Cyber Security Today, August 9, 2023 – The latest ransomware news, and more

Share post:

The latest ransomware news, and more.

Welcome to Cyber Security Today. It’s Wednesday, August 9th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

Cyb er Security Today on Amazon Alexa Cyber Security Today on Google Podcasts Subscribe to Cyber Security Today on Apple Podcasts

Today’s podcast starts with three reports on ransomware:

Ransomware gangs are increasingly finding or buying zero and one-day vulnerabilities. That’s according to an analysis of recent attacks by researchers at Akamai. The report also notes that it’s not uncommon for the same victim organization to be attacked twice by different ransomware groups. While a victim firm is distracted from mediating the initial attack, other ransomware groups that are scanning for potential targets will take advantage. The report also notes that unpatched Log4Shell and Microsoft Exchange Server ProxyLogon vulnerabilities — both two years old — are still being exploited by ransomware gangs.

What can IT security teams do? What experts have been saying for years: Isolate critical systems through network segregation; limit user access to those systems; keep all software, firmware and operating systems patched with the latest security updates; and invest in regular employee security awareness training.

Here’s an odd trend in ransomware: Gangs that use leaked ransomware code to build their own variants demand significantly less from victims than from bigger groups. That’s according to researchers at Cisco Systems. Over the past three years there have been leaks by anonymous people of ransomware source code. Maybe they come from competitors. Maybe they come from white hat hackers. In some cases a gang leaks its code or builder deliberately. Whatever the reason, it has allowed new families like MortalKombat, RA Group, RTM Locker, ESXiArgs, Chaos 4 and others to emerge. The thing is, say the researchers, the crooks behind these repurposed strains are demanding a lot less from victims than established gangs to get access to encrypted data back — like a couple of thousand dollars in Bitcoin versus millions. Ultimately to the victim firm it doesn’t matter — their data is still stolen. And if they pay even a small amount, it just encourages the crooks.

A ransomware gang called TargetCompany is using fully undetectable packers in their binaries to evade detection. That’s according to researchers at Trend Micro. Those behind this strain focus on exploiting vulnerable SQL servers. After initially installing the Remcos backdoor, the attackers download the TargetCompany ransomware wrapped in an undetectable or FUD packer. Defenders are warned to watch for signs of these packers through unusual network behaviour.

CardioComm Solutions, a Canadian provider of heart monitoring technologies, is still recovering from a cybersecurity incident last week. When I checked Tuesday the company’s full website was still unavailable. A request for the latest status had not been answered by the time the podcast was recorded late yesterday afternoon.

SAP has released 20 security patches. These include two new HotNews notes and eight High Priority notes. One HotNews note has a CVSS score of 9.8. The patch fixes two vulnerabilities in SAP Power Designer. It affects customers who have the PowerDesigner Client connecting to the shared model repository through a PowerDesigner Proxy. Another patch deals an improper Authorization Check vulnerability in SAP Message Service. Researchers at Onapsis say this issue may affect the majority of SAP customers.

I reported earlier on a vulnerability in the PaperCut print management software. Well, updates are now available for PaperCut NG and MF.

Chinese military hackers compromised Japan’s classified defence network as far back as 2020, the Washington Post reported on Monday. The U.S. National Security Agency made the discovery, which notified the Japanese in hopes they would take swift action. But a year later the intruders still had access. Since then Japan has boosted government cybersecurity spending, the news story says.

In the United Kingdom, the Electoral Commission says the names and addresses of anyone who registered to vote between 2014 and 2022 — which could be tens of millions of people — were copied by an unknown attacker in August, 2021. In addition, the hackers got into the commission’s email system. The breach was only discovered just over a year later.

Finally, yesterday was Microsoft Patch Tuesday for August. The security updates address 74 vulnerabilities, six of which are classified as critical. One of them is in Exchange Server, two are in Microsoft Teams and three are in Microsoft Message Queuing Service. The zero-day hole is in .NET and Visual Studio. Also released for those who need it were Windows 10 and 11 cumulative updates for the second half of 2022.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, August 9, 2023 – The latest ransomware news, and more first appeared on IT World Canada.
Howard Solomon
Howard Solomonhttps://www.itworldcanada.com
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for several of ITWC's sister publications including ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

Featured Tech Jobs

SUBSCRIBE NOW

Related articles

Digital humans make inroads into customer service: Hashtag Trending for Tuesday, April 23, 2024

Before we get to our stories, coincidentally leading with one on digital humans used in customer service, we...

Cyber Security Today, April 22, 2024 -Vulnerability in CrushFTP file transfer software, security updates for Cisco’s controller management application, and more

This episode reports on a new campaign to steal credentials from LastPass users, a warning to admits of Ivanti Avalanche mobile device management software

Cyber Security Today, April 22, 2024 -Vulnerability in CrushFTP file transfer software, security updates for Cisco’s controller management application, and more

This episode reports on a new campaign to steal credentials from LastPass users, a warning to admits of Ivanti Avalanche mobile device management software

Google Play introduces new biometric verification with a user warning

Google has recently announced updates to the biometric verification process for Google Play purchases, aiming to bolster security...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways