Siemens Energy, Schneider Electric Targeted by Ransomware Group in MOVEit Attack

Energy giants Schneider Electric and Siemens Energy have confirmed being targeted by a ransomware group in the recent campaign exploiting a vulnerability in Progress Software’s MOVEit managed file transfer (MFT) software.

The Cl0p ransomware group claims to have exploited a MOVEit zero-day vulnerability to access the files of hundreds of organizations that had been using the MFT product. Several major companies have confirmed being hit and the cybercriminals have started naming victims that refuse to pay up.

This week, the hackers added over a dozen more alleged victims to their leak website. Germany-based Siemens Energy, a spinoff of Siemens’ energy business, and France-based automation and energy management giant Schneider Electric are among the companies named this week on the Cl0p site.

Siemens Energy has confirmed for SecurityWeek that it’s among the targets of the MOVEit attack and said it took immediate action in response to the incident.

“Based on the current analysis no critical data has been compromised and our operations have not been affected,” the company said in an emailed statement.

Schneider Electric told SecurityWeek that the company became aware of the MOVEit software zero-day on May 30 and promptly deployed mitigations to secure data and infrastructure.

“Subsequently, on June 26th, 2023, Schneider Electric was made aware of a claim mentioning that we have been the victim of a cyber-attack relative to MOVEit vulnerabilities. Our cybersecurity team is currently investigating this claim as well,” the company said.

Advertisement. Scroll to continue reading.

Other major organizations listed recently by Cl0p on its leak website include Sony, EY, PwC, Cognizant, AbbVie and UCLA, but it’s unclear if all of them have been targeted in the MOVEit attack. SecurityWeek has reached out to each of them for comment.

The attackers have started leaking data allegedly stolen from energy giant Shell, which has confirmed being targeted in the MOVEit attack. SecurityWeek has reached out to Shell as well.

Some evidence suggests that the cybercriminals have known about the MOVEit zero-day vulnerability since 2021, but mass attacks only started in late May 2023.

While some government organizations have also confirmed being impacted, the hackers claim they have deleted all the data obtained from such entities, noting that they are financially motivated and “do not care about politics”. They allegedly deleted data obtained from more than 30 government and government-related organizations.

The cybercriminals also claim on their website that they are the only group to have exploited the zero-day before it was patched and they are the only ones in possession of the data obtained as a result of the attack.

https://www.securityweek.com/siemens-energy-schneider-electric-targeted-by-ransomware-group-in-moveit-attack/

3-Year Probe Into Encrypted Phones Led to Seizure of Hundreds of Tons of Drugs, Prosecutors Say

Investigations triggered by the cracking of encrypted phones three years ago have so far led to more than 6,500 arrests worldwide and the seizure of hundreds of tons of drugs, French, Dutch and European Union prosecutors said Tuesday.

The announcement underscored the staggering scale of criminality — mainly drugs and arms smuggling and money laundering — that was uncovered as a result of police and prosecutors effectively listening in to criminals using encrypted EncroChat phones.

“It helped to prevent violent attacks, attempted murders, corruption and large-scale drug transports, as well as obtain large-scale information on organised crime,” European Union police and judicial cooperation agencies Europol and Eurojust said in a statement.

The French and Dutch investigation gained access to more than 115 million encrypted communications between some 60,000 criminals via servers in the northern French town of Roubaix, prosecutors said at a news conference in the nearby city of Lille.

As a result, 6,558 suspects have been arrested worldwide, including 197 “high-value targets.” Seized drugs included 30.5 million pills, 103.5 metric tons (114 tons) of cocaine, 163.4 metric tons (180 tons) of cannabis and 3.3 metric tons (3.6 tons) of heroin. The investigations also led to nearly 740 million euros ($809 million) in cash being recovered and assets or bank accounts worth another 154 million euros ($168 million) frozen.

Police announced in 2020 they had cracked the encryption of EncroChat phones and effectively listened in on criminal gangs.

