Cyber Intelligence Briefing: 8 September 2023

The S-RM Cyber Intelligence Briefing is a weekly round-up of the latest cyber security news, trends, and indicators, curated by our intelligence specialists.

1. FBI TAKES DOWN NOTORIOUS QAKBOT BOTNET NETWORK

International law enforcement agencies and the FBI have taken down infamous malware platform Qakbot, which was used for more than a decade by criminals to commit a variety of financial crimes. Qakbot infected more than 700,000 computers and caused hundreds of millions worth of damage to businesses around the world.

Separately, the US and UK have sanctioned 11 individuals allegedly associated with Trickbot – a notorious group reportedly responsible for extorting at least USD 180 million from victims globally, including through ransomware attacks.

SO WHAT?

These actions do disrupt the cybercriminal ecosystem, although the impact is often short-lived as cybercriminals quickly find new methods and techniques to achieve their objectives. Despite the crackdown, organisations should continue to invest in their cyber security defences.

2. DATA ON UK MINISTRY OF DEFENCE SITES EXPOSED AFTER ATTACK ON SUPPLIER

The UK Ministry of Defence has allegedly experienced a data breach following a LockBit ransomware attack on its supplier Zaun, a UK-based high-security fencing manufacturer. According to media reports, LockBit leaked documents relating to sales orders and physical installations and equipment at MOD and GCHQ sites. The hackers gained access to Zaun's systems via a legacy Windows 7 device.

SO WHAT?

Organisations should replace vulnerable legacy systems to prevent potential data breaches and disruptions, which can have significant security implications.

3. PASSWORD DATA LEAKS AT CALLAWAY AND LOGICMONITOR

Golf equipment supplier Callaway has informed 1.1 million customers that account information, including passwords and security questions, was exposed in an IT incident.

Separately, the use of weak default passwords and insecure password policies by network security company LogicMonitor has led to cyber attacks on its customers.

SO WHAT?

It is important to use unique passwords and enable multi-factor authentication to protect against account compromises.

4. RAAC VS RAAS: CYBER INCIDENTS AT START OF TERM CAUSE DISRUPTION TO UK SCHOOLS

Debenham High School in Suffolk UK had all IT systems taken offline during a recent hack and, in another incident, a ransomware attack on a school in Wokingham restricted access to teaching resources, preventing lesson planning. Separately, a North London high school has resorted to pushing back its official start date by 6 days to recover from a cyber incident.

SO WHAT?

Cyber incidents can cause significant operational downtime. In the event of an attack, you must ensure that you have backups, isolated and stored offsite/offline to help speed up recovery time.

5. CONCERNS OVER NEW LAW GOVERNING SOFTWARE VULNERABILITIES IN CHINA

A new law in China effectively forces organisations to first report all software vulnerabilities to the country’s Ministry of Industry and Information Technology before publicly releasing a patch. There are concerns that this will facilitate the exploitation of zero-day vulnerabilities by state-linked threat actors. According to a report by the US think tank Atlantic Council, there has been a marked increase in the number of zero-day exploits used by Chinese state-linked hacking teams since the law was passed.

SO WHAT?

Zero-day vulnerabilities are incredibly difficult to defend against. While prevention is ideal, an organisation’s ability to detect and respond to intrusions is critical.

6. PATIENT DATA POSSIBLY LEAKED FROM MELBOURNE PATHOLOGY CLINIC

A cyber attack on Melbourne pathology clinic TissuPath potentially exposed ten years' worth of patient data, including names, dates of birth, contact details, Medicare numbers, and private health insurance details. The attack was claimed by the ransomware gang ALPHV/BlackCat.

SO WHAT?

Organisations should sanitise and encrypt data to safeguard sensitive information. Compliance with a strict data retention policy can also mitigate the impact of a data breach.

7. TRYGG-HANSA FINED USD 3 MILLION FOR EXPOSING CLIENT DATA

Swedish insurer Trygg-Hansa has been fined USD 3 million by the Swedish Authority for Privacy Protection after it was found that a backend database was publicly accessible without authentication. This led to the potential exposure of sensitive data of over 650,000 clients for over two years. The exposed information included personal, health, financial, and social security data.

SO WHAT?

Misconfigurations are a common cause of data breaches. Organisations should conduct regular penetration tests to identify potentially accessible and vulnerable systems.