Félix Bolaños, Minister of the Presidency, said that Sánchez’s phone was attacked in May and June 2021, while Robles’s was attacked in June 2021. Bolaños said that the highest Spanish crook court, the National Court, will investigate the “illicit” and “external” activity.
He also said that the wiretaps must have come from external Spain because any such activity in Spain would have required the authorization of a judge.

Pegasus, sold by the Israeli company NSO Group, has been used to spy on dozens of Catalan independence activists, including the president of Spain’s northeastern region, Pere Aragonès, and three of his predecessors who led the region before him.

The Catalan regional government has targeted the country’s National Intelligence Center (CNI). The Spanish Ombudsman has also launched an investigation into the alleged persecution of Catalan activists by the CNI, which is part of the Government.

The Catalan president said in a statement: “Any political espionage is extremely serious. A few days ago we denounced the espionage, but the Spanish government did not give us any explanation. When it comes to massive espionage on Catalan institutions and the independence movement, everything was silence and excuses. With this, everything goes very fast. Responsibility must be cleared immediately. A thorough and independent investigation and accountability is urgently needed.”

NSO Group said in a statement that it would look into “any suspected misuse” of its software and would cooperate with any government investigation. According to a spokesperson, “we have not seen any information about this alleged misuse and we do not know the details of this case.”

NSO’s position remains: “Using cyber tools to surveil politicians, activists or journalists is a serious misuse of any technology, and goes against the intended use of these critical tools. NSO is a software provider; the company does not handle the technology nor is it aware of the data collected.” NSO Group claims that Pegasus is only sold to governments to track criminals and terrorists.

NSO Group was blacklisted by the United States three months after a group of journalists working with a French non-profit association called Forbidden Stories revealed that many journalists and activists had been hacked by foreign governments using spyware called NSO.

Illustration: Photographs by Pedro Sánchez and Margarita Robles: Wikipedia. NSO Group Logo – Website Screenshot (c) NSO Group.

The post The telephone number of the President of the Spanish Government was the object of the Pegasus spy program appeared first on B6G.NET| for all information technology.

The first on the market to tokenize Gmail documents, the product is designed to monitor and manage email attachments so users can monitor their entire journey, gaining visibility into who has downloaded the file, who opened it and who forwarded it.

Moreover, Document GPS allows senders to revoke a recipient’s access to download or share attachments at any time, even after email delivery. “ShelterZoom was built with the idea of enhancing the security of online information exchange by making blockchain integration simple and effortless,” said Chao Cheng-Shorland, CEO and co-founder of ShelterZoom.

“We’ve taken what we did for paperwork and contracts and applied it to email attachments, ensuring a document’s journey is secure throughout its existence. In addition, Document GPS complements our virtual trading platform, allowing clients to carry out an entire workflow within the same secure ecosystem.”

According to ShelterZoom, as Web3 grows, digital security will become much more critical than it already is. To help with this, Document GPS provides email senders with a time-stamped record in its interactive attachment library, which is integrated into the email interface, providing extensive visibility into how each recipient has interacted. with the dossier.

The company built the solution on top of the same blockchain technology that powers its overall platform to supply an additional degree of security for Gmail and Google Workspace users.

ShelterZoom plans to introduce a similar service to Microsoft Outlook users later this year. At the occasion, current use cases include crypto bankers, small business owners, and individual Google users.

The post Plugin for Gmail allows to control documents and negotiations via blockchain appeared first on B6G.NET| for all information technology.

According to data collected specifically in Latin America, 70% of companies revealed having suffered from one to four security breaches in the ultimate 12 months and 17% said they had suffered more than five, with these breaches costing up to US$1 million for their businesses (for 37% of respondents) and more than US$1 million (for 26%). According to 64% of the executives consulted, the cybersecurity skills gap contributes to the increase in cyber risk of their organizations.

As a result, the skills hole remains a top concern for executives and is increasingly fitting a precedence for boards. In the countries of the region, 89% of the organizations reported that their board of directors specifically questions what the company is doing to face the increase in cyber attacks. And 80% of those surveyed said the board is pressuring them to increase the number of IT and cybersecurity employees.

According to ISC’s 2021 Cyber Workforce Report , the global cybersecurity workforce needs to grow by 65% to effectively defend organizations’ critical assets. While the global number of professionals needed to fill the gap fell from 3.12 million to 2.72 million last year, it remains a significant hole that leaves businesses vulnerable. In Latin America alone, 701,000 cybersecurity professionals are lacking, according to this report.

Trainings and certifications

The Fortinet report demonstrates that training and certifications are essential ways organizations seek to address the skills gap. According to 98% of Latin American leaders, technology-focused certifications positively impact their role and that of their team. Thus, 77% of leaders prefer to hire people with certifications, but 88% say that it is difficult to find professionals with this differential. Additionally, 95% of respondents say they are willing to pay for an employee to receive cybersecurity certifications. One of the main reasons companies highly value certifications is to increase awareness and perform tasks more efficiently.

As for staff in general, 52% of leaders believe that their employees do not have the essential cybersecurity knowledge. To help prevent business risks and breaches, Fortinet has a free security awareness and training service through the award-winning Fortinet Training Institute . Available in multiple languages, this service features exclusive threat intelligence from Fortinet’s FortiGuard Labs so all employees understand and stay safe from the latest cyberattack methods.

“According to the Fortinet report, the skills hole is not only a talent scarcity challenge, but is also severely impacting the business, fitting a top concern for executive leaders around the world. We are committed to addressing the challenges revealed in the report through a number of initiatives, including programs focused on cybersecurity certifications and recruiting more women into the industry. As part of this commitment, Fortinet has set a goal of training 1 million professionals by 2026 to increase cyber awareness and close the skills hole in the industry,” says Sandra Wheatley, senior vice president of Marketing, Threat Intelligence and Communications, Fortinet. .

