Search This Blog

Showing posts with label Cyber Attacks. Show all posts

Cyber-War Exercise held between US and Taiwan


In a cyber-war event that has been going for a week now, the Taiwanese executives are getting hit by phony emails and messages as a part of it. The event is said to be one of its kind. As a part of the cyber-war training between Taiwan and America, the local authority (of Taiwan) is co-directing the cyber drill with the American Institute in Taiwan (AIT), which also represents the US interests in Taiwan. "The foremost is attention is on threats professed by 'North Korea and other countries' that are responsible for the attack," says AIT in a statement.


On the contrary, Taiwan says that a vast number of cyber-attacks that it suffers come from China. "It is like fighting combat when we are dealing with attacks like these," said a Taiwanese official earlier this month. The cyber-war drills are to take place on Friday, which will try to break into the administration servers and websites by duping the workers in receiving misleading messages. "Taiwan considers China as the main offender for these cyberattacks threats on the island," said Veerle Nouwens, Royal United Services Institute for Defence and Security Studies, UK.

"Taiwanese administration's systems suffer around 30 million cyberattacks every month, and China is responsible for half of it," says the administrator general of Cyber Security Agency, Taiwan. He further adds, "But, no matter where the origin of the attacks happen, building a robust cyber-security system is the first priority for every government and private-sector corporations."

Risks involved- 
The cyber-war exercises were formally started by Raymond Greene, Director, AIT, at a Microsoft event. "It is a start of new opportunities between the two nations in the cybersecurity field," says Raymond regarding the tests. "The concern today is not any physical violence in any country but rather an invasion of cyber-security by corrupt criminals that is capable of stirring the society from the inside." "But in the end, these attacks are a concern for us all in numerous ways." This is a matter of serious concern as the cyberattacks are trying to influence the elections, economy, and infrastructure of the victim country.

The data of Alfa-Bank's clients is sold on the black market


The data of Alfa-Bank credit card holders, as well as Alfa Insurance customers came up for sale in the Darknet. The bank confirmed the leak saying that it affects a few customers and does not pose a threat to the money in the accounts.

Seller who published the ad on a hacker forum said that he has up-to-date data on about 3,500 Alfa-Bank customers and about 3,000 Alfa Insurance customers. The ad was published on October 31, the seller registered there on the same day.

To verify the data, the seller suggested to look at 23 contracts. They contained the full name, mobile phone number, passport data, registration address, the amount of credit limit or issued insurance, the subject of insurance, as well as the date of conclusion of the contract. According to the seller, all contracts of Alfa-Bank are issued in October.

When the investigator tried to transfer money by phone number, in 11 of the 13 credit card contracts, the names and first letters of the surnames matched. Also he phoned up nine customers, most of them confirmed that they had recently issued a credit card at Alfa Bank. Fraudsters have already managed to make a call to one of the clients, after which he blocked the card.

Alfa-Bank confirmed the leak. "At the moment, it is reliably known about the illegal distribution of personal data of 15 clients. The occurrence of this situation is not the result of a violation of the protection of the corporate information system of the Bank, " - said the representative of the Bank.

According to him, the leak does not pose a threat to customer accounts, as it does not have data to access them.

Indeed, the contracts do not contain card numbers and CVV-codes, so fraudsters will not be able to get direct access to the money. However, they can use the information to call a customer under the guise of a Bank and find out the necessary information to steal money.
Alfa Insurance has introduced additional security measures and is investigating the publication of customer data.

Recall, in early October Sberbank confirmed of credit card accounts, which affects at least 200 customers of the Bank. It was announced that 60 million credit cards were in the public domain.

Georgia in a panic after a strange cyberattack


On October 28, several hundred websites in Georgia were attacked by hackers. As a result of the cyberattack, several Georgian TV companies stopped broadcasting. The cyberattack was also carried out on the website of the administration of the President of Georgia Salome Zurabishvili. When the site was opened, a photo of the runaway ex-President of Georgia appeared with the inscription: "I will be back." The damage, according to preliminary data, is very large.

The State Security Service and the Ministry of Internal Affairs with the support of partner countries are investigating a massive cyber attack on public and private sites in Georgia.

The Georgian Ministry of Internal Affairs admitted on Tuesday that the attack could come from both Georgian territory and from abroad.

