Cybersecurity News & Trends

January 27, 2023/0 Comments/in Weekly News /by Jordan Riddles

Curated cybersecurity news and trends from the industry’s leading bloggers and news outlets, for you from SonicWall.

We’re nearing the end of January, and SonicWall is still roaring into headlines. Read about the NSsp 15700’s “superpowers,” as described by the folks at iTWire, and see how CyberSecurityInsider breaks down some of our latest threat intelligence. Take a look at MedTechDive citing some of our data and see TechTarget’s piece on one of our partners.

This week has been busy for industry news. The FBI has taken down the ransomware gang known as Hive, and we have information from Dark Reading, Axios and Reuters. Security Week reports that German airports, banks and government have been hit with Killnet DDoS attacks. TechCrunch reports that backups have been stolen from a breach at LastPass. At Hacker News, we’re hearing about vulnerabilities in Samsung’s Galaxy app store on Android. Bleeping Computer is reporting that Microsoft OneNote attachments are the latest trend in email-based malware.

SonicWall News

2023 Predictions: Emerging Tech & Global Conflict Bring New Cyber Threats

CyberSecurityInsiders, SonicWall News: 2022 saw a shifting cybersecurity landscape as rising geopolitical conflicts brought new tactics, targets and goals for cybercrime. According to recent threat intelligence from SonicWall, global ransomware attempts declined 31% YoY as cybercriminals and nation-state actors opted for never-before-seen malware variants, IoT malware, and cryptojacking in attacks motivated by financial gain and state-sponsored hacktivism.

Cybersecurity ‘More Critical Than Ever’ In Era of Connected Care: BD

MedTechDive, SonicWall News: Ransomware attacks in which cybercriminals attempt to extort money declined by 23% overall during the first half of 2022 but increased 328% in healthcare, according to data from cybersecurity company SonicWall.

IT Services Industry Looks to Cyber, Cloud Consulting for Growth

TechTarget, SonicWall News: Logically’s MSSP offerings include extended detection and response, endpoint detection and response, and MDR; enterprise-level managed firewall services; and cybersecurity assessments, according to Skeens. The company runs a SOC. The company’s IT security technology partners include SonicWall.

The Sonicwall NSsp 15700 Brings Serious Network Protection Super Powers

iTWire, SonicWall News: iTWire really could go on and on; the list of features is almost endless. There is a database of applications for intelligent packet analysis, support for IoT devices, DNS protection and more. However, the best thing right now is to take it for a spin yourself. You can demo the SonicWall NSsp series firewalls online without any installation or commitment and see all the features and benefits in action.

Royal Mail ‘Cyber Incident’ Causes Widespread Disruption

Strategic Risk, SonicWall News: There were 623 million ransomware attacks globally in 2021 according to SonicWall, representing a 105% year-on-year increase. The UK saw a 228% surge and a 65% increase in never-before-seen malware.

8 Safety Solutions to Keep Your Business Secure

Business Info, SonicWall News: Network security devices are essential for any business. They establish a firewall that will protect internal networks from external threats, such as attacks from the internet. The SonicWall TZ270 uses patented Real-Time Deep Memory Inspection (RTDMI) to prevent cyber-attacks.

Safe Homes: Security Tech for Remote Workers

Silicon, SonicWall News: Speaking to Silicon UK, Rick Meder, VP of Strategic Partnerships and Platform Architecture at SonicWall, commented: “With most employees no longer within the protected perimeter of a traditional corporate network, the basic secure access tools in place for remote access workers have become quickly inadequate. The potential attack surface expands exponentially, oversight by security staff is met with extreme challenges, and policy complexity reaches levels like never before. Efforts to uphold an adequate security posture while maintaining workforce productivity quickly become overwhelming.”

Finally, Ransomware Victims Are Refusing to Pay Up

The Register, SonicWall News: SonicWall in October 2022 said that it saw a 31 percent drop in ransomware attacks in the first nine months of the year, but that also was coming off record numbers recorded in 2021. CEO Robert VanKirk at the time told The Register there was an “unstable cyberthreat landscape” fed by expanded attack surfaces, growing numbers of threats, and a tense geopolitical environment that included the Russia’s attack on Ukraine. The CEO also noted that even though the numbers in 2022 were down, they were still higher than in any year but 2021.

Top 7 AI Trends to Watch Out for In 2023

Silicon, SonicWall News: Immanuel Chavoya, emerging threat expert at cybersecurity company SonicWall, believes new AI software will give threat actors the ability to quickly exploit vulnerabilities and reduce the technical expertise required “down to a five-year-old level.”

All You Need to Know About The ‘Godfather’ Malware Targeting This Country’s Financial System

AMB Crypto, SonicWall News: “The research titled “2022 SonicWall Cyber Threat Report” from cybersecurity company SonicWall claims that cryptojacking attacks have increased in the banking sector by 269% year-to-date. This figure is nearly five times higher than cyberattacks directed at the retail sector. According to the study from SonicWall, the total number of cryptojacking incidents increased by 30% to 66.7 million in the first half of 2022.”

An Evolving Landscape: Top 10 Cybersecurity Predictions For 2023

Silicon Republic, SonicWall News: “Spencer Starkey, channel sales EMEA VP for SonicWall, predicts that healthcare and education will be among the sectors most targeted by cyberattacks in 2023. The cybersecurity company claims the healthcare sector saw a 328% year-on-year increase in ransomware attacks last year.”

Royal Mail’s Export Service Hit with Major Cyber Incident And Is Experiencing ‘Severe Disruption’

City AM, SonicWall News: “Terry Greer-King, Head of EMEA at SonicWall, a cybersecurity firm, linked this cyber incident to declining cyber safety in the UK. Greene told City Am: “The cyber incident at the Royal Mail shows that the public sector, like all other industries, is still vulnerable to mass cyberattack. As legacy IT concerns become more apart across the UK’s public sector, the state of its cybersecurity is still a main topic that must be addressed, especially after 2021 brought a 94% increase in malware on the global government sector. As a service that people and businesses alike depend on day-to-day, ensuring its digital infrastructure remains secure must be a top priority. To truly safeguard national public-sector cybersecurity, the government must take real concerted action now,” he added.

