Cybersecurity M&A Roundup: 36 Deals Announced in May 2021

Cybersecurity M&A roundup for May 2021

Tens of cybersecurity mergers and acquisitions were announced in May 2021, including by Imperva, Accenture, Cisco, HelpSystems, Splunk, Twilio, and Zscaler.

May 1-9

Acuant acquires Hello Soda

Identity verification and fraud prevention company Acuant acquired UK-based identity verification and KYC solutions provider Hello Soda. Acuant said the acquisition will help it improve its products and strengthen its position in the digital identity market.

Aryaka acquires Secucloud

WAN and SASE solutions provider Aryaka announced that it completed the acquisition of Secucloud, a Germany-based company that has developed a SASE platform. Aryaka said it will be able to provide better managed SD-WAN and SASE solutions for enterprise customers as a result of the deal.

Ascend Technologies acquires Switchfast Technologies

IT solutions provider Ascend Technologies announced buying Switchfast Technologies, which specializes in customized IT services. Both companies provide — among several others — cybersecurity services, and Ascend said the deal will enable it to offer a brader portfolio of services and solutions, including network monitoring and cybersecurity assessments.

Databarracks acquires 4sl

Business continuity and disaster recovery solutions provider Databarracks purchased 4sl, which specializes in managed data recovery and backup services for companies in regulated sectors. Both companies are based in the UK.

EPAM Systems acquires White-Hat

US-based enterprise software development company EPAM Systems acquired Israel-based cybersecurity services firm White-Hat. EPAM said the goal of the acquisition is to expand its cybersecurity expertise portfolio and diversify EMEA delivery capabilities.

Forcepoint acquires Cyberinc

Behavior-based cybersecurity solutions provider Forcepoint acquired Cyberinc, a company that specializes in remote browser isolation technology designed to help organizations reduce risks and attack surface. Forcepoint will use the acquired technology to improve its SASE platform.

Gimmal acquires Sherpa Software

Information governance solutions provider Gimmal has acquired Sherpa Software, which specializes in data governance and eDiscovery solutions for enterprises. Sherpa has merged into Gimmal and its technology will help the company expand its eDiscovery and data governance capabilities.

Intermediate Capital Group (ICG) acquires minority stake in 6point6

UK-based global alternative asset manager ICG acquired a minority stake in 6point6, a UK-based provider of cybersecurity and other IT services. Terms of the deal have not been made public, but the deal values 6point6 at $100 million.

Imperva acquires CloudVector

Cybersecurity firm Imperva acquired API security company CloudVector. Imperva said the acquisition will enable it to improve its API security solutions.

Infobip acquires Anam Technologies

Croatia-based IT and telecoms company Infobip acquired Irelend-based Anam Technologies, which is known for its SMS firewall service. Infobip wants to provide a “high level of security and protection of messages to mobile operators.”

Kordia acquires Base2

State-owned communications and cybersecurity firm Kordia has acquired Base2, which provides managed IT, network, and cybersecurity solutions. Both companies are based in New Zealand. Base2 will operate as an independent business unit of Kordia.

LiveAction acquires CounterFlow AI

Network performance management firm LiveAction acquired CounterFlow AI, which provides network detection and response solutions. LiveAction said the deal will enable it to provide “a unified network performance monitoring and diagnostics (NPMD) platform that incorporates encrypted traffic analysis for security incident detection and response.”

OneTrust acquires Shared Assessments

Security and compliance solutions provider OneTrust acquired third-party risk management company Shared Assessments. The goal is to enable Shared Assessment to further scale the availability and adoption of the Standardized Information Gathering Questionnaire (SIG), which is one of the most widely used third-party risk standards, used by over 15,000 companies. Shared Assessments will remain a vendor-neutral industry organization.

RIA in a Box acquires ITEGRIA

Compliance, cybersecurity, and operational software solutions provider RIA in a Box acquired ITEGRIA, which offers cloud-based virtual desktop solutions for registered investment advisors (RIAs). RIA in a Box said the deal will help it enhance its cybersecurity and operational offerings for RIA firms.