Political scientist Tornike Gordadze, who held the post of minister in the government of Saakashvili, believes that this is a vivid example of "the ineffective work of the government to ensure security against possible threats, including from Russia."

In addition, the French Daily Le Monde saw the Russian connection in a large-scale cyberattack.

According to the newspaper, the current Georgian authorities are taking new steps to improve relations with the Kremlin in the hope of resuming trade with the Russian neighbor, as well as the extradition of alleged criminals. The hacker Yaroslav Sumbayev, who was arrested in Georgia in 2018 and suspected of involvement in the murder of Colonel Evgenia Shishkina, who was investigating economic crimes and corruption offenses, was handed over to Russian authorities on October 24, despite a statement by his lawyer regarding the risk of "inhuman treatment." The publication believes that a large-scale cyber attack could be a retaliation from the hacker community.

Former analyst of the Georgian National Security Council and political affairs assistant to the Prime Minister of Georgia, political analyst Tornike Sharashenidze, did not rule out "the involvement of the Russian Federation in the hacker attack in Georgia."

Malspam Campaign attacks German organizations with Buran ransomware


As of Oct 2019 researchers have discovered malicious spam (malspam) campaign targeting German organizations that delivered Buran crypto-ransomware family. The emails are crafted so as to appear to be coming from online fax service eFax.

Public reporting indicates that Buran malspam campaigns began on 13 September 2019, corroborated by metadata found in emails and Microsoft Word documents. Then the campaign on 1 October 2019 copied the eFax brand, an online fax service. German organizations were targeted using an email that seemed like it was from eFax and Word document in German.

 Technical Details 

On opening the mail, the user is given a hyperlink, which if clicked directs the user to a PHP page that contains the malicious word document. The document then contains a Visual Basic for Applications (VBA) macro, when enabled, downloads the malicious executable.

On Activation, the Buran ransomware performs the following tasks- (Sc.Itssecure.com)

•Sends an HTTP GET request to hxxp://geoiptool[.]com, in order to determine the location of the victim machine.
•Copies itself to another directory & renames itself to “Isass.exe”, in order to evade being detected by security solutions in place.
•It then utilizes a command shell to establish persistence.
•Further, it modifies the windows registry’s run key, so that “Isass.exe” is executed every time someone logs into the machine.
•It then disables services like windows event log and windows error recovery & automatic repair.
•Finally, it deletes any backups made by Volume shadow copy service (VSS).
•Upon completion of the encryption process, a ransom note is displayed, containing the instructions that need to be followed by the victim, in order to decrypt his files.

These type of malicious spam ransomware campaigns leads to lag in business-critical operations, loss of sensitive and confidential data and financial loss to the organization. Such ransomware keeps surfacing often and can lead to degeneration of an organization and hence organizations should take active measures and protect themselves from such malevolent attacks. The organizations should create strong cybersecurity with updated systems and software and invest in employee training programs, to aware them about malspams, phishing, and other threats.

Group-IB reported on the five hacker groups threatening to Russian banks


The main hacker groups threatening Russian banks are Cobalt, Silence, MoneyTaker, Lazarus and SilentCards. They can hack a Bank, reach isolated financial systems and withdraw funds, said Ilya Sachkov, CEO and founder of Group-IB, a company specializing in preventing cyber attacks.

At the same time, hacker groups are shifting their focus from Russia to other countries.

According to the founder of Group-IB, "it is curious that three of the five groups (Cobalt, Silence, MoneyTaker) are Russian-speaking, but over the last year Cobalt and Silence began to attack banks mainly outside Russia".

"For example, Silence began its activities in Russia, but gradually shifted its focus to the CIS, and then entered the international market. Group-IB analysts have detected Silence attacks in more than 30 countries in Europe, Asia and the CIS for the current year," said Sachkov.

According to him, the pro-government hackers of developed countries are the most dangerous, since their activity is less noticeable, while they have a better arsenal for carrying out attacks.

"Our last year's forecast came true. The number of targeted attacks aimed at espionage, sabotage or obtaining direct financial benefits has grown significantly. So-called "digital weapons" or cyberweapons, which can stop production processes and disable networks of critical infrastructure and large commercial enterprises, are actively used. This is a serious problem. The number of cyber attacks will increase and it will be more difficult to resist them, " added Sachkov.

