Cyber Intelligence Briefing: 2 December 2022

The S-RM Cyber Intelligence Briefing is a weekly round-up of the latest cyber security news, trends, and indicators, curated by our intelligence specialists.

1. META FINED AFTER USER DATA LEAKED

Ireland’s Data Protection Commission (DPC) has fined Meta EUR 265 million following an April 2021 data breach. Personal information of more than 500 million Facebook users was harvested and leaked online. Malicious actors took advantage of a vulnerability in Facebook’s application programming interface (API) to scrape users’ public profiles for phone numbers, dates of birth, locations, and email addresses.

Separately, malicious actors abused a Twitter API vulnerability to steal the personal information of over 5.4 million users. The information was initially marketed on a hacking forum for USD 30,000 in July, and was made available for free last week.

SO WHAT?

Organisations that hold sensitive personal data online in a web-facing format should take steps to protect their APIs from automated web scraping tools.

2. LASTPASS HACKED AGAIN

For the second time in 2022, password manager LastPass has suffered a data breach that has resulted in customer data being compromised. Threat actors gained access using stolen information from a previous security breach in August 2022. Customer passwords have reportedly not been accessed during this incident.

SO WHAT?

Organisations should conduct thorough post-incident reviews and examine lessons learned to reduce the risk of similar incidents reoccurring in the future.

3. LARGE ORGANISATIONS HIT BY RANSOMWARE

Vice Society has hit IKEA Morocco and IKEA Kuwait. The attacks have led to personally identifiable information being posted on their leak site. Separately, the group has also targeted Cincinnati State College.
Black Basta ransomware group has claimed responsibility for the cyber attack on Canadian meat supplier Maple Leaf Foods, publishing screenshots of their financial information and corporate files. Maple Leaf has reportedly refused to pay a ransom.

SO WHAT?

Ransomware incidents cause significant reputational and financial damage. S-RM offers ransomware readiness assessments that will help your organisation understand if existing policies, people, processes, and technology are sufficient in protecting against this constant threat.

4. UK PARLIAMENTARY INQUIRY INTO RANSOMWARE STRATEGY

An inquiry into the UK’s national security strategy against ransomware held its first session on Monday. The introductory session aimed to establish the scale and nature of the threat. The committee heard evidence that ransomware has increased by 300 percent year on year since 2020. It was also established that the UK government has not delivered tangible actions to address the threat.

SO WHAT?

Considering the prevalence of ransomware attacks, it is important to stay informed of the ever-changing threat landscape, and the new tactics, techniques, and procedures that threat groups are employing.

5. RAGNAR LOCKER LAUNCH ATTACK ON BELGIAN POLICE

The Ragnar Locker ransomware gang infiltrated a local Belgian police unit’s network and leaked years’ worth of confidential information that could compromise police investigations. The Belgian Chief Commissioner of Police blamed the breach on ‘human error’ and stated that the sensitive data should not have been on the compromised administrative network.

SO WHAT?

Network segmentation can reduce the impact of an attack by preventing threat actors from moving laterally once they have gained access. Organisations should consider their network architecture as part of an assessment of their overall level of ransomware resilience.

6. HIGH-PRIORITY PATCH

US federal agencies have been ordered to patch an actively exploited critical vulnerability (CVE-2021-35587), affecting Oracle Fusion Middleware software. Threat actors with unauthenticated access could abuse this security flaw to compromise Oracle Access Manager (OAM) instances and take over any user or administrator accounts on a vulnerable system.

SO WHAT?

Organisations should implement the vendor patches for vulnerable versions of Oracle Fusion Middleware as soon as possible.