The most recent high-profile attack was made against the San Francisco 49ers according to BleepingComputer which got confirmation from the 49ers.

According to the information disclosed by the 49ers they are in the process of recovering from an attack by the BlackByte ransomware gang which caused a "temporary disruption" of parts of the 49ers IT infrastructure.

Currently we have few details.  We do not know for example whether the BlackByte gang was able to successfully deploy their ransomware. We cannot confirm the gang's claims that they stole data from the football organization.

Their official disclosure statement reads in part, as follows:

"The San Francisco 49ers recently became aware of a network security incident that resulted in temporary disruption to certain systems on our corporate IT network. Upon learning of the incident, we immediately initiated an investigation and took steps to contain the incident.

Third-party cybersecurity firms were engaged to assist, and law enforcement was notified.

While the investigation is ongoing, we believe the incident is limited to our corporate IT network; to date, we have no indication that this incident involves systems outside of our corporate network, such as those connected to Levi's Stadium operations or ticket holders.

As the investigation continues, we are working diligently to restore involved systems as quickly and as safely as possible."

While the BlackByte gang isn't particularly active, security professionals have been aware of their activities since July 2021. They have taken down their share of relatively high-profile targets and are certainly not to be ignored.

The lesson here is simple.  No matter who you are you are not safe.  The hackers don't care and they will come for you.  Stay vigilant out there because 2022 is just getting started.

Used with permission from Article Aggregator

Leveraging this and their massive infrastructure and marketing budget, they have flexed their corporate muscles and gained market share.

According to statistics gathered by data analytics firm Kantar, Apple accounted for slightly more than half of all smartphone sales in the US in 2021. They claimed 51 percent of the total sales for the year which is  a 2.7 percent increase from 2020.

Apple lost ground in Australia, Japan, and Great Britain. Sales surged in Germany (up 5.6 percent to 30.9 percent of the market. Sales were also up 2.2 percent in France to 26.7 percent of the French market, up 1.3 percent in Italy to 19 percent of the market and up an impressive 9.1 percent in China, to 25.7 percent of the market.

The increase in the Chinese market alone more than made up for the losses we mentioned and the company is forecasting strong demand going forward for the iPhone 13.

Bear in mind that when looking at these figures, we're comparing Apple's iPhone sales to the entire Android ecosystem.  That's how utterly dominant the company is in the smartphone market, and that's amazing.

It gets even better for Apple because their next generation iPhone SE is generating a tremendous amount of industry buzz and excitement. It will likely allow Apple to widen their lead on the Android ecosystem.

If you're a fan of Apple and their products, this is great news indeed.  It's hard to believe that the company was at one time verging on bankruptcy.

Even if you're not a fan of Apple, you must admire the company.  Their customers are more than just customers. They are diehard fans of not only the company itself, but of every product the firm makes.  Anyone in any industry would kill to have customers half as loyal as Apple's.

Used with permission from Article Aggregator

Right now, NFTs are all the rage.  Everyone is talking about them, and many are excited about them.  Hackers have been quick to take advantage of that fact, and the Fortinet researchers have stumbled across a poisoned spreadsheet that purports to contain information about NFTs.

The spreadsheet actually quietly deploys a malware strain called BitRAT when opened.

BitRAT is a particularly nasty strain of malware that first appeared for sale on the Dark Web back in late 2020.  It is notable because it can bypass User Account Control (UAC), which is a Windows feature designed to prevent unauthorized access to the OS.

Once installed on a target system BitRAT can steal login credentials from browsers and other applications. It can log keystrokes and upload or download files which makes it more than capable of installing other forms of malware once the beachhead has been established.

It's too early to say yet whether NFTs are here to stay or if they're just a flash in the blockchain pan.  Either way, if they are generating buzz and excitement around the world, hackers will continue to exploit that excitement.

As the Fortinet researchers put it:

"Be mindful that attackers often use attractive and trendy subjects as lures. As NFTs become increasingly popular, they will be used to entice victims into opening malicious files or clicking on malicious links."

The best thing you can do is to educate your employees and inform them of the threat.  Remind everyone you know that no matter how exciting the topic might be, it's never a good idea to open files from untrusted sources or click on links embedded in emails.  If you need to go to a website open a new browser tab and manually type in the URL.  Better safe than sorry.

According to Avanan, hackers are breaking into Team chats and attaching malicious files to ongoing conversations.  By all outward appearances the attached files appear to be relevant to the conversations, but anyone unfortunate enough to click on the file will be infected.

At this point, it's not clear how the hackers are gaining access to Teams in the first place. The most likely possibilities include compromising a third-party vendor that a company does business with, phishing attacks, or stealing Microsoft 365 or email credentials.

The disturbing thing about this recent spate of attacks is the fact that it requires absolutely no sophistication.  It's about the simplest form of attack one could imagine and made possible in no small part by virtue of the fact that Microsoft Teams is almost universally trusted by those who use it.

Very few people think anything of security once they're entrenched in the Teams framework.

The researchers at Avanan recommend the following to limit your risk and exposure:

• Encourage end-users to reach out to IT when seeing an unfamiliar file
• Implement protection that downloads all files in a sandbox and inspects them for malicious content
• Deploy robust, full-suite security that secures all lines of business communication, including Teams
• Make sure you recognize anyone leaving files in Teams chat

Even if your employees follow all of those recommendations, it won't provide bullet-proof protection, but it will make an infection from this vector much less likely.

Although Teams already has robust file protection protocols in place, you can bet that Microsoft will be taking another closer look at this in the weeks and months ahead.

Used with permission from Article Aggregator

While there have been some attacks that specifically targeted Linux users, they've managed to keep a low enough profile that it hasn't been a major issue.

According to a group of researchers from VMware, that appears to be changing.

They warn that hackers are increasingly setting their sights on Linux-based systems. That's a problem because to date, there has been no corresponding increase in efforts to detect and manage those threats.

Even worse is that with a growing number of hybrid systems in use today, Linux is becoming much more commonly seen in the Enterprise environment. Given the disconnect between the growing threat level and the level of preparations being made to meet that threat, Linux-based systems may well be the new weakest link in your company's network.

If there's a silver lining in the dire warning from the folk at VMware it lies in the fact that most of the attacks targeting Linux-based systems aren't very sophisticated at this point.  That will change over time but in the here and now it shouldn't take much to fend off the current generation of attacks.

As the VMware team put it:

"Focus on the basics. The fact is that most adversaries are not super advanced. They're not looking for unique exploits, they're looking for the general open vulnerabilities and misconfigurations. Focus on those before you start focusing on zero-day attacks and new vulnerabilities - make sure you've got the basics covered first."

It's sound advice and easy to follow.  The worst thing you can do in this case is nothing.  The threat level is rising.  That's an indisputable fact.  Those who take no action do so at their cost.

Used with permission from Article Aggregator

What sets this one apart is that the hackers are using a lowly but specially crafted CSV file to infect machines. They are installing the BazarBackdoor malware. If you're not familiar with the term CSV stands for "Comma Separated Values" and it's a text file format that can be loaded into Excel.

If you open the file in a text editor, you'll simply see alphanumeric values separated by commas with the first line generally being the headers for the spreadsheet. Open the same file in Excel and it will separate the data into neat rows and columns.

CSV files are popular because they make it relatively easy to export data from one application and import it into another. Since the files are text only most people consider them to be relatively harmless and are generally not all that cautious when opening them.

Microsoft Excel supports a feature called Dynamic Data Exchange (DDE) which can be used to execute commands whose output is inputted into the open spreadsheet including CSV files.

Hackers are always on the lookout for new angles to play and have naturally begun to abuse this feature. They execute commands that download malware on the devices of unsuspecting victims.

BazarBackdoor is a stealthy malware strain created by the TrickBot group. It's main purpose as the name suggests is to provide ongoing remote access to an internal device that can be used as a springboard for further lateral movement within a network.

The current campaign is centered around emails that pretend to be "Payment Remittance Advice" emails with links to remote sites that download a CSV file with innocuous names like "document-2196t6.csv."

If this file is opened in notepad or word pad and examined, at first glance it will appear to be nothing more than a run of the mill CSV file. Unfortunately, embedded inside of it is a WMIC call in one of the columns of data that launches a PowerShell command and that's enough. That's all the hackers need to install the malware.

As always vigilance is your best defense against this sort of thing. Remind your employees not to open any emails from unknown or untrusted sources and not to download or open any attachments from those emails.

Used with permission from Article Aggregator

According to Microsoft, in 2021 the company blocked more than 25.6 billion brute force authentication attacks against Azure AD users. They also and intercepted a staggering 35.7 billion phishing emails with Microsoft Defender for Office 365.

Vasu Jakkal is Microsoft's Corporate Vice President for Security, Compliance, and Identity. Jakkal is both passionate and concerned about this subject.  The increase in the total number of attempts since the pandemic began has been breathtaking.

Unfortunately, Jakkal says that so far only a minority of Azure AD and Microsoft 365 users seem interested in taking steps to bolster their own security. Based on statistics gathered by Microsoft, only 22 percent of Azure AD users have activated MFA (multi-factor authentication) protocols. MFA  would keep their accounts safer and make it significantly more difficult for hackers to force their way in.

Here is how much more difficult it can be:

Google combined forces with researchers at New York University and the University of California to study that very topic. They discovered that MFA implementation can block up to 100 percent of automated bot attacks, 99 percent of bulk phishing attacks, and up to 66 percent of targeted attacks. That is an impressive level of protection for something that's so simple to implement and make use of!