The head of the company Group-IB also said that cybercriminals began to use a new method of stealing money from Bank customers by installing remote access programs on smartphones. The monthly losses of large banks from this type of fraud can reach 6-10 million rubles.

He noted that the Secure Bank system monthly records of more than 1 thousand attempts to steal money from the accounts of individuals using this scheme.

Earlier it was reported about a new way of stealing from Bank cards. Hackers pose as Bank employees using the technology to substitute phone numbers.

The Head of the FSB spoke about the threat of massive terrorist hacker attacks


Director of the FSB Alexander Bortnikov said that terrorist can disguise their hacking attacks under the actions of special services of specific States and this threatened to political and military conflicts. He stated this at the XVIII international meeting of heads of intelligence, security and law enforcement agencies in Sochi.

According to the FSB, terrorist groups create and develop their own cyber units.

Bortnikov called on intelligence agencies of other countries to support Russia's demand to deposit encryption keys for mobile devices. Fighting terrorism is ineffective as long as they use closed channels of communication on the Internet, he explained.

"The main tool of communication between bandits are still Internet Messengers with high crypto protection. In this regard, we consider it a serious problem that a number of the world's leading IT companies do not want to cooperate with intelligence agencies in the field of information security,” Bortnikov said.

He also called on the special services to join efforts in identifying and blocking terrorist and extremist materials on the Internet and to establish cooperation with leading technology companies for this purpose.

Bortnikov also noted that the capabilities of terrorists in the future can grow due to the growing availability of artificial intelligence technologies. And with their help, the militants will be able to analyze large amounts of information, including illegally obtained databases.

In addition, the FSB Director said that international terrorists are increasingly using "confidential cryptocurrencies" to financially fuel their criminal activities. According to Bortnikov, terrorists create shell companies that legally participate in trading on stock exchanges, invest in real estate and various sectors of the economy. At the same time, criminals are increasingly using not bitcoin, but so-called “confidential cryptocurrencies”, which guarantee the anonymity of transactions.

Also, Alexander Bortnikov said about the threat of massive terrorist attacks using unmanned aerial vehicles. According to Bortnikov, the use of unmanned aerial vehicles capable of delivering various cargoes by terrorists will become a "real challenge" for the world's intelligence services.

It is important to add that this year the FSB has identified 39 terrorist attacks in preparation and eliminated 32 terrorists.

How 5G Network would Change the IoT and the Challenges Ahead



Extremely fast and effective, 5G mobile networks would increase the exposure to attacks as every internet of things (IoT) when connected to fifth-generation technology can potentially become a tempting target for attackers and cybercriminals.

The efficiency would allow for improved interconnectivity and greater control over devices and machines ranging from automobiles to traffic lights and everything in between which have internet-connected sensors embedded in it. The number of such items is reported to rise from 14.2bn to 25bn by 2021, according to global research and advisory firm, Gartner.

Major home appliance company, Whirlpool is all set to have one its factories run on 5G technology. The factory puts to use a lot of metal and as 5G penetrate through walls and doesn't reflect off metal unlike Wi-Fi, Douglas Barnes, Whirlpool's North American regional IT and OT manufacturing infrastructure applications manager, says, "This will allow us to go to truly autonomous vehicles throughout the entire plant, for maintenance, for delivery, for everything that supports the manufacturing operations. That business case carries so much weight and so much in cost savings. The payback for 5G is very favorable."

With encryption of data becoming more secure than ever, 5G technology will massively change the way users communicate over the internet, browse, watch videos and play games. However, the increased speed and effectiveness, low latency, high Gbps data transfer rates, and greater capacity also accompany more security challenges as compared to the current mobile networks. It would mean that threat actors while breaching a machine running on a 5G network, will be able to download and hence steal the data much faster than the current networks allow. It would also make it easier for criminals to execute bigger cyber attacks by utilizing the increased engagement of software required to smoothly run 5G technology.

Did hackers exploit IoT before?

Earlier in 2016, in the "Mirai botnet" cyber attack, where hackers took advantage of vulnerable IoT devices to take down major websites including Reddit, Twitter, Spotify and left much of the internet inaccessible, the incident witnessed the involvement of a large number of routers, cameras, and video recorders to take down a large chunk of the internet for the Eastern coast.