Sectigo acquires SiteLock

Digital certificate management and web security firm Sectigo bought SiteLock, a website security and monitoring provider. The acquisition also includes Patchman, a Dutch web security provider that SiteLock acquired in 2017. Following the acquisition, SiteLock will operate as a separate business unit within Sectigo.

SGS acquires Brightsight

Swiss inspection, verification, testing and certification company SGS acquired Brightsight, a Dutch cybersecurity evaluation laboratory network for chip-based payment systems, identity solutions and IoT platforms. SGS said the deal is part of its strategy to “become the global TIC leader in cybersecurity.”

May 10-16

Absolute Software acquires NetMotion

Endpoint security and data risk management company Absolute Software announced an agreement to acquire NetMotion, a company that specializes in secure access solutions, for $340 million in cash. The acquisition will help Absolute expand its product offering and sales channels.

Accenture acquires Linkbynet

Consulting giant Accenture announced buying Linkbynet, a France-based cloud services provider that offers cloud optimization, transformation and security services. Accenture says the deal will help it enhance the capabilities of its Cloud First solutions.

Centricus Acquisition Corp. merges with Arqit Limited

Quantum encryption technology firm Arqit Limited is merging with Centricus Acquisition Corp., a publicly-traded special purpose acquisition company. Arqit has developed encryption technology that should secure communications against any type of attack, including attacks that involve a quantum computer. As a result of the transaction, Arqit will become a publicly listed company.

Cisco acquires Kenna Security

Networking giant Cisco is purchasing Kenna Security, a cybersecurity company focused on vulnerability management technology. Cisco said Kenna’s technology, which integrates with all major vulnerability assessment platforms, will be integrated into its SecureX platform.

CWSI acquires AVR International

Ireland-based mobile and cloud security firm CWSI is acquiring AVR International, a UK-based provider of cyber and cloud security services, in a deal that values AVR at up to €5.2 million ($6.3 million). CWSI said the acquisition will help accelerate its UK growth.

HelpSystems acquires Agari and Beyond Security

Cybersecurity and automation solutions provider HelpSystems announced two acquisitions in May: email security company Agari and vulnerability assessment and compliance solutions firm Beyond Security. The goal is to enhance HelpSystems’ data security and infrastructure protection portfolios.

Fidelis Cybersecurity acquires CloudPassage

Extended detection and response (XDR) provider Fidelis Cybersecurity announced the acquisition of cloud security and compliance company CloudPassage in an effort to enhance its active XDR platform.

Jamf acquires Wandera

Jamf, a provider of enterprise management solutions for Apple devices, has acquired Wandera, which specializes in zero trust cloud security and access for mobile devices, for $400 million in cash. Jamf said the acquisition will help it extend its mobile security and access capabilities.

NCC Group acquires IPM business of Iron Mountain

UK-based cybersecurity firm NCC Group is acquiring the intellectual property management (IPM) business of US-based storage and information management services firm Iron Mountain for $220 million. Iron Mountain said it decided to sell its IPM business to “focus on its core strengths.”

secunet acquires stashcat

Cybersecurity solutions provider secunet Security Networks is acquiring stashcat, an enterprise communications application that includes file storage and video conferencing functionality. Both companies are based in Germany. Secunet said the acquisition enables it to expand its offering.

May 17-31

Belcan acquires VICTOR42

Belcan, an AE Industrial Partners-owned company that provides engineering, consulting and technical services for the aerospace, defense, automotive, government and industrial sectors, announced the acquisition of VICTOR42, a firm that provides technology, intelligence and cybersecurity solutions for government and private sector organizations. Belcan says the deal will help it expand its offerings.

Crossword Cybersecurity acquires Verifiable Credentials Limited

Cybersecurity and risk management firm Crossword Cybersecurity announced buying Verifiable Credentials Limited (VCL), which has developed middleware technology for verifiable credentials systems. Both companies are based in the UK. Crossword has acquired VCL in an effort to expand and will pay £2.75 million ($3.9 million) for the company.