Betting on diversity – The report found that 64% of leaders in Latin America admit that their organization faces difficulties recruiting and 48% face difficulties retaining talent. The hardest-to-hire positions are cloud security specialists (at 40%) and SOC and DevSecOps analysts (tied at 37%).

Among the top three hiring challenges are hiring recent college graduates (77% of respondents), women (72%), and minorities (60%). It is a positive trend that organizations are looking to build more capable and diverse teams, 93% of companies in Latin America have explicit diversity goals for the next two or three years as part of their hiring strategy. The report also showed that 80% of organizations have formal structures to specifically recruit more women.

The post Half of the managers believe that their employees do not have the necessary knowledge in cybersecurity appeared first on B6G.NET| for all information technology.

Within the damage suffered, it should be noted that cybercriminals demand an amount proportional to the victim’s annual income, which ranges between 0.7% and 5%. On the other hand, in 2021 the duration of the “blackmail” decreased from 15 days to 9 days. Check Point Research has also found that ransomware groups have basic rules to successfully negotiate with victims, which influences the process and dynamics of the transaction.

It’s clear that in recent years, ransomware has evolved into the most cumbersome type of cyberattack that businesses face. Moreover to affecting the day-to-day processes of organizations and disrupting business, this threat can have a enormous financial impact. In its most apparent form, crook gangs will demand a ransom payment, which can run into the millions of dollars. In this research, the extra hidden costs caused both during and after these types of threats were examined. The long-term losses suffered by victims are far greater than most might assume.

Ransomware attacks are now the most lucrative type of cybercrime, allowing crook gangs to make immense profits. Over the years, cybercriminals have refined their processes for defining extortion demands and have developed sophisticated negotiation techniques with victims, with the goal of demanding the highest level of ransom payment that the association can afford. To show a true picture of its two faces, that is, from the perspective of the victims and the criminals, Check Point Research has used the following sources of information to obtain monetary information for this research:

• Victim Losses: Kovrr’s Cyber Incident Database includes data on past cyber incidents and their financial impact.
• Profits of Cybercriminals: Information from Conti Leaks as a representative example of the monetary dynamics of cybercriminals.

Main conclusions

1. Collateral cost: The ransom paid is only a small component of the price of the ransomware attack for the victim. Researchers estimate that the complete impact is 7 times greater than what you pay cybercriminals, and is made up of intervention and reset costs, legal fees, and monitoring payments.
2. Sum of the demand: the amount of the ransom depends on the annual income of the company and ranges from 0.7% to 5% of the annual income. The higher the victim’s annual benefits, the lower the fee that will be required, since that percentage represents a higher numerical dollar value.
3. Duration of the attack: the extension of the impact of an attack of this type has been significantly reduced in 2021, from 15 to 9 days.
4. Negotiation Rules – Ransomware groups have well-defined ground rules to ensure successful negotiation with victims, which influences the process and dynamics of the transaction:

• Accurate estimate of the financial position of the victim.
• Quality of the exfiltrated data of the affected party.
• The repute of the ransomware group.
• The existence of cyber insurance.
• The approach and interests of those who negotiate with the victims.

“In this investigation, we have provided an in-depth analysis from the perspectives of both the attackers and victims of ransomware. The key learning is that the ransom paid, which is the figure most research deals with, is not the decisive amount in its ecosystem. Both cybercriminals and those affected have numerous other aspects and related financial considerations. It is striking how systematic these cybercriminals are in defining the amount of the ransom and in the negotiation. Nothing is accidental and everything is defined and deliberate according to the factors that we have described. It should be noted that, for companies, the “collateral cost” is 7 times greater than the ransom they pay. Our advice is that it is essential to build adequate cyber defenses in advance, particularly a well-defined response plan can save organizations a lot of money” , warns Eusebio Nieva, technical director of Check Point Software for Spain and Portugal.

How to protect yourself from ransomware  

• Have a robust data backup: The goal of the ransomware is to force the victim to pay a ransom in order to regain access to their encrypted data. However, this is only effective whether the target actually loses control of their own information. Having a strong and secure data backup is an effective way to mitigate the impact of such a threat.
• Cybersecurity training: Phishing emails are one of the most popular ways to spread these malware. By tricking a user into clicking on a link or opening a harmful attachment, cybercriminals can gain access to their computer and start the process of installing and running ransomware program on it. Frequent cybersecurity training is crucial to protecting the association.
• Strong and secure user authentication: Enforcing a strong password policy, requiring the use of multi-factor authentication, and educating employees about phishing attacks designed to steal login credentials are critical components of an organization’s cybersecurity strategy. company.
• Up-to- date patches: Keeping computer systems up-to-date and applying security patches, particularly those categorized as critical, can help limit an entity’s exposure to ransomware attacks.

The post Two Sides of a Ransomware Threat Explored: Victims and Cybercriminals appeared first on B6G.NET| for all information technology.

Cisco on Friday rolled out fixes for a medium-severity vulnerability affecting IOS XR Software that it said has been exploited in real-world attacks.

Tracked as CVE-2022-20821 (CVSS score: 6.5), the issue relates to an open port vulnerability that could be abused by an unauthenticated, remote attacker to associate to a Redis instance and achieve code execution.

“A successful exploit could allow the attacker to write to the Redis in-memory database, write arbitrary files to the container filesystem, and retrieve information about the Redis database,” Cisco said in an advisory.

“Given the configuration of the sandboxed container that the Redis instance runs in, a remote attacker would be unable to execute remote code or abuse the integrity of the Cisco IOS XR Software host system.”

The flaw, which it said was identified during the resolution of a technical assistance center (TAC) case, impacts Cisco 8000 Series routers running IOS XR Software that has the health check RPM installed and active.

