Fall is in the air, and the leaves will soon be changing colors, which is fitting because today is National Coloring Day. SonicWall may not have any crayons, but we’ve been adding some color to the media this week with SonicWall EMEA Vice President Spencer Starkey talking to SC Media about threat geomigration and Security Boulevard citing data from our Mid-Year Cyber Threat Report.

In industry news, Bleeping Computer had the lowdown on the latest Lazarus gang cryptojacking attack as well as the massive cyberattack at MGM Resorts. Tech Crunch covered the near-parallel attack at Caesars Entertainment. Dark Reading reported on a brand-new malware variant with a late-night theme.

Remember to keep your passwords close and your eyes peeled – cybersecurity is everyone’s responsibility.

SonicWall News

How to promote online student safety

Security Boulevard, SonicWall News: Worse yet, cybercriminals are upping the ante with a host of sophisticated new attack vectors. SonicWall identified over 270,000 never-before-seen malware variants in just the first half of 2022 — a 45% year-over-year increase. For perspective, that’s the equivalent of 1,500 new malware strains daily.

UK military data possibly compromised in LockBit attack against third party

SC Media, SonicWall News: “Such an attack shows the persistent risk of cyberattacks faced by governments amid threat geomigration,” according to SonicWall Vice President of EMEA Spencer Starkey. “These cyberattacks raise concerns about a country’s own national security, critical national infrastructure as well as the safety of sensitive information,” Starkey added.

Stealthier Means of Malicious Cyber-Attacks and What It Means for IT Departments

Nasdaq, SonicWall News: Bob VanKirk, CEO, SonicWall, joins Jill Malandrino on Nasdaq TradeTalks to discuss stealthier means of malicious cyber-attacks and what it means for IT departments.

SonicWall: ‘Complacency is the enemy in the cybersecurity game’

Unleash, SonicWall News: SonicWall’s VP of EMEA Spencer Starkey’s topline message to organizations is: “Don’t let the overall data fool you.” Yes, the first quarter of 2023 saw the lowest number of attacks since the fourth quarter of 2019 (51.2 million). However, the second quarter of this year saw the number of attacks rocket to 74% higher than Q1 at 88.9 million. Indeed, SonicWall predicts that ransomware attacks are “poised for a rebound” later this year.

Liongard Expands SonicWall Relationship to Enhance Configuration Change Detection and Response with Capture Client Platform to Mitigate Cybersecurity Risk

Business Wire, SonicWall News: “Extending Liongard’s relationship with SonicWall gives us the ability to inspect and assess across the SonicWall solution portfolio,” said Michelle Accardi, CEO of Liongard, “Our integrated solution will proactively monitor SonicWall Capture Client policy configurations, guarding against human errors and changes, both on and off network. With this comprehensive protection in place, our partners gain effective threat protection, increased visibility and protection, and centralized management.”

SonicWall Promotes Michelle Ragusa-McBain To Global Channel Chief

CRN, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to head its sizable global partner organization, just months after hiring the channel veteran as its North America channel chief. Looking ahead, SonicWall is planning to roll out a “soft launch” of its revamped SecureFirst Partner Program in September, with a full global launch of the new program planned for February 2024, Ragusa-McBain told CRN.

SonicWall Promotes Cisco Vet to Global Channel Leader

Channel Futures, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to vice president and global channel leader. She joined SonicWall as vice president and North America channel leader in May. A key theme for SonicWall’s channel strategy is embracing an outside-in approach to crafting its strategy and executing with partners. What that means is we’re listening to our partners and customers more than ever before, rather than operating in a vacuum and telling you what you need.

Ransomware Attacks Skyrocket in Q2 2023

Infosecurity Magazine, SonicWall News: “Ransomware attacks surged by 74% in Q2 2023 compared to the first three months of the year, a new report has found.

The 2023 SonicWall Mid-Year Cyber Threat Report observed two “very unbalanced quarters” regarding the volume of ransomware attacks so far this year. SonicWall Capture Labs Threat Researchers recorded 51.2 million attacks in Q1 2023, representing the smallest number of attacks since Q4 2019.”

How Bitcoin Swings Helped Drive an Almost Nin-fold Surge in Cryptojacking attacks in Europe

DL News, SonicWall News: Cryptojacking attacks skyrocketed when Bitcoin prices fell, and could be the overture to something worse, according to SonicWall researchers. These attacks turn victims’ computers into unknowing crypto mining rigs. Bitcoin reached a $68,000 high in November 2021 before crashing down to as low as just above $16,000 in 2022. It currently hovers around $30,000.

Cryptojacking attacks surge 399% globally as threat actors diversify tactics

ITPro, SonicWall News: Security experts have issued a warning over a significant increase in cryptojacking attacks as threat actors seek to ‘diversify’ their tactics. The volume of cryptojacking attacks surged by 788% in Europe during the first half of the year, with attacks in North America also rising by 345%.

SonicWall: Ransomware Declines Further As Attackers ‘Pivot’ Their Tactics

CRN, SonicWall News: Ransomware continued to lose favor among malicious actors during the first half of 2023, but overall intrusions increased as some attackers switched focus to other types of threats, according to newly released SonicWall data. In the cybersecurity vendor’s report on the first six months of the year, ransomware attack volume dropped 41 percent from the same period a year earlier, the report released Wednesday shows.

Industry News

MGM Resorts Cyberattack Causes IT Shutdown

The main website, online reservation system, and some in-casino services of MGM Resorts International were shut down following a cyberattack this week. As of Thursday, systems have now been down for four full days. The company stated that it began an immediate investigation as soon as it noticed a cyberattack was underway. The systems appear to have been shut down by MGM Resorts itself as a protection measure – not shut down by the hackers. According to a local news outlet, some guests at the resort even reported that their room keys were no longer working. While it appears many systems have been affected, the type of cyber incident that led to this has not been released publicly. A hacking group known as ‘Scattered Spider’ has taken credit for the attack. Scattered Spider is believed to be made up of young adults and teenagers from the United States and United Kingdom. They’ve claimed the attack on MGM but denied involvement with a similar attack on Caesars Entertainment. Dark Reading believes they are responsible for both.  This string of attacks on casinos has certainly shaken things up in Las Vegas. It’s unclear when MGM’s systems may come back online at this time. This isn’t MGM Resorts’ first rodeo with cybersecurity incidents. In 2019, hackers stole more than 10 million customer records from the company. Further information should become available as time goes on.

Caesars Entertainment Suffers Massive Data Breach

MGM isn’t the only casino getting hit with cyberattacks this week. On Thursday, Caesars Entertainment reported that hackers had stolen a significant amount of customer data in a cyberattack. The hackers allegedly stole a complete copy of Caesars’ customer loyalty database. The stolen data has loads of sensitive information including Social Security numbers, driver’s license numbers and more. The report from Caesars indicated that they may have paid a ransom to the hackers, stating, “We have taken steps to ensure that the stolen data is deleted by the unauthorized actor, although we cannot guarantee this result.” Some reports claimed Caesars had paid around $15 million to the hackers to stop the leak of its data. The attack was apparently the result of a social engineering attack on a third-party IT company that works with Caesars. Representatives of Caesars Entertainment haven’t responded to any requests for comments but have confirmed that they’ve reached out to relevant law enforcement agencies concerning the breach. The hacking group that has now taken credit for the attack on MGM, Scattered Spider, denies any involvement in the attack on Caesars, but Dark Reading states otherwise.

Hackers Unveil Never-before-seen ‘3AM’ Malware After LockBit Fails

Threat actors attacking a construction company using LockBit ransomware had a surprise trick up their sleeve. When the LockBit ransomware failed to infiltrate the network, they pulled out a never-before-seen malware variant called ‘3AM.’ According to Dark Reading, the new malware is nothing to write home about other than its cutesy name, but it did sneak through one computer on the system making the attack successful. After deploying 3AM, a thematic note appeared saying, “Hello, ‘3 am’ The time of mysticism, isn’t it? All your files are mysteriously encrypted, and the systems ‘show no signs of life’, the backups disappeared. But we can correct this very quickly and return all your files and operation of the systems to [sic] original state.” While the note reads like a bad attempt at creative writing, the ransomware was indeed successful. Researchers noted that organizations should expect hackers to have more than one method of attack. An attacker using multiple malware families isn’t unheard of. The best thing any organization can do is have robust cybersecurity capable of thwarting multiple malware variants in place.

CoinEx Loses $53 Million of Cryptocurrency in Cryptojacking Attack

CoinEx, a global cryptocurrency exchange platform, announced this week that cyber attackers had stolen more than $50 million worth of cryptocurrency from them. The stolen cryptocurrencies include Ethereum, Tron and Polygon. CoinEx did state that cryptocurrencies held by its users were not affected by this attack, and if it’s discovered that any have been, the affected parties will receive full compensation from CoinEx. According to Bleeping Computer, a blockchain investigator has linked the attack to North Korea’s Lazarus gang. Lazarus has been responsible for many high-profile cryptojacking attacks this year including attacks on Atomic Wallet, Alphapo and CoinsPaid. At this point, one would almost assume that any high-profile cryptojacking will be linked to Lazarus. Crypto exchanges seem to be the favorite target of the group as of late.

SonicWall Blog

Why Firewall Throughput Numbers Don’t Tell the Whole Story – Tiju Cherian

Elevate Your Network with The Ultimate 3 & Free Promotion – Michelle Ragusa-McBain

Why Education is the New Cybercrime Epicenter – Amber Wolff

How SonicWall Offers High Availability at the Lowest Price – Tiju Cherian

Cryptojacking Continues Crushing Records – Amber Wolff

Why Should You Choose SonicWall’s NSsp Firewalls? – Tiju Cherian

Utilize APIs to Scale Your MySonicWall Operation – Chandan Kumar Singh

First-Half 2023 Threat Intelligence: Tracking Cybercriminals Into the Shadows – Amber Wolff

If It’s Easy, It’s TZ – Tiju Cherian

Sonic Boom: Getting to Know the New SonicWall – Michelle Ragusa-McBain

SonicWall’s Traci McCulley Orr Honored as a Talent100 Leader – Bret Fitzgerald

3 & Free Promotion: How to Upgrade to a Gen 7 NSsp Firewall for Free – Michelle Ragusa-McBain

Monthly Firewall Services Option for Simplicity and Scalability – Sorosh Faqiri

September is here, which means the great pumpkin spice drought has finally come to an end. Unfortunately, there’s been no such drought in cybercrime. Be sure to read our Mid-Year Update to the 2023 Cyber Threat Report for the latest trends and details on all things concerning cyber threats.

In industry news, PC Magazine covered the FBI’s huge takedown of the Qakbot botnet. Bleeping Computer had the lowdown on the cyber incident at the University of Michigan. Tech Crunch provided details on the massive data breach at Forever 21. Dark Reading broke down a major vulnerability in Openfire’s enterprise messaging application.

Remember to keep your passwords close and your eyes peeled – cybersecurity is everyone’s responsibility.

SonicWall News

SonicWall Promotes Michelle Ragusa-McBain To Global Channel Chief

CRN, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to head its sizable global partner organization, just months after hiring the channel veteran as its North America channel chief. Looking ahead, SonicWall is planning to roll out a “soft launch” of its revamped SecureFirst Partner Program in September, with a full global launch of the new program planned for February 2024, Ragusa-McBain told CRN.

SonicWall Promotes Cisco Vet to Global Channel Leader

Channel Futures, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to vice president and global channel leader. She joined SonicWall as vice president and North America channel leader in May. A key theme for SonicWall’s channel strategy is embracing an outside-in approach to crafting its strategy and executing with partners. What that means is we’re listening to our partners and customers more than ever before, rather than operating in a vacuum and telling you what you need.

Ransomware Attacks Skyrocket in Q2 2023

Infosecurity Magazine, SonicWall News: “Ransomware attacks surged by 74% in Q2 2023 compared to the first three months of the year, a new report has found.

The 2023 SonicWall Mid-Year Cyber Threat Report observed two “very unbalanced quarters” regarding the volume of ransomware attacks so far this year. SonicWall Capture Labs Threat Researchers recorded 51.2 million attacks in Q1 2023, representing the smallest number of attacks since Q4 2019.”

How Bitcoin Swings Helped Drive an Almost Nin-fold Surge in Cryptojacking attacks in Europe

DL News, SonicWall News: Cryptojacking attacks skyrocketed when Bitcoin prices fell, and could be the overture to something worse, according to SonicWall researchers. These attacks turn victims’ computers into unknowing crypto mining rigs. Bitcoin reached a $68,000 high in November 2021 before crashing down to as low as just above $16,000 in 2022. It currently hovers around $30,000.

Cryptojacking attacks surge 399% globally as threat actors diversify tactics

ITPro, SonicWall News: Security experts have issued a warning over a significant increase in cryptojacking attacks as threat actors seek to ‘diversify’ their tactics. The volume of cryptojacking attacks surged by 788% in Europe during the first half of the year, with attacks in North America also rising by 345%.

SonicWall: Ransomware Declines Further As Attackers ‘Pivot’ Their Tactics

CRN, SonicWall News: Ransomware continued to lose favor among malicious actors during the first half of 2023, but overall intrusions increased as some attackers switched focus to other types of threats, according to newly released SonicWall data. In the cybersecurity vendor’s report on the first six months of the year, ransomware attack volume dropped 41 percent from the same period a year earlier, the report released Wednesday shows.

Evolving Threats – Evolved Strategy

ITVoice, SonicWall News: The ever-evolving cybersecurity landscape is rapidly changing, and businesses must change with it. The massively expanding, distributed IT reality is creating an unprecedented explosion of exposure points for sophisticated cybercriminals and threat actors to exploit.

Britain’s Biggest Hospital Held To Ransom

Cyber Security Intelligence, SonicWall News: SonicWall expert Spencer Starkey said “The healthcare sector continues to be a prime target for malicious actors as evidenced by the recent attack on Barts Health NHS Trust. Not only does this attack risk the potential for exposed patient data, but any significant IT issue that halts patient care poses an immediate threat to life.”

Hackers claim breach is the ‘biggest ever’ in NHS history

Silicon Republic, SonicWall News: Spencer Starkey, vice-president of EMEA at cybersecurity company SonicWall, said that the healthcare sector continues to be a “prime target” for hackers globally. “Not only does this attack risk the potential for exposed patient data, but any significant IT issue that halts patient care poses an immediate threat to life,” said Starkey, referring to the Barts Health cyberattack. The ramifications of an attack on the healthcare sector can be disastrous and it’s important to place the utmost amount of time, money and efforts on securing it.

How to Reach Compliance with HIPAA

TrendMicro, SonicWall News: According to the 2022 SonicWall Cyber Threat Report, healthcare continued a large spike in malware in 2021, at 121%. While the largest jump in IoT malware attacks belonged to healthcare, which saw a 71% year-over-year increase. To shed light on the significance malware can carry, it’s important to look at how recent breaches could’ve been circumvented by abiding to the HIPAA rules and safeguards.

Why Attackers Love to Target IoT Devices

VentureBeat, SonicWall News: Malicious objects were blocked on more than 40% of OT systems. SonicWall Capture Labs threat researchers recorded 112.3 million instances of IoT malware in 2022, an 87% increase over 2021.

Industry News

FBI Circulates Uninstaller to Dismantle Qakbot Botnet

Qakbot, which is a Trojan intended to steal bank account information, has been in circulation since 2008. This week, the United States Justice Department and the FBI announced the success of an operation in which they seized control over the Qakbot servers and forced the botnet to send out an uninstaller that removed the program from infected computers. Agents involved in the investigation said the botnet was controlling some 700,000 computers, 200,000 of which were in the U.S. This is a major blow to cybercrime since Qakbot was so widespread and had been around for such a long time. This probably isn’t the absolute end of the malware, but it’s dealt an incredibly hefty blow to it. Not only did Qakbot work to steal bank account information, but it also operated as a botnet. The creators of Qakbot would sell access to the infected computers to other cybercriminal groups. In a YouTube video announcing the operation’s success, FBI director Christopher Wray stated, “The FBI neutralized this far-reaching, criminal supply chain, cutting it off at the knees.” Qakbot has been linked to some of the most notorious ransomware gangs in the world such as Lockbit, Conti, Black Basta, Royal, Revil and more. The losses suffered by victims of Qakbot are thought to be in the hundreds of millions of dollars. The fight against cybercrime is never-ending, but this is a victory worth celebrating.

Cyberattack Forces University of Michigan to Shut Down Network

The University of Michigan, home to some 30,000 staff and 51,000 students, was forced to shut down all of its network services this week to deal with a cybersecurity incident. The incident took place the day before classes were set to start back for the fall semester. The university had to shut down multiple services including Google, Canvas, Wolverine Access and email services. Since disconnecting, many services have now been restored, including Zoom, Adobe Cloud, Dropbox, Slack, Google and Canvas. The U of M is working with law enforcement and external cybersecurity experts to get to the bottom of the incident, but so far, more information hasn’t become available.

539,000 Customers Affected by Forever 21 Data Breach

Mall-staple Forever 21 suffered a data breach earlier this year that’s affected more than half a million customers. The hacking began in January 2023 and lasted for over three months. The threat actors obtained sensitive information such as data on current and former employees. The stolen data included the names, dates of birth, bank account info, Social Security numbers and healthcare information of the employees. Forever 21 released a statement saying, “Forever 21 has taken steps to help assure that the unauthorized third party no longer has access to the data.” Folks at Tech Crunch speculated that this could imply Forever 21 paid the hacker in exchange for the deletion of the stolen data. If that were the case, there’s no way to trust that the cybercriminals actually deleted the data. This is the second major breach at Forever 21, the first coming in 2017 with a massive theft of credit card numbers. Only time will tell the true ramifications for the employees whose data was stolen.

Kinsing Threat Group Targets Openfire Cloud Servers

A vulnerability in Openfire’s enterprise messaging application is being exploited by the Kinsing hacker gang. The vulnerability, tracked as CVE-2023-32315, is being used by the gang to create fake admin users in Openfire cloud servers that are then used by the group to take full control of the instance. Once they have access, they upload malware and a cryptominer to the servers. Security researchers have tallied over 1,000 attacks utilizing this vulnerability in the past two months. The researchers actually created an Openfire server intended to be used as a honeypot in July. It was attacked almost immediately, and they were able to track 91% of the attacks back to the Kinsing hacker gang. Dark Reading ran a Shodan search that showed over 6,000 internet-connected Openfire servers and found that 984 of those were vulnerable to the flaw. The researchers are asking any organization using Openfire servers to check their systems for vulnerabilities and patch them accordingly.

SonicWall Blog

Elevate Your Network with The Ultimate 3 & Free Promotion – Michelle Ragusa-McBain

Why Education is the New Cybercrime Epicenter – Amber Wolff

How SonicWall Offers High Availability at the Lowest Price – Tiju Cherian

Cryptojacking Continues Crushing Records – Amber Wolff

Why Should You Choose SonicWall’s NSsp Firewalls? – Tiju Cherian

Utilize APIs to Scale Your MySonicWall Operation – Chandan Kumar Singh

First-Half 2023 Threat Intelligence: Tracking Cybercriminals Into the Shadows – Amber Wolff

If It’s Easy, It’s TZ – Tiju Cherian

Sonic Boom: Getting to Know the New SonicWall – Michelle Ragusa-McBain

SonicWall’s Traci McCulley Orr Honored as a Talent100 Leader – Bret Fitzgerald

3 & Free Promotion: How to Upgrade to a Gen 7 NSsp Firewall for Free – Michelle Ragusa-McBain

Monthly Firewall Services Option for Simplicity and Scalability – Sorosh Faqiri

Monitoring and Controlling Internet Usage with Productivity Reports – Ashutosh Maheshwari

Roses are red, violets are blue, today is National Bad Poetry Day, too. While our poetry might be bad, our Mid-Year Update to the 2023 Cyber Threat Report is excellent. Be sure to give it a read to stay on top of the latest trends and intelligence surrounding cyber threats.

In industry news, Dark Reading had the lowdown on a QR code phishing campaign that targeted a U.S. energy giant. Tech Crunch covered the new Citrix ShareFile bug that CISA is sounding the alarm on. Bleeping Computer provided details on the Discord.io hack and the ongoing LinkedIn account stealing debacle.

Remember to keep your passwords close and your eyes peeled: cybersecurity is everyone’s responsibility.

SonicWall News

SonicWall Promotes Michelle Ragusa-McBain To Global Channel Chief

CRN, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to head its sizable global partner organization, just months after hiring the channel veteran as its North America channel chief. Looking ahead, SonicWall is planning to roll out a “soft launch” of its revamped SecureFirst Partner Program in September, with a full global launch of the new program planned for February 2024, Ragusa-McBain told CRN.

SonicWall Promotes Cisco Vet to Global Channel Leader

Channel Futures, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to vice president and global channel leader. She joined SonicWall as vice president and North America channel leader in May. A key theme for SonicWall’s channel strategy is embracing an outside-in approach to crafting its strategy and executing with partners. What that means is we’re listening to our partners and customers more than ever before, rather than operating in a vacuum and telling you what you need.

Ransomware Attacks Skyrocket in Q2 2023

Infosecurity Magazine, SonicWall News: “Ransomware attacks surged by 74% in Q2 2023 compared to the first three months of the year, a new report has found.

The 2023 SonicWall Mid-Year Cyber Threat Report observed two “very unbalanced quarters” regarding the volume of ransomware attacks so far this year. SonicWall Capture Labs Threat Researchers recorded 51.2 million attacks in Q1 2023, representing the smallest number of attacks since Q4 2019.”

How Bitcoin Swings Helped Drive an Almost Nin-fold Surge in Cryptojacking attacks in Europe

DL News, SonicWall News: Cryptojacking attacks skyrocketed when Bitcoin prices fell, and could be the overture to something worse, according to SonicWall researchers. These attacks turn victims’ computers into unknowing crypto mining rigs. Bitcoin reached a $68,000 high in November 2021 before crashing down to as low as just above $16,000 in 2022. It currently hovers around $30,000.

Cryptojacking attacks surge 399% globally as threat actors diversify tactics

ITPro, SonicWall News: Security experts have issued a warning over a significant increase in cryptojacking attacks as threat actors seek to ‘diversify’ their tactics. The volume of cryptojacking attacks surged by 788% in Europe during the first half of the year, with attacks in North America also rising by 345%.

SonicWall: Ransomware Declines Further As Attackers ‘Pivot’ Their Tactics

CRN, SonicWall News: Ransomware continued to lose favor among malicious actors during the first half of 2023, but overall intrusions increased as some attackers switched focus to other types of threats, according to newly released SonicWall data. In the cybersecurity vendor’s report on the first six months of the year, ransomware attack volume dropped 41 percent from the same period a year earlier, the report released Wednesday shows.

Evolving Threats – Evolved Strategy

ITVoice, SonicWall News: The ever-evolving cybersecurity landscape is rapidly changing, and businesses must change with it. The massively expanding, distributed IT reality is creating an unprecedented explosion of exposure points for sophisticated cybercriminals and threat actors to exploit.

Britain’s Biggest Hospital Held To Ransom

Cyber Security Intelligence, SonicWall News: SonicWall expert Spencer Starkey said “The healthcare sector continues to be a prime target for malicious actors as evidenced by the recent attack on Barts Health NHS Trust. Not only does this attack risk the potential for exposed patient data, but any significant IT issue that halts patient care poses an immediate threat to life.”

Hackers claim breach is the ‘biggest ever’ in NHS history

Silicon Republic, SonicWall News: Spencer Starkey, vice-president of EMEA at cybersecurity company SonicWall, said that the healthcare sector continues to be a “prime target” for hackers globally. “Not only does this attack risk the potential for exposed patient data, but any significant IT issue that halts patient care poses an immediate threat to life,” said Starkey, referring to the Barts Health cyberattack. The ramifications of an attack on the healthcare sector can be disastrous and it’s important to place the utmost amount of time, money and efforts on securing it.

How to Reach Compliance with HIPAA

TrendMicro, SonicWall News: According to the 2022 SonicWall Cyber Threat Report, healthcare continued a large spike in malware in 2021, at 121%. While the largest jump in IoT malware attacks belonged to healthcare, which saw a 71% year-over-year increase. To shed light on the significance malware can carry, it’s important to look at how recent breaches could’ve been circumvented by abiding to the HIPAA rules and safeguards.

Why Attackers Love to Target IoT Devices

VentureBeat, SonicWall News: Malicious objects were blocked on more than 40% of OT systems. SonicWall Capture Labs threat researchers recorded 112.3 million instances of IoT malware in 2022, an 87% increase over 2021.

Industry News

Major US Energy Company Targeted by QR Code Phishing Campaign

Security researchers discovered a QR code phishing campaign sending thousands of emails to employees of a major energy company in the United States as well as other industries. The lures sent out by the hackers included PNG attachments and redirect links that claimed to be associated with either Microsoft, Salesforce or CloudFlare. The emails included urgent messages telling employees to update their Microsoft account security settings, with the ultimate goal of credential theft. The campaign did target multiple industries, but a majority of the emails were sent to an unnamed top U.S. energy company. Other affected industries included manufacturing, insurance, tech and finance. The campaign is by no means over – it’s ongoing. According to researchers, it’s growing 270% each month. QR codes aren’t a traditional method of delivery for phishing lures, but the researchers noted that they’re more likely to reach inboxes due to limitations on Secure Email Gateways (SEGs). Most SEGs can scan links for malicious intent, but they can’t scan QR codes. That gives the attackers an advantage. Workers in the affected industries should stay vigilant and be cautious should they receive a QR code claiming they need to update security settings.

CISA Sounds the Alarm on New Citrix ShareFile Bug

It seems like filesharing tools are a prime target for threat actors in 2023, as CISA has issued a warning that hackers are now exploiting a bug in Citrix ShareFile. The bug, tracked as CVE-2023-24489, could spell bad news for federal enterprises which CISA noted are at significant risk from this particular vulnerability. The bug was discovered in June and given a severity rating of 9.8 out of 10. The flaw is concerning Citrix ShareFile’s “storage zones controller” feature that allows on-premise file storage as well as storage on supported cloud platforms. Threat actors could exploit the vulnerability to compromise these instances without needing a password. Security researchers noted that they’ve already found 6,000 publicly exposed instances as of July. Since we’re now in the middle of August, that number has likely increased. Organizations utilizing the vulnerable feature should work to patch this as soon as possible to mitigate risks. This vulnerability comes on the heels of the Cl0p ransomware gang’s exploitation of a bug in MOVEit’s files transfer tool that’s affected more than 200 organizations around the globe.

LinkedIn Accounts Hijacked, Some Even Asked to Pay Ransom

LinkedIn users are having a rough time this week as many users find themselves either locked out of their accounts or with their accounts completely hijacked. On top of that, LinkedIn support seems totally overwhelmed with users reporting lengthy response times and little to no resolutions. Some users have even experienced being asked to pay a ransom to get back their accounts. Dismayed users took to Reddit and Twitter to sound the alarm on both the breach and LinkedIn’s lack of response. LinkedIn still hasn’t made an official announcement despite some users reporting breaches as long as ten days ago. Bleeping Computer reported that the hackers are likely using stolen credentials or brute forcing to steal accounts. Users who have multi-factor authentication (MFA) enabled have faced lockouts as part of LinkedIn’s security policy. It’s unclear if it’s a hacking group or multiple individuals carrying out the attacks, but one common theme in the attacks is that the hackers replace the real owners’ email addresses with an email address ending in “rambler.ru”. If you frequent LinkedIn, it may be a good idea to go ahead and enable MFA and change your password just in case.

Data of 760,000 Discord.io Users Stolen, Service Shuts Down

A custom invite service for the popular communication application Discord has been shut down after an attacker managed to steal the data of 760,000 users. To be clear, the website that was hacked (Discord.io) is a third-party service that isn’t associated with the real Discord. The third-party service is widely used by people who own or manage Discord servers. This week, a hacker by the name ‘Akhirah’ began offering the data for sale on hacking forums and provided proof that the data was legitimate. The data included mainly usernames and email addresses, but it also included a small number of billing addresses as well as salted and hashed passwords. Discord.io’s response was to cease all operations for an indefinite period of time. Bleeping Computer spoke with the hacker, who claimed that this hack isn’t just about money. The hacker claims that some of the servers that Discord.io oversees link to illegal and harmful content and seemed to imply that that was at least part of their reason for the attack. Any users of Discord.io should be treating the situation as if their data will be abused. Since email addresses were included in the breach, they should keep a watchful eye out for emails attempting to get them to enter passwords or obtain other information.

SonicWall Blog

Cryptojacking Continues Crushing Records – Amber Wolff

Why Should You Choose SonicWall’s NSsp Firewalls? – Tiju Cherian

Utilize APIs to Scale Your MySonicWall Operation – Chandan Kumar Singh

First-Half 2023 Threat Intelligence: Tracking Cybercriminals Into the Shadows – Amber Wolff

If It’s Easy, It’s TZ – Tiju Cherian

Sonic Boom: Getting to Know the New SonicWall – Michelle Ragusa-McBain

SonicWall’s Traci McCulley Orr Honored as a Talent100 Leader – Bret Fitzgerald

3 & Free Promotion: How to Upgrade to a Gen 7 NSsp Firewall for Free – Michelle Ragusa-McBain

Monthly Firewall Services Option for Simplicity and Scalability – Sorosh Faqiri

Monitoring and Controlling Internet Usage with Productivity Reports – Ashutosh Maheshwari

SonicWall NSM 2.3.5 Brings Enhanced Alerting Capabilities – Suriti Singh

Is Red/Blue Teaming Right for Your Network? – Stephan Kaiser

NSv Series and Microsoft Azure’s Government Cloud: Strengthening Cloud Security – Tiju Cherian

 

It’s the middle of August, and SonicWall is having another excellent month. Be sure to check out the Mid-Year 2023 Cyber Threat Report for the latest must-know data and trends in the cybersecurity space.

In industry news, Dark Reading covered the recent rise in ransomware’s victim count. Data Breach Today provided details on a dangerous data leak with the police in Northern Ireland. Bleeping Computer had the lowdown on Missouri’s Medicaid data breach. Hacker News reported on a massive exposure of U.K. voter data.

Remember to keep your passwords close and your eyes peeled – cybersecurity is everyone’s responsibility.

SonicWall News

SonicWall Promotes Michelle Ragusa-McBain To Global Channel Chief

CRN, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to head its sizable global partner organization, just months after hiring the channel veteran as its North America channel chief. Looking ahead, SonicWall is planning to roll out a “soft launch” of its revamped SecureFirst Partner Program in September, with a full global launch of the new program planned for February 2024, Ragusa-McBain told CRN.

SonicWall Promotes Cisco Vet to Global Channel Leader

Channel Futures, SonicWall News: SonicWall has promoted Michelle Ragusa-McBain to vice president and global channel leader. She joined SonicWall as vice president and North America channel leader in May. A key theme for SonicWall’s channel strategy is embracing an outside-in approach to crafting its strategy and executing with partners. What that means is we’re listening to our partners and customers more than ever before, rather than operating in a vacuum and telling you what you need.

Ransomware Attacks Skyrocket in Q2 2023

Infosecurity Magazine, SonicWall News: “Ransomware attacks surged by 74% in Q2 2023 compared to the first three months of the year, a new report has found.

The 2023 SonicWall Mid-Year Cyber Threat Report observed two “very unbalanced quarters” regarding the volume of ransomware attacks so far this year. SonicWall Capture Labs Threat Researchers recorded 51.2 million attacks in Q1 2023, representing the smallest number of attacks since Q4 2019.”

How Bitcoin Swings Helped Drive an Almost Nin-fold Surge in Cryptojacking attacks in Europe

DL News, SonicWall News: Cryptojacking attacks skyrocketed when Bitcoin prices fell, and could be the overture to something worse, according to SonicWall researchers. These attacks turn victims’ computers into unknowing crypto mining rigs. Bitcoin reached a $68,000 high in November 2021 before crashing down to as low as just above $16,000 in 2022. It currently hovers around $30,000.

Cryptojacking attacks surge 399% globally as threat actors diversify tactics

ITPro, SonicWall News: Security experts have issued a warning over a significant increase in cryptojacking attacks as threat actors seek to ‘diversify’ their tactics. The volume of cryptojacking attacks surged by 788% in Europe during the first half of the year, with attacks in North America also rising by 345%.

SonicWall: Ransomware Declines Further As Attackers ‘Pivot’ Their Tactics

CRN, SonicWall News: Ransomware continued to lose favor among malicious actors during the first half of 2023, but overall intrusions increased as some attackers switched focus to other types of threats, according to newly released SonicWall data. In the cybersecurity vendor’s report on the first six months of the year, ransomware attack volume dropped 41 percent from the same period a year earlier, the report released Wednesday shows.

Evolving Threats – Evolved Strategy

ITVoice, SonicWall News: The ever-evolving cybersecurity landscape is rapidly changing, and businesses must change with it. The massively expanding, distributed IT reality is creating an unprecedented explosion of exposure points for sophisticated cybercriminals and threat actors to exploit.

Britain’s Biggest Hospital Held To Ransom

Cyber Security Intelligence, SonicWall News: SonicWall expert Spencer Starkey said “The healthcare sector continues to be a prime target for malicious actors as evidenced by the recent attack on Barts Health NHS Trust. Not only does this attack risk the potential for exposed patient data, but any significant IT issue that halts patient care poses an immediate threat to life.”

Hackers claim breach is the ‘biggest ever’ in NHS history

Silicon Republic, SonicWall News: Spencer Starkey, vice-president of EMEA at cybersecurity company SonicWall, said that the healthcare sector continues to be a “prime target” for hackers globally. “Not only does this attack risk the potential for exposed patient data, but any significant IT issue that halts patient care poses an immediate threat to life,” said Starkey, referring to the Barts Health cyberattack. The ramifications of an attack on the healthcare sector can be disastrous and it’s important to place the utmost amount of time, money and efforts on securing it.

How to Reach Compliance with HIPAA

TrendMicro, SonicWall News: According to the 2022 SonicWall Cyber Threat Report, healthcare continued a large spike in malware in 2021, at 121%. While the largest jump in IoT malware attacks belonged to healthcare, which saw a 71% year-over-year increase. To shed light on the significance malware can carry, it’s important to look at how recent breaches could’ve been circumvented by abiding to the HIPAA rules and safeguards.

Why Attackers Love to Target IoT Devices

VentureBeat, SonicWall News: Malicious objects were blocked on more than 40% of OT systems. SonicWall Capture Labs threat researchers recorded 112.3 million instances of IoT malware in 2022, an 87% increase over 2021.

Industry News

Zero-day Exploits Cause Rise in Ransomware Victims

Between the first quarter of 2022 and the first quarter of 2023, ransomware’s victim count rose by 143%. As noted in the Mid-Year 2023 Cyber Threat Report, ransomware attacks as a whole are down. So why might the number of victims be up? The answer: zero-day exploits. Ransomware attackers are increasingly choosing to exploit zero-day vulnerabilities when choosing their next targets. The researchers found that threat actors are moving away from classic attack methods like phishing and moving straight to finding zero-day exploits, either on the gray market or through in-house development. The Cl0p ransomware gang may be the most notorious example of this. This year alone they’ve used zero-day exploits to break into multiple large companies with exploits on Fortra’s GoAnywhere software and MOVEit’s file transfer tool. Researchers also found that ransomware groups are moving away from encrypting the victim’s data and moving more toward exfiltrating the data. Gone are the days when a hacked company could find a way to unencrypt its data leaving the attackers in the dust – with the switch to exfiltration, victims can now either pay up or risk having their data sold on the Dark Web. These are concerning trends to see especially when many expect ransomware attack numbers to rebound in the second half of 2023. Robust cybersecurity measures and good cyber hygiene practices are the best ways for organizations to protect themselves from attacks.

Serious Data Mishap Puts Police in Northern Ireland in Danger

The Police Service of Northern Ireland (PSNI) accidentally uploaded a spreadsheet containing the first initials, surnames and locations of all officers and staff on its website earlier this week. The PSNI blamed ‘human error’ for the mistake. The spreadsheet was live on the PSNI website for at least three hours on Tuesday afternoon. Fortunately, the spreadsheet did not include home addresses. PSNI had created the spreadsheet to comply with a freedom of information request, but it’s unclear how it ended up on the website for the public’s view although an investigation is underway. This situation has even higher stakes with the historical context of policing in Northern Ireland. Many of the officers and employees actually hide their employment – some even go so far as to hide it from their families. That means that although it didn’t include home addresses, even the names of employees can have serious consequences. In March, the British government sounded the alarm on terrorism in Northern Ireland following an assassination attempt on a police officer. The head of a cybersecurity firm in Dublin called this leak “the most serious breach” he has ever seen. The information exposed in this spreadsheet could be used not just by petty criminals, but by republican paramilitaries to commit acts of terror against officers. The breach could result in numerous members of the PSNI needing to relocate their homes and families.

Missouri Medicaid Data Exposed in IBM MOVEit Breach

Following the Cl0p ransomware gangs MOVEit file transfer tool attacks, Missouri’s Department of Social Services (DSS) has announced that sensitive healthcare information from Missouri’s Medicaid program was exposed. The attack didn’t actually take place on Missouri’s DSS – it was against IBM, which provides data services to the DSS. IBM stated that they’ve been working with the DSS to minimize the damage from this incident. According to the DSS, the exposed information potentially includes names, department client numbers, dates of birth, benefit eligibility and medical claims information. According to Bleeping Computer, only two Social Security Numbers were included in the breach. The Missouri DSS recommended that all involved individuals freeze their credit to prevent fraud.

Voter Data of Over 40 million Exposed in UK Electoral Commission Breach

Voters in the United Kingdom should be wary as the U.K.’s Electoral Commission has announced that they’ve suffered a “complex” cyberattack. The commission identified the incident in October 2022 but noted that the attackers had access to the system since August 2021. With over a year of free reign inside the Commission’s systems, the threat actors had access to the voter data of 40 million people. The only excluded parties are those who registered anonymously or electors registered outside of the U.K. According to Hacker News, the data included names, email addresses, home addresses, phone numbers, personal images and more. As of now, the identity of the attackers is unknown. It’s also unclear why the Commission waited 10 months to disclose this attack. The Commission’s email server was also exposed which puts anyone who was in contact with the Commission through email at risk. A security watchdog recommended that anyone who has been in contact with the Commission and anyone who registered to vote between 2014 and 2022 should keep a careful eye out for unauthorized use of their personal information.

SonicWall Blog

Why Should You Choose SonicWall’s NSsp Firewalls? – Tiju Cherian

Utilize APIs to Scale Your MySonicWall Operation – Chandan Kumar Singh

First-Half 2023 Threat Intelligence: Tracking Cybercriminals Into the Shadows – Amber Wolff

If It’s Easy, It’s TZ – Tiju Cherian

Sonic Boom: Getting to Know the New SonicWall – Michelle Ragusa-McBain

SonicWall’s Traci McCulley Orr Honored as a Talent100 Leader – Bret Fitzgerald

3 & Free Promotion: How to Upgrade to a Gen 7 NSsp Firewall for Free – Michelle Ragusa-McBain

Monthly Firewall Services Option for Simplicity and Scalability – Sorosh Faqiri

Monitoring and Controlling Internet Usage with Productivity Reports – Ashutosh Maheshwari

SonicWall NSM 2.3.5 Brings Enhanced Alerting Capabilities – Suriti Singh

Is Red/Blue Teaming Right for Your Network? – Stephan Kaiser

NSv Series and Microsoft Azure’s Government Cloud: Strengthening Cloud Security – Tiju Cherian

Four SonicWall Employees Featured on CRN’s 2023 Women of the Channel List – Bret Fitzgerald

NSv Series and AWS GovCloud: Facilitating Government’s Move to the Cloud – Tiju Cherian