Industry News

Russia-backed Hacker Group Killnet Attacks German Infrastructure

After Germany agreed to send aid to Ukraine in the form of tanks, the Russia-backed cybercriminal gang known as Killnet attacked airports, banks and government offices in Germany with DDoS attacks. While the attack was instigated by Killnet, it is likely that more people took part in it. Killnet announced the attack on Wednesday following Germany’s announcement of sending aid to Ukraine. According to Security Week, Germany is on high alert for cybercriminal activity due to the geopolitical unrest in Europe.

FBI Hacks Hive Ransomware Gang

In perhaps the week’s biggest news, the U.S. government has busted the infamous Hive ransomware gang. The group has been extremely active since it first appeared in 2021. According to Dark Reading, the gang has been operating a ransomware-as-a-service (RaaS) platform. The gang does not discriminate, as they have attacked schools, infrastructure and businesses alike. According to the U.S. Department of Justice, they have been infiltrating Hive’s systems since July 2022 and have captured their decryption keys. According to Reuters, this move from the FBI may have saved victims up to $130 million. Government hackers were able to break into Hive’s networks and distribute their decryption keys to victims across the world. The government hackers warned the victims in advance so they could take precautions against Hive. Hive was one of the most notorious cybercriminal gangs in the world. They typically extorted international businesses and demanded huge cryptocurrency payments in return.

According to Axios, this move from the DoJ is one of the most significant moves the U.S. government has taken against a ransomware gang. Before now, the U.S. has been tight-lipped about its operations against cybercriminal gangs. In the wake of the attack on the Colonial Pipeline in 2021, ransomware has become a priority for the U.S. government. The FBI’s director, Christopher Wray, said the investigation into Hive is still ongoing. It’s unclear how large of a dent this will make in global ransomware attacks, but one thing is certain – it’s a good day to be fighting against cybercriminals.

GoTo Encrypted Backups Stolen in LastPass Breach

GoTo, the parent company of the popular password manager LastPass, has revealed that customers’ encrypted backup data was stolen during a recent breach. According to LastPass, the attackers used information that was stolen during an incident in August 2022. According to TechCrunch, the breach also impacted several of GoTo’s products, including its VPN tool, Hamachi. GoTo CEO Paddy Srinivasan said, “The affected information, which varies by product, may include account usernames, salted and hashed passwords, a portion of multi-factor authentication settings, as well as some product settings and licensing information.” Srinivasan also said GoTo is advising impacted customers to reset passwords and MFA settings.

Samsung’s Galaxy App Store Security Flaws

NCC Group has discovered two security flaws in Samsung’s Galaxy app store on Android. The vulnerabilities could allow threat actors to direct users to bogus landing pages or even install malicious apps on the user’s device. Hacker News reports that Samsung has patched the vulnerability to stop unauthorized access. These vulnerabilities only affect users who are running Android 12 or any version before that. Users who are running Android 13 are unaffected.

Microsoft OneNote Attachments Now Being Used to Spread Malware

Threat actors are now able to infect remote access users with phishing malware using OneNote attachments, according to Bleeping Computer. In the past, attackers have been able to attach malicious Excel and Word files to emails which ran macros on the infected computers to install malware. Microsoft has since disabled macros by default, which has forced threat actors to look elsewhere for getting malicious files from point A to point B. TrustWave SpiderLabs began warning users in December about OneNote files being used in this way. Fortunately, OneNote has been able to recognize these files and warn users not to open them. However, some users have ignored the warning and opened the malicious files anyways. The best way to protect yourself is to not open files from anyone you don’t know.

SonicWall Blog

Can You Catch All the Phish? Take Our New Phishing IQ Quiz and Find Out! – Ken Dang

Celebrating 2023 With Expanded “3 & Free” – Matt Brennan

‘3 & Free’ Promotion: How to Upgrade to a New SonicWall TZ Series NGFW for Free – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

3 & Free: 1 Amazing Deal, 2 Exceptional Firewalls, 3 Years of Superior Threat Protection – Matt Brennan

SonicWall Wins CRN’s 2022 Tech Innovator Award in Enterprise Network Security – Bret Fitzgerald

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

A New Era of Partnering to Win – Robert (Bob) VanKirk

Multiply Your Security with Multifactor Authentication – Amber Wolff

10 Reasons to Upgrade to the Latest SonicWall Gen 7 TZ Firewall – Sarah Choi

Cybersecurity News & Trends

January 20, 2023/0 Comments/in Weekly News /by SonicWall Staff

Curated cybersecurity news and trends from the industry’s leading bloggers and news outlets, for you from SonicWall.

SonicWall continues to make waves in the news with its products and executives. Read Business Info’s safety solutions to keep your business secure and see what our VP of Strategic Partnerships and Platform Architecture, Rick Meder, had to say to Silicon. We also hear from our CEO, Bob VanKirk, and our emerging threat expert, Immanuel Chavoya.

In industry news, we’re taking a peek at newly discovered vulnerabilities, artificial intelligence and the open sea. Dark Reading reports that everyone’s favorite AI chatbot, ChatGPT, is dabbling in writing polymorphic malware. Over at Bleeping Computer, the word is that a vendor’s exposed database has caused trouble at Nissan. The good folks at Hacker News warn of a Linux vulnerability that has caught the attention of malicious actors. From Trend Micro, GitHub CodeSpaces has a port forwarding issue that’s allowing easy malware delivery. Security Weekly alerts us about a ransomware attack that affected 1,000 ships across the globe.

SonicWall News

Royal Mail ‘Cyber Incident’ Causes Widespread Disruption

Strategic Risk, SonicWall News: There were 623 million ransomware attacks globally in 2021 according to SonicWall, representing a 105% year on year increase. The UK saw a 228% surge and a 65% increase in never-seen-before malware.

8 Safety Solutions to Keep Your Business Secure

Business Info, SonicWall News: Network security devices are essential for any business. They establish a firewall that will protect internal networks from external threats, such as attacks from the internet. The SonicWall TZ270 uses Real-Time Deep Memory Inspection to prevent cyber-attacks.

Safe Homes: Security Tech for Remote Workers

Silicon, SonicWall News: Speaking to Silicon UK, Rick Meder, VP of Strategic Partnerships and Platform Architecture at SonicWall, commented: “With most employees no longer within the protected perimeter of a traditional corporate network, the basic secure access tools in place for remote access workers have become quickly inadequate. The potential attack surface expands exponentially, oversite by security staff is met with extreme challenges, and policy complexity reaches levels like never before. Efforts to uphold an adequate security posture while maintaining workforce productivity quickly become overwhelming.”

Finally, Ransomware Victims Are Refusing to Pay Up

The Register, SonicWall News: SonicWall in October 2022 said that it saw a 31 percent drop in ransomware attacks in the first nine months of the year, but that also was coming off record numbers recorded in 2021. CEO Robert VanKirk at the time told The Register there was an “unstable cyberthreat landscape” fed by expanded attack surfaces, growing numbers of threats, and a tense geopolitical environment that included the Russia’s attack on Ukraine. The CEO also noted that even those the numbers in 2022 were down, they were still higher than in any year but 2021.

Top 7 AI Trends to Watch Out for in 2023

All You Need to Know About The ‘Godfather’ Malware Targeting This Country’s Financial System

AMB Crypto, SonicWall News: “The research titled “2022 SonicWall Cyber Threat Report” from cybersecurity company SonicWall claims that cryptojacking attacks have increased in the banking sector by 269% year-to-date. This figure is nearly five times higher than cyberattacks directed at the retail sector. According to the study from SonicWall, the total number of crypto-jacking incidents increased by 30% to 66.7 million in the first half of 2022.”

An Evolving Landscape: Top 10 Cybersecurity Predictions For 2023

Silicon Republic, SonicWall News: “Spencer Starkey, channel sales EMEA VP for SonicWall, predicts that healthcare and education will be among the sectors most targeted by cyberattacks in 2023. The cybersecurity company claims the healthcare sector saw a 328pc year-on-year increase in ransomware attacks last year.”

Royal Mail’s Export Service Hit with Major Cyber Incident and Is Experiencing ‘Severe Disruption’

City AM, SonicWall News: “Terry Greer-King, Head of EMEA at SonicWall, a cybersecurity firm, linked this cyber incident to declining cyber safety in the UK. Greene told City AM: “The cyber incident at the Royal Mail shows that the public sector, like all other industries, is still vulnerable to mass cyber attack. As legacy IT concerns become more apart across the UK’s public sector, the state of its cybersecurity is still a main topic that must be addressed, especially after 2021 brought a 94% increase in malware on the global government sector. As a service that people and businesses alike depend on day-to-day, ensuring its digital infrastructure remains secure must be a top priority. To truly safeguard national public-sector cybersecurity, the government must take real concerted action now,” he added.

Study Find One in Four SMES Hit by Ransomware Last Year

Technology Magazine, SonicWall News: “Today, cyberattacks continue to present an ever-changing threat to businesses across all sectors. NCC Group’s Annual Threat Monitor report, which indicated ransomware attacks almost doubled in 2021, rising 92.7% on the previous year, while research by SonicWall found that 66% of customers were more concerned about cyberattacks last year.”

All You Need to Know About The ‘Godfather’ Malware Targeting This Country’s Financial System

AMB Crypto, SonicWall News: “The research titled “2022 SonicWall Cyber Threat Report” from cybersecurity company SonicWall claims that cryptojacking attacks have increased in the banking sector by 269% year-to-date. This figure is nearly five times higher than cyberattacks directed at the retail sector. According to the study from SonicWall, the total number of crypto-jacking incidents increased by 30% to 66.7 million in the first half of 2022.”

Leading Cybersecurity Companies for The Food Industry

Just Food, SonicWall News: “Amongst the leading vendors of cybersecurity in food industry are Dragos, Eat IT Drink IT, NCR, Netskope, PDI Software, Preciate, Singtel, SonicWall, TitanHQ, VikingCloud, Auvesy-MDT, Cali Group, and Cardonet.”

Goodbye 2022, Hello 2023: Experts Weigh in With Channel Expectations

MicroScope, SonicWall News: “Matt Brennan, vice-president of North America channel sales at SonicWall, believes the effects of supply chain disruption will continue to have an impact on 2023: “Supply chain challenges have wreaked havoc across most industries around the world. IT has been affected across the board. Because of these challenges, brand loyalty will fade. [Customers] won’t hesitate to make purchases they can get now rather than wait for a specific brand product later – fulfillment is critical, regardless of how long customers have been brand loyal.” Brennan adds that this will lead to a shift in the market as customers learn that “staying brand loyal is not necessary to run their businesses successfully”.

Industry News

ChatGPT Trips the Alarm Over Polymorphic Malware

Researchers at Cyberark recently warned that OpenAI’s ChatGPT, an online chatbot that has been stirring up noise in the media recently, could be used to create polymorphic malware. Dark Reading reports that polymorphic malware is a highly advanced type of malware that actually contains no malicious code. That makes it exceedingly difficult to detect.

Cyberark also warned that the AI could be used to generate injection code. ChatGPT is free to use and has a simple user interface. This makes ChatGPT something that Cybersecurity experts should be keeping in their peripheral vision. It may not be causing many problems just yet, but the potential for malicious use is most certainly there.

Exposed Database Leaks Personal Data Of 18,000 Nissan Customers

On Monday, Nissan began sending out notifications to customers that their data had been breached. Nissan said in the memo that they had received notification in June of 2022 that one of their third-party software developers had experienced a breach. Bleeping Computer reports that Nissan gave data to the vendor to develop and test software for them. The automaker placed the blame on the vendor’s database being poorly configured.

Nissan conducted an investigation and found that an unauthorized user likely had access to the data. NMAC numbers (Nissan finance account numbers), full names, and dates of birth were all included in the leak. Nissan noted that there was no evidence the data had been misused, but they did offer affected customers a one-year membership of Experian identity protection.

Hack Alert: Recently Patched Linux Tool Is the Newest Target Of Malicious Actors

A widely-used Linux tool, Control Web Panel, is being actively exploited by malicious actors after a vulnerability was patched. The bug, listed as CVE-2022-44877, gave elevated privileges and allowed for unauthenticated remote code execution on some servers according to Hacker News. All software versions before 0.9.8.1147 are impacted.

