Cyber Intelligence Briefing: 21 July 2023

The S-RM Cyber Intelligence Briefing is a weekly round-up of the latest cyber security news, trends, and indicators, curated by our intelligence specialists.

1. ESTEE LAUDER AND TOMRA TAKE ACTION DURING EXTENSIVE CYBER ATTACKS

Ransomware groups Cl0p and BlackCat/ALPHV both claim to have successfully stolen data from Estee Lauder in separate incidents. The cosmetics giant confirmed it had suffered an attack, and said it had taken down some of its systems in response.

Separately, Norwegian recycler Tomra has disconnected systems to contain a major cyber attack. The disruption appears to be operational with no indication of data theft.

SO WHAT?

Containment and eradication actions are crucial for limiting business impact during an attack. These containment and eradication procedures should be clearly defined in an incident response plan.

2. VIRUSTOTAL INADVERTENTLY LEAKS DETAILS OF 5,600 CUSTOMERS

VirusTotal, Google's malware scanning repository, uploaded a list of names and email addresses of thousands of its users worldwide. Affected customers include private sector intelligence firms and individuals affiliated with national security and defence agencies. Google removed the leaked list within an hour of its posting, and is now evaluating their internal processes and technical controls.

SO WHAT?

Anything uploaded to VirusTotal is publicly visible, which puts data security at risk. Avoid automated uploads to the platform and ensure attachments have any sensitive data removed prior to uploading.

3. CLOUD SECURITY: SENSITIVE DOCUMENTS OF WEC DRIVERS EXPOSED AS MICROSOFT INCREASES LOGGING VISIBILITY

Researchers have discovered exposed cloud storage buckets containing over 1.1 million files belonging to the FIA World Endurance Championship (FIA WEC). The cloud storage contained passports and driver licences belonging to FIA WEC drivers.

Separately, following the recent cloud-based Outlook breach, Microsoft has made Purview Audit logs available to all customers for free. The advanced logging feature, which was previously only available to premium customers, assisted in detecting the latest breach.

SO WHAT?

If your organisation makes use of cloud services, carefully review the settings and enable the appropriate logging functionality.

4. NEW RANSOMWARE STRAIN IMPERSONATING CYBER SECURITY FIRM SOPHOS

The cyber security firm Sophos is being impersonated by a new ransomware strain called SophosEncrypt, which appends '.sophos' to encrypted files and displays a wallpaper with the Sophos brand. Sophos is investigating the source of the ransomware.

SO WHAT?

Organisations should stay vigilant against innovative attack methods employed by threat actors, such as posing as cyber security vendors.

5. IT EMPLOYEE JAILED FOR IMPERSONATING RANSOMWARE GANG TO EXTORT EMPLOYER

A former IT security analyst from the UK has been given a three-year prison sentence for impersonating the ransomware gang that had targeted his employers. The individual gained access to a board members’ private emails and attempted to redirect ransomware payments to his own bitcoin wallet.

SO WHAT?

Companies must stay vigilant against the possibility of internal threats. Involving external forensic providers to investigate a breach can help detect malicious behaviour.

6. RANSOMWARE SIMILARITIES DISCOVERED

NoEscape, a new ransomware group discovered in June 2023, is likely to be a rebranding of the Avaddon ransomware group, who were last seen in 2021. The evaluation was based on the tactics, techniques, and procedures (TTPs) of both groups, with the ransomware encryptor having close similarities. Ransom demands by NoEscape have been known to be as high as USD 10 million.

SO WHAT?

Threat actors often rebrand and form new groups, reusing the same techniques, tactics, and procedures.

7. CRIMINALS EXPLOIT WOOCOMMERCE FLAW TO HIJACK WORDPRESS WEBSITES

Hackers are actively exploiting a critical security flaw in WooCommerce Payments WordPress plugin, which has more than 600,000 active installations. The flaw enables attackers to impersonate users, including administrators, to take control of WordPress sites.

SO WHAT?

Technical details on the vulnerability have been public for several weeks. Organisations should update their WooCommerce Payments installations to a patched version as soon as possible.

CRA23_Winner Shield S-RM is proud to have been voted Cyber Incident Response Team of the Year at Zywave’s 2023 Cyber Risk Awards. Read more here.