EncroChat sold phones for around 1,000 euros ($1,094) worldwide and offered subscriptions with global coverage for 1,500 euros ($1,641) per six months. The devices were marketed as offering complete anonymity and were said to be untraceable and easy to erase if a user was arrested.

Advertisement. Scroll to continue reading.

French law enforcement authorities launched investigations into the company operating EncroChat in 2017. The probe led to a device being installed that was able to evade the phones’ encryption and gain access to users’ communications.

Authorities also have identified and detained some of the alleged leaders of the EncroChat provider, Carole Etienne, chief prosecutor at the judicial tribunal of Lille, told reporters.

“Three people were arrested on June 22 in Spain and handed over to France on the basis of European arrest warrants,” she said. “Other individuals have been located outside the European Union and have not yet been charged.”EncroChat is not the only secret communications network used by criminals that have been infiltrated by law enforcement authorities.In March 2021, Belgian police arrested dozens of people and seized more than 17 metric tons (18.7 tons) of cocaine after cracking another encrypted chat system, called Sky ECC.

The FBI and other law enforcement agencies went a step further and created an encrypted service — ANOM — that was marketed to criminals in a global sting that led to the arrest of more than 800 suspects and seizure of more than 32 metric tons (35.2 tons) of drugs, including cocaine, cannabis, amphetamines and methamphetamines.

https://www.securityweek.com/3-year-probe-into-encrypted-phones-led-to-seizure-of-hundreds-of-tons-of-drugs-prosecutors-say/

Gas Stations Impacted by Cyberattack on Canadian Energy Giant Suncor

Some services at Petro-Canada gas stations have been disrupted following a cyberattack on parent company Suncor, one of the largest energy companies in North America.

Suncor is a Canada-based company that produces oil and runs several refineries in North America. The organization owns a network of more than 1,800 Petro-Canada retail and wholesale locations.

In a brief statement issued on June 25, Suncor said it had experienced a cybersecurity incident that may impact some transactions with suppliers and customers. The company said it brought in third-party experts to aid investigation and response efforts, and noted that authorities have been notified.

“At this time, we are not aware of any evidence that customer, supplier or employee data has been compromised or misused as a result of this situation,” the company said.

On June 26, Petro-Canada said on Twitter that it’s working with Suncor to respond to the cybersecurity incident, informing customers that some services may be unavailable, including credit card payments and car washes.

Petro-Canada also informed customers that they will not be able to log into their loyalty program account from the app or website.

It’s unclear if the disruptions have been caused by a ransomware attack. In these types of attacks, cybercriminals can encrypt files and steal data from the victim’s systems — they can conduct only one or both types of activities.

Advertisement. Scroll to continue reading.

In 2021, American oil pipeline system Colonial Pipeline was targeted in a ransomware attack that resulted both in significant disruption and the theft of information, with the company paying millions of dollars to the attackers.

SecurityWeek has sent an email to Suncor asking if the incident involved ransomware and whether the company received a ransom demand from the attackers. This article will be updated if the energy giant responds.

Threat actors have been observed selling access to energy organizations, including oil and gas firms, on cybercrime forums.

https://www.securityweek.com/gas-stations-impacted-by-cyberattack-on-canadian-energy-giant-suncor/

British Twitter Hacker Sentenced to Prison in US

A British national has been sentenced to five years in prison in the US for his role in hacking schemes targeting cryptocurrency wallets, Twitter accounts, and other social media accounts.

The man, Joseph James O’Connor, also known as ‘PlugwalkJoe’, 24, was arrested in Spain in July 2021 and extradited to the US in April this year. He pleaded guilty in court in May.

According to court documents, between March 2019 and May 2019, O’Connor and others engaged in a SIM swapping attack resulting in the theft of $794,000 worth of cryptocurrency from a Manhattan-based cryptocurrency company.

As part of the attack, the perpetrators took over the phone numbers of three executives at the victim company to gain access to accounts and computers and steal cryptocurrency from wallets maintained on behalf of two clients.