Gryphon Investors acquires Iceberg Networks

Private equity firm Gryphon Investors announced acquiring three companies in May, including Iceberg Networks, which provides security operations management and governance, risk and compliance, and integrated risk management solutions.

Intuity Technologies merges with myITdepartment

Managed IT services provider Intuity Technologies announced a merger with managed services provider myITdepartment. The companies, both based in Ireland, will offer a wide range of services, including cybersecurity, to small and medium enterprises.

Nuvias Group acquires Cloud Distribution

Nuvias Group, a provider of security, agility and manageability services, is purchasing Cloud Distribution, which provides cybersecurity, networking and SaaS solutions. Both companies are based in the UK. The acquisition is part of Nuvias Group’s expansion strategy.

Relativity acquires Text IQ

Legal and compliance technology firm Relativity is buying Text IQ, which uses AI to manage and mitigate risks in enterprise data. Relativity says the deal enables it to expand its product offerings.

Twilio acquires Ionic Security

Customer engagement solutions provider Twilio is acquiring data security platform Ionic Security. Twilion said the acquisition helps it address security and compliance challenges. Ionic’s technology will be integrated into Twilio products and will no longer be offered as a standalone platform.

Splunk acquires TruSTAR

Machine data solutions firm Splunk is acquiring TruSTAR, a company that provides a threat intelligence platform. Splunk says the acquisition will help extend its security analytics capabilities.

Zscaler acquires Smokescreen

Cloud security company Zscaler is buying active defense and deception technology firm Smokescreen. The goal is to use Smokescreen technology to enhance Zscaler’s Zero Trust Exchange product and provide threat intelligence and telemetry for the Zscaler team.

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/KS7bypIvhgU/cybersecurity-ma-roundup-36-deals-announced-may-2021

Meat-packing Giant JBS USA Shuts Down Systems Following Cyberattack

JBS USA, the US subsidiary of the world’s largest meat processing company, said Monday that some operations were shut down following a cyberattack that affected its North American and Australian IT network.

Headquartered in Greeley, Colorado, JBS USA (JBS Foods) is a global food company wholly owned by Brazil-based JBS S.A., the largest meat processing firm in the world. In addition to the United States, JBS has operations in Australia, Canada, Mexico, New Zealand, and Europe.

In a statement, the company announced that an “organized cybersecurity attack” identified on Sunday impacted servers used in support of its North American and Australian IT systems.

The cyberattack does threaten the food supply chain and could lead to shorateds and price increases.

“The company took immediate action, suspending all affected systems, notifying authorities and activating the company’s global network of IT professionals and third-party experts to resolve the situation,” JBS USA said.

[ Also Read: Cybersecurity Threats to the Food Supply Chain ]

AFP reported that the company’s Australian facilities have been “paralysed by the attack,” with up to 10,000 meat workers being sent home without pay.

The company claimed that its backup servers were not impacted by the incident and that it has already started the recovery operations, to have systems back online as soon as possible.

JBS USA also notes that it hasn’t found evidence that customer, employee, or supplier data might have been compromised or misused during the attack, but warns of possible delays in transactions.

“Resolution of the incident will take time, which may delay certain transactions with customers and suppliers,” the company said.

JBS has not shared any technical details regarding the incident, but it may be a ransomware attack.

SecurityWeek has contacted JBS for clarifications on the incident, but hasn’t received a reply yet.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/E9_eyDv9V1w/meat-packing-giant-jbs-usa-shuts-down-systems-following-cyberattack

Microsoft Creates Cybersecurity Council for the Public Sector in APAC

Looking to build stronger responses against cyberattacks in the Asia Pacific (APAC) region, Microsoft on Monday announced the creation of a cybersecurity council for the public sector in the region.

The Asia Pacific Public Sector Cybersecurity Executive Council consists of policy makers and influencers from Brunei, Indonesia, Korea, Malaysia, Philippines, Singapore, and Thailand. It seeks seeks to accelerate collaboration between public and private cybersecurity organizations.