So far, exploitation of the bug has been minimal, with GreyNoise reporting four unique IP addresses attempting to abuse it. All frequent users of CWP are advised to apply the most up-to-date patches to avoid any issues.

Github CodeSpaces Vulnerability Causes Concerns About Easy Malware Delivery

GitHub CodeSpaces is a cloud-based integrated development environment that was fully released to the public in November 2022. A feature of this IDE that allows forwarded ports to be shared publicly could be exploited by malicious actors. It seems that these features could be used to create a malware file server with a legitimate GitHub account. GitHub would usually be alerted by a user using their tools in this way. Due to this vulnerability, a user could be serving malicious content directly under GitHub’s nose, and GitHub would be none the wiser.

Trend Micro reports that no abuse of this exploit has been witnessed thus far. The exploit was discovered during an internal security check on the platform.

Ransomware Attack on Ship Management Software Disrupts Servers On 1,000 Ships

A recognized maritime advisor, DNV, was the victim of a ransomware attack on its ShipManager system servers. The attack resulted in 1,000 ships being impacted globally. This attack comes a mere two weeks after the LockBit ransomware gang carried out an attack on Portugal’s Port of Lisbon. The European shipping industry has been the victim of multiple such attacks over the course of the past year.

On January 19^th, DNV released a statement saying they are working to restore servers on the impacted ships. They made it clear that all of the impacted ships have maintained complete offline functionality throughout this ordeal.

SonicWall Blog

Can You Catch All the Phish? Take Our New Phishing IQ Quiz and Find Out! – Ken Dang

Celebrating 2023 With Expanded “3 & Free” – Matt Brennan

‘3 & Free’ Promotion: How to Upgrade to a New SonicWall TZ Series NGFW for Free – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

3 & Free: 1 Amazing Deal, 2 Exceptional Firewalls, 3 Years of Superior Threat Protection – Matt Brennan

SonicWall Wins CRN’s 2022 Tech Innovator Award in Enterprise Network Security – Bret Fitzgerald

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

A New Era of Partnering to Win – Robert (Bob) VanKirk

Multiply Your Security with Multifactor Authentication – Amber Wolff

10 Reasons to Upgrade to the Latest SonicWall Gen 7 TZ Firewall – Sarah Choi

Cybersecurity News & Trends

January 13, 2023/0 Comments/in Weekly News /by Ray Wyman Jr

Curated cybersecurity news and trends from the industry’s leading bloggers and news outlets, for you from SonicWall.

SonicWall is leading this news cycle with more company mentions and stories featuring executives and cybersecurity experts like Spencer Starkey, Senior Director, Regional Sales-EMEA, and Terry Greer-King, Vice President, EMEA and APJ Sales.

In industry news, we run the full range of international hacks and highly developed phishing campaigns. The Record reports that a pro-Russian hacktivist group is going after NATO targets. This story has contributions from Sentinel Labs, Reuters, and Cyberscoop. From Cyberwire, a critical hack alert about phishers hitting Microsoft’s Dynamic 365 Customer voice services. Bleeping Computer alerted us about a breach at Norton LifeLock. Dark Reading reports that “sneaky” hackers are wooing corporate workers with fake Zoom downloads. So please watch what you click. CSO Online reports on a developing story about a ransomware group actively exploiting the Citrix (CVE-2022 27510) vulnerability. And Hacker News warns us that tainted VPN installers are spreading EyeSpy surveillance ware.

As always, watch the corners before you cross the road, and remember that cybersecurity is everyone’s business.

SonicWall News

All You Need to Know About The ‘Godfather’ Malware Targeting This Country’s Financial System

AMB Crypto, SonicWall News: “The research titled “2022 SonicWall Cyber Threat Report” from cybersecurity company SonicWall claims that cryptojacking attacks have increased in the banking sector by 269% year-to-date. This figure is nearly five times higher than cyberattacks directed at the retail sector. According to the study from SonicWall, the total number of crypto-jacking incidents increased by 30% to 66.7 million in the first half of 2022.”

An Evolving Landscape: Top 10 Cybersecurity Predictions For 2023

Silicon Republic, SonicWall News: “Spencer Starkey, channel sales EMEA VP for SonicWall, predicts that healthcare and education will be among the sectors most targeted by cyberattacks in 2023. The cybersecurity company claims the healthcare sector saw a 328pc year-on-year increase in ransomware attacks last year.”

Royal Mail’s Export Service Hit with Major Cyber Incident And Is Experiencing ‘Severe Disruption’

City AM, SonicWall News: “Terry Greer-King, Head of EMEA at SonicWall, a cybersecurity firm, linked this cyber incident to declining cyber safety in the UK. Greene told City Am : “The cyber incident at the Royal Mail shows that the public sector, like all other industries, is still vulnerable to mass cyber attack. As legacy IT concerns become more apart across the UK’s public sector, the state of its cybersecurity is still a main topic that must be addressed, especially after 2021 brought a 94% increase in malware on the global government sector. As a service that people and businesses alike depend on day-to-day, ensuring its digital infrastructure remains secure must be a top priority. To truly safeguard national public-sector cybersecurity, the government must take real concerted action now,” he added.

Study Find One in Four SMES Hit By Ransomware Last Year

All You Need to Know About The ‘Godfather’ Malware Targeting This Country’s Financial System

AMB Crypto, SonicWall News: “The research titled “2022 SonicWall Cyber Threat Report” from cybersecurity company SonicWall claims that cryptojacking attacks have increased in the banking sector by 269% year-to-date. This figure is nearly five times higher than cyberattacks directed at the retail sector. According to the study from SonicWall, the total number of crypto-jacking incidents increased by 30% to 66.7 million in the first half of 2022.”

Leading Cybersecurity Companies for The Food Industry

Goodbye 2022, Hello 2023: Experts Weigh in With Channel Expectations

MicroScope, SonicWall News: “Matt Brennan, vice-president of North America channel sales at SonicWall, believes the effects of supply chain disruption will continue to have an impact on 2023: “Supply chain challenges have wreaked havoc across most industries around the world. IT has been affected across the board. Because of these challenges, brand loyalty will fade. [Customers] won’t hesitate to make purchases they can get now rather than wait for a specific brand product later – fulfilment is critical, regardless of how long customers have been brand loyal.” Brennan adds that this will lead to a shift in the market as customers learn that “staying brand loyal is not necessary to run their businesses successfully”.

Tips for Health Systems on Managing Legacy Systems to Strengthen Security

HealthTech, SonicWall News: A lack of support from the manufacturer generally means a lack of security patches. As a result, devices running a legacy OS are easy targets for attackers — in fact, malware attacks on internet-connected devices spiked 123 percent in the first half of 2022, according to research from SonicWall.

Cybersecurity for Investors: Why Digital Defenses Require Good Governance

Yahoo! Finance, SonicWall News: Cyberattacks are very costly. In the first half of 2022, at least 2.8 billion malware attacks were recorded globally, an increase of 11% over the previous 12 months, according to cybersecurity company SonicWall.

Remote Monitoring, AI Research and Data at Risk: Healthcare Tech Predictions For 2023

BetaNews, SonicWall News: Healthcare could come under threat from geopolitical attacks believes Immanuel Chavoya, threat detection and response strategist at SonicWall. “When it comes to protecting against threats of geopolitically motivated attacks, the present call to action is to be proactive, rather than reactive, to an assault. Attacks such as targeted malware or vulnerability exploitation could be used to inflict chaos on critical infrastructure such as healthcare, electric utilities, financial institutions, and oil and gas. These attacks tie up resources, cause financial damage, and send a signal. In 2023, organizations and governments will need to be prepared by ensuring that they don’t have any issues that could become low-hanging fruit for attacks and closely monitor their network activity for quick identification of and reaction to any attack.

Future Tech Role of Partners

CRN (India), SonicWall News: Security threats are becoming increasingly sophisticated, and organizations are looking for proactive ways to secure their IT environments. Whether their environment is in the Cloud, on-premises or a hybrid, organizations look to managed security services providers (MSSPs) to provide the best-in-class security to protect their business and mitigate future risk.

SonicWall CEO: Partner Program Revamp on Tap for Early 2023

CRN, SonicWall News: As other vendors are increasing their prices, we’re actually doing the opposite,” he said. If a customer and a partner commit to buying three years of services—services that go with our solutions—what they end up getting is the firewall hardware at no charge. That translates to a double-digit price decrease savings.

Industry News

Pro-Russian Hacktivists Go After NATO

A pro-Russian hacktivist group has been going after targets in NATO countries since the war against Ukraine started. The Record report that group NoName057(16)

used Telegram and GitHub to launch distributed denial-of-service attacks against Ukraine and several NATO countries.

According to researchers at Sentinel Labs, the group targeted candidate websites in the 2023 Czech presidential election and businesses and organizations across Poland and Lithuania. According to Reuters, the group is also responsible for disrupting Denmark’s financial sector earlier this week.

The gang also used GitHub to host their distributed denial of service tools. Cyberscoop reports that GitHub disabled the group’s accounts this Tuesday.

Hack Alert: Microsoft’s Dynamic 365 customer voice service

Threat actors are busy developing new methods to attack companies that use Microsoft’s Dynamic 365 customer voice service.

According to Cyberwire, hackers use Microsoft Customer Voice to send phishing messages to victims in the form of a service notification to the end user. Hackers harvest the password when the victim logs in to view the document. In another attack variant, the end user is enticed to click on the link in the email to print a document. An easy defensive fix is to hover over URLs to validate the sender before clicking links in emails or text messages.

Norton LifeLock Warns That Hackers Breached Password Manager Accounts

Bleeping Computer reports that Gen Digital, previously Symantec Corporation and NortonLifeLock, is now sending customers data breach notifications informing them of hackers’ successful breach of Norton Password Manager accounts through a credential-stuffing attack.

A letter sample was shared with the Office of the Vermont attorney general. It appears that the attackers did not cause a breach at the company but rather account compromises on other platforms. According to the company, their systems were not compromised. However, they claim that an unauthorized third party has used the username and password of user accounts.

Sneaky Hackers Woos Corporate Workers With Fake Zoom Downloads

According to Dark Reading, a sneaky new info stealer is sliding onto user machines via website redirects from Google Ads that pose as download sites for popular remote workforce software, such as Zoom and AnyDesk.

Researchers from Cyble have revealed that the threat actors behind the new malware “Rhadamanthysstealer,” which is available on the Dark Web as a malware-as-a-service model, are using two delivery methods to spread their payload, as disclosed by researchers at Cyble.

Researchers detected several phishing domains that the threat actors created to spread Rhadamanthys, most of which appear to be legitimate installer links for the software above brands. Some of the malicious links they identified include: bluestacks-install[.]com, zoomus-install[.]com, install-zoom[.]com, install-anydesk[.]com, and zoom-meetings-install[.]com.

Ransomware Group Actively Exploiting Citrix Vulnerability

A ransomware group known as Royal is believed to be actively exploiting a critical security flaw affecting Citrix systems, according to the cyber research team at cyber insurance provider At-Bay. Announced by Citrix on November 8, 2022, the vulnerability, identified as CVE-2022-27510, allows for the potential bypass of authentication measures on two Citrix products: the Application Delivery Controller (ADC) and Gateway.

There were no known instances of the vulnerability being exploited in the wild at the time of disclosure. However, as of the first week of 2023, At-Bay’s cyber researchers claimed new information suggests the Royal ransomware group is now actively exploiting it. Royal, considered one of the more sophisticated ransomware groups, emerged in January 2022 and was particularly active in the second half of last year.

Beware: Tainted VPNs Spreading EyeSpy Surveillanceware

Hackers know how we use VPN services to protect ourselves from… them. According to Hacker News, hackers have created tainted VPN installers to deliver a piece of surveillance ware dubbed EyeSpy as part of a malware campaign that started in May 2022. It uses “components of SecondEye – a legitimate monitoring application – to spy on users of 20Speed VPN, an Iranian-based VPN service, via trojanized installers,” Bitdefender said in an analysis.

A majority of the infections are said to originate in Iran, with smaller detections in Germany and the U.S., the Romanian cybersecurity firm added.

It has many features, including taking screenshots, activating microphones, logging keystrokes, gathering files and saved passwords from web browsers, and remotely controlling the machines to run arbitrary commands.

