Dopo RegreSSHion, un’altra vulnerabilità colpisce OpenSSH: tracciato come CVE-2024-6409, il bug permette di eseguire codice da remoto a causa di una race condition.
La vulnerabilità è presente nel processo figlio di privsep e in particolare nelle operazioni di signal handling. A scoprire il bug è stato il ricercatore di sicurezza AlexanderPeslyak, il quale ha spiegato che, a differenza di regreSSHion, il processo viene eseguito con privilegi ridotti e quindi l’impatto immediato è inferiore.
Pixabay
In ogni caso, se si utilizza una versione di OpenSSH non patchata, un attaccante può sfruttare a suo piacimento una delle due vulnerabilità per compromettere l’intero sistema e prenderne il controllo, installando malware od ottenendo dati sensibili. “Potrebbe anche essere possibile creare un exploit che funzioni contro una delle due vulnerabilità in modo probabilistico, il che potrebbe ridurre la durata dell’attacco o aumentare la percentuale di successo” aggiunge il ricercatore.
Mentre regreSSHion è stata già sfruttata dagli attaccanti, al momento i ricercatori non sono a conoscenza di tentativi di sfruttamento di questa nuova vulnerabilità.
Peslyak ha contattato i ricercatori di Qualys per comunicargli la scoperta e il team ha confermato l’esistenza e la natura della vulnerabilità.
Le versioni vulnerabili sono la 8.7 e la 8.8. Poiché la race condition alla base dei bug è la stessa, è consigliabile installare il prima possibile le patch disponibili. Rimangono valide anche le indicazioni sulla segmentazione di rete e sull’implementazione di soluzioni per il monitoraggio di attività sospette.
Indipendentemente dal settore (sanità, finanza, PA, istruzione, ecc.) tutte le organizzazioni lavorano con i dati.
Anche tutti gli attacchi informatici funzionano con i dati. Che la fonte sia esterna o interna, sofisticata o meno, le minacce hanno bisogno di dati per rubare un’identità o un segreto aziendale, compromettere una rete o condurre un attacco denial-of-service.
Tuttavia, nonostante i dati siano al centro delle operazioni aziendali e delle violazioni, le aziende continuano a pagare milioni per prodotti e servizi di rilevamento delle minacce che faticano a rispondere a domande importanti quando si verifica un incidente. Domande come… “Sono stati rubati dati?”
Varonis protegge prima di tutto i dati e l’offerta Managed Data Detection and Response (MDDR) è un servizio gestito per il monitoraggio e la protezione dei dati critici 24 ore su 24, 7 giorni su 7, 365 giorni all’anno.
Cos’è Varonis MDDR e come funziona?
Sin dalla fondazione di Varonis nel 2005, il rilevamento delle minacce è stato un componente fondamentale della sua Data Security Platform.
Varonis MDDR combina la tecnologia di rilevamento delle minacce leader del settore con il team di threat hunters di livello mondiale, con gli analisti forensi e gli addetti alla risposta agli incidenti che valutano, indagano e rispondono agli avvisi, così non deve farlo il cliente.
Questo servizio incorpora anche l’analisi comportamentale, l’apprendimento automatico, l’automazione basata su IA, decenni di esperienza nella security e un’esclusiva telemetria dei metadati per proteggere i clienti Varonis dalle minacce e dai percorsi di attacco che i servizi XDR ed EDR non possono rilevare.
MDDR è data-centric
I tradizionali servizi di rilevamento e risposta tendono ad essere incentrati sugli attori delle minacce. Rispondono a domande del tipo: “Chi era l’autore della minaccia? Quale CVE ha sfruttato? Quali strumenti sono stati utilizzati?”
Si tratta di domande importanti a cui rispondere, ma quando si tratta di comprendere l’impatto sui dati, si presentano in breve tempo e aumentano di settimane il tempo medio per rilevare una violazione.
A differenza dei tradizionali servizi XDR ed EDR, Varonis MDDR si concentra sui dati dell’azienda, quindi non ottiene solo informazioni incentrate sull’attore di un attacco.
Varonis può fornire informazioni su quali file sono stati interessati, se sono state prese di mira informazioni personali o proprietà intellettuale e altro ancora, per arrivare alla risposta principale: se i dati sono stati rubati e se la violazione deve essere segnalata.
Senza questo focus sui dati, le organizzazioni con stack di sicurezza avanzati possono comunque cadere vittime di violazioni da parte di minacce interne e attaccanti che aggirano i controlli degli endpoint e della rete.
Varonis MDDR risponde a domande a cui altre soluzioni di rilevamento e risposta non possono rispondere, ad esempio se i dati sono stati esfiltrati e se l’incidente costituisce una violazione materiale.
Investigazioni AI-driven
Quando viene rilevata un’attività anomala, Varonis esegue un’indagine iniziale per aggiungere un contesto critico sull’utente (i suoi colleghi, i dati con cui lavora, le tendenze degli avvisi, i dispositivi coinvolti e gli orari di lavoro generali) e attiva le risposte automatiche necessarie. Gli avvisi critici vengono inoltrati al team di esperti Varonis per ulteriori indagini e mitigazioni.
Nell’interfaccia Varonis, i clienti vedono su quali avvisi stanno lavorando gli analisti, leggono le loro note e rimangono aggiornati. I casi verranno inoltrati solo quando necessario.
Un avviso di ransomware, ad esempio, attiverà l’intelligenza artificiale di Varonis per indagare. Se i risultati indicano un vero positivo, l’analista MDDR viene coinvolto rapidamente per esplorare l’avviso e arrivare a una soluzione il prima possibile.
Le indagini Varonis basate sull’intelligenza artificiale rendono possibile mantenere lo SLA leader del settore, consentendo di rispondere agli avvisi di ransomware entro 30 minuti e ad altri avvisi entro 120 minuti. Il servizio include anche la ricerca proattiva delle minacce e valutazioni mensili della sicurezza per garantire che il livello di sicurezza dei dati aziendali sia in costante miglioramento.
Gli esperti Varonis rispondono rapidamente ed esaminano l’avviso per arrivare alla risoluzione il più rapidamente possibile.
Threat hunting proattivo
Il team di Varonis Threat Labs (VTL) ricerca in modo proattivo tendenze, minacce informatiche emergenti, autori di minacce e altro ancora, che prendono di mira determinati settori verticali.
Questi risultati vengono inclusi nelle valutazioni mensili sullo stato di sicurezza per i clienti MDDR, con gli ultimi aggiornamenti in tempo reale di intelligence sulle minacce per ridurre continuamente la superficie di attacco.
Nel 2018, Varonis ha costituito la sua organizzazione di risposta agli incidenti (IR) che ha ispirato l’offerta MDDR. Fin dalla sua nascita, Varonis IR ha indagato su oltre 10.000 incidenti.
Recentemente, presso un istituto sanitario, Varonis ha identificato tentativi di intrusione da parte del gruppo ransomware BlackCat, noto anche come ALPHV, e ha impedito la possibilità di un evento di crittografia malevolo. Dopo aver avvisato rapidamente il cliente, Varonis ha identificato il dispositivo vulnerabile e assistito con la mitigazione.
Varonis MDDR aiuta inoltre i clienti a combattere le minacce interne. In un caso, per esempio, la funzionalità EDR ha avvisato un cliente di un’attività insolita e il cliente ha contattato il team Varonis per indagare e identificare un file sospetto sulla rete.
Gli esperti Varonis hanno identificato rapidamente l’autore del file – un amministratore IT scontento – e hanno esaminato la sua attività sulla rete. È stato scoperto che non solo aveva creato il file sospetto, ma aveva anche creato oggetti non autorizzati per sfruttare probabilmente la persistenza nella rete, oltre ad accedere ai file delle risorse umane relativi a un partner che stava affrontando un’azione disciplinare verso l’organizzazione.
Ciò che era iniziato come un incidente EDR si è evoluto in un’indagine sulle minacce interne molto più ampia e, senza l’attenzione del team IR di Varonis sui dati e sulla reale portata della minaccia, avrebbe portato a un risultato molto diverso.
Non attendere che si verifichi una violazione
Senza un monitoraggio continuo dei dati, le organizzazioni aumentano il rischio di esposizione quando si verifica una violazione. Varonis MDDR è la soluzione che fornisce il monitoraggio dei dati 24x7x365. Per saperne di più: https://www.varonis.com/it/
A cura di Mike Thompson, Security Architect Manager, Varonis
The cannabis industry is experiencing exponential growth as more regions legalize its use for both medicinal and recreational purposes. This expanding market presents unique opportunities but also comes with unique challenges in the realms of security and compliance.