Policy makers from government and state agencies and cybersecurity experts from the public sector that form the council will work together to ensure improved communication and to promote the sharing of threat intelligence and technology, in an effort to battle evolving cyber threats in the region.

[ MORE AT: SecurityWeek’s 2021 Singapore ICS Cyber Security Virtual Conference ]

According to Microsoft, the initiative builds on the need for governments to build cyber-defense strategies and keep the region protected from attacks through strong collaboration with tech companies, given that private organizations own most of the necessary technology infrastructure.

“Cyberthreats and attacks are inevitable in this interconnected world, which is why our collective strength and collaboration as a community is imperative. [This is] the first step towards defending our communities in cyberspace with the founding members that include government leaders, policymakers, regulators, industry stakeholders across the region,” said Sherie Ng, General Manager, Public Sector, Microsoft Asia Pacific.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/Qyw6ZrNda8c/microsoft-creates-cybersecurity-council-public-sector-apac

Interpol Says 585 People Arrested in APAC Operation Against Cyber-Enabled Crime

Interpol revealed last week that specialized law enforcement officers in the Asia-Pacific (APAC) region intercepted more than $83 million in fraudulent money transfers as part of a six-month coordinated effort aimed at cyber-enabled financial crime.

Codenamed HAECHI-I, the operation mainly targeted five types of online financial crime: investment fraud, money laundering (from illegal online gaming), online sextortion, romance scams, and voice phishing (vishing).

The operation resulted in over 1,600 bank accounts worldwide being frozen as part of roughly 1,400 investigations opened between September 2020 and March 2021, with a total of 892 cases being solved.

As part of the effort, authorities arrested a total of 585 individuals, Interpol says.

In one case, a Korean company was targeted in a scheme where the attackers impersonated a trading partner to demand payment for a series of fraudulent invoices. The company ended up transferring roughly $7 million to the fraudsters, but authorities managed to freeze half of the stolen funds.

One ‘ramp and dump’ scheme, a type of investment fraud, involved a criminal syndicate purchasing a large quantity of specific stocks to cause a price increase, an upward trend then advertised on social media, followed by the fraudsters selling all of their stocks at a high price.

According to Interpol, a swift reaction from law enforcement resulted in the problematic trading accounts being frozen and most of the victims’ funds being recovered.

Operation HAECHI-I, the first effort of a three-year project aimed at combating cyber-enabled financial crime in Korea, saw participation from authorities in Cambodia, China, Indonesia, Korea, Laos, the Philippines, Singapore, Thailand, and Vietnam.

Although focused on the APAC region, the investigations conducted as part of this operation ended up becoming international.

Related: The Anti-Fraud Lifecycle

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/ikD9QRpv5fQ/interpol-says-585-people-arrested-apac-operation-against-cyber-enabled-crime

Kenyan Arrested in Qatar First Targeted by Phishing Attack

A Kenyan security guard now facing charges in Qatar after writing compelling, anonymous accounts of being a low-paid worker there found himself targeted by a phishing attack that could have revealed his location just before his arrest, analysts say.

While analysts from Amnesty International and Citizen Lab said they were unable to say who targeted Malcolm Bidali, the phishing attack mirrored others previously carried out by Gulf Arab sheikhdoms targeting dissidents and political opposition. It also would require access to confidential information stored by telecommunication companies typically only released to government or security force officials to be able to be useful as well.

Ooredoo and Vodafone Qatar, the two major internet providers in Qatar, did not respond to requests for comment. Qatar as well did not respond to questions about the phishing attack targeting Bidali.

The weekslong detention of Bidali, 28, in an undisclosed location comes ahead of Qatar hosting the 2022 FIFA World Cup and has again raised questions about freedom of expression in this small, energy-rich nation before the tournament.

“There is no evidence that he is being detained for anything other than his legitimate human rights work — for exercising his freedom of expression, and for shining a spotlight on Qatar’s treatment of migrant workers,” multiple human rights organizations campaigning for Bidali’s release recently wrote.

