Connect with us

Cyber Security

What To Know About Ransomware Attacks Going Into 2022 – Security Intelligence

Avatar photo

Published

on

Everything You Need To Know About Ransomware Attacks and Gangs In 2022
Ransomware is a lucrative business for criminals. It is paying off, and it is working.
According to a recent Trend Micro report, a staggering 84% of US organizations experienced either a phishing or ransomware attack in the last year. The average ransomware payment was over $500,000.
Bad actors want to keep cashing in. So they’re going as far as creating ransomware kits as a service (Ransomware as a Service) to be sold on the dark web and even setting up fake companies to recruit potential employees.
Many ransomware gangs function like real companies — with marketing teams, websites, software development, user documentation, support forums and media relations.
If the “companies” run by ransomware gangs can operate with minimal expenses and mind-blowing revenues, what’s stopping them from growing in number and size?
But, the more we know about how these gangs operate, the better we can be prepared for the next ransomware attack.
Ransomware attacks are on the rise because it’s easier than ever for criminals to launch an attack. So simple, in fact, that would-be attackers can download prefabricated ransomware kits containing everything they need to strike.
These ransomware kits are sold on the dark web as a service, much like the Software-as-a-Service (SaaS) model. Ransomware-as-a-Service kits provide criminals the opportunity to launch ransomware attacks with minimal technical knowledge. No malware creation skills? No problem.
Malicious actors often purchase the kits under a monthly subscription and, in many cases, are offered the opportunity to act as an affiliate of the malware creator’s service and earn a commission. Perpetuating ransomware is profitable all around.
With most RaaS kits, criminals get access to user forums, 24/7 technical support, user reviews and even discounts on future purchases.
Not only are RaaS kits crafted to minimize the technical roadblocks, but they’re also inexpensive. While the more extensive kits may fetch several thousand dollars, some ransomware kits sell for only forty dollars per month.
Using this business model, tracking and identifying these ransomware developers is more challenging since they are not the ones launching the attacks.
Unfortunately, cybersecurity experts predict RaaS to become more prevalent in 2022.
Ransomware is a lucrative and competitive business. In 2020, ransomware revenues were over $400 million worldwide.
Today, ransomware gangs operate much like regular, legitimate businesses would — complete with professional websites, marketing campaigns, how-to videos and even white papers.
Some ransomware gangs and operators are very well known in both black and white hat communities, and maintain a steady presence on the dark web. Many others, however, appear, disappear and reappear — often with new kits.
Would-be criminals looking to purchase a ransomware kit can even, for no money down, launch an attack and receive a smaller share of their victim’s ransom as an affiliate of a large ransomware gang. Some ransomware gangs might offer an easy-to-use interface for attack monitoring, while others only wish to deal with hackers with more technical skills.
According to Brett Callow, Threat Analyst at Emsisoft, one troubling trend to look out for is that the gangs are now using exfiltrated data in more extreme ways. “They no longer simply release it on the dark web,” he said. “Gangs use the data to contact customers or business partners or use non-publicly available information relating to mergers or IPOs as additional leverage.”
The FBI recently issued a Private Industry Notification (PIN) about the threat.
Cybersecurity news is typically doom and gloom. How refreshing, then, to begin with some positive news on the ransomware front before outlining the best defense strategies.
“The risk-to-reward ratio today has a bit more risk and a bit less reward,” explained Callow. “Arrests, bitcoin recoveries, infrastructure disruption and bounties have given threat actors a few black eyes.”
Plus, Callow’s team of security experts have been actively pursuing a high-profile ransomware group — and they’re succeeding in helping victims quietly take back their data without dispensing any ransom.
Despite the progress, ransomware is not going away in 2022. For the enterprise, a robust ransomware defense strategy can only fortify its cybersecurity posture.
