What's new arround internet
| Src | Date (GMT) | Titre | Description | Tags | Stories | Notes |
 |
2023-09-27 05:00:29 | Une perspective CISO sur les menaces d'identité A CISO Perspective on Identity Threats (lien direct) |
Compromised credentials and commandeered accounts can act as skeleton keys for your networks and corporate systems. With such a potentially lucrative reward on offer, cyber criminals are increasingly focusing their attacks on your identities to unleash data exfiltration, take over IT environments and launch ransomware attacks. To gain a deeper understanding of how industry leaders are tackling this shift in the threat landscape, I recently participated in a webinar led by Proofpoint executives Tim Choi, group vice president of product marketing, and Ofer Israeli, group vice president and general manager, Identity Threat Defense. We discussed why identity attacks are a growing problem, the challenges of identifying vulnerable users, and how to protect people and data from attacks that use compromised accounts. The ease that compromised identities offer Our industry uses the term “people-centric” a lot. We know that attackers target people so they can launch ransomware campaigns or exfiltrate data. But for today\'s cyber criminals, that is no longer the end of the matter. Threat actors now target people to compromise identities. They use those identities to further elevate their access and privileges. And they, they make lateral moves within organizations to gain intel, launch further attacks and steal more data. Thanks to tools like Mimikatz and Bloodhound that can identify hidden relationships, user permissions and attack paths, the whole process of targeting identities, stealing credentials and escalating privileges is now very simple. Understanding high-risk identities Malicious actors need to know two things to increase the chances of a successful attack: where the data is that they want, and which identity will give them access to it. Most of the time, the answer to the latter is a service account. These accounts are not always protected in a privileged access management solution. They often have access to many different files and systems with static passwords that can do nothing. Regular users who are shadow administrators are also very high-risk identities. They\'re not usually marked as privileged but have often inherited all kinds of access through complicated Active Directory group memberships, which are very hard to follow. Where are organizations most vulnerable to identity attacks? Most organizations have struggled with identity and access management (IAM) for many years. Access has a way of becoming a living, breathing organism, so security teams need to make sure they understand what\'s going on with it. There are three main areas of concern: Shared credentials Stored credentials Shared secrets Most users will have tens, if not hundreds, of usernames and passwords across various accounts. And they are likely reusing credentials across at least some of them. All it takes is for just one site to suffer an attack, and those credentials can be sprayed across many more accounts and systems. When it comes to password storage, businesses must be extremely careful. Get them out of the environment they are used in as a starting point. Unfortunately, many identity attacks originate from drive-by hacking, where cyber criminals get credentials from password dumps or data breaches and try their luck, password spraying across corporate accounts. Protecting your identities Cybersecurity is like an asynchronous war. And by the time we\'ve built a new control or defense mechanism, the bad guys have figured out a new way to circumvent it. That is what\'s happening right now. There are plenty of statistics to confirm that even in the largest breaches, threat actors get in right through the front door. How? Because they gain access to a shared credential and identity that has more access than anyone at the target organization was aware it had. Fundamentally, it is a hygiene issue. We\'re all guilty of getting caught up in new, fancy rocket-science security capabilities. But we\'re missing some of the basics. That\'s simp | Ransomware Tool Threat | ★★★ | |
|
2023-09-21 05:00:51 | Le retour de la livraison directe des ransomwares? The Return of Direct Ransomware Delivery? (lien direct) |
Si vous avez lu notre guide de survie à Ransomware mis à jour, vous savez déjà que le ransomware moderne est rarement livré directement par e-mail.De nos jours, les gangs de ransomware préfèrent s'associer avec les courtiers d'accès initiaux (IAB).Les IAB fonctionnent en distribuant des logiciels malveillants dans des campagnes à haut volume, puis en vendant un accès à des systèmes compromis.Mais il y a encore des cas de bord où les acteurs de la menace essaient de couper l'intermédiaire et de livrer directement des ransomwares.
Un exemple récent de ceci est Knight ou Knight Lite Ransomware (une version rebaptisée du cyclops ransomware-as-a-Service).En août 2023, les chercheurs de Proofpoint ont vu plusieurs campagnes dans lesquelles Knight a été livré directement par e-mail.Ces campagnes étaient principalement à faible volume, avec moins de 500 messages, bien qu'une campagne en contenait plus de 1 000.Les campagnes ont principalement ciblé les utilisateurs anglophones, mais nous avons également noté des campagnes ciblant les utilisateurs en Italie et en Allemagne dans ces langues.
Un leurre sur le thème de la facture a envoyé une récente campagne Knight.
Les leurres e-mail de ces campagnes ont inclus des faux messages d'un site Web de voyage bien connu destiné aux organisations hôtelières, ainsi qu'à des leurres de facturation plus standard.Les e-mails contiennent une pièce jointe HTML qui charge une interface de navigateur dans le navigateur usurpant le site légitime.Cette interface invite ensuite la victime à cliquer et à télécharger un fichier exécutable ou xll zippé contenant le ransomware.Dans certaines campagnes ultérieures ciblant les utilisateurs italiens, la chaîne d'attaque a été modifiée pour inclure un fichier zip interstitiel contenant soit un LNK reliant à un partage WebDAV ou à un XLL, qui installent tous deux un téléchargeur.Cela installe à son tour la charge utile Knight.Le téléchargeur utilisé dans ces chaînes d'attaque ultérieurs n'a pas été vu auparavant dans nos données, et nos chercheurs enquêtent.Dans toutes les chaînes d'attaque, une fois installées, Knight Ransomware commence un mouvement latéral, en scrutant des adresses IP privées en tant que précurseur pour chiffrer les appareils en réseau.
Les fichiers sont chiffrés par une extension .Knight_L, et une note de rançon est laissée des sommes exigeantes allant de 5 000 $ à 15 000 $ en Bitcoin.L'acteur de menace fournit un lien vers un site contenant des instructions supplémentaires et une adresse e-mail pour les informer lorsqu'un paiement a été effectué.Actuellement, il n'y a rien pour indiquer que les données sont exfiltrées et chiffrées.
Capture d'écran de la page Web Knight Ransomware Tor.
Le paysage des menaces a considérablement changé depuis l'époque des campagnes de ransomwares à volume à volume élevé.En fait, les campagnes de Knight récentes sont la première fois depuis 2021 que les chercheurs à preuves ont vu la livraison de ransomwares par courriel dans les semaines consécutives en utilisant les mêmes caractéristiques de la campagne.Mais avec une perturbation récente dans le botnet de logiciel malveillant à grande échelle QBOT-A à grande échelle couramment utilisé par de nombreux attaquants IABS-Ransomware peuvent décider de revoir ces méthodes de livraison.
Pour plus d'informations sur le paysage des ransomwares en développement, consultez le Guide de survie des ransomwares et abonnez-vous à notre blog de menace.
If you\'ve read our updated Ransomware Survival Guide, you already know that modern ransomware is rarely delivered directly by email. These days, ransomware gangs prefer to partner with initial access brokers (IABs). IABs operate by distributing malware in high volume campaigns and then selling access to compromised systems. But there are still some edge cases where threat actors try to cut out the middleman and deliver ransomware directly. A recent example of this is Knight or Knight Li |
Ransomware Malware Threat | ★★ | |
|
2023-09-19 05:00:12 | Pourquoi les données sur les soins de santé sont difficiles à protéger et quoi faire à ce sujet Why Healthcare Data Is Difficult to Protect-and What to Do About It (lien direct) |
Hospitals, clinics, health insurance providers and biotech firms have long been targets for cyber criminals. They handle data like protected health information (PHI), intellectual property (IP), clinical trial data and payment card data, giving attackers many options to cash in. And as healthcare institutions embrace the cloud, remote work and telehealth, the risks of attacks on this data only increase. Besides outside attackers, insider risk is another concern in an industry where employees face high and sustained levels of stress. And then there\'s the increasing risk of ransomware. In the 2022 Internet Crime Report from the FBI\'s Internet Crime Complaint Center, healthcare was called out as the critical infrastructure industry hardest hit by ransomware attacks. In this blog, we\'ll take a look at some of the information protection challenges faced by the healthcare industry today. And we\'ll look at some solutions. Healthcare data breach costs Not only are data breaches in healthcare on the rise, but the costs for these breaches are high for this industry, too. IBM\'s Cost of a Data Breach Report 2023 says that the average cost of a healthcare data breach in the past year was $11 million. These costs can include: Ransoms paid Systems remediation Noncompliance fines Litigation Brand degradation There\'s a high cost in terms of disruptions to patient care as well. System downtime or compromised data integrity due to cyber attacks can put patients at risk. For example, when Prospect Medical Holdings faced a recent cyber attack, its hospitals had to shut down their IT networks to prevent the attack\'s spread. They also needed to revert to paper charts. The Rhysida ransomware gang claimed responsibility for that attack, where a wealth of data, including 500,000 Social Security numbers, patient files, and legal documents, was stolen. Information protection challenges in healthcare Healthcare firms face many challenges in protecting sensitive data. They include: Insider threats and electronic health record (EHR) snooping What are some insider threats that can lead to data breaches in healthcare? Here\'s a short list of examples: Employees might sneak a peek at the medical records of a famous patient and share the details with the media. Careless workers could click on phishing emails and open the door to data theft. Malicious insiders can sell patient data on the dark web. Departing employees can take valuable research data with them to help along own careers. A growing attack surface due to cloud adoption Most healthcare businesses are increasing their use of cloud services. This move is helping them to improve patient care by making information more accessible. But broad sharing of files in cloud-based collaboration platforms increases the risk of a healthcare data breach. It is a significant risk, too. Proofpoint threat intelligence shows that in 2022, 62% of all businesses were compromised via cloud account takeover. Data at risk across multiple data loss channels When EHRs are housed on-premises, patient records can still be accessed, shared and stored on remote endpoint and cloud-based collaboration and email systems. And as healthcare data travels across larger geographies, protecting it becomes much more of a challenge. How Proofpoint can help Our information protection platform, Proofpoint Sigma, provides unmatched visibility and control over sensitive data across email, cloud, web and endpoints. This unified platform allows healthcare businesses to manage data risk, while saving time and reducing operational costs. We can help protect your data from accidental disclosure, malicious attacks and insider risk. As the healthcare industry continues to adopt remote work and telehealth, there is one particular Proofpoint solution that stands out for its ability to help safeguard data. That\'s Proofpoint Insider Threat Management (ITM). It monitors user and data activity on endpoints. And it allows security teams to detect, investigate and respond to potential data l | Ransomware Data Breach Threat Medical Cloud | ★★ | |
|
2023-09-18 05:00:09 | Comment mieux sécuriser et protéger votre environnement Microsoft 365 How to Better Secure and Protect Your Microsoft 365 Environment (lien direct) |
Microsoft 365 has become the de facto standard for email and collaboration for most global businesses. At the same time, email continues to be the most common attack vector for threat actors. And spam, phishing, malware, ransomware and business email compromise (BEC) attacks keep increasing in both their sophistication and impact. Verizon\'s 2023 Data Breach Investigations Report highlights the upward trend BEC attacks, noting that they have doubled over the past year and comprise 60% of social engineering incidents. While Microsoft 365 includes basic email hygiene capabilities with Exchange Online Protection (EOP), you need more capabilities to protect your business against these attacks. Microsoft offers Defender for Office 365 (MDO) as part of its security tool set to bolster security. And it\'s a good place to start, but it simply can\'t stop today\'s most sophisticated email threats. That\'s why analysts suggest you augment native Microsoft 365 security to protect against advanced threats, like BEC and payload-less attacks such as TOAD (telephone-oriented attack delivery). “Supplement the native capabilities of your existing cloud email solutions with third-party security solutions to provide phishing protection for collaboration tools and to address both mobile- and BEC-type phishing scenarios.” Source: 2023 Gartner Market Guide for Email Security The rise of cloud-based email security solutions Email threats are nothing new. For years now, secure email gateways (SEG) have been the go-to solution to stop them. They filter spam, phishing emails and malware before they can get to users\' inboxes. But with more businesses adopting cloud-based email platforms-particularly Microsoft 365-alternative email security solutions have appeared on the market. Gartner calls them integrated cloud email security (ICES); Forrester refers to them as cloud-native API-enabled email security (CAPES). These solutions leave the basic email hygiene and handling of email traffic to Microsoft. Then, they examine the emails that are allowed through. Essentially, they identify threats that have slipped past Microsoft\'s defenses. The main advantage of ICES and CAPES is their ease of deployment and evaluation. They simply require a set of permissions to the Microsoft 365 installation, and they can start detecting threats right away. It\'s easy to remove these solutions, too, making it simple and straightforward to evaluate them. Two deployment models: the good and the bad When you\'re augmenting Microsoft 365 email security, you have several options for deployment. There\'s the post-delivery, API-based approach, which is used by ICES and CAPEs. And there\'s the pre-delivery, MX-based approach used by SEGs. Post-delivery deployment (API-based model) In this scenario, Microsoft provides an API to allow third-party vendors to receive a notification when a new email is delivered to a user\'s mailbox. Then, they process the message with their platform. If a threat is found, it can be deleted or moved to a different folder, like quarantine or junk. However, this approach presents a risk. Because a message is initially delivered to the mailbox, a user still has a chance to click on it until the threat is retracted. Emails must be processed fast or hidden altogether while the solution scans the message for threats. Analyzing attachments for malware or running them through a sandbox is time-consuming, especially for large or complex attachments. There are also limits on how many alerts from Microsoft 365 that cloud-based email security solutions can receive. Pre-delivery deployment (MX-based model) This approach is useful for businesses that want to detect and prevent email threats before they reach their users\' inboxes. As the name suggests, email is processed before it is delivered to a user\'s inbox. To enable this model, an organization\'s DNS email exchange (MX) record must be configured to a mail server. The MX record indicates how email messages should be routed in | Ransomware Data Breach Malware Tool Threat Prediction Cloud | ★★★ |
To see everything:
Our RSS (filtrered)
