale.

The automation part is made possible through malware. Usually, the devices used in the attack are part of a botnet, or a residential proxy service. Residential proxies are IP addresses assigned to real devices by internet service providers (ISPs). They make it appear as though the user is browsing from a legitimate residential location rather than a data center, which makes them a major target for cybercriminals.

read more
alt=Weekly intelligence report titled "CPRI," summarizing key insights and data for strategic decision-making.
Cyber security
2025-02-11 Post a Comment

10th February – Threat Intelligence Report

TOP ATTACKS AND BREACHES

  • Grubhub, the US-based online food ordering and delivery platform, suffered a data breach due to unauthorized access through a compromised third-party service provider’s account. The incident exposed personal details of customers, drivers, and merchants, including names, email addresses, phone numbers, payment card types, last four digits of card numbers, and hashed passwords for certain legacy systems. Grubhub has since revoked the service provider’s access and launched an investigation into the incident.
  • The city of McKinney, Texas, notified about a cyber-attack it experienced on October 31, 2024, which was detected on November 14. The breach exposed sensitive information, including names, addresses, Social Security numbers, driver’s license numbers, credit card details, financial account data, and medical insurance information of approximately 17,751 residents. The city has notified affected individuals and is offering one year of identity protection services.
  • Bohemia Interactive has reported severe disruptions to its online gaming services, affecting DayZ and Arma Reforger, due to a sustained DDoS attack. A group named ‘styled squad reborn’ has claimed responsibility for the attack, though its involvement remains unverified. Some reports suggest the attackers initially demanded a Bitcoin ransom to halt the attacks but later dismissed it as a joke.
  • Yazoo Valley Electric Power Association, serving multiple counties in Mississippi, experienced a cyberattack in August 2024 that compromised the personal information of more than 20,000 residents. The breach was linked to the Akira ransomware group, which claimed to have stolen documents containing Social Security numbers and company financial records.

Check Point Harmony Endpoint and Threat Emulation provide protection against this threat (Ransomware_Linux_Akira_C/D, Ransomware.Wins.Akira.G/H)

  • The University of The Bahamas suffered a ransomware attack on February 2nd, which disrupted internet and telephone systems, affecting administrators, professors, and students. The incident impacted all online applications, including email platforms and systems used for classwork, leading to the cancellation of online classes. The university is collaborating with law enforcement to contain the incident and has urged students to change their passwords.
  • British engineering company IMI has fallen victim to a cyber-attack which resulted in unauthorized access to its systems. Upon detection, the company engaged external cybersecurity experts to investigate and contain the incident. This event follows a similar cyber-attack reported by another UK-based engineering firm, Smiths Group, nine days earlier.

VULNERABILITIES AND PATCHES

  • Trimble has disclosed that a deserialization vulnerability in its Cityworks software, identified as CVE-2025-0994 with a CVSS v4.0 score of 8.6, is being actively exploited. This flaw allows authenticated users to execute remote code on Microsoft Internet Information Services (IIS) servers, leading to unauthorized access and deployment of Cobalt Strike beacons. Cityworks is widely used by local governments and utilities for asset and work order management. Trimble advises users to update to version 15.8.9 or later to mitigate this risk.
  • Cisco has published an advisory addressing two critical vulnerabilities in Cisco Identity Services Engine (ISE). The vulnerabilities, CVE-2025-20124 (CVSS 9.9) and CVE-2025-20125 (CVSS 9.1), allow remote attackers to gain escalation privilege and execute arbitrary commands on affected devices.
  • A high-severity kernel flaw actively exploited in Android devices was patched by Google in its latest security update. This Linux kernel vulnerability, identified as CVE-2024-53104 (USB video-class driver code), potentially allows several types of attacks through a buffer overflow, triggered by parsing undefined video frames. The latest patch aims to mitigate this by skipping parsing of problematic frames.

THREAT INTELLIGENCE REPORTS

  • Check Point Research has identified that threat actors are leveraging AI models like DeepSeek and Qwen to generate malicious content. These models have been manipulated to assist in developing infostealer malware, bypassing anti-fraud protections, and optimizing spam distribution techniques. Researchers observed cybercriminals using “jailbreaking” methods to override built-in security restrictions, allowing the creation of harmful tools.
  • Check Point has reported a phishing campaign impersonating Facebook, falsely notifying recipients of copyright infringement. The emails, sent from Salesforce’s automated mailing service, direct users to a fake Facebook support page to harvest credentials. The campaign began around December 20, 2024, primarily affecting enterprises across the EU (45.5%), US (45.0%), and Australia (9.5%), with versions in Chinese and Arabic, indicating a broad geographic target.
  • Researchers have uncovered an ongoing cyber campaign where Russian threat actors are deploying SmokeLoader malware against Ukrainian government and private sector organizations. The attackers use phishing emails impersonating Ukrainian agencies and businesses, embedding malicious attachments that exploit vulnerabilities to deliver SmokeLoader. This malware, traditionally used for financially motivated attacks, is now being leveraged in cyber-espionage operations against Ukrainian critical infrastructure.
read more
alt=3D render of a stylized black and red checkers board with abstract pieces.
Cyber security
2025-01-23 Post a Comment

Dangerous new botnet targets webcams, routers across the world

Story by Sead Fadilpašić

  • Security researchers observe new botnet-building campaign called Murdoc
  • Its attacks are targeting IP cameras and routers
  • More than 1,000 devices have been identified as compromised

Cybersecurity researchers from the Qualys Threat Research Unit have observed a new large-scale operation exploiting vulnerabilities in IP cameras and routers to build out a botnet.

In a technical analysis, Qualys said the attackers were mostly exploiting CVE-2017-17215 and CVE-2024-7029, seeking to compromise AVTECH IP cameras, and Huawei HG532 routers. The botnet is essentially Mirai, although in this case it was dubbed Murdoc.

Qualys said Murdoc demonstrated “enhanced capabilities, exploiting vulnerabilities to compromise devices and establish expansive botnet networks.”

The persevering Mirai

The campaign most likely started in July 2024, and has so far managed to compromise 1,370 systems. Most of the victims are located in Malaysia, Mexico, Thailand, Indonesia, and Vietnam.

With a network of internet-connected devices (bots) under their control, malicious actors can mount Distributed Denial of Service (DDoS) attacks, bringing websites and services down, disrupting operations and causing financial and reputational harm.

Mirai is a highly popular botnet malware. Created by three college students in the US: Paras Jha, Josiah White, and Dalton Norman, Mirai became infamous in 2016 after orchestrating a large-scale DDoS attack on Dyn, that temporarily disrupted major websites, including Netflix, and Twitter.

The creators released the source code online, right before their arrest in 2017. They pled guilty to using the botnet for DDoS attacks and other schemes.

While law enforcement continues to target and disrupt the botnet, it has shown great resilience and continues to be active to this day.

Less than two weeks ago, a Mirai variant named ‘gayfemboy’ was found exploiting a bug in Four-Faith industrial routers. Although clearly spawned from Mirai, this new version differs greatly, abusing more than 20 vulnerabilities and targeting weak Telnet passwords. Some of the vulnerabilities have never been seen before, and don’t have CVEs assigned just yet. Among them are bugs in Neterbit routers, and Vimar smart home devices.

read more
alt=Person interacting with a futuristic kitchen appliance touchscreen.
Cyber security
2025-01-10 Post a Comment

White House Plan to Secure Smart Devices Highlights Connected Economy Vulnerabilities

By   |  January 9, 2025

Digital transformation is a double-edged sword.

From cloud computing and Internet of Things (IoT) to artificial intelligence-driven analytics and real-time payment systems, the connectivity ushered in by technological advances has unlocked opportunities for innovation and growth.

The more connected the economy becomes, however, the more vulnerabilities there are for fraudsters to exploit.

This makes cybersecurity increasingly crucial, as evidenced by the White House deploying a Cyber Trust Mark for connected consumer devices Tuesday (Jan. 7). The initiative has been supported by major manufacturers and retailers, including Amazon, Google, Best Buy, Samsung and LG Electronics. It’s set to be administered by the Federal Communications Commission and is based on security features and criteria approved by the U.S. National Institute of Standards and Technology.

The interconnected nature of consumer and business technologies means that a breach in one area can have cascading effects across an organization or household.

“The White House launched this bipartisan effort to educate American consumers and give them an easy way to assess the cybersecurity of such products, as well as incentivize companies to produce more cybersecure devise, much as Energy Star labels did for energy efficiency,” the U.S. executive branch said in a statement.

Read also: What 2024’s Worst Cyberattacks Say About Security in 2025

Cyber Threats in a Hyperconnected World

The economy’s connective tissue is increasingly digital, so the question is not whether vulnerabilities will arise but how prepared organizations will be to address them.

The PYMNTS Intelligence report “Multitasking Consumers Want to Shop — and Work — at the Same Time” found that the average consumer now owns six connected devices, a number that climbs to seven among millennials and bridge millennials.

To comply with the new, voluntary standard, devices may need embedded protections like secure software updates, encryption and default password protocols. For companies that have historically prioritized speed-to-market over security, this may necessitate a redesign of existing workflows.

At the same time, building cybersecurity features into devices from the ground up could increase production costs. Smaller manufacturers or startups might find these requirements particularly challenging due to resource constraints. Separately, ensuring that components sourced from third-party suppliers also meet the cyber standards could further complicate manufacturing processes, but also aligns with the broader marketplace trend of emphasizing security across supply chains.

For the initiative to succeed, consumers must recognize, understand and prioritize the Cyber Trust Mark. However, it isn’t just consumer-facing manufacturers that need to take steps in 2025 to prioritize cybersecurity. The business landscape is also undergoing a digital transformation.

This sea of technological change could have unanticipated consequences if not navigated adroitly.

AI-Powered Cybersecurity Reshapes Business Resiliency

For B2B enterprises, where sensitive financial data, proprietary information and critical supply chain operations are at stake, failing to prioritize cybersecurity could lead to devastating consequences — not only in terms of financial loss but also reputational damage and legal repercussions.

The democratization of technologies like AI has made complex tools available to virtually anyone, making it easier for cybercriminals to carry out attacks, Finexio Chief Strategy Officer Chris Wyatt told PYMNTS in an interview posted in August.

But the use of AI isn’t solely reserved for fraudsters. The PYMNTS Intelligence report “The AI MonitorEdge Report: COOs Leverage GenAI to Reduce Data Security Losses” showed that 55% of companies employ AI-powered cybersecurity measures. The report, based on an August survey, marked a sharp increase from the 17% of chief operating officers who reported using AI-driven security tools in May.

In interviews for the “What’s Next in Payments” series, a panel of executives explained to PYMNTS that a multilayered security strategy, also known as defense in depth, reduces risks at various levels.

“The surge in cyberattacks targeting enterprise operations highlights a shift in how hackers approach their targets,” PYMNTS wrote last month. “Rather than casting wide nets through ransomware campaigns, cybercriminal groups are focusing on critical infrastructure that serves as the backbone of corporate data exchange.”

read more
alt=Department of the Treasury building exterior, showcasing its classical architecture and prominent entrance.
Cyber security
2025-01-02 Post a Comment

US Treasury hacked: Are China and the US stepping up their cyberwar?

Department of the Treasury calls cyberattack a ‘major incident’, accuses China-backed hackers.

By Sarah Shamim

The United States Department of the Treasury on Monday blamed China for breaching its network and gaining access to information that includes unclassified documents.

Beijing has denied the allegation, calling it “groundless”.

Keep reading

list of 4 items

end of list

The alleged hacking comes weeks after Beijing accused Washington of carrying out two cyberattacks on Chinese technology firms.

With Washington and Beijing trading blame, we assess the history of cyberwarfare between the world’s two largest economies and whether it has intensified.

Who hacked the US Treasury Department?

The US Treasury Department accused Chinese state-sponsored hackers of breaking into its system this month and accessing employee workstations and unclassified documents.

The department said the hackers gained access by overriding a security key used by third-party cybersecurity provider BeyondTrust, which provides technical support remotely to Treasury employees.

The Treasury Department made these details public on Monday in a letter to the US Congress. The attack was caused by “a China-based Advanced Persistent Threat (APT) actor”, the letter said.

The department, however, did not specify the number of workstations compromised, the nature of the files, the exact timeframe of the hack and the confidentiality level of the stations compromised.

On December 8, Treasury was alerted about a hack by BeyondTrust. The BBC reported that BeyondTrust first suspected unusual activity on December 2 but took three days to determine it was hacked.

How did the US Treasury Department respond?

The department said there is no evidence that the hackers still have access to department information and the compromised BeyondTrust has been taken offline.

It is assessing the impact of the hack with the assistance of the US Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI). The hack is being investigated as a “major cybersecurity incident”.

The department’s letter to Congress added that supplemental information about the attack would be sent to US lawmakers in 30 days.

“Over the last four years, Treasury has significantly bolstered its cyber defence, and we will continue to work with both private and public sector partners to protect our financial system from threat actors,” a spokesperson for the department said in a separate statement.

How has China responded?

China has denied the department’s accusations, and its Ministry of Foreign Affairs said Beijing condemns all forms of hacker attacks.

“We have stated our position many times regarding such groundless accusations that lack evidence,” ministry spokesperson Mao Ning was quoted as saying by the AFP news agency.

A spokesperson for the Chinese embassy in the US, Liu Pengyu, denied the department’s allegations. “We hope that relevant parties will adopt a professional and responsible attitude when characterising cyber-incidents, basing their conclusions on sufficient evidence rather than unfounded speculation and accusations,” he said, according to a BBC report.

“The US needs to stop using cybersecurity to smear and slander China and stop spreading all kinds of disinformation about the so-called Chinese hacking threats.”

Are the US and China ramping up cyberattacks against each other?

While the US has blamed China for cyberattacks over the years, Beijing has also accused Washington of hacking its critical cyber-infrastructure in recent years.

Here’s a brief timeline of recent cyberattacks claimed by the two nations:

On December 18, China’s National Computer Network Emergency Response Technical Team/Coordination Centre of China (CNCERT/CC) released a statement saying two US cyberattacks since May 2023 tried to “steal trade secrets” from Chinese technology firms.

On December 5, US Deputy National Security Adviser Anne Neuberger said a Chinese hacking group called Salt Typhoon had obtained communications of senior US government officials but classified information was not compromised.

A month earlier, on November 13, the FBI and CISA said they had uncovered a broad cyberespionage campaign carried out by China-linked hackers.

The US alleged that the hackers had compromised “private communications of a limited number of individuals”. While it did not specify who these individuals were, they were “primarily involved in government or political activity”, the FBI and CISA said.

Weeks before the US elections in November, the FBI launched an investigation after reports alleged Chinese hackers had targeted mobile phones of President-elect Donald Trump and Vice President-elect JD Vance as well as people associated with Kamala Harris, the Democratic presidential candidate in the race.

In July 2023, US tech giant Microsoft said the China-based hacking group Storm-0558 breached email accounts at about 25 organisations and government agencies. The breached accounts included those belonging to US Department of State staff.

In March, the US and United Kingdom accused China of carrying out a sweeping cyberespionage campaign that allegedly hit millions of people, including lawmakers, journalists and defence contractors. The two countries slapped sanctions on a Chinese company after the incident. A month before, US authorities said they had dismantled a China-sponsored hacker network called Volt Typhoon.

In response, China called the charges “completely fabricated and malicious slanders”.

In March 2022, China said it experienced a series of cyberattacks that mostly traced back to US addresses. Some were also traced back to the Netherlands and Germany, according to CNCERT/CC.

 

Video Duration 3 minutes 57 seconds
  • Now Playing

    Video Duration 03 minutes 57 seconds
    China cyber-attacks: Beijing calls UK & US accusations 'groundless'

    China cyber-attacks: Beijing calls UK & US accusations ‘groundless

Why are cyberattacks launched?

State-sponsored actors are regularly accused of launching cyberattacks against adversaries that range from state institutions to politicians and activists. They aim to gain unauthorised access to confidential data and trade secrets or disrupt economies and critical infrastructure.

Advertisement

“The US and China have had a history of using cyberdefence to further their national security aims,” Rebecca Liao, the Co-Founder and CEO at web3 protocol Saga, told Al Jazeera.

“While espionage against state actors is an accepted practice, the US has protested against China’s rampant cyberattacks against US commercial entities,” said Liao, who was a member of President Joe Biden’s 2020 and Hillary Clinton’s 2016 presidential campaigns, advising on China, technology and Asia economic policy.

“It is obviously not diplomatically wise to build a track record of resorting to espionage. That’s why Beijing has been so swift to deny all allegations.”

With the development of digital technology, cyberattacks are on the rise worldwide, according to the German Institute for International and Security Affairs (SWP). Data from the SWP shows that cyberattacks went up from 107 in 2014 to 723 in 2023.

Cyberattacks are also carried out by individuals or organised groups who want to steal data and money.

How can countries protect themselves from cyberattacks?

The US and China “should spearhead a treaty on the responsible use of the cyberspace”, wrote researchers Asimiyu Olayinka Adenuga and Temitope Emmanuel Abiodun from the Political Science Department at Nigeria’s Tai Solarin University in an article published this year.

