Cyber Security Today, Wednesday April 13, 2022 – Updated malware attacks a Ukraine power company, the RaidForums darkweb site is seized, a new Hafnium attack and more patches issued

Share post:

Updated malware attacks a Ukraine power company, the RaidForums darkweb site is seized, a new Hafnium attack and more patches issued. Welcome to Cyber Security Today. It’s Wednesday April 13th, 2022. I’m Howard Solomon, contributing reporter on cybersecurity for  
Cyb er Security Today on Amazon Alexa Cyber Security Today on Google Podcasts Subscribe to Cyber Security Today on Apple Podcasts
What does it mean to have a successful security organization? There are three key elements that business leaders have identified. Download the eBook “Traits of Highly Successful Security Organizations” sponsored by AWS at
  The Russian military threat group known as Sandworm has allegedly reached back into the past for its latest cyber attack on Ukraine. According to security researchers at ESET, last Friday Sandworm deployed an updated version of a piece of malware that it successfully used in 2016 to temporarily bring down part of Ukraine’s power grid. The latest victim was also a power provider. The original malware, dubbed Industroyer, goes after network-connected industrial controllers. Industroyer2 is slightly different: It goes after devices only running the IEC-104 protocol. Then it releases a new version of the CaddyWiper destructive malware to attack those devices. CaddyWiper was first discovered in March going after a bank in Ukraine. There was also a third piece of malware deployed against the energy company last week, another wiper that destroys servers running the Linux and Solaris operating systems. ESET isn’t sure how the attackers compromised the energy company last week, or how it moved from the IT to the industrial control system network. IT admins need to familiarize themselves with this malware in case it’s used in other countries. On the other side of the cyberwar, the British news agency The Telegraph reports a hacking group claims it has compromised servers at the Russian space agency, while the hacktivist group Anonymous claims it hacked three more Russian companies and leaked their emails. The U.S. and Europol announced the seizure of the website called RaidForums, a criminal marketplace where stolen data was bought and sold. The U.S. also unsealed six criminal charges laid against the site’s founder and chief administrator. He was arrested in January in Romania, where the U.S. has requested his extradition. The investigation was done with the help of Europol as well as police in the U.K., Sweden, Romania, Portugal, Germany and other law enforcement agencies. The China-based Hafnium threat group has a new attack campaign against telecommunications companies, internet service providers and data services firms. According to Microsoft, it’s been going on since last August. It leverages a hole in the Rest API of Zoho’s ManageEngine, an identity and access management authentication suite. As part of the attack a new evasion malware dubbed Tarrask is used that hides in Windows Task Scheduler. It then executes tasks the attacker wants done. This link to a report includes indicators of compromise security teams should look for. Attention IT administrators: If staff at your firm use the AWS Client VPN for remotely connecting to servers and data on the AWS platform make sure you’re running the latest version. That’s because a serious vulnerability has been found. According to researchers at Rhino Security Labs, the client can be compromised by an attacker. The new version users should have is 3.0. Another update warning comes from HP and the remote desktop utility it now owns called Teradici PCoIP. There are high severity vulnerabilities in the Client and Graphics Agents that need to be patched with the latest updates. These are tools used not only in Windows but also Linux and macOS environments. According to a news report these Teradici products are available not only from HP but also other vendors. Finally, yesterday was Patch Tuesday, when a number of IT companies release patches or security updates for their products. That includes Microsoft and SAP. SAP administrators should note one them fixes a serious hole in the HANA Extended Application Services. For any vendor make sure patches are prioritized and applied as soon as possible. You can follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. The post Cyber Security Today, Wednesday April 13, 2022 – Updated malware attacks a Ukraine power company, the RaidForums darkweb site is seized, a new Hafnium attack and more patches issued first appeared on IT World Canada.
Howard Solomon
Howard Solomon
Currently a freelance writer, I'm the former editor of and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.


Related articles

Okta’s login flaw exposes users to attack, says Mitiga

According to Mitiga, Okta's login system contains a simple error that could expose its users to future attacks. Users...

Congress committee chair to TikTok: ‘Your platform should be banned’

In response TikTok CEO says company is building a 'firewall' around American user data against fore

Beware of scammers using AI-generated voice clones, FTC warns

The Federal Trade Commission (FTC) issued a consumer alert warning people to be vigilant for calls using voice...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways