David
3,500 Cybercriminals Arrested by Law Enforcement – December 21st
Over 3,500 cybercriminals were arrested and $300M worth of assets were seized by Europol, the South Korean government, along with cooperation from law enforcement agencies from 34 countries on a large-scale sting operation labeled "HAECHI IV". The operation spanning from July to December 2023, targeted predominantly email, e-commerce, and investment cyber fraudsters.
Financial Sector Sees Most Cyberattacks in 2023 – December 20th
Based on a Netwrix survey, the financial sector in 2023 experienced the most cyberattacks among any other sector in 2023. Surveying 1,610 IT and security professionals from more than 100 countries, the survey also revealed phishing and malware to be the most common attacks across all sectors.
‘Predatory Sparrow’ Cyberattack Shuts Down 70% of Iran’s Gas Stations – December 19th
Threat actor group Gonjeshke Darande, which translates to “Predatory Sparrow” claimed the cyberattacks against Iranian petrol stations, rail networks, and steel factories, according to Iranian State Media. 'Predatory Sparrow', speculated to be linked to Israel, explains the attack to be in response to "the aggression of the Islamic Republic and its proxies in the region".
MongoDB’s Data Breach Confirmed – December 18th
MongoDB revealed a data breach exposing customer metadata and sensitive information in an email announcement to their customers. The email, alerting MongoDB's customers of the cyberattack, also informed customers to be aware of heightened phishing email risk due to the data breach, and to set up multi-factor authentication for their accounts as a phishing safety measure.
Newsquest Media Group Discloses Cyberattack – December 15th
The UK's Newsquest Media Group reported a cyberattack that disrupted the company's websites and apps to the UK National Cyber Security Centre (NCSC) on Monday, December 11th. The UK media company with over 250 local news sites' stated that the series of Distributed Denial-of-Service (DDoS) attacks disrupted the reading experience of an estimated 48 million monthly readers.
The UK is at ‘High Risk’ of Ransomware Attacks – December 14th
The Joint Committee on National Security Strategy (JCNSS) published a report "A hostage to fortune: ransomware and UK National Security," which revealed the UK's lack of planning against ransomware attacks. Targeted mainly at the critical cyber infrastructure of the UK government, the JCNSS report warns that a severe attack could disrupt the core of government services, healthcare, and child protection, which could lead to bringing the country to a 'standstill'.
Ukraine’s Largest Telecom Crippled by Russian Cyberattack – December 13th
Kyivstar, Ukraine's largest telecom provider announced it was hit by a devastating cyberattack, disrupting internet access for over 26 million users. Kyivstar's parent company, VEON Ltd confirmed the devastating cyberattack, claiming it to be “one of the largest cyberattacks in the history of the global telecom market.”
Fraudulent LinkedIn Profiles Targeting Saudi Workers for Corporate Data Leaks – December 12th
Revealed in a presentation at last month's Black Hat Middle East and Africa conference, was a corporate information leak tactic targeting Saudi Arabian workers using fraudulent LinkedIn profiles. The LinkedIn attacks start with fraudulent accounts pretending to be Muslim women in their 20s who say they work in Southeast Asia. Once the connection is made, attempts to harvest sensitive corporate information through long, seemingly legitimate professional conversations ensue.
AutoSpill Attack May Lead to Stolen Android Credentials – December 11th
Researchers from the International Institute of Information Technology (IIIT) presented a new attack named 'AutoSpill' that enables attackers to steal account credentials on Android devices via an autofill operation, during the Black Hat Europe security conference. IIIT researchers pinpointed WebView, the Android feature used to open external links through an internal browser view as the starting point of the security flaw, leaving autofilled usernames and passwords vulnerable.
Russian Campaign Targeting UK Politics Exposed – December 8th
The National Cyber Security Centre (NCSC) in collaboration with partners from the US, Australia, Canada, and New Zealand revealed the Russian-state-backed threat actors terrorizing UK political systems. The NCSC identified the group 'Star Blizzard' to be a subordinate to Centre 18 from the Russian Federal Security Service (FSB). Star Blizzard targeted UK parliamentarians, UK-US trade documents, UK think tanks, universities, journalists, and NGOs using various sophisticated phishing tactics.
LockBit Keeps Role as Biggest Global Ransomware Threat in 2023 – December 7th
According to a report by ZeroFox, LockBit was involved in more than a quarter of global ransomware and digital extortion (R&DE) attacks in 2023. The report found 30% of LockBit's attacks target Europe and 25% in North America. Despite remaining the global leader in ransomware, ZeroFox notes there to be a downward trajectory in the number of LockBit's attacks compared to 2022.
New Sophisticated Attacks Demonstrated by Disney+ Impersonators – December 6th
Abnormal Security published a study revealing a Disney+ impersonation attack, demonstrating never-before-seen phishing tactics. The cybercriminals initiated the impersonation attack through an auto-generated notification email, about pending charges for their Disney+ subscription. The emails also demonstrated customized PDFs, with legitimate numbers & emails, inflated charges, and believable branding.
Convicted Russian Pleads Guilty to Ransomware Attacks – December 5th
The Department of Justice announced that the Russian national behind the malware tool Trickbot, used to launch ransomware attacks on American hospitals, pleaded guilty to his role in the malware tool's development. Trickbot was used to facilitate ransomware attacks on a string of American hospitals and health systems, disrupting care delivery and risking patient safety.
North Korea Continues Crypto Theft Campaign – December 4th
A joint advisory by the Federal Bureau of Investigation (FBI), the Environmental Protection Agency, and the Cybersecurity Infrastructure and Security Agency (CISA) announced the Iranian-based threat actor group “Cyber Av3ngers” compromised over 200 internet-connected devices in the US. Suspected to be anti-Israeli by motive, the “Cyber Av3ngers” group was behind the Pennsylvania Water Authority hacks, disrupting an industrial control device that was made in Israel.
Behind the Navy’s First Cyber Strategy – December 1st
To improve cybersecurity readiness, the U.S. Navy launched its first cybersecurity strategy. The 14-page Navy cyber strategy outlined cybersecurity as a core competency in modern warfare and highlighted the importance of protecting the information environment.