The networking equipment maker also cautioned that it became aware of the attempted exploitation of the zero-day bug earlier this month. “Cisco strongly recommends that customers apply suitable workarounds or upgrade to a constant software release to remediate this vulnerability,” it added.

The post Cisco Issues Patch for New IOS XR Zero-Day Vulnerability Exploited in the Wild appeared first on B6G.NET| for all information technology.

A case of software supply chain attack has been observed in the Rust programming language’s crate registry that leveraged typosquatting techniques to publish a rogue library containing malware.

Cybersecurity firm SentinelOne dubbed the attack “CrateDepression.”

Typosquatting attacks take place when an adversary mimics the name of a popular package on a public registry in hopes that developers will accidentally download the malicious package instead of the valid library.

In this case, the crate in question is “rustdecimal,” a typosquat of the real “rust_decimal” package that’s been downloaded over 3.5 million times to date. The package was flagged earlier this month on May 3 by Askar Safin, a Moscow-based developer.

According to an advisory published by the Rust maintainers, the crate is said to have been first pushed on March 25, 2022, attracting fewer than 500 downloads before it was permanently removed from the repository.

Like prior typosquatting attacks of this kind, the misspelled library replicates the entire functionality of the original library while also introducing a malicious function that’s designed to retrieve a Golang binary hosted on a remote URL.

Specifically, the new function checks whether the “GITLAB_CI” surroundings variable is set, suggesting a “singular interest in GitLab continual integration (CI) pipelines,” SentinelOne famous.

The payload, which is equipped to capture screenshots, log keystrokes, and download arbitrary files, is capable of running on both Linux and macOS, but not Windows systems. The ultimate goals of the campaign are unknown as yet.

While typosquatting attacks have been formerly documented against NPM (JavaScript), PyPi (Python), and RubyGems (Ruby), the development marks an strange instance where such an incident has been discovered in the Rust ecosystem.

“Software supply-chain attacks have gone from a rare occurrence to a highly desirable approach for attackers to ‘fish with dynamite’ in an attempt to contaminate entire user populations at once,” SentinelOne researchers said.

“In the case of CrateDepression, the targeting interest in cloud software build environments suggests that the attackers could attempt to leverage these infections for larger scale supply-chain attacks.”

The post Researchers Uncover Rust Supply Chain Attack Targeting Cloud CI Pipelines appeared first on B6G.NET| for all information technology.

Google’s Threat Analysis Group (TAG) on Thursday pointed fingers at a North Macedonian spyware developer named Cytrox for developing exploits against five zero-day (aka 0-day) flaws, four in Chrome and one in Android, to target Android users.

“The 0-day exploits were used alongside n-day exploits as the developers took advantage of the time difference between when some critical bugs were patched but not flagged as security issues and when these patches were fully deployed across the Android ecosystem,” TAG researchers Clement Lecigne and Christian Resell said.

Cytrox is alleged to have packaged the exploits and sold them to different government-backed actors located in Egypt, Armenia, Greece, Madagascar, Côte d’Ivoire, Serbia, Spain, and Indonesia, who, in turn, weaponized the bugs in at least three different campaigns.

The commercial surveillance company is the maker of Predator, an implant analogous to that of NSO Group’s Pegasus, and is known to have developed tools that enables its clients to penetrate iOS and Android devices.

In December 2021, Meta Platforms (formerly Facebook) disclosed that it had acted to remove roughly 300 accounts on Facebook and Instagram that the company used as part of its compromise campaigns.

The list of the five exploited zero-day flaws in Chrome and Android is below –

According to TAG, all the three campaigns in question commenced with a spear-phishing email that contained one-time links mimicking URL shortener services that, once clicked, redirected the targets to a rogue domain that dropped the exploits before taking the victim to an authentic site.

“The campaigns were limited — in each case, we assess the number of targets was in the tens of users,” Lecigne and Resell famous. “If the link was not active, the user was redirected directly to a valid website.”

The final goal of the operation, the researchers assessed, was to distribute a malware dubbed Alien, which acts as a precursor for loading Predator onto infected Android devices.

The “simple” malware, which receives commands from Predator over an inter process communication (IPC) mechanism, is engineered to record audio, add CA certificates, and hide apps to evade detection.

The first of the three campaigns took place in August 2021. It used Google Chrome as a jumping off point on a Samsung Galaxy S21 device to force the browser to load another URL in the Samsung Internet browser without requiring user interaction by exploiting CVE-2021-38000.

Another intrusion, which occurred a month later and was delivered to an up-to-date Samsung Galaxy S10, involved an exploit chain using CVE-2021-37973 and CVE-2021-37976 to escape the Chrome sandbox (not to be confused with Privacy Sandbox), leveraging it to drop a moment exploit to escalate privileges and deploy the backdoor.

The third crusade — a full Android 0-day exploit — was detected in October 2021 on an up-to-date Samsung phone running the then latest version of Chrome. It strung together two flaws, CVE-2021-38003 and CVE-2021-1048, to escape the sandbox and compromise the system by injecting malicious code into privileged processes.

Google TAG pointed out that while CVE-2021-1048 was fixed in the Linux kernel in September 2020, it wasn’t backported to Android until final year as the fix was not marked as a security issue.

“Attackers are actively looking for and profiting from such slowly-fixed vulnerabilities,” the researchers said.

“Tackling the harmful practices of the commercial surveillance industry will require a robust, comprehensive approach that includes cooperation among threat intelligence teams, network defenders, academic researchers and technology platforms.”

The post Cytrox’s Predator Spyware Targeted Android Users with Zero-Day Exploits appeared first on B6G.NET| for all information technology.

A Linux botnet malware known as XorDdos has witnessed a 254% surge in activity over the last six months, according to latest research from Microsoft.