Compliance and security in the cannabis industry, while closely related, address different aspects of operational integrity. Compliance focuses on adhering to local and state regulations to ensure legal and safe production and distribution, whereas security involves protecting the physical and digital assets of the business (including inventory, cash and personnel) from theft, diversion and cyber threats.
Unique security challenges
Gone are the days of carrying backpacks full of cash to pay licensing fees and other obligations (yes, that really happened), but safety concerns surrounding cash transactions, product transport, and foremost, the safety of staff, remain paramount.
High-value inventory: Cannabis products, both in raw and processed forms, are highly valuable, not just monetarily, but also from a possession perspective. Carry limits are in place so that no one individual has access or control of large amounts of inventory with the intent to sell to minors or undeveloped markets. This makes them attractive targets for theft and diversion to be distributed in what is called the “gray” market.
Cash-intensive operations: Most operators have access to a bank of some sort for their business, but most transactions with consumers take place with cash. This means that security measures must be in place for handling and storing large amounts of cash.
Employee safety: Cannabis businesses are subject to stringent regulatory oversight. These measures have laid the foundation to ensure necessary protocols are in place to protect employees from a variety of pitfalls or situations that exist as they work with cannabis and cash.
Stringent oversight: Regulatory oversight has laid the foundation to ensure compliance and security protocols are in place. While some security measures may seem extreme, such as checking in every person who is accessing limited access facilities, escorting visitors, transport safety measures and more cameras than you can count, they are all necessary when working in the cannabis space.
Implementing robust security measures
To address these challenges, cannabis businesses must implement comprehensive security strategies. Key components include physical security, employee training and cybersecurity.
Physical security encompasses surveillance systems, secure storage facilities, and stringent access controls. High-resolution cameras, alarm systems and reinforced vaults are essential to safeguard valuable inventory and cash reserves.
❝
The cannabis industry is at a critical juncture, with enormous potential for growth and innovation. However, the risks associated with security and compliance should not be underestimated.”
Additional safety measures come into play, even when hiring cannabis employees. Each state has its one set of rules for who can work in cannabis, but strict and repetitive background screens take place for every employee before someone can be trusted to work in cannabis. This helps weed out the bad actors.
Employee training is equally important. Employees must be trained to recognize and respond to security threats. This includes understanding protocols for handling cash, managing inventory and ensuring the integrity of the supply chain. Regular training sessions ensure that all staff are up-to-date on the latest security practices and are equipped to handle potential threats.
In 2024, cybersecurity cannot be overlooked — or overstated. As with any modern business, cannabis companies must protect their digital assets along with environmental control systems that live in the cloud. This involves safeguarding customer data, securing online transactions and preventing cyberattacks or hacking into system databases.
The importance of compliance
Compliance in the cannabis industry is multifaceted, involving local and state rules. Key areas of focus include:
Licensing: Obtaining and maintaining the necessary licenses is fundamental to operating a legal cannabis business. This process can be complex and requires meticulous attention to detail. Businesses must navigate an evolving regulatory landscape, submit comprehensive documentation and often undergo rigorous inspections. The cost of non-compliance can be severe, including hefty fines, license suspension or permanent closure.
Product testing and labeling: Product testing and labeling are critical components of compliance. Cannabis products must meet stringent safety standards to ensure they are free from contaminants such as pesticides, heavy metals and microbial impurities. Accurate labeling is equally important, providing consumers with essential information about the product’s potency, ingredients and usage instructions. This transparency helps build consumer trust and ensures safety for products that hit the store shelves.
Record-keeping: Detailed records must be kept for all aspects of the business, from seed to sale. Traceability and accountability become paramount when a product is recalled or needs to be investigated for product safety.
Building a company culture of compliance
Creating a culture within a cannabis organization requires commitment from all levels of the business. Compliance and security are everyone’s jobs! Senior management must lead by example, while all employees need to embrace the importance of compliance. Regular training sessions and clear communication of policies are essential. Additionally, this is not a one-time effort but an ongoing process. Businesses must stay abreast of changing regulations and continuously refine their practices — rules can change overnight to be implemented the next day.
Partnering with experts
Given the complexities of security and compliance, partnering with experts can be invaluable. Security consultants, legal advisors and compliance specialists can provide the insights and support needed to navigate the regulatory landscape and implement effective security measures.
The cannabis industry is at a critical juncture, with enormous potential for growth and innovation. However, the risks associated with security and compliance should not be underestimated. The adage “You’re only as strong as your weakest link” is particularly relevant in the cannabis industry. It is critical to build a company-wide culture of compliance and security, ensuring that every member of the organization is aware of their role in maintaining these standards. By prioritizing these aspects, businesses can not only protect their assets and reputation but also build a foundation for long-term success.
As technology moves forward at seemingly break-neck speed — and as bad actors invent new ways to attempt to thwart it — companies are showing an increased willingness to invest in more solutions for both physical and cybersecurity needs. But as with anything else, not all solutions are created equal, so it is important to choose wisely, and for the right reasons.
On the physical front, AI and cloud based solutions are driving a lot of decisions today.
For example, a study conducted by Harris found that 70 percent of security professionals believe their organization plans to increase spending on physical security systems in 2025. More than 90 percent thing the future of physical security will be cloud-based, with three quarters looking to transition to the cloud in the next year.
The report, commissioned by Verkada, surveyed more than 1,500 IT and physical security leaders to gather insights on the state of cloud physical security. It also looked at attitudes on the cyber front and AI, finding that 90 percent of professionals surveyed think that cloud security is now more effective at protecting against data leaks and unauthorized access; while 80 percent think AI-based analytics will play a large role in future physical security solutions.
Another report, from HID, also looked at the state of physical security, particularly access control. Specific to smart buildings, the report found that open standards have become a key driver, allowing for more converged solutions that can help organizations make not only security but also business decisions — with nearly a third saying integration with other business functions a top trend.
When asked about AI, just 23 percent had no plans to incorporate some form of the technology.
On the cyber side, there is also recent evidence that budgets are expanding.
A report by Optiv found that cyber budgets have increased by almost 60 percent year-over-year. But the details are a big more nuanced. While organizations with more than 5,000 employees spent an average of $26 million on cybersecurity investments in 2024, just 36 percent cited a “formal” approach to establishing those budgets, and many were a possible direct result of a rise in incidents rather than a proactive one.
More than 60 percent cited experiencing a cybersecurity event within the past two years, and 55 percent had experienced at least four incidents.
The report also suggested that simply throwing technology at the problem may not be as effective, with 40 percent of respondents saying their organization had “too many” technologies, leading to a decrease in effectiveness overall.
However, another study from Titania shows that some organizations are thinking more proactively, with 70 percent saying they are increasing spending on proactive cybersecurity solutions such as attack surface and risk-based vulnerability management. According to the study these investments are outpacing those in preventative and reactive solutions.
This research also highlighted the importance of consolidating proactive security tools such as attack surface visibility and management, increased security control optimization and better manpower productivity.
Will the AI revolution collapse the cybersecurity skills gap?
With AI-powered cyber threats growing by the day, the cyber skills gap reached 4 million people in 2023. Gardner theorizes that by 2028, the adoption of GenAI will significantly reduce that gap, removing the need for specialized education from 50% of entry-level cybersecurity positions. This would alleviate a major challenge facing the cybersecurity community… but what about today?
Most businesses are anxious to embrace the power of generative AI, but only a small proportion currently feel they have the technology, funding, culture and skills in place to support its adoption — and the cybersecurity skills gap is at the heart of this deficit, which is why the industry is already seeing changes in how we work to create a safer world.
The AI cyber revolution has just begun
When computers first shifted into the mainstream, many feared the new technology would steal their jobs. While some roles did indeed become obsolete, most simply evolved and adjusted — and today, it’s hard to imagine doing our work without computers, let alone smartphones.
Now, AI and GenAI are promising to augment work to be even more productive.
Eventually, they will become as second nature as using laptops, but currently, society is still in the Wild West of this technology. By exploring this new frontier and learn how to use AI wisely, knowledge and best practices on it will grow. There will be more regulations and additional security KPIs around utilizing it.
As with all technology, AI could very well replace some aspects of some security roles. The cybersecurity industry will also continue to evolve and adjust — and the changes are already coming, fast.