They cited the example of the treaties signed between the US and Soviet Union as a result of the Strategic Arms Limitations Talks, SALT I and SALT II, in 1972 and 1979. The two Cold War superpowers signed the treaties to establish US-Soviet stability by limiting their production of nuclear weapons.

In their article, the Tai Solarin researchers added that there is a need for further technological development, particularly in quantum computing, that will make it harder to execute cyberattacks.

Victor Atkins, a fellow with the Indo-Pacific Security Initiative of the US think tank Atlantic Council, wrote in a February article that the US “should launch an expansive new multilateral cyber threat intelligence sharing coalition in the Indo-Pacific” to combat cyberattacks from China.

“A decade ago, there were some suggestions about convening an international body around cybersecurity to come up with standards or codes of conduct that participating nations would abide by,” Liao, the tech expert, said.

“However, none of these efforts have yielded fruit, and it is up to each individual country to protect against cyberattacks.”

Governments currently are working on developing cybersecurity infrastructure such as firewalls to protect themselves from cyberattacks such as hacking.

An article published by the University of Miami added that countries employ other practices to counter cyberthreats. These include testing these cyberthreats in a simulated environment. “Cyber teams constantly undergo training exercises, similar to the military,” the article said.

 

read more
alt=Weekly intelligence report titled "CPRI," summarizing key insights and data for strategic decision-making.
Cyber security
2024-12-30 Post a Comment

30th December – Threat Intelligence Report

TOP ATTACKS AND BREACHES

  • The Clop ransomware gang exploited a zero-day vulnerability (CVE-2024-50623) in Cleo’s Secure File Transfer products and is extorting 66 companies following alleged data theft. The attackers have given the victims 48 hours to initiate ransom negotiations before publicly disclosing their identities. This incident mirrors Clop’s previous exploitation of zero-day flaws in platforms like Accellion FTA, GoAnywhere MFT, and MOVEit Transfer.

Check Point Harmony Endpoint, Threat Emulation and IPS provide protection against this threat (Ransomware.Win.Clop; Ransomware.Wins.Clop; Ransomware.Wins.Clop.ta.* ; Cleo Arbitrary File Upload (CVE-2024-50623))

  • Pittsburgh Regional Transit (PRT) experienced a ransomware attack last week, resulting in service disruptions to its rail system and customer service operations. While transit services have resumed normal operations, certain rider services, such as processing ConnectCards, remain affected. The investigation, involving law enforcement and cybersecurity experts, is ongoing, with no confirmation yet regarding data theft or the group responsible for the attack.
  • Cyberhaven has been a victim of a cyber-attack that resulted in distribution of a malicious update for its Chrome browser extension. The compromised extension was able to exfiltrate users’ sensitive information, including authenticated sessions and cookies.
  • Cariad, Volkswagen’s automotive software subsidiary, exposed data from 800,000 electric cars, including sensitive geo-location information, due to misconfigured IT applications. The exposed data included details of vehicles from VW, Seat, Audi, and Skoda, with precise locations for 460,000 cars and pseudonymized user data. The Chaos Computer Club identified the vulnerability, enabling access to terabytes of unprotected customer information stored in Amazon cloud storage.
  • Japan Airlines has resumed to normal activity following a cyberattack that caused delays in domestic and international flights. The attack involved a sudden surge in network traffic, indicative of a distributed denial-of-service (DDoS) attack, affecting data communication with external systems. No customer information was leaked, and flight safety remained uncompromised.
  • ZAGG Inc., a consumer electronics accessories maker, has disclosed a data breach resulting in the exposure of customers’ payment card information. The breach occurred between October and November 2024, due to malicious code injected into the FreshClick app, a third-party application provided by their e-commerce platform, BigCommerce.
  • The European Space Agency’s (ESA) official merchandise store was hacked, causing it to display a fake payment page designed to steal customer payment card details.

VULNERABILITIES AND PATCHES

  • A critical SQL injection vulnerability (CVE-2024-45387), rated 9.9 on the CVSS scale, has been identified in Apache Traffic Control versions 8.0.0 and 8.0.1. The flaw allows privileged users with specific roles to execute arbitrary SQL commands in the database via crafted PUT requests. The issue has been patched in version 8.0.2.

Check Point IPS provides protection against this threat (Apache Traffic Control SQL Injection (CVE-2024-45387))

  • A critical vulnerability (CVE-2024-52046) with a maximum CVSS score of 10.0, has been discovered in Apache MINA, a Java network application framework. The flaw arises from the ObjectSerializationDecoder’s use of Java’s native deserialization protocol without adequate security measures, enabling attackers to execute remote code by sending malicious serialized data.
  • Palo Alto Networks has disclosed an actively exploited Denial of Service (DoS) vulnerability (CVE-2024-3393) affecting PAN-OS software. The flaw allows unauthenticated attackers to send malicious packets that force affected firewalls into reboot or maintenance mode, disrupting firewall protection. The issue impacts devices with DNS Security logging enabled and has been patched in versions PAN-OS 10.1.14-h8, 10.2.10-h12, 11.1.5, and 11.2.3.
  • A high-severity OS command injection vulnerability (CVE-2024-12856) has been identified in Four-Faith router models F3x24 and F3x36. Exploitation via default credentials may enable unauthenticated OS command execution. Over 15,000 internet-facing devices are at risk, with evidence suggesting active exploitation since at least early November 2024.

Check Point IPS provides protection against this threat (Four-Faith F3x Series Command Injection (CVE-2024-12856))

THREAT INTELLIGENCE REPORTS

  • Researchers have observed “OtterCookie”, a new malware used in the North Korean-associated Contagious Interview campaign. This financially motivated campaign targets a broad range of victims and is active in Japan. OtterCookie communicates via Socket.IO, executes shell commands to exfiltrate sensitive data, including cryptocurrency keys, and uses clipboard data collection to enhance its capabilities.
  • Researchers have identified heightened activity by the Paper Werewolf (aka GOFFEE) cluster, conducting at least seven campaigns targeting Russian organizations since 2022. Using phishing PowerShell and PowerRAT, and emails with malicious macros, the group conducts espionage and destructive ops, including disabling IT infrastructure and changing account credentials. The arsenal includes custom implants, reverse shells, and malicious IIS modules for credential harvesting.
  • Researchers have analyzed the increased activity from botnets like the Mirai variant “FICORA” and the Kaiten variant “CAPSAICIN,” which exploit long-standing vulnerabilities in D-Link devices to execute malicious commands via the HNAP interface.
read more
alt=1. A visual representation of Earth in 2025, highlighting themes of sustainability and cybersecurity for a safer future.
Cyber security
2024-12-30 Post a Comment

Looking At the Year Ahead: What Can We Expect Within the Cybersecurity Landscape?

Cybersecurity experts predict cybersecurity attacks will continue to happen with more sophistication

Pietje Kobus

2024 was a year that saw several blows to the healthcare industry when it came to cybersecurity. Data breaches and ransomware attacks caused major disruptions in the daily operations of healthcare organizations with significant monetary implications.

On February 21, Change Healthcare reported a cybersecurity breach that caused prescription delays for numerous pharmacies. Many healthcare organizations struggled with cash flow, pushing some close to bankruptcy.

In May, one of the nation’s largest health systems, Ascension, was a victim of a ransomware attack impacting Ascension’s electronic health records systems (EHR) and tools for ordering tests, procedures, and medications. This caused several hospitals to be on diversion for emergency medical services.

In July, the healthcare industry woke up to a global outage caused by a faulty software update by cybersecurity firm CrowdStrike affecting computers running on Microsoft Windows. “Healthcare is estimated to have suffered direct losses of $1.94 billion, with an average estimated loss of $64.6 million per company,” Steve Alder reported for the HIPAA Journal.

Numerous other healthcare organizations were victims of data breaches this past year. IT departments scrambled to stay on top of a barrage of cybersecurity attacks.

Errol Weiss, chief security officer at Health-ISAC, confirms that this year, a higher number of cybersecurity events were observed than the year prior. What’s happening now, he says, is that not only are hospitals victims of ransomware attacks but now patients as well. Criminals will threaten to release private patient data if a ransomware sum is not being paid. The ransomware group BlackCat attacked Leigh Valley Health, for example, and threatened to release nude pictures of its cancer patients. The class action suit was settled for $65 million. Weiss expects to see more of these types of attacks in the year ahead. “They will go after whatever they can,” Weiss says about the cybercriminals.

To the question of whether he thinks federal legislation on cybersecurity measures within healthcare will be helpful, Weiss responds, “Hospitals are operating on razor-thin margins as it is, and it is very difficult for them to invest in things that aren’t directly related to patient care. If we’re going to talk about any kind of legislation moving forward, especially in the new administration, it needs to come with the adequate resources to make sure that that happens.”

Weiss doesn’t believe in throwing money at the problem. He advocates getting the right people into organizations to address issues. He believes a virtual CISO program is a way to get additional help in. Weiss says there are a lot of cybersecurity vendors and point solutions. “The market is very confusing…. So if you had $100 to spend on cyber security, where would you spend that?”

As to what to expect in 2025, Weiss points to the issue of attacks on the supply chain, where the level of sophistication is increasing. In this area, Weiss says, the attacks don’t seem so random, “where many of these malware attacks, the ransomware gang will send out millions of malicious emails and hope that they get somebody somewhere to click on something and install the ransomware.” The attacks this past year seem to be more targeted.

Weiss anticipates artificial intelligence (AI) will also be part of more attacks. “We’ve already seen the talk about malicious actors leveraging AI to develop zero-day attacks, which is absolutely mind-boggling because you leverage AI to help develop some new attack technique.” Weiss adds, “If the bad guys can use AI to develop a new zero-day, I think we’ve got to also be proactive, finding out those zero-days, and then defending against those.”

Jason Griffin, managing director of digital health for Nordic, agrees that the cybersecurity landscape continues to evolve. “The threat surface continues to grow.” “We become more and more integrated with not just our electronic medical records, but our biomedical devices and other devices that are now managing and storing data that are networked across every hospital.”

Griffin states that phishing and access controls are the biggest areas of threats. He believes attacks will rise and will continue to be successful. “The sophistication of the tools and the approaches by these hackers will only grow exponentially.”

“AI,” Griffin adds, “can help those bad actors grow exponentially the number of attacks that they can put into the environment.” Cybercriminals can attack through fabricated videos and conversations. “They’re going to get more sophisticated now that they can generate content from an AI perspective, that is even more close to reality.”

However, as cyber attackers become more sophisticated, so do we in preventing the attacks, Griffin notes. Being proactive is key in preventing these attacks, he says. He agrees with Weiss that the budget isn’t always there.

Griffin believes that more standards in cybersecurity within healthcare would be beneficial. New York is already adopting more stringent regulations going into 2025.

“Healthcare providers should connect their technology, and cyber teams should be connecting more with the business,” Griffin advises. “Cyber security is becoming a patient safety issue.” It’s key, he says, that CISOs and CIOs align more with the business strategy and understand the ramifications of losing access to the system. Being prepared is essential, Griffin says because an attack will inevitably happen. “You can’t be prepared enough.”

“I just can’t stress enough that this is not just a technical concern,” Griffin underscores, “we’ve got to elevate the discussion to a business and strategy discussion.” “We all have a responsibility now to protect our data, protect our patients, and protecting those patients comes in many forms and fashions.”

read more
alt=Image illustrating steps to remove Safari from a Mac, highlighting a recent macOS vulnerability affecting privacy controls.
Cyber security
2024-10-19 Post a Comment

Microsoft Reveals macOS Vulnerability that Bypasses Privacy Controls in Safari Browser

î „Ravie Lakshmanan

Microsoft Reveals macOS Vulnerability

Microsoft has disclosed details about a now-patched security flaw in Apple’s Transparency, Consent, and Control (TCC) framework in macOS that has likely come under exploitation to get around a user’s privacy preferences and access data.

The shortcoming, codenamed HM Surf by the tech giant, is tracked as CVE-2024-44133. It was addressed by Apple as part of macOS Sequoia 15 by removing the vulnerable code.

HM Surf “involves removing the TCC protection for the Safari browser directory and modifying a configuration file in the said directory to gain access to the user’s data, including browsed pages, the device’s camera, microphone, and location, without the user’s consent,” Jonathan Bar Or of the Microsoft Threat Intelligence team said.

Microsoft said the new protections are limited to Apple’s Safari browser, and that it’s working with other major browser vendors to further explore the benefits of hardening local configuration files.

Microsoft Reveals macOS Vulnerability

HM Surf follows Microsoft’s discovery of Apple macOS flaws like Shrootless, powerdir, Achilles, and Migraine that could enable malicious actors to sidestep security enforcements.