The trojan, so named for carrying out denial-of-service attacks on Linux systems and its use of XOR-based encryption for communications with its command-and-control (C2) server, is known to have been active since at least 2014.

“XorDdos’ modular nature provides attackers with a versatile trojan capable of infecting a variety of Linux system architectures,” Ratnesh Pandey, Yevgeny Kulakov, and Jonathan Bar Or of the Microsoft 365 Defender Research Team said in an exhaustive deep-dive of the malware.

“Its SSH brute-force attacks are a relatively simple yet effective technique for gaining root access over a number of potential targets.”

Remote control over vulnerable IoT and other internet-connected devices is gained by means of secure shell (SSH) brute-force attacks, enabling the malware to form a botnet capable of carrying distributed denial-of-service (DDoS) attacks.

Besides being compiled for ARM, x86, and x64 architectures, the malware is designed to support different Linux distributions, not to mention come with features to siphon touchy information, install a rootkit, and act as a vector for follow-on activities.

In a further sign that the malware could act as a conduit for other threats, devices originally breached with XorDdos are being subsequently infected with another Linux trojan called Tsunami, which then deploys the XMRig coin miner.

In recent years, XorDdos has targeted unprotected Docker servers with exposed ports (2375), using victimized systems to overwhelm a target network or service with fake traffic in order to render it inaccessible.

XorDdos has since emerged as the top Linux-targeted threat in 2021, followed by Mirai and Mozi, accounting for more than 22% of all IoT malware observed in the wild, per cybersecurity firm CrowdStrike.

“XorDdos uses evasion and persistence mechanisms that allow its operations to remain robust and stealthy,” the researchers noted.

“Its evasion capabilities include obfuscating the malware’s activities, evading rule-based detection mechanisms and hash-based malicious dossier lookup, as well as using anti-forensic techniques to break process tree-based analysis.”

The post Microsoft Warns Rise in XorDdos Malware Targeting Linux Devices appeared first on B6G.NET| for all information technology.

The first of them, launched on March 22, takes advantage of the suspension of Visa and Mastercard operations in Russia, to trick the user into filling out a form to request a new card. The alleged document is actually a malicious Office document located on Dropbox, which, once executed, loads a template hosted on the same service. Through a backdoor called Tiny Fluff, attackers can control the compromised endpoint and perform malicious activities such as data and dossier theft, and downloading of arbitrary files.

An extra, simplified version of this campaign was discovered on March 25, and although this moment operation delivers a simpler version of TinyFluff, it still exploits Dropbox to deliver the files used in the initial stage of the attack.

“Once again, attackers have used a known cloud service to deliver malicious content, and in this particular case they are also taking advantage of the geopolitical situation that is making both organizations and individuals more vulnerable,” says Paolo Passeri, Director of Cyber-Intelligence of Netskope.

However, this is not the only recent crusade that has been exploited by Dropbox, in a totally different example threat actors targeted the African banking sector via the RemcosRAT delivered from Dropbox (again), and an old one known as OneDrive. Curiously, in this second crusade, the payload is delivered through the GuLoader downloader, which, at least in this case, is not delivered through a cloud service, but through HTML Smuggling Techniques.

The post Russian citizens become collateral victims of cybercriminals appeared first on B6G.NET| for all information technology.

North Korean hackers made more than $600 million in unlawful profits in one hit!

The Federal Bureau of Investigation (FBI) has convicted a group of hackers who call themselves “Lazarus” for hacking an electronic game called “Axie Infinity,” a game that allows players to earn cryptocurrencies.

The attack was carried out by hacking a network that allows users to send cryptocurrencies from one blockchain to another. And the US Treasury imposed sanctions on the “Lazarus” group, a well-known group of hackers believed to be working for the North Korean government to finance its activities.

Cyber attacks have been a very important source of revenue for the North Korean regime for years, and leader Kim Jong Un has continued to pursue nuclear weapons, according to the United Nations panel and experts in the field of cybersecurity. An example of this.. Surely you have heard about the ballistic missile that was launched for the first time four years ago by North Korea.

For the Lazarus Group, they have a history of stealing cryptocurrency over the past years and their illicit profits are estimated to be around $1.75 billion based on a report from Chainalysis, a company that tracks cryptocurrency transactions. These notifications end that the attack is from North Korea.

Source:
https://edition.cnn.com/2022/04/14/politics/fbi-north-korea-hackers-crypto/index.html
https://www.bbc.com/news/world-asia-61036733
https://www.nknews.org/pro/major-outage-disrupts-north-korean-websites-and-email-delivery/

The post A famed game was hacked by North Korean hackers, making profits exceeding half a billion dollars appeared first on B6G.NET| for all information technology.

The North Korea-backed Lazarus Group has been observed leveraging the Log4Shell vulnerability in VMware Horizon servers to deploy the NukeSped (aka Manuscrypt) implant against targets located in its southern counterpart.

“The attacker used the Log4j vulnerability on VMware Horizon products that were not applied with the security patch,” AhnLab Security Emergency Response Center (ASEC) said in a new report.

The intrusions are said to have been first discovered in April, although multiple threat actors, including those aligned with China and Iran, have employed the same approach to further their objectives over the past few months.

NukeSped is a backdoor that can perform various malicious activities based on commands received from a remote attacker-controlled domain. Last year, Kaspersky disclosed a spear-phishing crusade aimed at stealing critical data from defense companies using a NukeSped variant called ThreatNeedle.

Some of the key functions of the backdoor range from capturing keystrokes and taking screenshots to accessing the device’s webcam and dropping additional payloads such as information stealers.

The stealer malware, a console-based utility, is designed to exfiltrate accounts and passwords saved in web browsers like Google Chrome, Mozilla Firefox, Internet Explorer, Opera, and Naver Whale as well as information about email accounts and recently opened Microsoft Office and Hancom files.