Commenting on the matter, Cesar Cerrudo, chief technology officer at IOActive, a cybersecurity consultancy, said, "I think 5G will be a more tempting target for nation-state actors than . . . hackers, as 5G will be a core communication technology for most countries,” 

Security experts recorded more than 500,000 attacks on smart devices in 2 hours


Avast experts conducted an experiment installing in Russia (in Moscow and Khabarovsk) and in other countries of the world more than 500 trap servers (Honeypots), posing as IoT devices, such as streaming devices, webcams or routers. With this, the experts wanted to prove how many potential attacks smart home devices face.

More than 500 traps were scanned by potential attackers 561,003 times in two hours, and five devices located in Russia were scanned 5,370 times in two hours. Honeypots traps were located in Russia, Mexico, France, Germany, South Korea, Australia, the United Kingdom, Australia, Japan, Spain, Ireland, Singapore, the United States, and India. According to the research, the three main countries from which the attacks came were the US, the Netherlands and Japan.

It is worth noting that Avast researchers chose typical connected devices with open ports to make attackers believe they were connecting to real routers, smart TVs, Webcams, or other smart devices.

The purpose of the trap was to calculate the activity of cyber criminals and study the methods of attackers who believe they attack real devices with real data. Avast traps were programmed with open ports such as TCP: 23 (telnet Protocol), TCP: 22 (ssh Protocol), TCP: 80 (HTTP Protocol), which are usually found in Internet-connected devices such as routers, security cameras and smart TVs.

According to Avast research, streaming devices are among the top 5 most vulnerable in the home, and two-thirds of routers in Russia have weak credentials or software vulnerabilities.

According to Michal Salat, Director of the Avast Threat Analysis Department, most people do not pay much intention to the vulnerabilities of home devices such as smart speakers, TVs or light bulbs, as they believe that they can not become a target of cybercriminals.

"For many people, it probably doesn't matter if their devices are used to attack other people, but they should know that hackers can also target them".

An attacker needs only one hacked device to take control of the entire home network. A vulnerable coffee maker can become the front door for a hacker to spy on households with a smart speaker and a security camera. In addition, connected devices may contain GPS data, so that an attacker will receive information about the exact location of the device.

Attack against Saudi Aramco Damages the World's Biggest Oil Producer



With the Saudi government and U.S. intelligence authorities accusing Iran, and Iran accusing the Yemeni rebels, the most recent attack against Saudi Aramco has damaged the world's biggest oil producer and deferred oil production, roiling oil and gas markets.

As of late, Iran has indeed deployed dangerous computer viruses against Saudi Arabia and these attacks have now marked a somewhat "real-world" continuation of this long-stewing cyber war between the two nations, by and by overflowed into other global powers.

Nicholas Hayden, the global head of threat intelligence for cyber intelligence company Anomali, who has served as a cyber-security operator in the electrical sector says that, “There hasn’t been a discernible increase in cyber-attack activity in the region yet but while nothing is standing out right now in the region, there’s a good chance that there are nation-state actors involved, ”

Iran has been notably known for increasing cyber-attacks when it clashes with nations, and that can likewise mean collateral damage in other companies  as well not simply Saudi-owned working together in the area.

“We’re certainly paying more attention than we normally would to that area. When stuff like this happens, we tend to put our ear a little bit closer to the ground.” Says Hayden.

Since, collateral damage is a common symptom of regional cyber conflict, organizations working in Saudi Arabia and beyond ought to likewise be alert for any changes that might hit the region.

The majority of the experts surveyed by CNBC conceded to one end solution, that in spite of the 'economic odds' stacked against them, Iran has turned out to be one of the world's most noteworthy cyber security powers.

John Hultquist, director of intelligence analysis for cyber security company FireEye, included later that, they’ve never been the most technically sophisticated. But they have made up in their brazenness, their willingness to destroy and disrupt. They have really separated themselves on this from others, as if they have nothing to lose.”

Regardless of all this Saudi Aramco yet again declined to comment for the issue when approached.

The Rise of the DDoS Attacks and the Abuse of the WS-Discovery Protocol


A new type of attack that feeds on vulnerabilities in the usage of the Web Services Dynamic Discovery protocol has been discovered recently by analysts from Akamai's DDoS mitigation service Prolexic.