How AI is changing cybersecurity roles, today
Perhaps the most buzzed-about change in cybersecurity is the CISO’s ever-increasing responsibilities, which were only bolstered by the recent SEC regulations. Instead of working in the trenches as they once did, today’s CISOs are starting to take on broader business-related responsibilities as they are increasingly reporting directly to the CEO and becoming more actively involved in board decisions.
Alongside this, there are often new technologies, terms and categories coined by thought leaders. Despite pervasive fears of job loss, the cybersecurity community has yet to see any roles become obsolete. Instead, the community is seeing roles evolve and expect a whole new sphere of AI security specialist roles to emerge.
With a reduction in manual analyst tasks and responsibilities, for example, analysts are now learning to manage AI-driven cybersecurity technologies. As the technology becomes more powerful, professionals foresee the introduction of more AI security analyst roles or Machine Learning Engineers who will verify and train AI-derived models and technologies.
Whatever the future holds, with 3.5 million unfilled cybersecurity expected to remain unfilled through 2025, the need for cybersecurity talent must be addressed now. While AI isn’t expected to dramatically reduce that number, it is already augmenting work and enhancing and accelerating training and education — which is why 86% of CISOs agree it will alleviate security skills gaps and talent shortages.
Managing today’s skills gap
Even as new capabilities and roles in cyberspace emerge, the cybersecurity community must be prepared to handle today’s escalating threats. Taming this new Wild West of AI requires holistic, collaborative approaches that involve government, academia and the private sector.
To attract, train and retain skilled workers, for example, the industry needs more than simple certification programs. It needs novel solutions like the Department of Defense (DoD) Cyber Service Academy, which covers academic expenses in return for service with the DoD after graduating, and the Women in Apprenticeship and Nontraditional Occupations Grant Program, which addresses a significant underrepresentation.
In addition to luring in new talent, we must ensure our education keeps pace. That means that instead of relying on university faculty for research in this field, we must turn to experts working on the frontlines of the industry to keep our programs in sync with real-world needs.
With their guidance, offerings like university SOC labs can prepare students for the pace of cyber jobs by mimicking real-world experiences. Industry leaders can also serve as guest speakers or offer targeted courses that go beyond how AI is shaping emerging threats to also provide hands-on training and lectures about how AI technologies are being developed to more-rapidly address cyber threats and attacks.
Both government and private sectors can also help support the wealth of amazing associations committed to helping cybersecurity workers upskill.
Looking to the future
In the face of this critical struggle, the cybersecurity community will continue to lean into our tradition of collaborating and sharing best practices — and thankfully, the efforts of the Cybersecurity Infrastructure Security Agency (CISA) and the billions of dollars allocated to cyber in Biden’s proposed 2025 budget reflect the government’s commitment to keeping us safe.
Even as the industry upskills its workforce to manage the cybersecurity skills gap and learn how to harness and protect its businesses and customers with AI, that very technology is the key to empowering today’s workers to do more. Instead of a defined shift, cybersecurity roles and AI are tied together in a continuum. The future is happening now.
The groundwork for success in your security career lies in careful consideration of your goals, your drive and your ability to reach them. Every security professional goes through this complex process at some point in their career.
Effective career management is the opposite of chance. It is based on accurate analysis of your situation, skills, and attributes followed by action you take to improve your position to succeed. The only person who has all this information and can use it to affect change is you.
A complete picture of you is essential to the creation of an effective resume or CV as well as any online employment profiles. It takes time and effort to think through this, but the exercise is an investment in yourself. It helps set up your best security career direction and gives you control over how potential employers evaluate and perceive you.
Think about your current employment circumstances. There are lots of reasons to be variously happy or unhappy in your current job. List the pluses and minuses, then consider the role your family situation plays in your career decisions. A partner’s employment, children, aging parents or other family dynamics including financial well-being all have an impact.
Create a complete list of every job you have ever held, including any military service, internships, summer or part-time employment. Not everything will make it onto your resume or CV, but it will outline directionally where you have been. It can also help identify those things you genuinely enjoyed, may want to revisit and set a direction for.
Analyze how you chose participation or memberships in business, professional and social associations. If you held office or served on committees, you demonstrated and excelled at leadership. Achievement of certifications, licenses or clearances through organizations reflects commitment.
Look at your formal education. Include any added non-degree-related work. Would you take a different direction if you were to begin those programs now? Most organizations support lifelong learning. Would literally changing course or seeking additional training put you on a more preferable path?