“The attacker collected extra information by using backdoor malware NukeSped to send command line commands,” the researchers said. “The collected information can be used later in lateral movement attacks.”

The post Hackers Exploiting VMware Horizon to Target South Korea with NukeSped Backdoor appeared first on B6G.NET| for all information technology.

The standard procedure is to contaminate files like jquery.min.js and jquery-migrate.min.js with obfuscated JavaScript that fires on every page load, allowing the attacker to redirect website visitors to a destination of their choosing.

The website security company said domains at the end of the redirect chain could be used to load ads, phishing pages, malware, or even trigger another set of redirects.

In some cases, unsuspecting users are taken to a fake redirect landing page that contains a fake CAPTCHA check, and clicking it displays unwanted advertisements that are disguised to seem to come from the operating system and not from a browser. Web navigator.

The campaign, a follow-up to another wave detected final month, is believed to have affected 322 websites so far, since May 9. The set of April attacks, in the meantime, has compromised more than 6,500 websites.

All of the websites shared a common problem: malicious JavaScript had been injected into the website and database files, including lega WordPress core files, such as:

./wp-includes/js/jquery/jquery.min.js
./wp-includes/js/jquery/jquery-migrate.min.js
Once the website was compromised, the attackers attempted to automatically infect any .js files with jQuery in the names. They injected code that starts with “/* trackmyposs*/eval(String.fromCharCode…”

However, it was clear that the attackers had taken some steps to evade detection and obfuscated their malicious JavaScript with CharCode.

From the perspective of a site visitor, they will simply see the next page of malware before reaching the last destination. This page tricks unsuspecting users into subscribing to push notifications from the malicious site. Whether they click on the fake CAPTCHA, they will be signed up to get unwanted ads even when the site is not open, and the ads will appear to come from the operating system, not a browser.

The post Massive WordPress JavaScript injection campaign redirects to ads appeared first on B6G.NET| for all information technology.

According to online discussions, numerous companies are experiencing problems, particularly those that have installed the updates on Windows servers that also serve as domain controllers (DCs) and Active Directory Certification Services (ACDS). Some administrators complained that Network Policy Server (NPS) policies were failing, generating the error “authentication failed owing to a user credential mismatch”.

Removing update KB5013941 reportedly resolved the issue. One user pointed out that in his setup, DC and NPS are running on different servers, and after testing the updates on each, he concluded that the NPS servers can be patched but the DC servers may require the update to be rolled back.

Steve Syfuhs, a Microsoft senior software engineer specializing in encryption, authentication and identification, confirmed the problem, admitting that it is being reported by a large number of IT administrators. “After installing the updates released on May 10, 2022 for domain controllers, authentication failures may arise on the server or client for services such as Network Policy Server (NPS), Routing and Remote Access Service (RRAS), Radius, Extensible Authentication Protocol (EAP), and Protected Extensible Authentication Protocol (PEAP),” Syfuhs said, adding that “an issue has been identified with how the domain controller handles the assignment of certificates to machine accounts.”

Microsoft on Tuesday patched two “high severity” privilege escalation vulnerabilities, identified as CVE-2022-26931 and CVE-2022-26923, as part of its monthly security updates. This is the cause of the problems Windows Server administrators are currently facing.

Earlier this year, a large number of Windows Server administrators opted out of Microsoft’s security patches, citing several issues causing such severe operational disruption that they felt it preferable to remain unprotected by security patches than to update and deploy The corrections.

Microsoft has published a mitigation proposal for administrators who want to work around the certificate issue, but don’t want to revert to the latest version, as this would leave them somewhat helpless. Microsoft stated that the solution includes manually assigning certificates to a machine account in Active Directory.

The post Microsoft’s latest Patch Tuesday affected corporate authentication policies appeared first on B6G.NET| for all information technology.

The first of the two flaws, tracked as CVE-2022-22972 (CVSS score: 9.8), concerns an authentication bypass that could allow an actor with network access to the user interface to gain administrative access without prior authentication.

CVE-2022-22973 (CVSS score: 7.8), the other flaw, is a case of local privilege escalation that could allow an attacker with local access to promote privileges to the root user on vulnerable virtual devices.

“It is extremely important that steps be taken quickly to patch or mitigate these issues on-premises,” VMware writes , explaining that “CVE-2022-22954 was leveraged by an unauthenticated actor with web interface network access to execute a command. arbitrary shell as a VMware user. It then took virtue of CVE-2022-22960 to elevate the user’s privileges to root. With root access, the actor could wipe logs, escalate permissions, and move laterally to other systems.”

Some of the exploits reported by the company involve botnet operators, who exploit the flaws to deploy variants of the Mirai Distributed Denial of Service (DDoS) malware.

The disclosure follows a warning from the US Cybersecurity and Infrastructure Agency (CISA) that advanced persistent threat (APT) groups are exploiting CVE-2022-22954 and CVE-2022-22960 – two other VMware flaws that were fixed early final month – separately and in combination. In a statement, the CISA has urged federal civil executive branch agencies (FCEBs) to apply the updates before 5 pm EDT on May 23 or to disconnect the devices from their networks. “CISA expects attackers to quickly develop a capability to exploit these vulnerabilities in affected VMware products,” the agency said.

The post VMware releases patches for new vulnerabilities in its products appeared first on B6G.NET| for all information technology.

Researchers report that Emotet, an advanced, self-propagating, modular Trojan, remains the most prevalent malware this month, affecting 6% of organizations worldwide. It is the only one that remains in its position and the rest of the list has indeed changed: Tofsee and Nanocore are out and have been replaced by Formbook and Lokibot, which are now the moment and sixth most prevalent malware, respectively.