The attackers here are said to have had used a moderately new strategy—one that can possibly yield more than 15,000 per cent rate of return for the junk data it heaves at a victim.

Since WS-Disclosure provides devices on a similar network a chance to communicate, and guides them all to ping one area or address with insights concerning themselves, attackers can control WS-Discovery by sending uniquely crafted pernicious protocol requests to vulnerable devices like CCTV cameras and DVRs, which is extremely simple for them to do as WS-Discovery is intended to be utilized internally on local access networks and Akamai gauges that approximately 800,000 gadgets exposed on the web can receive WS-Discovery commands.

“There's a huge pool of vulnerable devices sitting out there waiting to be abused” says Chad Sailor, senior specialist on Akamai's security insight reaction group.

"DDoS attacks abusing the WS-Discovery protocol have increased," says security researcher Troy Mursch.
 "The notable thing here is the amount of vulnerable hosts that can be abused and the large amplification factor that enables crippling attacks."

Video game platforms are the most well-known targets for DDoS attacks, during the beginning of September, for instance, Blizzard's hugely famous World of Warcraft Classic went down sporadically for a considerable length of time as a result of a DDoS attack.

"With gaming, they are one of our most frequently attacked industries," Akamai's Seaman says. "We have a handful of different gaming customers that we protect and we basically see the full gamut of all the different attack vectors and exploratory attacks through them. So it’s not surprising to see them being the first ones being targeted with a new vector."

In any case the dread about WS-Discovery DDoS attacks, however, is that the gaming industry won't be the last target as the researchers caution once more that the industries should be prepared for greater versions in the future.


Radio Pakistan Website hacked


The website of state broadcasters Radio Pakistan was hacked for a brief period of time on Sunday and was restored successfully. The hackers displayed the following message on the website

“Hello Admin, you are very secured. Appreciated your security. We got an eye on you. Expect us. Pakistan zindabad.”

According to the reports, the group of hackers who call themselves ‘Crash Rulers’ have accepted the ownership of the attack. The news of the hacking was released on twitter through the twitter handle name @TheCrashRulers.

The user behind the twitter handle which led to the attack has not been known yet. According to the tweets by the same twitter handle over the last three months, it claims to have attacked various government agency websites, business websites, some of them includes Public Procurement Regulatory Authority Pakistan, Pakistan Cricket Board, Bahauddin Zakariya University and Zoom Petroleum Pakistan among others.

Though the claims have not been authenticated yet.

'Malicious attack' takes Wikipedia offline in Germany


Wikipedia users in Germany couldn't find the answers they were looking for when they were met with an error message while attempting to visit the online encyclopedia on Friday.

The website fell victim to a "massive and widespread" denial-of-service (DDoS) attack that paralyzed the site on Friday evening across Germany and in other parts of Europe.

The website reappeared shortly before midnight before going offline again early Saturday.

In a DDoS attack, the attackers attempt to make an online service unavailable by overwhelming it with traffic from multiple sources.

Later Friday evening, Wikipedia tweeted that it was "continuing to work on restoring access."

Biding their time until the online encyclopedia was back online, social media users were quick to share their Wikipedia woes on Twitter using the hashtag #WikipediaDown.

Alert: #Wikipedia is now down across the #US and much of the world, following hours of intermittent disruption caused by a major #DDoS attack; incident ongoing #WikipediaDown : Tweeted NetBlocks.org.

Knew I should have given Wikipedia £2#WikipediaDown: Tweeted another user.

If you can’t read @Wikipedia, just read #WikipediaDown, in almost as many languages. #DDOS: read another tweet.

U.S. Cyber Military Forces Execute Retaliatory Cyber-attack Against Iran




In a retaliatory cyber-attack against Iran, U.S. cyber military forces cut down a database utilized by its Revolutionary Guard Corps to target ships in the Persian Gulf, just hours after 'the Islamic Republic shot down an American Drone'.

Right now, Iran still can't seem to recuperate the majority of the data lost in the attack and is attempting to re-establish military communication networks connected to the database.

As indicated by the Washington Post, the U.S President Donald Trump purportedly approved the U.S. Cyber Command's strike however the government has not openly recognized its occurrence.