The backbone of that strategy is ensuring you follow a robust backup process. Backups should be regular and frequent. The more frequent the backups, the less data you are at risk of losing. Whenever possible, backups should be stored on different devices in different locations.
Backups aside, here are the key critical elements to include in your ransomware defense strategy:
– Embrace zero trust, enforce least privilege principles. IBM Security X-Force recommends that organizations apply least-privilege methodologies like zero trust so that user access is limited to what they need to do their jobs.
– Test employees. By testing employees with simulated phishing attacks, the chances of being successfully phished with a real ransomware email can diminish.
– Patch frequently. Maintaining an aggressive and current patch management policy can foil attackers that maliciously use zero-day vulnerabilities in their ransomware attacks — a notable threat intelligence trend.
– Change default passwords. This defense tactic is overlooked and underrated, as a default password is one of the easiest ways for a bad actor to gain easy entry and access.
– Use MFA wherever possible. While MFA isn’t foolproof, it’s a massive improvement over password-only protection and can be the difference between a successful and foiled attack.
– Use current antivirus and endpoint protection. AV solutions must be updated as often as possible since ransomware is constantly evolving to avoid detection. Additional endpoint protection solutions that detect suspicious behavior and untrusted applications should also be given serious consideration.
– Strip/limit/prohibit email attachments containing executables. Organizations may configure their email gateways to scan attached ZIP archives, but often forgo stripping or removing the executables. If the executable is malicious, it’s an easy way for attackers to bypass other endpoint controls.
– Foster a culture of security. When everyone in the organization, from the executive to the entry-level employee, is encouraged to participate in security, risk typically decreases.
Mark Stone is a Hubspot-certified content marketing writer specializing in technology, business, and entertainment. He is a regular contributor to Forbes Bra…
4 min readThis is a time of major changes for businesses and agencies. That includes the move to the cloud and the shift to being digital-first. So, cybersecurity has moved to a front-and-center position in many companies and industries. When talking about…
3 min readCorporate clients and cloud service providers (CSPs) are both responsible for cloud security. Clients remain accountable for governance and compliance. However, their other duties will vary depending upon the type of cloud deployment. What can cloud-native security controls do for…
4 min readWill people ever live in a digital world 24/7? Nobody knows for sure, but the metaverse is certainly expanding rapidly. As the world dives deeper into the digital realm, companies need guidance on how to protect their assets and intellectual…
Whether it’s online or brick-and-mortar, every new store or website represents a new potential entry point for threat actors. With access to more personally identifiable information (PII) of customers than most industries, bad actors perceive retail as a great way to cash in on their attacks. Plus, attackers can duplicate attack methods more easily since retailers share similar cybersecurity infrastructure.…
In the cybersecurity field, large databases of known threats and vulnerabilities have often been an essential resource. These catalogs show you where to focus your efforts. They’re also a good tool for prioritizing patches to increase security and mitigate the risk of disaster. As a result, these databases need to be reliable and up-to-date and use the correct criteria to…
The cost of a data breach has reached an all-time high. It averaged $4.35 million in 2022, according to the newly published IBM Cost of a Data Breach Report. What’s more, 83% of organizations have faced more than one data breach, with just 17% saying this was their first data breach. What can organizations do about this? One solution is…
Today, many leading industries and modern enterprises have switched from processing and acting on data stored in databases to data in flight. How? Through real-time applications. One way to enable this is WebSocket, but it comes with vulnerabilities as well.  What Is WebSocket? Real-time applications operate within an immediate time frame; sensing, analyzing and acting on streaming data as it…
Analysis and insights from hundreds of the brightest minds in the cybersecurity industry to help you prove compliance, grow business and stop threats.