O’Connor and his co-conspirators attempted to launder the stolen funds through dozens of transactions. Some of the crypto-coins were deposited in wallets controlled by O’Connor.

In July 2020, O’Connor participated in a scheme targeting multiple Twitter accounts, after gaining unauthorized access to internal tools used by the social media platform.

Using these administrative tools, the perpetrators took over multiple high-profile accounts, such as those of Jeff Bezos, Joe Biden, Mike Bloomberg, Bill Gates, and Elon Musk. The attackers targeted roughly 130 accounts.

Advertisement. Scroll to continue reading.

According to court documents, O’Connor used SIM swapping to access without authorization two accounts on TikTok and Snapchat, threatening to release sensitive, personal materials about both victims.

In June and July 2020, O’Connor stalked and threatened a minor, orchestrating a series of swatting attacks on the victim. He made swatting calls and sent swatting messages to the police, a high school, a restaurant, and a sheriff’s department in the victim’s area.

O’Connor pled guilty to conspiracy to commit computer intrusions, wire fraud, and money laundering, computer intrusion, extortion, stalking, and making threats.

He was also sentenced to three years of supervised release and ordered to pay $794,000 in forfeiture.

https://www.securityweek.com/british-twitter-hacker-sentenced-to-prison-in-us/

In Other News: Microsoft Win32 App Isolation,Tsunami Hits Linux Servers, ChatGPT Credentials Exposed on Dark Web

SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar.

We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports.

Here are this week’s stories:

Oracle EU Sovereign Cloud

Oracle has launched a new EU Sovereign Cloud offering designed to help organizations across the European Union gain more control over data privacy and sovereignty requirements. Oracle EU Sovereign Cloud is located and operated entirely within the European Union and aligned with EU standards of practice.

NineID seed funding

Advertisement. Scroll to continue reading.

Belgian access management start-up NineID raised $2.6 million in seed funding to build a secure bridge between the digital and physical worlds of corporate security. After raising $1.4 million in 2022 and launching its product, the company announced raising another $1.2 million, closing its $2.6 million seed round.

Microsoft launches public preview of Win32 app isolation

Microsoft has launched a public preview of Win32 app isolation, created to “encapsulate and restrict” the execution of processes. Built on the foundation of AppContainers, Win32 app isolation is a new security feature designed to be the default isolation standard on Windows clients and will bring added security features to help defend against attacks that leverage vulnerabilities in applications.

Zyxel patches critical vulnerability in NAS devices

Zyxel released patches for a critical-severity pre-authentication command injection vulnerability (CVE-2023-27992) impacting some NAS models, warning that unauthenticated attackers could exploit the bug via HTTP requests to execute operating system (OS) commands remotely.

Tsunami botnet hits Linux SSH servers

AhnLab Security Emergency Response Center (ASEC) discovered an attack campaign that consists of the Tsunami DDoS bot being installed on “inadequately managed” Linux SSH servers. According to AhnLab, hackers managed to install the Tsunami bot malware, along with various other malware such as ShellBot, XMRig CoinMiner, and Log Cleaner.

DDoS botnets target IoT vulnerabilities

Palo Alto Networks warned of a new malware campaign exploiting dozens of vulnerabilities in routers, CCTV cameras, and other IoT devices to gain control over them and infect them with a variant of the Mirai botnet, capable of launching DDoS attacks.

Fortinet has observed attacks targeting a recent vulnerability in TP-Link Archer AX21 (AX1800) routers (CVE-2023-1389) to infect them with the Condi DDoS bot.

U.S. Tracked Huawei, ZTE Workers at Suspected Chinese Spy Sites in Cuba

U.S. officials reportedly tracked workers from Chinese telecom companies Huawei Technologies and ZTE entering and exiting suspected Chinese spy facilities in Cuba, the WSJ reports.

UPS users targeted in Smishing attacks

UPS is notifying individuals in Canada of an ongoing SMS phishing (Smishing) campaign designed to steal their personal information, including names and addresses.