SecondEye previously came under the radar in August 2022, when Blackpoint Cyber revealed the threat actors’ use of its spyware modules and infrastructure for data and payload storage.

SonicWall Blog

Can You Catch All the Phish? Take Our New Phishing IQ Quiz and Find Out! – Ken Dang

Celebrating 2023 With Expanded “3 & Free” – Matt Brennan

‘3 & Free’ Promotion: How to Upgrade to a New SonicWall TZ Series NGFW for Free – Matt Brennan

The Art of Cyber War: Sun Tzu and Cybersecurity – Ray Wyman

Talking Boundless Cybersecurity at the Schoolscape IT 2022 Conference – Mohamed Abdallah

3 & Free: 1 Amazing Deal, 2 Exceptional Firewalls, 3 Years of Superior Threat Protection – Matt Brennan

SonicWall Wins CRN’s 2022 Tech Innovator Award in Enterprise Network Security – Bret Fitzgerald

SonicWall Included on the Acclaimed CRN Edge Computing 100 List for 2022 – Bret Fitzgerald

A New Era of Partnering to Win – Robert (Bob) VanKirk

Multiply Your Security with Multifactor Authentication – Amber Wolff

10 Reasons to Upgrade to the Latest SonicWall Gen 7 TZ Firewall – Sarah Choi

Can You Catch All the Phish? Take Our New Phishing IQ Quiz and Find Out!

January 11, 2023/0 Comments/in Email Security, Threat intelligence /by Ken Dang

Test your ability to identify fraudulent emails, and see how susceptible you really are to social engineering and phishing scams.

Sometimes you realize it just a split-second too late. A wave of terror passes over you as you wonder, What did I just click? I think I’ve really messed up!

If this sounds familiar to you, don’t beat yourself up. Being duped by a good phishing scam can happen to the very best of us, and you’re joining millions of innocent victims worldwide who have done the same.

But it’s also important to take immediate action and to know what you need to do to avoid repeating the mistake. The human element contributes to 82% of breaches, according to the 2022 Verizon DBIR. Besides employing security technologies to prevent phishing attacks, companies must also take a hardline approach to educating people on how to spot phishing emails.

To help avoid email scammers continuing to get the better of us, SonicWall is thrilled to announce our new online Phishing Quiz. This quiz is designed to help educate users on how to recognize common signs of a phishing email. And because it’s interactive, it’s more engaging and informative than a simple email or handout would be.

Email is often the first attack vector.

Based on the lessons of past data breaches, those successful attacks involve using multiple tactics, techniques and procedures (TTP) to compromise the user. Moreover, in those events, email was the first to deliver at least one of the following:

The initial URL, in the form of a link to an exploit kit or phishing website
The malicious attachment, in the form of a dropper or payload
A pretexting message that becomes the starting point for a social engineering attack, manipulating users into giving up their credentials, sending money, disclosing sensitive data, etc.

Today, we’re seeing targeted phishing and pretexting attacks that are very well developed. The genuine appearance of these emails sent from stolen or fake identities can trick even the most security-conscious users. In addition, security practitioners we spoke with said they still see users clicking on phishing emails because they are unable to discern legitimate emails from fake ones.

Phishing tactics, techniques and procedures (TTP) are too clever.

As security vendors create new capabilities to protect users from phishing emails that bypass pre-delivery filters, attackers are equally devoted to creating more clever ways to reach the inbox. An example of these attacks is a low-volume, high-quality targeted phishing email that appears to come from Microsoft 365 or Gmail, as shown below.

Phishing emails are now more advanced. Attackers can replicate MFA screens to steal credentials.

This fake email renders professionally and is personalized for specific users, as opposed to the traditional high-volume spray-and-pray campaigns of the past. These attacks are sophisticated in both their ability to reach the inbox and the user experience on the back end. Each link brings up the login window of the second page of the account challenge, which pre-populates the user’s email address. It already knows who you are.

The phishing innovation curve is now happening post-delivery, as in the above example. In other words, instead of putting the malicious URL in the email, phishers link to a redirect server that acts as a gateway, sending queries from a security company to a benign site. In contrast, queries coming from the intended victims are directed to the phishing server.

The obfuscation methods developed over the years include identity deception, multiple redirections, URL splits, HTML tag manipulation, polymorphic malware, and dynamic obfuscated scripts, to name a few. We have seen skilled hackers combine numerous obfuscation techniques inside targeted phishing campaigns to hide the true intent of the target page, which is often a credential-harvesting page.

People are not perfect.

“Human beings are not creatures of logic; we are creatures of emotion. And we do not care what’s true. We care how it feels,” said Will Smith, a famous actor, rapper and perhaps even philosopher of our generation. These words have a deep connection to those who live and breathe cybersecurity. The notion that as long as human emotions can be manipulated, someone will likely make a bad mistake underscores one of many complex challenges for security practitioners to fix, but it cannot be addressed through technology alone. While phishing prevention technologies are necessary, it is also essential to establish a cybersecurity awareness program.

Raise employee awareness with the SonicWall Phishing Quiz.

Aside from advancing artificial intelligence and machine learning technologies inside security tools, SonicWall investments in training humans to resist human deception is part of a more significant effort to help people become part of the solution instead of being part of the problem.

The belief that security rests only on security practitioners and their technologies is dangerous, because when a phishing email invariably does make it to the inbox, there is no further line of defense. To reduce this human risk factor requires a culture and a mindset adjustment at the corporate and the individual level, aimed at getting everyone consciously thinking and proactively involved to become a key stakeholder in an organization’s security.

In a simple but effective way, the SonicWall Phishing Quiz encourages people to stay aware and exercise healthy suspicion when checking and responding to emails. The quiz lets you interactively examine a series of sample emails, including embedded links, to test your intuition and knowledge in distinguishing legit versus phishing emails.

The Phishing IQ Test evaluates your ability to identify fraudulent emails using real examples of common phishing attacks.

To measure your own ability to spot phishing emails, take the SonicWall Phishing Quiz today.

TAKE THE QUIZ

Celebrating 2023 With Expanded “3 & Free”

January 10, 2023/0 Comments/in Network Security /by Matt Brennan

Satisfy your security and financial resolutions with limited-time “3 & Free” promos on TZ Series NGFWs, NSa Series NGFWs and SonicWave Access Points.

In December, we announced our limited-time “3 & Free” promotion on SonicWall TZ370 and TZ470 firewalls. While promotions that include a free firewall have always been popular, the response to our TZ promotion has been tremendous.

As a result, we’ve decided to celebrate the arrival of the new year by dramatically expanding the scope of our offer: Our 3 & Free pricing now applies to almost every TZ Series firewall that SonicWall carries.

3 & Free: What’s New for 2023

While we’ve added new models to the promotion, qualifying for an upgrade to the latest TZ Series firewall is as simple as ever. Through March 31, current SonicWall customers or those looking to swap out a competitor’s appliance can purchase three years of SonicWall’s Advanced Protection Service Suite (APSS), and they’ll receive a TZ appliance absolutely free.

The APSS suite offers all the tools you need to protect against today’s sophisticated malware, ransomware, encrypted threats, viruses, spyware, zero-day exploits and more. The comprehensive package includes:

Capture Advanced Threat Protection with RTDMI™
Gateway Anti-Virus
Anti-Spyware
Intrusion Prevention
Application Firewall Service
Content Filtering Services
Comprehensive Anti-Spam
NSM Essential with Management and 7-Day Reporting and 24×7 Firmware Support

In addition, you’ll get all the benefits of our latest operating system, SonicOS 7. Built from the ground up to be simpler, more capable and more flexible than any OS before it, SonicOS 7 features advanced security, simplified policy management, and critical networking and management capabilities — all designed to meet the needs of distributed enterprises with next-gen SD-Branches and small- to medium-sized businesses.

“3 & Free”: More than just TZ

Our TZ Series promo is just one of three 3 & Free promotions we’re running to ring in the new year: We also have great deals on NSa Series NGFWs and SonicWave Access Points.

NSa Series “3 & Free”

Despite its remarkable versatility, the entry-level TZ Series isn’t a fit for every use case: Some larger and more complex deployments call for a more robust appliance. That’s why we’re also offering a 3 & Free promotion on two of our most popular NSa Series firewalls.

Through Jan. 31, 2023, when you purchase an NSa 2700 or NSa 3700 High Availability appliance and three years of Advanced Protection Service Suite, you’ll also get the primary NSa 2700 or NSa 3700 NGFW and a stateful HA Upgrade Service License free.

This promotion is for every SonicWall upgrade that qualifies, regardless of whether you’re a current SonicWall customer or you’re making the switch from a competing product.

More on the NSa Series 3 & Free promotion and what sets the NSa Series apart from its competitors.

SonicWave Access Points “3 & Free”

If you’re all set for firewalls, but your wireless connectivity could use an upgrade, we also have a promo for you.

SonicWall’s 600 Series SonicWave Wireless Access Points leverage 802.11ax — the most advanced technology available — to deliver superior performance in complex, multi-device environments. These access points offer enterprises ‘always on, always secure’ access point operations, all while simplifying the user experience.

Best of all, while supplies last, when you buy three SonicWave 621, SonicWave 641 or SonicWave 681 access points, you’ll get the fourth absolutely free. This offer applies to access points purchased individually as well as four-packs and eight-packs, allowing you to multiply your savings.

SonicWave, NSa or TZ: Which Will You Get Free?

Our 2023 kickoff deals offer an unprecedented opportunity to save money while upgrading to the most advanced security solutions SonicWall has to offer, but these promotions are only available for a limited time. To learn more about promo requirements, eligibility and more, download our 2023 Promotion Guide.

Get the Details

Cybersecurity News & Trends

January 6, 2023/0 Comments/in Weekly News /by Ray Wyman Jr

Every week SonicWall collects the most compelling, trending and important interviews, media and news stories affecting your cybersecurity — just for you.

Happy New Year! While everyone was enjoying the holidays, SonicWall kept going with global industry news about the partner program, more mentions for the Threat Reports, and expert commentary by SonicWall executives.

Cybersecurity didn’t take a break either. Health Care IT News and Toronto City News surprised everyone with a report about the LockBit ransomware gang apologizing for hacking a children’s hospital. Forbes and Wired Magazine reported on the sale of Twitter user data. Bleeping Computer discovered that Amazon S3 is now encrypting all new data using AES-256 – by default! SC Magazine reports on a JAMA study that shows healthcare disruptions from ransomware attacks are probably underreported. And Dark Reading has released its BOLD Cybersecurity predictions for 2023. We only dared to mention two of the “scary” ones.

Remember that cybersecurity is everyone’s business. Be safe out there!

SonicWall News

Goodbye 2022, Hello 2023: Experts Weigh in With Channel Expectations

MicroScope, SonicWall News: “Matt Brennan, vice-president of North America channel sales at SonicWall, believes the effects of supply chain disruption will continue to have an impact on 2023: “Supply chain challenges have wreaked havoc across most industries around the world. IT has been affected across the board. Because of these challenges, brand loyalty will fade. [Customers] won’t hesitate to make purchases they can get now rather than wait for a specific brand product later – fulfilment is critical, regardless of how long customers have been brand loyal.” Brennan adds that this will lead to a shift in the market as customers learn that “staying brand loyal is not necessary to run their businesses successfully”.

Tips for Health Systems on Managing Legacy Systems to Strengthen Security

Cybersecurity for Investors: Why Digital Defenses Require Good Governance

Remote Monitoring, AI Research and Data at Risk: Healthcare Tech Predictions For 2023

Future Tech Role of Partners

SonicWall CEO: Partner Program Revamp on Tap for Early 2023

Guardian Hit by Suspected Ransomware Attack

The Financial Times, SonicWall News: But the number of attacks has fallen by almost a quarter in the first half of this year, according to US security company SonicWall, partly because more organizations have refused to pay cyber criminals.

The Non-Stop Journey Towards ‘Zero Trust’

Canales Sectoriales (Spain), SonicWall News: According to Sergio Martínez, Country Manager of SonicWall, currently, only 11% of companies consider that they have sufficient internal computer capacity to deal with any cyberattack. It is estimated that more than 50% of companies that suffer a major cyberattack take more than five hours to detect it and, a significant number of them live with it for a few weeks or months.