Emotet’s 10% rise in March was mainly due to particular Easter-themed scams, but April’s decline could also be explained by Microsoft’s decision to disable particular macros associated with Office files, which affects how in which Emotet is normally distributed. In fact, there are reports highlighting a new delivery method: the use of phishing emails containing a OneDrive URL. Emotet has many uses once it manages to bypass a computer’s protections and also offers other malware to cybercriminals on Darknet forums, including banking Trojans, ransomware, botnets, etc. As a result, once Emotet finds a breach, the consequences can vary depending on the malware that manages to get in.

On the other hand, Lokibot, a Stealer, has re-entered the list in sixth place after a high-impact spam campaign that distributed the malware via xlsx files that looked like legitimate invoices. Added to this is the rise of Formbook and both have had a strong effect on the position of other malware, such as the AgentTesla Advanced Remote Access Trojan (RAT), which has dropped to third place.

In late March, critical vulnerabilities were found in the Java Spring Framework, known as Spring4Shell, and since then, numerous cybercriminals have exploited the threat to spread Mirai, the ninth most prevalent malware this month.

“With the ever-evolving cyber threat landscape, and with large corporations like Microsoft influencing the parameters in which cybercriminals can operate, threat actors are having to be more creative in how they distribute malware, which is evident in the new delivery method that Emotet now employs,” says Eusebio Nieva, Technical Director of Check Point Software for Spain and Portugal. “Furthermore, this month we have seen the Spring4Shell vulnerability make headlines. Although it is not yet on the list of the top ten threats, it should be famous that it has affected more than 35% of companies around the world in its first month alone, so it is likely that it will climb positions in the coming months”, concludes Nieva .

In April, the Education/Research sector continues to be the most attacked worldwide. “Git web server information disclosure” has been the most exploited and common vulnerability – it has affected 46% of companies worldwide – closely followed by “Apache Log4j Remote Code Execution”. “Apache Struts ParametersInterceptor ClassLoader Security Bypass” soars in the index, rising to third place with an overall impact of 45%.

The post Emotet leads the Top Malware and affects 6% of companies worldwide appeared first on B6G.NET| for all information technology.

HP is now announcing an interesting addition to its arsenal. A choice of HP Z-series Workstations will have WSL 2 ( the Linux Subsystem for Windows ) pre-installed and pre-enabled, ” so users can quickly and easily maximize productivity right out of the box,” they explain .

With this, these workstations will have extra capabilities such as:

• Harness the performance of Z by HP and the power of the NVIDIA GPU to total complex workflows in Ubuntu, such as AI and machine learning training, correct on a Windows machine.
• Access Windows productivity tools while simultaneously using GPU-enabled Ubuntu development workflows.
• Customize the Ubuntu experience to maximize developer productivity on Windows.

This tool is very interesting for developers or other professionals who need to run Linux applications, but without leaving Windows , thanks to the second version of this subsystem that initially arrived with limited functions (little more than Bash) and with low performance, but Microsoft has been improving it with each Windows 10 update.

The latest version significantly increased performance, added a full Linux kernel, support for DirectX 12 and graphical applications, and ease of installation. It also added a greater number of supported distributions such as Fedora and SuSE, beyond Ubuntu, which came first after an agreement between Microsoft and Canonical and definitely in Windows 11 it has improved its installation possibilities.

WSL 2 is a convenient add -on for those using Windows and Linux systems as it is an easy-to-use, integrated native Linux environment, adding to the capabilities of HP’s professional workstations.

In this regard, HP has announced another first in partnership with NVIDIA: combining the power of its workstations with Teradici CAS and NVIDIA Omniverse Enterprise. It is an innovative platform that enables remote co-creation, simultaneous real-time collaboration, and realistic simulation for design teams. This combination promises to convert 3D workflows, while removing location as a barrier to true 3D collaboration .

The post HP Z series will include WSL 2 by default to add Linux to Windows appeared first on B6G.NET| for all information technology.

The attack vector depends on an iPhone user running iOS 15 or later, as this was the version that added the functionality of finding a device even after it has been turned off.

Most wireless chips remain activated on an iPhone for users who have enabled the “Find My network” setting in Apple’s Find My app, even provided it has been manually turned off.

Bluetooth, NFC and ultra-wideband (UWB) wireless chips are connected to the phone’s secure element – the area where secrets are stored – and therefore can no longer be trusted components of the device, according to the researchers, given that are accessible after a shutdown.

The researchers were able to write to an iPhone 13’s Bluetooth chip by leveraging a legacy feature that requires iOS to be able to write to executable RAM regions using a vendor-specific Host Controller Interface (HCI) command.

Attackers could, in theory, modify the Bluetooth chip’s custom functionality during a low-energy mode, via malware, to send the device’s location to the attacker, or add new functionality, the researchers said in their study, titled “Evil Never Sleeps: When Wireless Malware Stays On After Turning Off iPhones.” 12-page PDF document. No registration required.

The post Researchers Demonstrate How to Install Malware on a Shutdown iPhone appeared first on B6G.NET| for all information technology.

According to the complaint made public Monday by the federal court in Brooklyn, New York, the charges stem from Zagala’s use and sale of ransomware, as well as its extensive support and profit-sharing agreements with cybercriminals who used its ransomware programs.

Breon Peace, United States Attorney for the Eastern District of New York, and Michael J. Driscoll, Deputy Director in Charge of the Federal Bureau of Investigation, New York Field Office (FBI), announced the charges as follows : “This multifaceted doctor allegedly treated patients, created and named his cyber tool after death, profited from a global ransomware ecosystem where he sold the tools to carry out ransomware attacks, trained attackers on how to extort money from victims, and then boasted of successful attacks, including by malicious actors associated with the government of Iran. The fight against ransomware is one of the main priorities of the Branch of Justice and this Office of the Attorney General. Provided you benefit from ransomware, we will find you and disrupt your malicious operations.”