A U.S. official who addressed the Washington Post additionally noted that the cyber-attack was intended to harm for Iran – however not to the degree that would further heighten pressures between the two sides.

Elissa Smith, a Pentagon spokesperson said in a statement, “As a matter of policy and for operational security, we do not discuss cyberspace operations, intelligence, or planning.”

In spite of the attack, the Islamic Republic has stayed rather active in the Strait of Hormuz, holding onto the English oil tanker Stena Impero in mid-July.

Recently discovered Fox News, it happened in June that Iran shut off a portion of its military radar sites around the time the U.S. was ready to dispatch retaliatory strikes, thusly it’s not clear if those radar sites were killed by cyber-attacks or if Iran shut them off intentionally fully expecting them.

In any case these strikes are not first major operations executed by the U.S. Cyber Command, as the organization a year ago had disrupted a Russian entity's endeavours to utilize Internet trolls to cultivate discontent among American voters during the 2018 midterm elections.


Texas Hit with a Series of Coordinated Ransomware Attack




Texas is currently hit with an 'unprecedented' of ransomware attacks that has significantly focused on local government entities in the state, with at least 23 impacted by the attacks.

The attacks which seem to have been led by a single threat actor are said to have of begun in the morning of August 16. It is additionally presumed that 23 may not be the final count considering that right now the details are at 'a minimum' with the Department of Information Resources (DIR), who is leading the investigation into the attacks.

The local Texas authorities, like the DIR, Texas Division of Emergency Management, and Texas Military Department are still investigating the origin of the attack, also involved are the federal agencies such as the Department of Homeland Security, Federal Bureau of Investigation – Cyber, and Federal Emergency Management Agency (FEMA).

In its original statement released on late Friday, DIR says that while investigations regarding the origins of the attack are continuous, their principle need is to aid the response and recuperation of 'affected entities'.

DIR is driving the reaction to what it calls a "coordinated ransomware attack" however does not unveil which organizations are affected. This is a result of security concerns involving the matter.

In an updated statement on Saturday, DIR said that the frameworks and systems of the State of Texas have not been influenced by this attack. Until more details rise, the strain of file-encrypting malware, which is said to be the one responsible for the attack as well as the perpetrator(s) ransom demand, still remains very unclear.

The Czech Republic again accused Russia of hacker attacks


The representative of the Czech National Cyber and Information Security Agency (NUKIB) during a report to the Senate Defense and Security Committee stated that hacker attack on the network of the Czech Foreign Ministry in June this year was organized by a foreign state.

NUKIB on Tuesday provided the results of the investigation of a DDoS attack, which reported that the Russian GRU attacked the computer network of the Foreign Ministry. “The GRU and their hacker group APT28 / Sofacy are behind this attack.”

"The Czech Foreign Ministry was again attacked by hackers from the Russian GRU. Therefore, I understand that we are conducting an open hybrid war with Russia. This espionage should not go unanswered", — Chairman of the party "Elders and Independents" Vit Rakushan commented on the situation.

Prime Minister Andrei Babish said that the Czech Foreign Ministry should focus on strengthening the security of its computer network.

Czech Foreign Minister Tomas Petricek, in turn, said that he had already appealed to the Ministry of Finance of the Republic for additional funding for his Department. The requested funds will be used to implement measures aimed at strengthening cybersecurity. The Minister intends to inform the government about cyber attacks on the Foreign Ministry.

According to Babish, the topic of cyber attacks on the Foreign Ministry will be one of the topics of discussion at the next meeting of the State Security Council. It will take place after August 26, when the holidays of most members of the Cabinet of Ministers will end.

It was previously reported that a criminal case was opened on the fact of a cyber attack on the Foreign Ministry. Hackers didn't manage to steal secret information. They gained access only to a few e-mail boxes of employees of the Ministry, but could not hack the server through which official correspondence is carried out.

Recall that in 2016, the Czech Foreign Ministry was also subjected to hacker attacks. Then the hackers got access to 150 email addresses of employees of the Ministry. The June attack this year led to failures in the internal computer network of the Ministry of Foreign Affairs

No environment is immune to cyber attacks : Research

Global cyber-security solutions provider Check Point Software Technologies Ltd, released its “Cyber Attack Trends: 2019 Mid-Year Report”, revealing that no environment is immune to cyber-attacks.