Recognition of lifetime achievements is key. Naming what they are will help clarify your personal strengths and preferences. Look for achievements within the scope of normal activities. Think about instances where you were highly motivated and enjoyed what you were doing. Past successes like these indicate interest, talent, ability and potential.
Even after this reflection, you may not be completely clear about your goals. No job is perfect, and a description of your ideal job and organization can be hard to pin down. What are your immediate objectives including compensation requirements? Are there adverse factors or barriers to you achieving these goals, and how can you overcome them?
Finally, consider what you want to see in the rear-view mirror when you are at the end of your career. Re-examine your personal value system as it underlies the decisions you make about both your life and career. Staying true to yourself is not always the easy road, but odds are you will be more confident in your career decisions.
Regardless of where you are in your security career, laying initial or more groundwork for your success is always a worthwhile investment.
Threat actors exploited Windows 0-day for more than a year before Microsoft fixed it
Getty Images
Threat actors carried out zero-day attacks that targeted Windows users with malware for more than a year before Microsoft fixed the vulnerability that made them possible, researchers said Tuesday.
The vulnerability, present in both Windows 10 and 11, causes devices to open Internet Explorer, a legacy browser that Microsoft decommissioned in 2022 after its aging code base made it increasingly susceptible to exploits. Following the move, Windows made it difficult, if not impossible, for normal actions to open the browser, which was first introduced in the mid-1990s.
Tricks old and new
Malicious code that exploits the vulnerability dates back to at least January 2023 and was circulating as recently as May this year, according to the researchers who discovered the vulnerability and reported it to Microsoft. The company fixed the vulnerability, tracked as CVE-2024-CVE-38112, on Tuesday as part of its monthly patch release program. The vulnerability, which resided in the MSHTML engine of Windows, carried a severity rating of 7.0 out of 10.
The researchers from security firm Check Point said the attack code executed “novel (or previously unknown) tricks to lure Windows users for remote code execution.” A link that appeared to open a PDF file appended a .url extension to the end of the file, for instance, Books_A0UJKO.pdf.url, found in one of the malicious code samples.
When viewed in Windows, the file showed an icon indicating the file was a PDF rather than a .url file. Such files are designed to open an application specified in a link.
Enlarge/ Screenshot showing a file named Books_A0UJKO.pdf. The file icon indicates it’s a PDF.
Check Point
A link in the file made a call to msedge.exe, a file that runs Edge. The link, however, incorporated two attributes—mhtml: and !x-usc:—an “old trick” threat actors have been using for years to cause Windows to open applications such as MS Word. It also included a link to a malicious website. When clicked, the .url file disguised as a PDF opened the site, not in Edge, but in Internet Explorer.
“From there (the website being opened with IE), the attacker could do many bad things because IE is insecure and outdated,” Haifei Li, the Check Point researcher who discovered the vulnerability, wrote. “For example, if the attacker has an IE zero-day exploit—which is much easier to find compared to Chrome/Edge—the attacker could attack the victim to gain remote code execution immediately. However, in the samples we analyzed, the threat actors didn’t use any IE remote code execution exploit. Instead, they used another trick in IE—which is probably not publicly known previously—to the best of our knowledge—to trick the victim into gaining remote code execution.”
IE would then present the user with a dialog box asking them if they wanted to open the file masquerading as a PDF. If the user clicked “open,” Windows presented a second dialog box displaying a vague notice that proceeding would open content on the Windows device. If users clicked “allow,” IE would load a file ending in .hta, an extension that causes Windows to open the file in Internet Explorer and run embedded code.
Enlarge/ Screenshot showing open IE window and IE-generated dialog box asking to open Books_A0UJKO.pdf file.
Check Point
Enlarge/ Screenshot of IE Security box asking if user wants to “open web content” using IE.
Check Point
“To summarize the attacks from the exploitation perspective: the first technique used in these campaigns is the “mhtml” trick, which allows the attacker to call IE instead of the more secure Chrome/Edge,” Li wrote. “The second technique is an IE trick to make the victim believe they are opening a PDF file, while in fact, they are downloading and executing a dangerous .hta application. The overall goal of these attacks is to make the victims believe they are opening a PDF file, and it is made possible by using these two tricks.”