The document adds: “We accuse Zagala of not only having created and sold ransomware products to hackers, but also of having trained them in their use. Our actions today will prevent Zagala from finding victims. However, numerous other malicious criminals are looking for companies and organizations that haven’t taken steps to protect their systems, which is an incredibly vital step in stopping the next ransomware attack.”

According to the criminal complaint, Zagala, a 55-year-old cardiologist residing in Ciudad Bolívar, Venezuela, has designed multiple ransomware tools. Zagala sold or rented his software to hackers who used it to attack computer networks.

One of Zagala’s first products, a ransomware tool called “Jigsaw v. 2”, had, according to Zagala’s own description, a “Doomsday” counter that kept track of how many times the user had tried to eradicate the ransomware. Zagala wrote: “If the user tries to kill the ransomware too many times, then it is clear that he is not going to pay, so better erase the entire tough drive.”

Starting in late 2019, Zagala began advertising a new tool online: a “Private Ransomware Builder” that he called “Thanos.” The name of the software appears to be a reference to a fictional cartoon villain named Thanos, who was responsible for the destruction of half of life in the universe, as well as a reference to the figure “Thanatos” from Greek mythology, who associate with death. Thanos software allowed its users to create their own unique ransomware, which they could then use or rent for use by other cybercriminals.

Instead of just selling Thanos software, Zagala allowed individuals to pay for it in two ways. First, a crook could buy a “license” to use the software for a sure period of time. The Thanos software was designed to periodically contact a server in Charlotte, North Carolina that Zagala controlled in order to confirm that the user had an active license. Alternatively, a Thanos client could join what Zagala called an “affiliate program,” providing the user with access to the Thanos builder in exchange for a share of the profits from the ransomware attacks. Zagala received payment in both fiat currency and cryptocurrencies, including Monero and Bitcoin.

Zagala advertised Thanos software on various online forums frequented by cybercriminals, using usernames that referenced Greek mythology. His two favorite nicknames were “Aesculapius”, referring to the ancient Greek god of medicine, and “Nosophoros”, which means “diseases carrier” in Greek. In public announcements for the program, Zagala boasted that the Thanos-created ransomware was almost undetectable by antivirus programs, and that “once encrypted,” the ransomware “erased itself,” making detection and recovery much easier. were “almost impossible” for the victim.

In private chats with clients, Zagala explained how to deploy his ransomware products: how to craft a ransom note, steal passwords from victims’ computers, and set up a Bitcoin address for ransom payment. As Zagala explained to a client, speaking of Jigsaw: “Victim 1 pays at the indicated btc [Bitcoin] address and decrypts their files.” Zagala also famous that “there is a penalty…[i]f the user reboots. For each reboot it will punish you with 1000 deleted files. After Zagala explained all the features of the software, the customer replied “Sir, I really need to say this… You are the best developer ever.” Zagala responded: «Thank you, it’s a pleasure to hear it[.] I feel very flattered and proud». Zagala had only one request: “If you have time and it’s not too much trouble, please describe your experience with me” in an online review.

On or about May 1, 2020, an FBI Confidential Human Source (CHS-1) spoke of joining Zagala’s “affiliate program.” Zagala replied: “Not for now. I don’t have seats.” But Zagala offered to license the software to CHS-1 for $500 a month with “basic options,” or $800 with “full options.”

On or around October 7, 2020, CHS-1 asked Zagala how to establish an affiliate program of his own using Thanos. Zagala responded with a short tutorial on how to set up a ransomware team. He explained that CHS-1 was to find people “well versed… in LAN hacking” and supply them with a version of the Thanos ransomware that was scheduled to expire after a set period of time. Zagala said that he personally had “a maximum of between 10 and 20” affiliates at any given time, and “sometimes only 5.” He added that hackers approached him for his software after gaining access to a victim’s network: “They come with LAN access, I check and then agree. They block several large networks and we hope… If you block networks without tape or cloud (backups), nearly everyone pays.”

Zagala further explained that sometimes a victim network turned out to have an unforeseen backup: “so there is no point in blocking because they have backups, so in that case we only exfiltrate data”, referring to the theft of victim information. . Zagala further added that he had a partner who “knows how to corrupt the tapes,” that is, the backups, and how to “turn off antivirus.” Lastly, Zagala offered to give CHS-1 an extra two weeks for free after CHS-1’s one-month license expired, explaining “because one month is very little for this business…sometimes you have to work hard to receive it.” good benefits.”

Zagala even publicly bragged about his knowledge and that his clients used his software to commit ransomware attacks. He even posted a link to a news story about an Iranian state-sponsored hacker group using Thanos to attack Israeli businesses.

In or around November 2021, Zagala began using a third username: “Nebuchadnezzar.” In chats with a moment confidential FBI source (CHS-2), Zagala stated that he had changed aliases to preserve “OPSEC…operational security” because “malware analysts are on top of me.”

In early May this year, law enforcement officers conducted a voluntary interview with a relative of Zagala’s who resides in Florida and whose PayPal account was used by Zagala to receive ill-gotten gains. This person confirmed that Zagala resided in Venezuela and had taught himself computer programming. The individual also showed agents contact information for Zagala on his phone that matched the email on dossier for the malicious infrastructure associated with the Thanos malware.

Provided convicted, the defendant faces up to five years in prison for attempted computer intrusion and five years in prison for conspiracy to commit computer intrusion.

The post The FBI accuses a Venezuelan doctor of using and selling the ‘Thanos’ ransomware appeared first on B6G.NET| for all information technology.

According to AP, the association has increased the pressure on the Costa Rican authorities to pay a ransom, increasing its demand to 20 million dollars. However, it is still unclear why the ransomware gang specifically targets this country.

