This week in Ransomware – Friday June 24th, 2022

The real target isn’t always obvious

A recent report from Telus noted that Cyberattacks are on the rise in Canada, with 98 per cent of Canadian organizations reporting a cyberattack in the last 12 months. Attacks are frequent, with 25 per cent of organizations experiencing at least one attack per day and most organizations experiencing more than 11–30 attacks per month.”

Another report from research firm Cybereason in April 2022, reports that “three quarters (73 per cent) said their organization was targeted by at least one ransomware attack in the preceding 24 months, compared to just 55 per cent of companies who had been targeted by at least one attack in our 2021 report, a staggering increase of 33 per cent year over year.” The report surveyed close to 1,500 cybersecurity professionals from companies with 700 or more employees, with participants from around the world.

The report also pointed out that most of the organizations (64 per cent) indicated the primary attack vector came from a third-party or supply chain compromise. This follows a warning earlier this year from the FBI and other agencies warning of ransomware attacks that were leveraging Managed Service Providers (MSPs) as their “delivery mechanism.” Both of these confirm a growing trend in which the initial victim of a breach is not the final target.

That does not mean that these unwitting victims have “dodged the bullet.” While they might not experience a ransomware attack, there could be other grave consequences. A few years ago, a small HVAC company was “outed’ as the way in which retail giant Target was hacked. Can a small business survive that adverse publicity?

Another impact has been that, regardless of size or industry, third-party suppliers are increasingly called on demonstrate security compliance in a more rigorous manner than in previous years, a process one executive called “death by compliance.”

Sourced from studies which can be downloaded from Telus and another from Cybereason. (Registration required)

Ransomware as a decoy

The security podcast Cyber Security Today had a story which revealed that threat actors may use ransomware attacks “to distract IT from a data theft going on elsewhere in the organization” and to “distract incident responders from what’s really going on.” Host Howard Solomon noted noted that a Chinese gang with the name “Bronze Starlight” was deploying ransomware with a very short lifespan, suggesting that the gang’s “goal is data theft or espionage.”

A story in Tech News Day notes that threat analysts from cybersecurity firm Secureworks have uncovered the activities of two Chinese hacking groups that use ransomware as a decoy for cyber espionage. Ransomware as a decoy allows attackers to cover their tracks, complicate attribution, as well as distracting defenders.

It also notes that a clue of this gang’s presence is the use of a “custom DLL loader called HUI Loader for uploading remote access trojans and Cobalt Strike beacons to compromised computers and servers. That leads to the uploading of ransomware.”

The gang initially compromises networks by exploiting known vulnerabilities in devices, which makes it more difficult to detect, but it should be noted there were often patches available that could have prevented the attack in the first place.

The lesson for cybersecurity defenders is that even if you have exceptional backup and recovery capabilities, you must not get distracted by an initial attack.

Sourced from the podcast Cyber Security Today with host Howard Solomon, produced by the ITWC podcasting network with additional notes from a story in Tech News Day.

Call me, maybe?

In another device oriented breach, actors were reported to have attacked Linux-based Mitel MiVoice VOIP appliances to provide initial access for a potential ransomware attack.

Mitel VOIP devices are used by a large number of organizations in many different sectors for telephony services. These have previously exploited for DDoS amplification attacks.

Security experts at Crowdstrike believe that this attack was part of of a ransomware attack. Fortunately, this attack was detected and stopped, but that there are a large number of vulnerable systems. While there is no official patch, Mitel released a remediation script in April for MiVoice Connect versions 19.2 SP3 and earlier and R14.x and earlier.

The lesson is clearly that patching is essential for all devices – even ones that do not carry data that might be encrypted.

Sourced from an article in Bleeping Computer

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Jim Love
Jim Love
I've been in IT and business for over 30 years. I worked my way up, literally from the mail room and I've done every job from mail clerk to CEO. Today I'm CIO and Chief Digital Officer of IT World Canada - Canada's leader in ICT publishing and digital marketing.

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now