The two big takeaways here are:

1. The total number of hacking attacks is increasing dramatically.
2. Although automated tools are getting progressively better at preventing many of them, end users have an important role to play too. Unfortunately, as of right now they're not.

Depressingly few users are taking even the most basic steps to better secure their accounts.  If you set one major IT security goal for the year, a very good one would be to do all you can to increase the percent of users at your firm who are taking advantage of MFA everywhere they can.

Used with permission from Article Aggregator

According to a recently released FTC report:

"More than 95,000 people reported about $770 million in losses to fraud initiated on social media platforms in 2021. 

Those losses account for about 25 percent of all reported losses to fraud in 2021 and represent a stunning eighteen-fold increase over 2017 reported losses. Reports are up for every age group, but people 18 to 39 were more than twice as likely as older adults to report losing money to these scams in 2021.

More than half of people who reported losses to investment scams in 2021 said the scam started on social media. Reports to the FTC show scammers use social media platforms to promote bogus investment opportunities and even to connect with people directly as supposed friends to encourage them to invest. 

People send money, often cryptocurrency, on promises of huge returns, but end up empty-handed."

Overall cryptocurrency scams are regarded as the number one threat for investors in 2022, according to a new report from the North American Securities Administrators Association (NASAA). However, the FTC is cautioning all users to exercise caution and develop better habits when scrolling through their favorite social media platform.

They recommend setting limits on who can see your posts, taking advantage of increasingly robust privacy controls, opting out of targeted advertising, and doing more due diligence on any company you plan on doing business with before buying anything from them.

It's good advice in general but it is especially important now given how prevalent social media-based attacks are becoming.

Used with permission from Article Aggregator

It now supports vulnerability management for both Android and iOS.

The company's announcement reads in part as follows:

"With this new cross-platform coverage, threat and vulnerability management capabilities now support all major device platforms across the organization - spanning workstations, servers, and mobile devices.

Threat and vulnerability management in Microsoft Defender for Endpoint continuously monitors and identifies impacted devices, assesses associated risks in the environment, and provides intelligent prioritization and integrated workflows to seamlessly remediate vulnerabilities."

Although the new feature was introduced with very little fanfare, this is a significant change. This will make the lives of network admins much easier by significantly decreasing the surface attack area of mobile endpoints.

This is part of Microsoft's broader strategy to expand the security platform's capabilities across all platforms to provide endpoint users with a unified security solution.  Previous upgrades to Microsoft Defender's capabilities included adding support for Linux users back in 2020.

Just one month later, the company added a "Microsoft Secure Score for Devices" feature. This is a feature that that allows network security professionals to evaluate the state of security of all devices connected to the enterprise network. It also includes a "recommended actions" section to further bolster security.

Then in October 2020 the company added another new feature that automatically generated reports to assist with the tracking of vulnerable Windows and macOS devices on the network. These included vulnerability severity levels, exploit availability, vulnerability age, and vulnerable devices sorted by OS.

All these changes are superb when evaluated individually but taken together they demonstrate just how serious Microsoft is taking matters of security. They also display the company's clear commitment to provide cross-platform protection. This is all with the understanding that networks are no longer homogenous entities and are often made up of a wide range of different device types running a variety of operating systems.

Kudos to Microsoft for their ongoing efforts to make Microsoft Defender even more valuable than it already is.

Used with permission from Article Aggregator

Initially the strain wasn't all that worrisome.  It stole system information but it was by no means the worst threat on a Mac user's radar.

Since that time, the hackers behind the malicious code have been busy. UpdateAgent has received a few developments, with each one adding a new element of danger to the equation.  As things stand now UpdateAgent should be considered a serious threat to Mac users.

As of its latest iteration UpdateAgent installs an annoyingly persistent adware strain called Adload. It has gained capabilities that make it easy for UpdateAgent to install other even more threatening and damaging payloads in the future.

Microsoft has been investigating and following the development of UpdateAgent.  The company has discovered that the hackers who created the strain are hosting a wide range of other payloads on Amazon Web Services' S3 and CloudFront services. While these have not yet been tied to UpdateAgent, it's a clear sign of the shape of things to come.

In addition to that, the code is now capable of fetching compressed zip files instead of .dmg files. It has been modified to prevent Gatekeeper from displaying pop-up warnings to users.  It can also inject persistent code inside background processes that are invisible to the user.

Microsoft had this to say about their study of the malware strain:

"UpdateAgent is uniquely characterized by its gradual upgrading of persistence techniques, a key feature that indicates this trojan will likely continue to use more sophisticated techniques in future campaigns. 

Like many information-stealers found on other platforms, the malware attempts to infiltrate macOS machines to steal data and it is associated with other types of malicious payloads, increasing the chances of multiple infections on a device."

If UpdateAgent wasn't on your radar before it certainly belongs there now.  It's one to watch  out for in the year ahead.

Used with permission from Article Aggregator