Yesterday, President Rodrigo Chaves declared at a press conference that the attack is coming from both inside and external of Costa Rica. He stressed that the nation was at war and that the authorities were fighting a national terrorist association with collaborators inside the country. The president noted that the impact of the cyberattack was far-reaching, affecting 27 government entities, including utility companies. Chaves, who has been in office for less than a week, accused former President Carlos Alvarado of not investing enough in cybersecurity and responding to attacks during the last days of his administration.

Conti warned Costa Rica that he has privileged information from the government, according to a statement released yesterday. He stressed that the country had less than a week to pay the ransom before destroying the unlock keys of the machines affected by the ransomware. The group stated that it was aware that the government had hired a data recovery specialist and warned him not to seek alternative solutions.

“I once again appeal to the inhabitants of Costa Rica to take to the streets and demand payment,” said Conti’s message. “Any other attempt to receive in touch through other services will be punished with the deletion of the key. I appeal to all Costa Ricans to go to their government and organize rallies so that they pay us as soon as possible. Provided your current government cannot stabilize the situation, what alternatives do you have? Is it worth changing the government?

President Chaves announced a state of emergency on May 8 after the Conti ransomware infected Costa Rica in April. Initially, the full impact of the attack was unknown, but it hurt the Public Treasury, which was left without digital services and was forced to rely on manual processes to carry out its functions. Conti demanded a $10 million ransom and noted that around 97% of the data he had acquired, a complete of 672 GB, had been released.

The post The Conti ransomware gang invites to overthrow the Costa Rican government appeared first on B6G.NET| for all information technology.

Veeam’s 2022 Ransomware Trends Report reveals the results of an independent research firm that surveyed 1,000 IT leaders whose organizations had been successfully attacked by ransomware at least once in the past 12 months, making it one One of the largest reports of its kind. The first-of-its-kind study examines the key learnings from these incidents, their impact on IT environments, and the steps taken to implement Contemporary Data Protection strategies that ensure business continuity well into the future. The research project specifically surveyed four IT profiles (CISOs, Security professionals, backup administrators, and IT Operations staff) to understand the alignment of cyber readiness across organizations.

“Ransomware has democratized data theft and requires collaborative replication from organizations across industries to maximize their ability to remediate and recover without paying the ransom,” said Danny Allan, CTO of Veeam. “Paying cybercriminals to restore data is not a data protection strategy. There is no warranty that these will be recovered, the risks of reputational damage and loss of customer trust are high, and more importantly, this fuels a self-fulfilling prophecy that rewards crook activity.”

Paying the ransom is not a recovery strategy

Of the organizations surveyed, the majority (76%) of cyber victims paid the ransom to end an attack and recover their data. Unfortunately, while 52% paid the ransom and were able to receive the data back, 24% paid the ransom but couldn’t get it back, resulting in a 1 in 3 chance that even paying the ransom, there is no data. . Notably, 19% of organizations did not pay the ransom because they were able to receive their data back. This is what the remaining 81% of cyber victims should aspire to: recover data without paying the ransom.

“One of the hallmarks of a strong Modern Data Protection strategy is a commitment to a lucid policy that the organization will never pay the ransom, but will do everything in its power to prevent, remediate, and recover from attacks. Allan added. “Despite the ubiquitous and unavoidable threat of ransomware, the narrative that businesses are helpless against it is not accurate. Employees need to be educated and ensure they practice impeccable digital hygiene; regularly conduct rigorous testing of its data protection solutions and protocols, and create detailed business continuity plans that prepare key stakeholders for worst-case scenarios.”

Prevention requires diligence from both IT and users

The “attack surface” for criminals is diverse. In most cases, cyber villains first gain access to production environments through errant users who clicked on malicious links, visited unsafe websites, or got involved with phishing emails, again exposing the preventable nature of many incidents. After successful access to the environment, there is very little difference in infection rates between data center servers, remote office platforms, and cloud-hosted servers. In most cases, intruders take advantage of known vulnerabilities, including common operating systems and hypervisors, as well as NAS platforms and database servers, exploiting any outdated or unpatched software they can find. Notably, security professionals and backup administrators reported significantly higher infection rates, compared to IT Operations or CISOs, implying that “those closest to the problem see even more problems.”

Remediation begins with immutability

Survey respondents confirmed that 94% of attackers attempted to destroy backup repositories, and in 72% of cases this strategy was partially successful. This removal of an organization’s recovery lifeline is a popular attack strategy, as it increases the likelihood that victims will have no choice but to pay the ransom. The only way to protect against this scenario is to have at least an immutable or air-gapped level within the data protection framework, which 95% of respondents said they now have. In fact, numerous organizations reported having some level of immutability or air gap media at more than one level of their disk, cloud, and tape strategy.

Other key findings from Veeam’s 2022 Ransomware Trends Report include:

• Orchestration matters: To proactively ensure the recoverability of their systems, one in six (16%) IT teams automate the validation and recoverability of their backups to ensure their servers are restorable. Then, during the remediation of a ransomware attack, 46% of respondents use an loney “sandbox” or staging/testing area to ensure their restored data is clean before bringing systems back into production.
• Organizational alignment needs to be unified – 81% believe their organizations’ cyber and business continuity/disaster recovery strategies are aligned. Notwithstanding, 52% of those surveyed consider that the interactions between these teams require improvement.
• Diversifying repositories is key: Nearly all organizations (95%) have at least a level of data protection that is immutable or air-gapped, 74% use cloud repositories that offer immutability; 67% use local disk repositories with immutability or locking, and 22% use air-gapped tape. Immutable or not, organizations noted that aside from disk repositories, 45% of production data is still stored on tape and 62% is stored in the cloud at some point in the data lifecycle.

The full Veeam Ransomware Trends Report 2022 is available for download on the Veeam site (registration required).

The post 76% of organizations admit to paying ransomware criminals appeared first on B6G.NET| for all information technology.