Threat actors continue to develop new tool sets and techniques, targeting corporate assets stored on cloud infrastructure, individuals’ mobile devices, trusted third-party supplier applications and even popular mail platforms:

Mobile banking: With over 50% increase in attacks when compared to 2018, banking malware has evolved to become a very common mobile threat. Today, banking malware is capable of stealing payment data, credentials and funds from victims’ bank accounts, and new versions of these malware are ready for massive distribution by anyone that’s willing to pay.

Software supply chain attacks: Threat actors are extending their attack vectors such as focusing on the supply chain. In software supply chain attacks, the threat actor typically instils a malicious code into legitimate software, by modifying and infecting one of the building blocks the software relies upon.

Email: Email scammers have started to employ various evasion techniques designed to bypass security solutions and anti-spam filters such as encoded emails, images of the message embedded in the email body, as well as complex underlying code which mixes plain text letters with HTML characters. Additional methods allowing scammers to remain under the radar of Anti-Spam filters and reaching targets’ inbox include social engineering techniques, as well as varying and personalizing email content.

Cloud: The growing popularity of public cloud environments has led to an increase in cyber-attacks targeting enormous resources and sensitive data residing within these platforms. The lack of security practices such as misconfiguration and poor management of the cloud resources, remains the most prominent threat to the cloud ecosystem in 2019, subjecting cloud assets to a wide array of attacks.

“Be it cloud, mobile or email, no environment is immune to cyber attacks. In addition, threats such as targeted Ransomware attacks, DNS attacks and Cryptominers will continue to be relevant in 2019, and security experts need to stay attuned to the latest threats and attack methods to provide their organizations with the best level of protection,” said Maya Horowitz, Director, Threat Intelligence & Research, Products at Check Point.

Sonicwall Cyber Threat Report 2019 Finds Escalation in Ransomware Attacks-As-A-Service


Based on the real world data from more than 1 million international security sensors in more than 200 nations, SonicWall made public the discoveries from its mid-year update of the 2019 through the 'SonicWall Cyber Threat Report'.

With the global malware volume going down by 20%, researchers found a 15% increment in ransomware attacks comprehensively.

This expansion in ransomware-as-a service, open-source malware kits and cryptojacking utilized by cybercriminals comprised of the major highlights of the new data found.

"Organizations continue to struggle to track the evolving patterns of cyber-attacks — the shift to malware cocktails and evolving threat vectors — which makes it extremely difficult for them to defend themselves," said SonicWall President and CEO Bill Conner.

"In the first half of 2019, SonicWall Real-Time Deep Memory Inspection (RTDMI) technology unveiled 74,360 'never-before-seen' malware variants. To be effective, companies must harness innovative technology, such as machine learning, to be proactive against constantly-changing attack strategies,” he added later.

In the first part of 2019, SonicWall also observed a 55% increase in IoT attacks, a number that outpaces the initial two quarters of the previous year, all because organizations and purchasers keep on connecting devices to the web without appropriate safety measures.



Free Scheme, 'The No More Ransom Project' Saving Thousands from Ransomware Attacks


A free scheme known as, 'The No More Ransom project' which was founded by Europol, police in the Netherlands, and McAfee is recorded to have prevented cyber-attack victims from paying heavy ransoms and assisted over 200,000 people in saving approximately $108m (£86m).

Along with advice and recommendations, the project delivers software which is configured to recover computer files that get encrypted during ransomware attacks.

With the introduction of 14 new tools in the year 2019 itself, the project having over 150 global partners can now decrypt a total of 109 variants of infection.

Referencing from the explanation given by, Steven Wilson, head of Europol's European Cybercrime Centre (EC3), “When we take a close look at ransomware, we see how easy a device can be infected in a matter of seconds. A wrong click and databases, pictures and a life of memories can disappear forever. No More Ransom brings hope to the victims, a real window of opportunity, but also delivers a clear message to the criminals: the international community stands together with a common goal, operational successes are and will continue to bring the offenders to justice.”

The project made determined and successful efforts to take down various ransomware campaigns including  GandCrab, which is amongst one of the most hostile ransomware campaigns of all time.

GandCrab continued making headlines in 2018 and in 2019, the cyber world saw an upsurge in the number of ransomware attacks targeting large organizations.

Commenting on the matter, Mr. Woser told BBC, "Projects like No More Ransom have been crucial when it comes to fighting ransomware on a global level, with pretty much all major parties cooperating on a global and daily basis, sharing intel[igence] in real-time - except for the US.

"The US should consider the success of the No More Ransom Project to be a call to action.

"Better cooperation between the private sector and law enforcement could result in fewer ransom demands being paid.

"That would make cyber-crime less profitable and, consequently, reduce the financial incentive for groups to commit cyber-crime."




Lone cyber police station in Bengaluru gets overburdened

The delay in setting up new police stations to handle cyber crime has overburdened the lone station in Bengaluru. Eight new police stations for cyber crime, economic offences and narcotics (CEN stations) were announced in December 2018 to handle the growing number of cyber crime cases in Bengaluru. One station was to be set up in each of the eight law-and-order divisions. Even six months after the announcement, the proposal is yet to be implemented.

The existing station, often crowded, has received over 4,700 complaints so far this year. It got 5,036 cases in the whole of 2018.

More cyber crime cases are registered in Bengaluru than in other Indian cities. And yet, some other cities have multiple dedicated stations. For instance, there are three cyber crime stations in Hyderabad.

Policemen say the sheer number of cases hampers investigations. In fact, the station has filed just one charge sheet until now this year against 52 in 2018 and 229 in 2017. A chargesheet is the end of the investigation process from the police side and paves the way for the case to be heard in court. Until now, there has been only one conviction for a cyber crime — in October 2018 after a case was investigated by the CID.

The existing station has a large number of visitors on most days. A policeman said, “Most of our time is spent in handling incoming cases, leaving us with hardly any time to investigate them.” Another official said though about 20 additional Central and Reserve (CAR) personnel have been deployed at the station, more stations are a must for faster resolution of cases.

Deputy commissioner of police (crime) Girish S said setting up of more stations will help the complainants as they will then have to travel only shorter distances to file complaints. Asked if the volume of cases was affecting investigations, Girish said, “I can’t say it’s affecting investigations, but what is happening is we are focusing on the more pressing, immediate cases, due to which the resolution time for other cases gets prolonged.” Cases of a very serious nature are taken up by the CID wing.

The Cyber Attack Response Center opened in Nizhny Novgorod


In the Russian city Nizhny Novgorod the largest Regional Cyber Attack Response Center was opened. The Center was established by Rostelecom-Solar, a subsidiary of Rostelecom, which is the operator of the systems supporting the operation of the public services portal and biometric identification in banks.
Solar JSOC Centers are already operating in other Russian cities such as Moscow, Samara and Khabarovsk. These subdivisions protect more than 110 largest Russian organizations from hacker attacks.  Federal agencies, regional administrations, financial organizations, energy companies apply to Rostelecom-Solar for information security.
The Center in Nizhny Novgorod has become the largest regional Center for monitoring and responding to cyber attacks.  The organization employs more than 70 information security professionals. The Center will be responsible for the security of all regional clients around the clock. The average response time to eliminate cyber attacks is 30 minutes.
This is a serious team of highly qualified experts in information security, able to provide customers with full protection against cyber threats, – said Igor Lyapunov, Vice President of Rostelecom for information security, General Director of Rostelecom-Solar.
All this work is impossible without qualified personnel.  This was one of the reasons why Nizhny Novgorod was chosen to create the Solar JSOC. The city has a number of universities that train IT specialists.
According to Igor Nosov, the Deputy Governor of the Nizhny Novgorod Region, today the Nizhny Novgorod Region ranks third in Russia in terms of the number of IT professionals. "We are proud of our IT companies. Today, about 700 such companies operate in the region, including the world's leading companies. And the fact that we are leaders in the IT sphere makes the problem of information security even more urgent for us.”
It is planned that the Regional Center will work closely with universities, implement internship and employment programs. Every year, more than 70 graduates and senior students participate in the Solar JSOC internship program, about 30 of them receive a job offer.

It is worth noting that now, cyber attacks are in the top 5 largest and most serious challenges facing Russia. Moreover, hacker targets are changing. Previously, the task was to seize cash, now hackers are going to gain control over the management of information systems. EhackingNews recently reported on a DDoS attack during the Presidential Straight Line.