While TCC is a security framework that prevents apps from accessing users’ personal information without their consent, the newly discovered bug could enable attackers to bypass this requirement and gain access to location services, address book, camera, microphone, downloads directory, and others in an unauthorized manner.

The access is governed by a set of entitlements, with Apple’s own apps like Safari having the ability to completely sidestep TCC using the “com.apple.private.tcc.allow” entitlement.

While this allows Safari to freely access sensitive permissions, it also incorporates a new security mechanism called Hardened Runtime that makes it challenging to execute arbitrary code in the context of the web browser.

That said, when users visit a website that requests location or camera access for the first time, Safari prompts for access via a TCC-like popup. These entitlements are stored on a per-website basis within various files located in the “~/Library/Safari” directory.

The HM Surf exploit devised by Microsoft hinges on performing the following steps –

  • Changing the home directory of the current user with the dscl utility, a step that does not require TCC access in macOS Sonoma
  • Modifying the sensitive files (e.g., PerSitePreferences.db) within “~/Library/Safari” under the user’s real home directory
  • Changing the home directory back to the original directory causes Safari to use the modified files
  • Launching Safari to open a web page that takes a snapshot via the device’s camera and grab the location

The attack could be extended further to save an entire camera stream or stealthily capture audio through the Mac’s microphone, Microsoft said. Third-party web browsers don’t suffer from this problem as they do not have the same private entitlements as Apple applications.

Microsoft noted it observed suspicious activity associated with a known macOS adware threat named AdLoad likely exploiting the vulnerability, making it imperative that users take steps to apply the latest updates.

“Since we weren’t able to observe the steps taken leading to the activity, we can’t fully determine if the AdLoad campaign is exploiting the HM surf vulnerability itself,” Bar Or said. “Attackers using a similar method to deploy a prevalent threat raises the importance of having protection against attacks using this technique.”

read more
alt=A man in a hoodie is seated at a computer, focused on the screen in a cozy indoor setting.
Cyber security
2024-10-18 Post a Comment

Undercover North Korean IT workers now steal data, extort employers

By

North Korean IT professionals who trick Western companies into hiring them are stealing data from the organization’s network and asking for a ransom to not leak it.

Dispatching IT workers to seek employment at companies in wealthier nations is a tactic that North Korea has been using for years as a means to obtain privileged access for cyberattacks or to generate revenue for the country’s weapons programs.

Researchers at cybersecurity company Secureworks uncovered the extortion component during multiple investigations of such fraudulent schemes.

After the employment of a North Korean national with access to proprietary data (as part of their contractor role) terminated, the company would receive the first extortion email, the researchers explain.

To obtain the job and avoid raising suspicions afterwards, the fraudulent IT workers used a false or stolen identity and relied on laptop farms to route traffic between their real location and the company through a U.S.-based point.

They also avoided video during calls or resorted to various tricks while on the job to hide their face during video conferences, such as using artificial intelligence tools.

Overview of the scheme
Overview of the scheme
Source: Secureworks

In July, American cybersecurity company KnowBe4 revealed that they were among the hundreds of victimized companies, and in their case, the threat actor attempted to install an infostealer on the company’s computer.

Secureworks tracks the group organizing and coordinating North Korea’s IT worker army as “Nickel Tapestry,” while Mandiant uses the UNC5267 name.

One example of a Nickel Tapestry campaign in mid-2024 that Secureworks investigated is that of a company that had proprietary data stolen almost immediately after employing an external contractor

The data was transferred to a personal Google Drive cloud storage using the company’s virtual desktop infrastructure (VDI).

After terminating the employment due to poor performance, the company began receiving extortion emails from external Outlook and Gmail addresses containing samples of the stolen data in ZIP archives.

The threat actors demanded a six-figure ransom to be paid in cryptocurrency in exchange to not leaking the data publicly.

Secureworks’ investigation revealed that Nickel Tapestry had used Astrill VPN and residential proxies to mask their real IP address during the malicious activities, while AnyDesk was used for remote accessing the systems.

The researchers warn that North Korean IT workers often coordinate to refer one another to companies.

Organizations should be cautious when hiring remote workers or freelancers, and look for signs of fraud like changes in payment accounts and laptop shipment addresses, submission of generic-looking resumes, atypical correspondence hours, and unwillingness to enable camera during interviews.

read more
Trustpilot
The rating of livingsafeonline.com at Trustprofile Reviews is 9.1/10 based on 13 reviews.
Verified by MonsterInsights