“We are constantly vigilant when it comes to phishing and other attempts from bad actors. UPS is aware of reports relating to an SMS phishing (“Smishing”) scheme focused on certain shippers and some of their customers in Canada. UPS has been working with partners in the delivery chain to understand how that fraud was being perpetrated, as well as with law enforcement and third-party experts to identify the cause of this scheme and to put a stop to it,” UPS told SecurityWeek.

Mondelez employees exposed in law firm hack

Personal information of more than 51,000 current and former workers at snack food giant Mondelez International was exposed in a data breach at law firm Bryan Cave Leighton Paisner LLC, Mondelez said. The breach occurred in February 2023 and was discovered on May 22, 2023.

Over 100,000 ChatGPT credentials on the dark web

Singapore-based cybersecurity firm Group-IB has discovered over 100,000 ChatGPT credentials in the logs of information stealers traded on the dark web. Between June 2022 and May 2023, Asia-Pacific had the largest number of stolen ChatGPT accounts.

GitHub repositories vulnerable to RepoJacking

Aqua Security says that millions of GitHub repositories might be vulnerable to RepoJacking, potentially exposing organizations to remote code execution attacks. RepoJacking occurs when a user or organization changes their name, resulting in GitHub creating new repository links and automatically redirecting projects to the new repository. However, the old username/organization name becomes available and the attacker can register it and create a malicious repository that breaks the redirection.

https://www.securityweek.com/in-other-news-microsoft-win32-app-isolationtsunami-hits-linux-servers-chatgpt-credentials-exposed-on-dark-web/

Norton Parent Says Employee Data Stolen in MOVEit Ransomware Attack

Gen Digital (NASDAQ: GEN), the company behind known cybersecurity brands such as Avast, Avira, AVG, Norton, and LifeLock, has confirmed that employee’s personal information was compromised in the recent MOVEit ransomware attack.

The attack exploited a zero-day vulnerability in the MOVEit Transfer managed file transfer (MFT) software that Progress Software disclosed on May 31.

Mass exploitation of the bug, which is tracked as CVE-2023-34362 and described as a critical-severity SQL injection, started in late May, but evidence suggests that the attackers knew about the flaw or tested it since 2021.

An exploitation campaign targeting the zero-day has been attributed to the Cl0p ransomware gang, which been publicly naming some of the victims. More than 100 organizations have been impacted by attacks targeting the zero-day.

Cl0p, which previously exploited a zero-day in the GoAnywhere MFT software to steal data from numerous organizations, has added Norton LifeLock to its leak site, cybersecurity analyst and security researcher Dominic Alvieri warned on Monday.

Responding to a SecurityWeek inquiry, Gen confirmed impact from the ransomware attack, revealing the attackers compromised the personal information of employees, including names, addresses, birth dates, and business email addresses.

“We use MOVEit for file transfers and have remediated all of the known vulnerabilities in the system. When we learned of this matter, we acted immediately to protect our environment and investigate the potential impact. We have confirmed that there was no impact to our core IT systems and our services and that no customer or partner data has been exposed. Unfortunately, some personal information of Gen employees and contingent workers was impacted which included information like name, company email address, employee ID number, and in some limited cases home address and date of birth. We immediately investigated the scope of the issue and have notified the relevant data protection regulators and our employees whose data may have been impacted.”

Advertisement. Scroll to continue reading.

Hot on the heels of the MOVEit zero-day disclosure, two more critical-severity SQL injection bugs were identified in the MFT software, namely CVE-2023-35036 and CVE-2023-35708.

While neither of them has been exploited in attacks to date, Progress Software has urged customers to apply patches for them as soon as possible, to prevent unauthorized access to the MOVEit Transfer environment.