source

Continue Reading
Advertisement
Click to comment

Business

Prosecutors seek from 40 to 50 years in prison for Sam Bankman-Fried for cryptocurrency fraud

Avatar photo

Published

on

Prosecutors seek from 40 to 50 years in prison for Sam Bankman-Fried for cryptocurrency fraud

By LARRY NEUMEISTER

NEW YORK (AP) — FTX founder Sam Bankman-Fried’s orchestration of one of history’s largest financial frauds in his quest to dominate the cryptocurrency world deserves a prison sentence of 40 to 50 years, federal prosecutors on Friday told a federal judge.

Prosecutors made the recommendation in papers filed in Manhattan federal court in advance of a March 28 sentencing, where a judge will also consider a 100-year prison sentence recommended by the court’s probation officers and a request by defense lawyers for leniency and a term of imprisonment not to exceed single digits.

Bankman-Fried, 32, was convicted in November on fraud and conspiracy charges after his dramatic fall from a year earlier when he and his companies seemed to be riding a crest of success that had resulted in a Super Bowl advertisement and celebrity endorsements from stars like quarterback Tom Brady and comedian Larry David.

Some of his biggest successes, though, resulted from stealing at least $10 billion from investors and customers between 2017 and 2022 to buy luxury real estate, make risky investments, dispense outsized charitable donations and political contributions and to buy praise from celebrities, prosecutors said.

 

FILE - Sam Bankman-Fried leaves Manhattan federal court in New York on Feb. 16, 2023. Bankman-Fried's lawyers are seeking leniency next month at the FTX founder's sentencing for cryptocurrency crimes. The lawyers filed presentence arguments late Monday, Feb. 26, 2024, in Manhattan federal court. (AP Photo/Seth Wenig, File)

 

“His life in recent years has been one of unmatched greed and hubris; of ambition and rationalization; and courting risk and gambling repeatedly with other people’s money. And even now Bankman-Fried refuses to admit what he did was wrong,” prosecutors wrote.

Advertisement
Submit your 2022 Austin Neighborhood Feedback

“Having set himself on the goal of amassing endless wealth and unlimited power — to the point that he thought he might become President and the world’s first trillionaire — there was little Bankman-Fried did not do to achieve it,” prosecutors said.

They said crimes reflecting a “brazen disrespect for the rule of law” had depleted the retirement funds and nest eggs of people who could least afford to lose money, including some in war-torn or financially insecure countries, and had harmed others who sought to “break generational poverty” only to be left “devastated” and “heartbroken.”

“He knew what society deemed illegal and unethical, but disregarded that based on a pernicious megalomania guided by the defendant’s own values and sense of superiority,” prosecutors said.

Bankman-Fried was extradited to the United States in December 2022 from the Bahamas after his companies collapsed a month earlier. Originally permitted to remain at home with his parents in Palo Alto, California, he was jailed last year weeks before his trial after Judge Lewis A. Kaplan concluded that he had tried to tamper with trial witnesses.

In their presentence submission, prosecutors described Bankman-Fried’s crimes as “one of the largest financial frauds in history, and what is likely the largest fraud in the last decade.”

“The defendant victimized tens of thousands of people and companies, across several continents, over a period of multiple years. He stole money from customers who entrusted it to him; he lied to investors; he sent fabricated documents to lenders; he pumped millions of dollars in illegal donations into our political system; and he bribed foreign officials. Each of these crimes is worthy of a lengthy sentence,” they wrote.

They said his “unlawful political donations to over 300 politicians and political action groups, amounting to in excess of $100 million, is believed to be the largest-ever campaign finance offense.”

And they said his $150 million in bribes to Chinese government officials was one of the single largest by an individual.

“Even following FTX’s bankruptcy and his subsequent arrest, Bankman-Fried shirked responsibility, deflected blame to market events and other individuals, attempted to tamper with witnesses, and lied repeatedly under oath,” prosecutors said, citing his trial testimony.

Advertisement
Submit your 2022 Austin Neighborhood Feedback

Two weeks ago, Bankman-Fried attorney Marc Mukasey attacked a probation office recommendation that their client serve 100 years in prison, saying a sentence of that length would be “grotesque” and “barbaric.”

He urged the judge to sentence Bankman-Fried to just a few years behind bars after calculating federal sentencing guidelines to recommend a term of five to 6 1/2 years in prison.

“Sam is not the ‘evil genius’ depicted in the media or the greedy villain described at trial,” Mukasey said, calling his client a “first-time, non-violent offender, who was joined in the conduct at issue by at least four other culpable individuals, in a matter where victims are poised to recover — were always poised to recover — a hundred cents on the dollar.”

Mukasey said he will respond to the prosecutors’ claims in a filing next week.

Read More

Continue Reading

Cyber Security

Biden to create cybersecurity standards for nation’s ports as concerns grow over vulnerabilities

Avatar photo

Published

on

Biden to create cybersecurity standards for nation’s ports as concerns grow over vulnerabilities

WASHINGTON (AP) — President Joe Biden on Wednesday signed an executive order and created a federal rule aimed at better securing the nation’s ports from potential cyberattacks.