The Check Point post includes cryptographic hashes for six malicious .url files used in the campaign. Windows users can use the hashes to check if they have been targeted.
A new malware campaign targets Spanish-speaking individuals within the mining sector. This campaign, discovered by Cofense Intelligence, is named Poco RAT and is a Remote Access Trojan. Based on the research, Poco RAT appears to utilize the POCO C++ Library to target Spanish-speaking individuals.
While the mining sector is the predominant target (67%) in this campaign, the campaign has also targeted manufacturing (20%), utilities (7%) and hospitality (6%).
This malware campaign was initially observed in early 2024 and was primarily delivered through embedded links to 7zip archives that contained executables housed in Google Drive. Emails in this campaign contained consistent features, including:
A financial theme in the subject line and body of the message
Spanish being the language in the subject line and body
The inclusion of a link to a 7zip archive housed in Google Drive or a delivered file with the link embedded
According to the research, this campaign is ongoing.
Get caught dealing drugs, and they practically throw away the key! Fall foul of the law by money laundering millions of dollars, however, and you’ll likely be back laundering more cash in around six years.
This is just one of the many paradoxes surrounding one of the world’s most widespread criminal activities and is one of the reasons it’s so popular, particularly among well-establish organized criminal gangs. In this episode, our regular panel of Cyjax CISO Ian Thornton-Trump, Red Goat Security’s Lisa Forte and Grey Hare Media’s Philip Ingram MBE dive deep into this dirty world.
The Money Laundering Machine: Inside the global crime epidemic – Episode 24
Our trio of hosts discuss paradoxes surrounding money laundering and the reasons it’s so popular, particularly among well-establish organized criminal gangs.
Lisa kicks off the debate, explaining the three key stages of money laundering, all of which must be painstakingly executed to liberate, distribute and hide the most funds successfully. The focus then shifts to what’s involved in launching a scam and the methods deployed to move money, viewed through the lens of some of the more high-profile cases, such as the Pandora Papers.
The complexity of money laundering activities and their huge reach and influence is then examined. The need for profitable businesses to act as fronts has actually benefited many of the communities targeted by criminal gangs, in whose interest it is, ironically, to crack down on neighbourhood crime so that the local shops they are extorting can flourish. This makes for safer, more stable environments and more profitable local businesses, which is how communities can gain by being exploited.
Spreading corruption
Having sourced the funds, successfully distributing, concealing and ultimately legitimizing the dirty money almost always means securing friends in high places, spreading corruption to the highest echelons of society. And our panel are quick to point out that this is why the influence of money laundering capers is so widespread.
Their attention next turns to traceability, which is key to law enforcement agencies cracking the money laundering code and disrupting the multi-layered scams. Ian points out how the Covid pandemic acted as a catalyst, making it easier to launder money as cashless payments exploded and cryptocurrency boomed. In contrast, blockchain’s immutability has become a key weapon in identifying and tracking the money trails and catching the scammers.
The exploited ecosystem
Of course, most crimes result in unfortunate innocent victims. In money laundering our panel conclude that there is a disturbing exploited ecosystem of unsuspecting or forced individuals who act as the distribution network of funds or valuable items. These people not only suffer at the hands of the gangs, but also frequently end up in jail while their abusers remain at large.
Our journey ends with our panel discussing what the future holds. Will innovation like AI help or hinder law enforcement? Will money laundering ever be stamped out? Tune in to discover the conclusions our experts draw, and to gain a fascinating insight into this ongoing crime wave.
A vulnerability was discovered in an NSA SkillTree training platform
Research from Contrast Security has unveiled a potential vulnerability within a training platform called SkillTree. This training platform is maintained on GitHub by the NSA.
GitHub has been used by malicious actors as an open-source development platform to house malware. For this reason, researchers aimed to uncover and understand security vulnerabilities in popular GitHub repositories.
Through the research, it was discovered that a cross-site request forgery (CSRF) vulnerability existed within SkillTree. This vulnerability provides a malicious actor with the ability to target a logged-in SkillTree’s Skills Service administrator to alter videos, text and captions. This vulnerability was designated CVE-2024-39326 and is rated moderate. The maintainers have been informed of the vulnerability and a patched version has been publicly released.
Researchers assert that this vulnerability existed due to a lack of CSRF protections within the SkillTree application.
h3 { font-weight: bold; font-size: 18px; color: #C72026; }