Known victims of the MOVEit zero-day attacks include the U.S. Department of Energy, Louisiana’s Office of Motor Vehicles, Oregon’s Department of Transportation, the Nova Scotia government, British Airways, the British Broadcasting Company, Aer Lingus, U.K. drugstore chain Boots, University of Rochester, the Illinois Department of Innovation & Technology (DoIT), and the Minnesota Department of Education (MDE).

https://www.securityweek.com/norton-parent-says-employee-data-stolen-in-moveit-ransomware-attack/

Australian Government Says Its Data Was Stolen in Law Firm Ransomware Attack

The Office of the Australian Information Commissioner (OAIC) says some of its files were stolen in a ransomware attack on law firm HWL Ebsworth.

One of the largest law firms in Australia, HWL Ebsworth says in an incident notice on its website that it became aware of the incident on April 28, after the Alphv/BlackCat ransomware gang boasted about the hack, and that it immediately informed the Australian authorities and started investigating the incident.

“The investigation indicates the threat actor had accessed and exfiltrated certain information on a confined part of the firm’s system, but not on our core document management system,” the law firm explains.

On June 9, HWL Ebsworth says, the ransomware group published on their leak site some of the data allegedly stolen from its systems, suggesting that the firm did not cave in to the gang’s ransom demands.

The law firm says it has yet to determine the full impact of the data breach and that it will notify all individuals whose personal information might have been compromised.

A full-service commercial law firm and the largest partnership among Australian law firms, HWL Ebsworth serves organizations across multiple sectors, including dozens of federal or state government departments.

OAIC, the Australian privacy and freedom watchdog, is one of HWL Ebsworth’s clients to have disclosed impact from the data breach.

Advertisement. Scroll to continue reading.

“On Saturday 10 June, HWL Ebsworth advised the OAIC that a document or documents relating to a limited number of OAIC files were included in the breach experienced by HWL Ebsworth,” OAIC said in a statement.

The incident reportedly impacted the NDIS Quality and Safeguards Commission, the Australian Federal Police, the Commonwealth Director of Public Prosecutions, the Department of Defence, the Department of Home Affairs, the Department of Foreign Affairs, and the Taxation Office as well.

The National Australian Bank (NAB), one of the four largest banks in the country, also disclosed some impact from the incident, stating that a small percentage of its customers might have been affected.

“We are aware that HWL Ebsworth, a law firm engaged by NAB for some legal services, has been impacted by a cyber-attack. NAB’s systems were not impacted and remain secure. We are working with HWLE as they continue to get more information in relation to the content of these matters,” NAB said.

The Alphv/BlackCat ransomware gang has leaked roughly 1.5 terabytes of data from the roughly 3.6 terabytes it allegedly stole from HWL Ebsworth. Last week, the law firm was granted an injunction restricting everyone, including the media, from discussing what information was stolen.

https://www.securityweek.com/australian-government-says-its-data-was-stolen-in-law-firm-ransomware-attack/

New Information Stealer ‘Mystic Stealer’ Rising to Fame

A new information stealer malware is quickly becoming popular among hackers on prominent underground forums, according to a warning from cybersecurity company Cyfirma.

Dubbed Mystic Stealer, the malware was first spotted in April 2023 when it was made available to seasoned cybercriminals for testing purposes.

Cyfirma’s researchers tracking the evolution of the malware discovered that the developer updated the information stealer based on feedback, leading to a surge in prevalence, with more than 50 active command-and-control (C&C) servers identified to date.

Written in C and targeting Windows, Mystic Stealer leverages code manipulation and operates in memory to evade detection. The malware uses system calls to compromise targets and to avoid leaving evidence of infection behind.

The malware does not use third-party libraries, contains a self-written browser database parser, and was designed to search for data of interest before compression, encryption and exfiltration.

Mystic Stealer’s developer also provides cybercriminals with a builder to deploy on their own server in order to customize the malware for attacks. A C&C panel provides Mystic Stealer users with control over the malware and the data gathering process.

According to Cyfirma, the malware is capable of hijacking passwords, cookies, credit cards, and other information from browsers and cryptocurrency wallet extensions, Outlook passwords, and files, and can take screenshots and gather system information.

Advertisement. Scroll to continue reading.

A sophisticated malware evolving based on recommendations received from well-known cybercriminals, Mystic Stealer has the potential of becoming a major threat to companies handling personally identifiable information (PII) and financial records, including healthcare, finance, and technology firms.

“Along with that, Mystic Stealer specifically targets individuals involved in cryptocurrency transactions. This includes users of cryptocurrency wallets, traders, and those engaged in mining activities. The malware aims to steal cryptocurrency wallets, private keys, or login credentials to gain unauthorized access to these assets,” Cyfirma notes.

https://www.securityweek.com/new-information-stealer-mystic-stealer-rising-to-fame/

Ransomware Gang Takes Credit for February Reddit Hack

The Alphv/BlackCat ransomware gang has taken credit for the February 2023 cyberattack against social media site Reddit, claiming to have stolen 80 gigabytes of data.

Reddit disclosed the breach shortly after being hacked earlier this year and described the incident as the result of a sophisticated and highly targeted phishing attack in which an employee’s credentials and second-factor authentication tokens were stolen.

The attackers accessed internal documents, internal dashboards, business systems, source code, the information of hundreds of contacts and current and former employees, and advertiser data, Reddit said at the time, noting that it had no evidence that the attackers compromised production systems, user passwords or accounts.

Over the weekend, the Alphv/BlackCat ransomware gang listed Reddit on its leak site and claimed to have stolen 80GB of data. No file-encrypting ransomware appears to have been deployed on Reddit’s systems.

The attackers demand a $4.5 million ransom to be paid in exchange for deleting the stolen data and that Reddit drops the API pricing changes set to go into effect this week.

In May, the Alphv/BlackCat ransomware group claimed responsibility for cyberattacks on Canadian software company Constellation Software and on Western Digital.

Operating under the Ransomware-as-a-Service (RaaS) model, Alphv/BlackCat emerged in November 2021 as the first ransomware written in the Rust programming language. Believed to be linked to the Darkside/Blackmatter ransomware gang, Alphv/BlackCat had compromised more than 100 organizations by July 2022.

Advertisement. Scroll to continue reading.

In addition to deploying file-encrypting ransomware, the group is known for engaging in additional extortion tactics, including stealing victim data and threatening to make it public, launching distributed denial-of-service (DDoS) attacks, and harassing victim’s partners, employees, and customers.

https://www.securityweek.com/ransomware-gang-takes-credit-for-february-reddit-hack/

ACN, in Italia nel 2022 record di incidenti cyber (1094 in totale e 160 nei confronti della PA). Il ransomware tra le minacce più impattanti. Scarica la relazione annuale

Nel 2022 1094 incidenti cyber trattati dall’Agenzia per la Cybersicurezza Nazionale (ACN), che hanno visto coinvolte aziende private e Pubbliche amministrazioni. Il ransomware si è confermato tra le minacce più impattanti. L’Agenzia, nel corso del 2022, ha osservato 130 eventi ransomware in danno a Pubbliche Amministrazioni e operatori privati.

Sono solo alcuni dei numeri che si possono leggere nella relazione annuale dell’Agenzia per la cybersicurezza nazionale, ACN. La relazione, prevista dalla legge istitutiva e appena comunicata alle Camere, rilasciata oggi, fornisce una panoramica sulle attività, i dati e le progettualità dell’ACN per il periodo che va dal 1° gennaio al 31 dicembre 2022.

Nell’82% degli attacchi ha coinvolto il settore privato, a fronte di un rimanente 18% di vittime appartenenti alla Pubblica Amministrazione, spiega la relazione. Il dato rappresenta, tuttavia, solo una parte del numero complessivo di attacchi ransomware effettivamente avvenuti, poiché in taluni casi le vittime – specie se appartenenti al tessuto produttivo delle Piccole Medie Imprese, spesso sprovviste di know-how e strutture interne dedicate – sono inclini a non segnalare l’evento, gestendolo in autonomia.

Il settore manifatturiero il settore più colpito, seguito da quello tecnologico, dal retail e dal settore sanitario.