Bidali worked 12-hour days as a security guard. In his spare time, he wrote anonymously under the pen name “Noah” about his experiences as a guard, including trying to improve his worker accommodations and the challenges of life.

The reason for Bidali’s detention by security forces beginning late May 4 remains unclear. About a week earlier on April 26, he spoke and briefly appeared in a videoconference with civil society and trade union groups describing his experiences.

Just hours after that videoconference ended, a Twitter user sent Bidali a link he later clicked on that appeared to initially be a video from Human Rights Watch. But instead, it sent him to a decoy, look-alike YouTube page that “might have allowed the attackers to obtain his IP address, which could have been used to identify and locate him,” Amnesty said. An IP address is a numeric designation that identifies its location on the internet.

“In like 10 minutes, almost any techie can set a website to capture the IP address of someone who clicks,” said Bill Marczak, a senior researcher at Citizen Lab who also came to the same conclusion as Amnesty. “The hard part is converting the IP address into a real name and address.”

That typically requires access to private information kept by internet service providers that typically only they or governments can access.

Twitter later suspended the account that targeted Bidali with the phishing attack. The San Francisco-based social media company did not respond to questions about the suspension.

Late on Saturday night, Qatar said in a statement that Bidali had been “formally charged with offenses related to payments received by a foreign agent for the creation and distribution of disinformation within the state of Qatar.” The statement did not elaborate or offer evidence to support the allegation.

If convicted under Article 120 of Qatar’s penal code, which uses similar language as the Qatari statement, Bidali could face up to 10 years in prison and a 15,000 Qatari riyal ($4,000) fine. Early last year, Qatar also amended its penal code to allow for prison sentences of up to five years and a fine of 100,000 Qatari riyals ($27,500) for anyone publishing “rumors or statements or false or malicious news or sensational propaganda,” according to Human Rights Watch.

Qatar is home to the state-funded Al Jazeera satellite news network. However, expression in the country remains tightly controlled.

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/Qu1tSYa2H7Q/kenyan-arrested-qatar-first-targeted-phishing-attack

SonicWall Patches Command Injection Flaw in Firewall Management Application

SonicWall last week announced the availability of patches for a severe vulnerability in its Network Security Manager (NSM) product.

NSM is a firewall management application that provides the ability to monitor and manage all network security services from a single interface, as well as to automate tasks to improve security operations. SonicWall’s platform is available both for on-premises deployments and as SaaS (Software-as-a-Service).

Tracked as CVE-2021-20026 and featuring a CVSS score of 8.8, the recently patched vulnerability impacts on-premises versions of SonicWall NSM, but does not affect NSM SaaS versions.

The issue, SonicWall reveals in a security advisory, is an OS command injection flaw that could be exploited by an attacker who has already been able to authenticate to a vulnerable system. The fact that authentication is required for exploitation lowers the severity of the flaw.

An authenticated attacker can send specially crafted HTTP requests to the vulnerable application to exploit the vulnerability.

“This critical vulnerability potentially allows a user to execute commands on a device’s operating system with the highest system privileges (root),” SonicWall explains.

The vulnerability impacts SonicWall NSM On-Prem 2.2.0-R10 and earlier releases, and was addressed with the release of NSM versions 2.2.1-R6 and 2.2.1-R6 (Enhanced).

In its advisory, SonicWall is urging all customers to apply the available patches as soon as possible, to ensure they remain protected.

“SonicWall customers using the on-premises NSM versions outlined […] should upgrade to the respective patched version immediately,” the company says.

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/dJ3zZ7jj7HU/sonicwall-patches-command-injection-flaw-firewall-management-application

Cybercriminals Target Companies With New ‘Epsilon Red’ Ransomware

A new piece of ransomware named Epsilon Red has been used to target at least one organization in the United States, and its operators have apparently already made a significant profit.

Cybersecurity firm Sophos reported last week that Epsilon Red operators have been spotted targeting a US-based company in the hospitality sector. The cryptocurrency address provided by the cybercriminals shows a bitcoin transaction for an amount worth roughly $210,000, which seems to indicate that at least one victim has agreed to pay the ransom demanded by the cybercriminals.

