Tag: hacktivism
AI enables ransomware boom
A new ransomware group, named Funksec, is the latest example of relatively inexperienced cybercriminals using AI to develop weaponized malware. The group claims that over 85 organizations fell victim to its ransomware attacks in December alone, potentially surpassing every other ransomware group in terms of victim numbers. According to Check Point Research: “FunkSec operators appear to use AI-assisted malware development which can enable even inexperienced actors to quickly produce and refine advanced tools…Presenting itself as a new Ransomware-as-a-Service (RaaS) operation, FunkSec appears to have no known connections to previously identified ransomware gangs.”
Disgruntled ex-Disney employee highlights insider threat
The Walt Disney Company, which has long had a history of troubled labor relations, recently found itself the victim of a disgruntled former employee. According to an affidavit in support of a criminal complaint against the former employee, Michael Scheuer, Disney discovered a security breach allegedly used to make its menus unusable, together with the redirection of QR codes to direct Disney customers to a website calling for a boycott of Israel. More seriously, it alleged that the threat actor manipulated allergen information on Disney menus, indicating that certain menu items were safe for people with peanut allergies when, in fact, they could have been potentially deadly for some diners. Scheuer is also alleged to have conducted denial of service attacks on four former colleagues and to have paid visits outside the home of one of them.
London’s transport cyber-breach is spreading fast
A cyber-attack on the London transport system earlier this month was far more serious than initially reported and is rapidly spreading across the UK. It is also now ringing loud alarm bells on both sides of the Atlantic, particularly in light of the upcoming US elections in November. Transport for London (TfL) has now admitted that over 5,000 customers’ personal details and, in many cases, their financial details have been stolen. TfL added that the breach is also rapidly starting to affect services outside London. The London Underground, the UK capital’s vast underground rail network, like most European metros, has a touchpad automatic electronic payment system using prepaid plastic cards. London also allows travelers simply to use their visa or MasterCard on the touchpads at the London underground barriers. This means that organizations such as TfL have become repositories of millions of commuters’ financial details, making them a tempting target for small-time cyber crooks.
Telegram chief’s arrest ignites global cyber-war
In the wake of Telegram owner and founder Pavel Durov’s shock arrest in Paris on Saturday, the French state is being hit by a growing wave of cyber-attacks designed to cause maximum embarrassment to beleaguered French president Emmanuel Macron. Durov was released from police custody in France on Wednesday and has been transferred to court for questioning ahead of a possible indictment that could result in a long prison sentence. A post on X by SaxX, reportedly the nom de Twitter of cybersecurity consultant Clément Domingo, listed 10 websites in France that bore the brunt of the first wave of cyber-attacks orchestrated by a new online hacktivist group, #opDurov.
Geopolitical crises fuel cyber-attacks in the US
As geopolitical tensions and conflicts rise across the globe, so are cyber-attacks on critical Western infrastructure, particularly industrial facilities running on operation technology (OT) systems. Ransomware attacks on industrial organizations increased by over 50 percent in 2023, according to a report by cybersecurity firm Dragos: OT Cybersecurity – 2023 in Review. Seventy percent of all ransomware attacks targeted 638 manufacturing entities in 33 unique manufacturing subsectors. Dragos tracked a total of 21 threat groups targeting industrial organizations including three new threat groups: Gananite, Laurionite, and Voltzite. Dragos reports all three new groups as conducting diverse operations against various organizations, including cybersecurity research firms, government and military defense entities, rail, manufacturing, automotive, and utilities. Voltzite has been the most active of the three in targeting critical infrastructure.
Cyber-attackers try to divert a commercial flight
Airline security has just entered a new era with news that on Saturday cybercriminals hacked the communications network on a commercial flight and tried to divert the plane to a fake destination and into the hands of the gang. On Sunday, EL AL Israel Airlines confirmed the attack on one of its planes. During the attack, instructions were given to the El Al crew that differed from their set route, alerting them to the possibility that terrorists were planning to crash the plane or that their attackers were planning a kidnapping.
Iran targets Western journalists
Hackers with close ties to the intelligence arm of Iran’s military, the Islamic Revolutionary Guard, are now personally targeting journalists, professors, and researchers. According to Microsoft, which detected the new activity, Iran is anxious to gather information on the entire range of Western views regarding the ongoing conflict in the Middle East. “Based on the identities of the targets observed in this campaign and the use of lures related to the Israel-Hamas war, this campaign may be an attempt to gather perspectives on events related to the war from individuals across the ideological spectrum,” says Microsoft. The Iran-backed hackers, known as Mint Sandstorm, a composite name used to describe several subgroups of activity with ties to the Islamic Revolutionary Guard, use a range of new techniques. For example, the hackers use legitimate but compromised email accounts to conduct highly planned phishing attacks against key journalists.
‘Hacktivists’ target environmental services
Politically-motivated hacking, known as ‘hacktivism’, is now on the rise across large sections of the globe. Politically motivated groups are increasingly attacking their enemies with primitive but effective distributed denial-of-service (DDoS) attacks, which involve overwhelming the target’s servers with vast volumes of internet traffic. But, according to cybersecurity firm Cloudflare’s DDoS Threat Report, the organizations being targeted most are environmental agencies pursuing green agendas such as Net Zero. While Cloudflare reported an overall increase of 117 percent in DDoS attacks around Black Friday and the holiday season, DDoS attacks on environmental agencies have soared over sixty-thousand-fold over the same period.
Samsung Customers in the UK Exposed by Data Breach – November 17th
Samsung notified its customers in the UK that a recent data breach potentially exposed customer data, stemming from a third-party business application vulnerability. Samsung UK further stated that the data affected only covers customers that purchased Samsung items in the UK online store, and ensured customers that the breach does not include passwords or financial data.
Israel conflict spreads to cyberspace
Israel-based cybersecurity firm Check Point Software said that the company has tracked over 40 groups conducting attacks that overwhelmed and disrupted more than 80 websites starting with the day of the Hamas onslaught. These included government and media sites and have the appearance of a concerted cyber follow-up to the genocidal terrorist attacks that took place on the ground.
SiegedSec threat actors breach NATO – October 6th
Cybersecurity firm, CloudSEK is looking deeper into the leaked data from NATO, an attack claimed by the SiegedSec threat actors. SiegedSec threat actors, who announced this attack on a Telegram group, claim to not be a state-sponsored group. Instead, their attacks are based on 'hacktivism' or 'just for fun'. This attack on NATO has reportedly compromised 845MB of sensitive information from the organization, impacting 31 nations. NATO is now investigating the SiegedSec claims and is working together with firms to strengthen their cybersecurity efforts so this kind of attack will not be replicated.