The administration is outlining a set of cybersecurity regulations that port operators must comply with across the country, not unlike standardized safety regulations that seek to prevent injury or damage to people and infrastructure.

“We want to ensure there are similar requirements for cyber, when a cyberattack can cause just as much if not more damage than a storm or another physical threat,” said Anne Neuberger, deputy national security adviser at the White House.

Nationwide, ports employ roughly 31 million people and contribute $5.4 trillion to the economy, and could be left vulnerable to a ransomware or other brand of cyberattack, Neuberger said. The standardized set of requirements is designed to help protect against that.

The new requirements are part of the federal government’s focus on modernizing how critical infrastructure like power grids, ports and pipelines are protected as they are increasingly managed and controlled online, often remotely. There is no set of nationwide standards that govern how operators should protect against potential attacks online.

The threat continues to grow. Hostile activity in cyberspace — from spying to the planting of malware to infect and disrupt a country’s infrastructure — has become a hallmark of modern geopolitical rivalry.

For example, in 2021, the operator of the nation’s largest fuel pipeline had to temporarily halt operations after it fell victim to a ransomware attack in which hackers hold a victim’s data or device hostage in exchange for money. The company, Colonial Pipeline, paid $4.4 million to a Russia-based hacker group, though Justice Department officials later recovered much of the money.

Ports, too, are vulnerable. In Australia last year, a cyber incident forced one of the country’s largest port operators to suspend operations for three days.

Advertisement
Submit your 2022 Austin Neighborhood Feedback

In the U.S., roughly 80% of the giant cranes used to lift and haul cargo off ships onto U.S. docks come from China, and are controlled remotely, said Admiral John Vann, commander of the U.S. Coast Guard’s cyber command. That leaves them vulnerable to attack, he said.

Late last month, U.S. officials said they had disrupted a state-backed Chinese effort to plant malware that could be used to damage civilian infrastructure. Vann said this type of potential attack was a concern as officials pushed for new standards, but they are also worried about the possibility for criminal activity.

The new standards, which will be subject to a public comment period, will be required for any port operator and there will be enforcement actions for failing to comply with the standards, though the officials did not outline them. They require port operators to notify authorities when they have been victimized by a cyberattack. The actions also give the Coast Guard, which regulates the nation’s ports, the ability to respond to cyberattacks.

Read More

Continue Reading

Business

Why Was Sam Altman Fired? Possible Ties to China D2 (Double Dragon) Data from Hackers

Avatar photo

Published

on

Theories are going around the internet why Sam Altman was fired. On an insider tech forum (Blind) – one person claims to know by third-hand account and how this news will trickle into the media over the next couple of weeks.

It’s said OpenAI had been using data from D2 to train its AI models, which includes GPT-4. This data was obtained through a hidden business contract with a D2 shell company called Whitefly, which was based in Singapore. This D2 group has the largest and biggest crawling/indexing/scanning capacity in the world 10x more than Alphabet Inc (Google), hence the deal so Open AI could get their hands on vast quantities of data for training after exhausting their other options.

The Chinese government became aware of this arrangement and raised concerns with the Biden administration. As a result, the NSA launched an investigation, which confirmed that OpenAI had been using data from D2. Satya Nadella, the CEO of Microsoft, which is a major investor in OpenAI, was informed of the findings and ordered Altman’s removal.

There was also suggestion that Altman refused to disclose this information to the OpenAI board. This lack of candor ultimately led to his dismissal and is what the board publicly alluded to when they said “not consistently candid in his communications with the board.”

To summarize what happened with Sam Altman’s firing:

1. Sam Altman was removed from OpenAI due to his ties to a Chinese cyber army group.

2.OpenAI had been using data from D2 to train its AI models.

3. The Chinese government raised concerns about this arrangement with the Biden administration.

Advertisement
Submit your 2022 Austin Neighborhood Feedback

4. The NSA launched an investigation, which confirmed OpenAI’s use of D2 data.

5. Satya Nadella ordered Altman’s removal after being informed of the findings.

6. Altman refused to disclose this information to the OpenAI board.

 

We’ll see in the next couple of weeks if this story holds up or not.

Continue Reading