Sophos researchers noticed that the ransom note dropped by Epsilon Red is similar to the one displayed by the REvil ransomware, but Epsilon Red’s ransom note is better written — it does not contain some of the grammar errors in the REvil note.

Epsilon Red ransomware

Victims are informed that their files have been encrypted and that their data has been stolen and will be leaked unless they pay the ransom. However, Sophos noted that the ransomware doesn’t contain a list of targeted file types and instead encrypts every file in a folder, which can lead to the entire system becoming inoperable.

Epsilon Red, developed in the Go language, has been described as “bare-bones ransomware.” The ransomware executable is small due to the fact that it’s only designed to scan the system for folders it can encrypt and perform the actual encryption. The remaining tasks are carried out by a dozen PowerShell scripts, which prepare the machine for the final encryption payload.

These PowerShell scripts are designed to modify firewall rules to allow the attackers’ remote connections, disable or kill processes that could prevent encryption, delete the Volume Shadow Copy to prevent recovery of encrypted files, delete Windows event logs, grant elevated permissions, uninstall security software, and obtain valuable data.

The attackers have also been spotted using Remote Utilities, a commercial solution that is available for free. Sophos researchers believe the attackers have used this tool to be able to maintain access to compromised systems in case their initial access point gets removed.

The initial access point in the attack spotted by Sophos was likely an unpatched Microsoft Exchange server. The attackers may have leveraged the vulnerabilities known as ProxyLogon, which have been exploited by many threat groups in the past months.

Sophos said it had not found any links to other cybercrime groups — except for the REvil ransom note similarities — and noted that the name Epsilon Red stems from an X-Men villain who has Russian origins.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/zRn-3bH8nYA/cybercriminals-target-companies-new-epsilon-red-ransomware

CISA-FBI Alert: 350 Organizations Targeted in Attack Abusing Email Marketing Service

An alert released on Friday by the FBI and the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) revealed that the number of organizations targeted in a recent attack abusing a legitimate email marketing service was higher than initially reported.

Microsoft reported last week that the Russia-linked threat actor it tracks as Nobelium, which is believed to be responsible for the SolarWinds supply chain attack, had been abusing a legitimate mass email service named Constant Contact to target government and other types of organizations in the United States and a dozen other countries.

The attacks, which appear to have started on May 25, involved Nobelium compromising the Constant Contact account of the United States Agency for International Development (USAID), which is responsible for civilian foreign aid and development assistance. Microsoft said spear-phishing emails apparently coming from USAID and set up to deliver malware were sent to roughly 3,000 accounts across more than 150 organizations.

However, according to the FBI and CISA, the attackers actually sent spear-phishing emails to over 7,000 accounts at 350 organizations, including government, non-governmental and intergovernmental organizations.

Incident response firm Volexity, which has also seen the phishing emails sent out via Constant Contact, found some links to APT29, a well-known cyberspy group tied to Russia. In their joint alert, CISA and the FBI acknowledge the reports linking the USAID-themed attack to APT29, but the agencies say they have yet to attribute the campaign to any threat actor.

In their alert, the two agencies don’t mention the link to the SolarWinds attack and they don’t name the government agency being impersonated. They did note that the spoofed emails contained a legitimate Constant Contact link that redirected users to a malicious URL set up to serve a malicious ISO file containing malware and a decoy PDF document.

USAID phishing email

Microsoft noted that it had not seen “evidence of any significant number of compromised organizations at this time” and the White House reported that U.S. government agencies had largely fended off the attack.

CISA and the FBI have shared indicators of compromise (IOCs) that organizations can use to detect attacks. They also published a separate report focusing on the malware used in the attack.

In a second new blog post on Nobelium attacks, Microsoft described four pieces of malware used by the threat actor in recent operations, specifically EnvyScout, BoomBox, NativeZone, and VaporRage.

Microsoft also mentioned in its blog posts that Nobelium has exploited an iOS zero-day in some of its attacks. The vulnerability in question, tracked as CVE-2021-1879, was patched in March by Apple, which credited Google’s Threat Analysis Group for reporting it. Apple warned at the time that the “issue may have been actively exploited,” but no other details were made public.

In its latest blog posts on Nobelium, Microsoft also only provided limited information on the use of CVE-2021-1879.

“In one of the more targeted waves, no ISO payload was delivered, but additional profiling of the target device was performed by an actor-controlled web server after a user clicked the link. If the device targeted was an Apple iOS device, the user was redirected to another server under NOBELIUM control, where the since-patched zero-day exploit for CVE-2021-1879 was served,” Microsoft said.

Previous Columns by Eduard Kovacs:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/3Mkwyh5Mtjo/cisa-fbi-alert-350-organizations-targeted-attack-abusing-email-marketing-service

Activists Launch Action Against ‘Cookie Banner Terror’

A group of online privacy activists said Monday it is taking action against hundreds of websites over their use of pop-up banners asking users to consent to “cookies”, the files that track users’ activity.

The Vienna-based NOYB group (an acronym of “none of your business”) said it would be presenting more than 500 draft complaints to companies over what it calls the “cookie banner terror” which has turned the internet into “a frustrating experience for users all over Europe”.

NOYB says many of the consent pop-ups which have become almost ubiquitous on the internet do not conform to EU laws, including the landmark General Data Protection Regulation (GDPR).

The group says the pop-ups in question do not give the user the simple “yes or no” to data collection that the law requires.

It says the banners are often designed in a way that make it “extremely complicated to click anything but the ‘accept’ button”.

The draft complaints are being lodged with companies in 33 countries, among them every European Economic Area (EEA) member state except Malta and Liechtenstein.

NOYB says it will file the complaints to regulatory authorities in a month’s time if the sites haven’t taken action to make the cookie banners comply with the requirements of privacy laws and rectify what NOYB calls their “unfair” and “frustrating” design.

The founders of NOYB include Austrian activists Max Schrems, who has notched up a series of legal victories over online privacy, including scuppering major EU-US data exchange arrangements.

“Frustrating people into clicking ‘okay’ is a clear violation of the GDPR’s principles,” Schrems said in a statement, adding: “Under the law, companies must facilitate users to express their choice and design systems fairly.”

NOYB says it has devised an automated system for identifying cookie banners that violate privacy regulations which could enable the group to file up to 10,000 complaints over the course of a year.

The group hopes that if its action is successful, “users should see simple and clear “yes or no” options” for data collection on more and more websites over the coming months.

Search giant Google has pledged to steer clear of tracking individual online activity when it begins implementing a new system for targeting ads without the use of cookies.

The company’s widely used Chrome browser recently began testing an alternative to the tracking practice that it believes could improve online privacy while still enabling advertisers to serve up relevant messages.

Previous Columns by AFP:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/lbf_ALEcxU0/activists-launch-action-against-cookie-banner-terror

US Says Agencies Largely Fended Off Latest Russian Hack

The White House says it believes U.S. government agencies largely fended off the latest cyberespionage onslaught blamed on Russian intelligence operatives, saying the spear-phishing campaign should not further damage relations with Moscow ahead of next month’s planned presidential summit.

Officials downplayed the cyber assault as “basic phishing” in which hackers used malware-laden emails to target the computer systems of U.S. and foreign government agencies, think tanks and humanitarian groups. Microsoft, which disclosed the effort late Thursday, said it believed most of the emails were blocked by automated systems that marked them as spam.

As of Friday afternoon, the company said it was “not seeing evidence of any significant number of compromised organizations at this time.”

Even so, the revelation of a new spy campaign so close to the June 16 summit between President Joe Biden and Russian counterpart Vladimir Putin adds to the urgency of White House efforts to confront the Kremlin over aggressive cyber activity that criminal indictments and diplomatic sanctions have done little to deter.