Il Lazio una delle regioni più colpite

Da un punto di vista geografico, le zone più interessate dal fenomeno corrispondono alle grandi aree metropolitane di Roma, Milano, Torino e ai distretti manifatturieri del Nord Ovest e Nord Est
(Figura 16). Tale contesto è presumibilmente determinato dalla maggiore presenza, in tali zone, di imprese operanti nel settore manifatturiero.

Anche il sito web istituzionale dell’Agenzia, all’indomani dell’attacco russo all’Ucraina, ha subito un attacco di tipo DDoS di considerevole entità, che è stato, però, totalmente mitigato dai sistemi di sicurezza preposti. Nel 2022, gli eventi significativi di tipo DDoS trattati dal CSIRT Italia in danno di soggetti italiani sono stati 44, distribuiti nel tempo come rappresentato in Figura 18.

Il 2022 un anno complesso per l’ACN

Un anno complesso che ha visto la maturazione dell’Agenzia, nata per decreto nella seconda metà del 2021, e che la necessità di mettere il Paese in sicurezza ha portato ad operare mentre si strutturava al suo interno, fino a dare alla luce la Strategia nazionale di cybersicurezza 2022-2026 e il relativo Piano di implementazione. Un importante documento di indirizzo fatto di 82 misure, volto a sostenere il potenziamento cyber del sistema Paese per far fronte alle sfide del mondo digitale rispetto ai tre obiettivi fondamentali di protezione, risposta e sviluppo digitale del Paese.

Principali criticità riscontrate

Tra i compiti attribuiti all’ACN figura l’intervento diretto in caso di incidente, per i fini di resilienza, di cui l’Agenzia è responsabile, che può avvenire anche in forma di supporto alle vittime di incidenti e attacchi cyber. Esso viene garantito dalle articolazioni tecnico-operative dell’Agenzia e consiste principalmente nell’individuazione e nell’implementazione delle azioni da attuare nell’immediato per il contenimento dell’incidente, nonché di quelle volte al ripristino di una efficiente erogazione dei servizi. Nei casi più complessi il supporto può avvenire tramite l’intervento in loco di un team di specialisti DDFIR (Deployable Digital Forensic Incident Response), in raccordo con la Polizia postale e delle comunicazioni, che nel corso del 2022 è intervenuto in 10 diversi incidenti – tutti avvenuti sul territorio nazionale.

Le analisi e le interazioni avute con i soggetti colpiti hanno consentito di identificare le principali
criticità che hanno determinato tali incidenti, ovvero:

errate politiche di sicurezza e gestione delle credenziali di accesso, più in particolare:
presenza di credenziali pubblicamente esposte, talvolta oggetto di precedenti data breach o dovuta alla presenza di infrastrutture già compromesse in precedenza da altri attaccanti e per le quali non sono state effettuate attività di mitigazione;
l’assenza di utilizzo di meccanismi di autenticazione forte (ad esempio, multifattore) per l’accesso ai servizi;

“È stato un anno intenso e ricco di sfide. Continueremo il lavoro avviato nel solco tracciato dalla Strategia Nazionale di Cybersicurezza – ha dichiarato il prefetto Bruno Frattasi, Direttore Generale dell’Agenzia – per mettere in pista attività e progetti innovativi allo scopo di rendere il paese più forte e sicuro dal punto di vista cibernetico. Nuove unità di personale si aggiungeranno presto all’organico dei 180 attualmente in Agenzia, e arrivare a 300 persone entro la fine dell’anno. A breve pubblicheremo la road map del piano di Ricerca e Innovazione realizzato in collaborazione con il Ministero dell’Università e della Ricerca e ci apprestiamo a licenziare nuovi bandi finalizzati all’impiego delle risorse del Pnrr avendo già raggiunto tutte le tappe previste dal cronoprogramma”.

Per approfondire

https://www.key4biz.it/acn-in-italia-nel-2022-trattati-1094-incidenti-cyber-160-nei-confronti-della-pa-il-ransomware-tra-le-minacce-piu-impattanti-scarica-la-relazione-annuale/450336/