Ways Governments Can Better Protect Public Data

Cyber Security Intelligence, SonicWall News: The chances of being hit by a ransomware attack are more significant than ever. Last year, global ransomware volume skyrocketed by 105% year over year, according to the 2022 SonicWall Cyber Threat Report. While no industry was spared, the numbers were particularly gruesome for governments. Ransomware attempts on government entities rose a staggering 1,885%. That’s more than double the increase reported by healthcare (755%), education (152%), and retail (21%) combined.

Risks That Could Impact Retail In 2023

BizCommunity, SonicWall News: Figures from SonicWall’s Biannual Report revealed that e-commerce and online retail businesses saw a 264% surge in the past 12 months in ransomware attacks alone. These statistics are extremely worrying for retail companies, so unsurprisingly, websites and digital security are at the forefront of retailers’ minds.

SonicWall Achieves Sales Record with The Help of The Distribution Channel

InfoChannel (Mexico), SonicWall News: 2022 has been a year of growth for SonicWall, especially for business partners, as announced by Eustolio Villalobos, general manager for Mexico, Central America and the Caribbean. Villalobos said that the company reached a record of internal sales in generation 7, SD-WAN and Wi-Fi 6 firewall solutions.

Unifying Efforts with Its SonicWall Channels Gains Ground in Latin America

eSemenal (Mexico), SonicWall News: Today we have seen how companies are more aware of the cybersecurity challenges they face and have understood that it is not a separate issue. Expanding issues such as hybrid work and 5G will be some of the main challenges next year, and companies regardless of their size will have to be prepared,” said Arley Brogiato, Sales Leader for SonicWall in Latin America.

According to the executive, sales of security solutions this year exceeded the company’s expectations globally, achieving higher growth than the prospect and a double-digit increase in its market shares.

Industry News

Lockbit Ransomware Group ‘Apologizes’ For Children’s Hospital Cyberattack

Health Care IT News hit us with a rather surprising story about a ransomware group that apologized for hitting a Toronto-based children’s hospital affiliated with the University of Toronto. For a bit of background, we went to Toronto City News and learned that on December 18, 2022, SickKids was hit with ransomware. Administrators reported delays with retrieving lab and imaging results. Other affected systems included employee timekeeping and pharmacy submissions. About ten days later, the hospital said that nearly half of the affected systems had been restored. Then an unexpected update.

LockBit ransomware group that provides affiliates access to malware for a cut of the ransom profits then issued an apology on the dark web on the last day of the year, which was then posted to Twitter. In the statement, the ransomware organization allegedly blamed a partner and offered a free decryptor for the hospital to unlock its data. Even with a ransomware group’s decryptor, healthcare organizations only recover about two-thirds of their files on average.

Twitter Data for Sale

Reported by Forbes, Wired, and posted on Twitter by @SonicWall, the close of 2022 saw hackers selling data stolen from 400 million Twitter users. The source, researchers say, is a widely circulated trove of email addresses linked to about 200 million users that were hacked out between June 2021 and January 2022, exploiting a bug in a Twitter application. The list on sale is likely a refined version of the larger batch with duplicate entries removed. According to the Forbes reporter, the hacker demanded $200,000 from Twitter for an “exclusive” sale of the data and warned that the social media platform could face a massive GDPR fine for failing to protect user data.

Twitter has not yet commented on the massive exposure. However, the cache of data clarifies the severity of the leak and who may be most at risk because of it.

Amazon S3 To Encrypt All New Data With AES-256

Bleeping Computer reported that Amazon Simple Storage Service (S3) would automatically encrypt all new objects added on buckets on the server side, using AES-256 by default.

While the server-side encryption system has been available on AWS for over a decade, the tech giant has enabled it by default to bolster security. As a result, administrators will not have to take any actions for the new encryption system to affect their buckets. In addition, Amazon promises it won’t have any negative performance impact.

The move follows two notable breaches related to Amazon S3 storage buckets, one in December 2017, leaked data from 123 million households and another in April 2019 of 540 million records of Facebook users. The reporter comments that had the data been encrypted, the leaks wouldn’t have had nearly as dire consequences for the exposed individuals. Amazon’s move to make server-side encryption a “zero-click” process is a fundamental step towards better security. It is bound to lessen the impact of upcoming data incidents that will inevitably happen.

JAMA: Underreported Healthcare Disruptions from Ransomware Attacks

SC Magazine reported on the findings from a new study published by the Journal of the American Medical Association (JAMA) that ransomware attacks on healthcare delivery organizations doubled between 2016 and 2021, from 43 reported attacks to 91. However, the study concludes that these numbers and impacts are likely underreported due to limited data from the incidents.

Across all sectors in the last year, security researchers struggled to gauge whether ransomware attacks were on the rise or stagnating. What’s clear is that attackers are getting smarter, and the cost to recover from these attacks is drastically increasing across all sectors — impacting cyber insurance coverage in the process.

In healthcare, the impacts of ransomware are readily seen in each hospital attack, confirming the patient safety risks posed by this extended network downtime. At least three global health systems are currently down after ransomware incidents which have led to care diversion, appointment cancellations and delays.

But as noted in JAMA, there’s not enough data to fully understand the minutiae of hospital impacts after ransomware. While the researchers noted the study’s limits, the data does shine a light on incident response and care disruptions.

The Boldest Cybersecurity Predictions for 2023

Dark Reading posted their “Predictions,” and as expected, they’re bold. Among the notable predictions “Automation is Finally Ready for Prime Time.” There’s been quite a lot of coverage on this issue, and predictions represent both boon and bane for network security teams. Automation could mean eliminating lower-level cybersecurity jobs, but industry observers also believe that more data always means more demand for higher-level analysts and engineers.

We thought this prediction paired nicely with another: “Scary AI & Machine Learning Gets Scarier.” Indeed, we saw evidence last year that shows cybercrime is using AI automation to weaponize deep fakes. Although we haven’t seen it in full practice yet, there’s good reason to believe it’ll be the go-to method for attackers in 2023 and beyond. Imagine seeing videos from people we know telling us it’s cool to share passwords (and other private information) with random callers. If that wasn’t scary enough, imagine ransomware teams using spoofed biometrics, fraudulent identity documents and synthetic identities.

And that’s just two of several they have that deserve a careful read.