“I don’t think it’ll create a new point of tension because the point of tension is already so big,” said James Lewis, a senior vice president at the Center for Strategic and International Studies. “This clearly has to be on the summit agenda. The president has to lay down some markers” to make clear “that the days when you people could do whatever you want are over.”

The summit comes amid simmering tensions driven in part by election interference by Moscow and by a massive breach of U.S. government agencies and private corporations by Russian elite cyber spies who infected the software supply chain with malicious code. The U.S. responded with sanctions last month, prompting the Kremlin to warn of retribution.

Asked Friday whether the latest hacking effort would affect the Biden-Putin summit, principal deputy press secretary Karine Jean-Pierre said, “We’re going to move forward with that.”

The U.S., which has previously called out Russia or criminal groups based there for hacking operations, did not blame anyone for the latest incident. Microsoft attributed it to the group behind the SolarWinds campaign, in which at least nine federal agencies and dozens of private sector companies were breached through a contaminated software update.

In this case, hackers gained access to an email marketing account of the U.S. Agency for International Development, and masquerading as the government body, targeted about 3,000 email accounts at more than 150 different organizations. At least a quarter of them involved in international development, humanitarian and human rights work, Microsoft Vice President Tom Burt said in a blog post late Thursday.

The company did not say what portion of the attempts may have led to successful intrusions but said in a separate technical blog post that most were blocked by automated systems that marked them as spam. The White House said even if an email eluded those systems, a user would still have to click on the link to activate the malicious payload.

Burt said the campaign appeared to be a continuation of multiple efforts by the Russian hackers to “target government agencies involved in foreign policy as part of intelligence gathering efforts.” He said the targets spanned at least 24 countries.

Separately, the prominent cybersecurity firm FireEye said it has been tracking “multiple waves” of related spear-phishing by hackers from Russia’s SVR foreign intelligence agency since March — preceding the USAID campaign — that used a variety of lures including diplomatic notes and invitations from embassies.

The hackers gained access to USAID’s account at Constant Contact, an email marketing service, Microsoft said. The authentic-looking phishing emails dated May 25 purport to contain new information on 2020 election fraud claims and include a link to malware that allows the hackers to “achieve persistent access to compromised machines.”

Microsoft said the campaign is ongoing and built on escalating spear-phishing campaigns it first detected in January.

USAID spokeswoman Pooja Jhunjhunwala said Friday that it was investigating with the help of the Cybersecurity and Infrastructure Security Agency. Constant Contact spokeswoman Kristen Andrews called it an “isolated incident.”

While the SolarWinds campaign,was supremely stealthy and began as far back as 2019 before being detected in December by FireEye, this campaign is what cybersecurity researchers call noisy, meaning easy to detect.

And though “the spear phishing emails were quickly identified, we expect that any post-compromise actions by these actors would be highly skilled and stealthy,” FireEye’s VP of analysis, John Hultquist, said in a statement Friday. He said the incident “is a reminder that cyber espionage is here to stay.”

Many cybersecurity experts did not consider the operation an escalation of online Russian aggression.

“I think it’s par for the course,” said Jake Williams, president of Rendition Infosec and a former U.S. government hacker. He said it’s naive to think that U.S. cyber operators aren’t engaged in similar operations targeting adversaries.

Bobby Chesney, a University of Texas at Austin law professor specializing in national security, said it is nowhere near as serious as the SolarWinds hack. Nor does it come anywhere near the damage done by the ransomware attack earlier this month — by Russian-speaking criminals tolerated by the Kremlin — that temporarily knocked the Colonial Pipeline offline.

Chesney said he thought it was wrong to regard the USAID targeting as a Russian response to sanctions or a sign the sanctions were somehow feckless.

“I don’t think it proves anything, really,” Chesney said. “It’s no surprise at all that the SVR is still engaged in espionage in the cyber domain. I don’t think we tried to deter them out of doing this wholesale.”

Previous Columns by Associated Press:

Tags:

http://feedproxy.google.com/~r/securityweek/~3/8Fk7vo-HZuI/us-says-agencies-largely-fended-latest-russian-hack