Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Businesses. Show all posts
UK
attacks Businesses Cyber Crime CyberCrime global cooperation guidance insurance Ransomware resilience Security UK

Global Effort Unites Against Ransomware: New Guidance to Strengthen Business Defenses

  

Ransomware attacks continue to pose significant challenges for businesses worldwide, with incidents on the rise. 

In response, the UK, along with 38 other nations and international cyber insurance organizations, has collaborated to release updated guidance aimed at supporting victims and enhancing resilience. This guidance advises against making immediate ransom payments, as recovery of data or malware removal is not guaranteed, and paying ransoms often encourages further criminal activity.

Instead, businesses are urged to create a comprehensive response plan, with policies and contingency measures in place. Organizations that fall victim to ransomware should report the incident to law enforcement and consult security professionals for expert guidance.

Ransomware has become a lucrative venture for cybercriminals, causing an estimated $1 billion in losses in 2023. By removing the incentive for criminals, these new policies aim to weaken the ransomware business model and reduce future attacks.

"International cooperation is crucial in fighting ransomware as cybercrime knows no borders," stated Security Minister Dan Jarvis. He emphasized that this collective effort will hit cybercriminals financially and better protect businesses in the UK and beyond.

The UK is taking a leading role, collaborating with three major insurance organizations—the Association of British Insurers, the British Insurance Brokers' Association, and the International Underwriting Association—to issue co-sponsored guidance. Meanwhile, the UK National Crime Agency has taken steps by sanctioning 16 individuals from the 'Evil Corp' cybercrime group, responsible for over $300 million in theft from critical infrastructure, healthcare, and government sectors.

Jonathon Ellison, Director for National Resilience at the NCSC, highlighted the urgency of addressing ransomware threats: "This guidance, backed by both international bodies and cyber insurance organizations, represents a united front in bolstering defenses and increasing cyber readiness."
Read more »
Technology
Artificial Intelligence Businesses Deep Fakes Financial Loss Scotland Technology

Why AI-Driven Cybercrime Could Be Your Business's Biggest Risk


 


The way technology keeps shifting its paradigm, the line between genuine interactions and digital deception is becoming increasingly difficult to distinguish. Today’s cybercriminals are leveraging the power of generative artificial intelligence (AI) to create more closely intricate and harder-to-detect threats. This new wave of AI-powered cybercrime represents a humongous challenge for organisations across the globe.

Generative AI, a technology known for producing lifelike text, images, and even voice imitations, is now being used to execute more convincing and elaborate cyberattacks. What used to be simple email scams and basic malware have developed into highly realistic phishing attempts and ransomware campaigns. Deepfake technology, which can fabricate videos and audio clips that appear genuine, is particularly alarming, as it allows attackers to impersonate real individuals with unprecedented accuracy. This capability, coupled with the availability of harmful AI tools on the dark web, has armed cybercriminals with the means to carry out highly effective and destructive attacks.

While AI offers numerous benefits for businesses, including efficiency and productivity, it also expands the scope of potential cyber threats. In regions like Scotland, where companies are increasingly adopting AI-driven tools, the risk of cyberattacks has grown considerably. A report from the World Economic Forum, in collaboration with Accenture, highlights that over half of business leaders believe cybercriminals will outpace defenders within the next two years. The rise in ransomware incidents—up 76% since late 2022— underlines the severity of the threat. One notable incident involved a finance executive in Hong Kong who lost $25 million after being deceived by a deep fake video call that appeared to be from his CFO.

Despite the dangers posed by generative AI, it also provides opportunities to bolster cybersecurity defences. By integrating AI into their security protocols, organisations can improve their ability to detect and respond to threats more swiftly. AI-driven algorithms can be utilised to automatically analyse code, offering insights that help predict and mitigate future cyberattacks. Moreover, incorporating deepfake detection technologies into communication platforms and monitoring systems can help organisations safeguard against these advanced forms of deception.

As companies continue to embrace AI technologies, they must prioritise security alongside innovation. Conducting thorough risk assessments before implementing new technologies is crucial to ensure they do not inadvertently increase vulnerabilities. Additionally, organisations should focus on consolidating their technological resources, opting for trusted tools that offer robust protection. Establishing clear policies and procedures to integrate AI security measures into governance frameworks is essential, especially when considering regulations like the EU AI Act. Regular training for employees on cybersecurity practices is also vital to address potential weaknesses and ensure that security protocols are consistently followed.

The rapid evolution of generative AI is reshaping the course of cybersecurity, requiring defenders to continuously adapt to stay ahead of increasingly sophisticated cybercriminals. For businesses, particularly those in Scotland and beyond, the role of cybersecurity professionals is becoming increasingly critical. These experts must develop new skills and strategies to defend against AI-driven threats. As we move forward in this digital age, the importance of cybersecurity education across all sectors cannot be overstated— it is essential to safeguarding our economic future and maintaining stability in a world where AI is taking the steering wheel.


Read more »
Ransomware
Businesses Data Breach data security Japan Kadokawa Group Ransomware

Kadokawa Group Hit by Major Ransomware Attack


 

Kadokawa Group, the parent company of renowned game developer FromSoftware, has fallen victim to a gruesome ransomware attack. The Japanese conglomerate, known for its diverse involvement in book publishing, the video-sharing service Niconico, and various other media enterprises, revealed the breach on Thursday. While the extent of the damage is still being assessed, the company is actively investigating potential information leaks and their impact on its business operations for the upcoming year.

The cyberattack, which occurred on Saturday, June 8, targeted the servers located in Kadokawa Group’s data centre. Niconico and its related services were the primary targets of this attack. Kadokawa Group stated that they are working on solutions and workarounds on a company-wide basis to restore normalcy to their systems and business activities. Despite the attack, Kadokawa assured that they do not store credit card information in their systems, which provides some relief regarding financial data security.

FromSoftware, the acclaimed studio behind hits like Dark Souls and Elden Ring, has not been specifically mentioned in Kadokawa’s disclosure about the affected businesses. This leaves some uncertainty about whether FromSoftware’s data and systems were compromised. However, Kadokawa’s broad approach to addressing the issue suggests a company-wide effort to mitigate any potential damage.

This incident is not an isolated one in the gaming industry. FromSoftware’s publishing partner, Bandai Namco, experienced a ransomware attack in 2022. Other prominent gaming companies, including Capcom, CD Projekt Red, and Insomniac Games, have also faced similar breaches. Notably, Rockstar Games suffered a major data breach in 2022, which resulted in the leak of an in-development build of Grand Theft Auto VI. In response, Rockstar took measures to enhance security, including limiting remote work.

Kadokawa Group is expected to provide further updates on the ransomware attack and the status of their systems in July. The company’s ongoing efforts to investigate and resolve the issue are crucial in determining the full impact of the breach.

While FromSoftware’s next project remains a mystery, fans eagerly anticipate the possibility of a Bloodborne sequel. Despite the current uncertainties surrounding the ransomware attack, the gaming community continues to look forward to future announcements from the esteemed game studio.

Kadokawa Group’s handling of this cyberattack will be closely watched as it unfolds, with implications for both their media operations and the wider industry’s approach to cybersecurity.


Read more »
Information Security
Businesses Customer Information Cyber Threats Data Breach Data Storage Information Security

The Role of Immutable Data Storage in Strengthening Cybersecurity


 

In today’s rapidly advancing digital world, how organisations store their data is crucial to their cybersecurity strategies. Whether protecting sensitive customer information, securing intellectual property, or ensuring smooth business operations, effective data storage methods can prominently impact an organisation's defence against cyber threats.

Modern businesses are experiencing a massive increase in data generation. This surge is driven by technological innovation, growing customer interactions, and expanding business operations. As data continues to grow at an exponential rate, organisations must find ways to fully utilise this data while also ensuring its security and availability.

Cyberattacks are becoming more frequent and sophisticated, making data protection a top priority for businesses. Ransomware attacks, in particular, are a major concern. These attacks involve cybercriminals encrypting an organisation’s data and demanding a ransom for its release. According to the Verizon 2023 Data Breach Investigations report, ransomware is involved in over 62% of incidents linked to organised crime and 59% of financially motivated incidents. The consequences of such attacks are severe, with businesses taking an average of 9.9 days to return to normal operations after a ransomware incident. Additionally, 1 in 31 companies worldwide faces weekly ransomware attacks, underscoring the urgent need for robust data protection measures.

Immutable data storage has become a key strategy in bolstering cybersecurity defences. Unlike traditional storage methods, which allow data to be modified or deleted, immutable storage ensures that once data is written, it cannot be altered or erased. This feature is crucial for maintaining data integrity and protecting critical information from tampering and unauthorised changes.

By adopting immutable storage solutions, organisations can significantly reduce the risks associated with cyberattacks, particularly ransomware. Even if attackers manage to penetrate the network, the immutable data remains unchanged and intact, rendering ransom demands ineffective. This approach not only protects sensitive information but also helps maintain business continuity during and after an attack.

As businesses continue to face the growing threat of cybercrime, adopting advanced data storage solutions like immutable storage is essential. By ensuring that data cannot be altered or deleted, organisations can better protect themselves from the devastating impacts of cyberattacks, safeguard critical information, and maintain operations without interruption. In an age where data is both a valuable asset and a prime target, robust storage strategies are indispensable to a comprehensive cybersecurity strategy.



Read more »
reputation
Businesses Cyber Attacks Cybersecurity measures data security Data Theft endpoint detection and response financial risks payment diversion fraud Ransomware reputation

Growing Threat of Cyberattacks Puts Businesses at Risk

 

In an era defined by digital advancements, businesses face an escalating peril: cyberattacks. While the digital age has opened up unprecedented opportunities, it has also ushered in a formidable threat to businesses' financial stability, data integrity, and reputation.

Recent years have witnessed a surge in both the frequency and sophistication of these attacks, leaving a trail of financial losses and reputational damage. Notably, small enterprises with fewer than ten employees have seen an alarming rise in cyberattacks, jumping from 23% to 36% over the past three years, according to a report from Hiscox, an insurance company.

The pandemic exacerbated vulnerabilities, with hospitals becoming frequent targets of ransomware attacks, jeopardizing patient well-being. A prevalent form of cybercrime, payment diversion fraud, affected one in three businesses within the last year, as highlighted by Eddie Lamb, Cyber Education and Advisory expert at Hiscox.

This form of attack involves cybercriminals attempting to redirect or steal payments meant for legitimate recipients. Ransomware attacks persist, as evidenced by a recent breach targeting the Greater Manchester police force. Additionally, data theft remains a persistent threat, with confidential information and intellectual property being prime targets.

According to Lamb, the average cost of an attack stands at €15,000, but one in eight afflicted businesses faced losses exceeding €238,000. Shockingly, one in five respondents stated that the cyber attack they endured posed a significant threat to the future viability of their business.

Beyond financial repercussions, cyberattacks also inflict intangible harm. Lamb emphasized that the damage extends to elements like brand reputation and the erosion of consumer trust, potentially leading to enduring consequences.

This is particularly evident in data breaches, where sensitive information beyond email lists may be compromised. For instance, in 2020, US cybersecurity firm FireEye fell victim to a highly sophisticated attack, possibly orchestrated by a nation-state, resulting in the loss of a critical toolkit.

While such large-scale attacks are infrequent, businesses of all sizes must fortify their defenses. Lamb stressed that while there's no foolproof safeguard, implementing modern anti-virus technology with endpoint detection and response (EDR) is crucial. EDR enables real-time threat monitoring and can autonomously take measures to prevent or mitigate harm.

Other protective measures include adopting multifactor authentication and biometrics. The UK National Cyber Security Centre also underscores the importance of robust data backups in its cyber security guide for small businesses. Online training resources and check tools tailored for small-sized businesses offer further support.

Recognizing that human error is a significant vulnerability, educating and training employees on best cybersecurity practices is essential. As cybercrime tactics evolve, staying updated on the latest trends is paramount.

Lamb urged businesses to be proactive, emphasizing that cyberattacks are a matter of "when" rather than "if". He stressed that the pivotal factor lies not in experiencing a breach, but in the response to it. Consequently, clear and comprehensive security policies, including an incident response plan, are crucial. Additionally, having a dedicated cyber defense team or individual is pivotal, ensuring a swift and coordinated response to minimize downtime.
Read more »
threat report
Businesses Cyber Security cyber threat data security Ransomware threat report

Ransomware Remains a Major Cyber Threat for Organizations Worldwide

 

Trellix, the cybersecurity firm delivering the future of extended detection and response (XDR), has published 'The Threat Report: Fall 2022,' examining cybersecurity patterns and attack techniques from the first quarter of the year. 

The threat report includes evidence of malicious activity linked to ransomware and state-linked advanced persistent threat (APT) hackers. The researchers examined proprietary data from its sensor network, open-source intelligence, and investigations by the Trellix Advanced Research Center. Here are some of the report’s key findings: 

• Transportation was the second most active sector globally, following telecom. APTs were also detected in transportation more than in any other sector. 

• Ransomware attacks surged 32% in Germany in Q3 and contributed 27% of global activity. Germany also experienced the most threat detections related to malicious hackers in Q3, with 29% of observed activity. In the United States, ransomware activity increased 100 % quarter-over-quarter in the transportation and shipping industries for Q3 2022. 

• Mustang Panda, a China-linked APT group, had the most identified threat indicators in Q3, followed by Russian-associated APT29 and Pakistan-linked APT36. 

• Phobos, ransomware sold as a complete kit in the cybercriminal underground, accounted for 10% of global detected activity and was the second most used ransomware detected in the US. 

• The infamous LockBit remained the most propagated ransomware in the third quarter of 2022, generating over a fifth (22%) of detections 

• Years-old security loopholes continue to remain a perfect target spot for threat actors. Threat analysts detected Microsoft Equation Editor vulnerabilities CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802 to be the most abused among malicious emails received by users during Q3. 

• Cobalt Strike, an authentic third-party tool, was employed in 33% of detected global ransomware activity and in 18% of APT detections in Q3. 

“So far in 2022, we have seen unremitting activity out of Russia and other state-sponsored groups. This activity is compounded by a rise in politically motivated hacktivism and sustained ransomware attacks on healthcare and education. The need for increased inspection of cyber threat actors and their methods has never been greater,” John Fokker, Trellix head of threat intelligence, stated. 

Earlier this year, Trellix announced its partner program to include multiple latest features along with 10 new technology associates and technology integrations with its flagship platform. The partner additions bring Trellix’s ecosystem to some 800 partners associated with its XDR platform.
Read more »
Ransomware
Businesses Cyber Attacks North Korean Hackers Ransom Ransomware

North Korean Hackers Employ H0lyGh0st Ransomware to Target Businesses

 

Researchers from Microsoft’s Threat Intelligence Center (MSTIC) this week claimed that the North Korean hackers are employing the H0lyGh0st ransomware to target small and midsize businesses worldwide. 

The hacking group, which calls itself H0lyGh0st and is tracked by Microsoft as DEV-0530, has been employing ransomware since at least June 2021 and has successfully exploited multiple businesses since September 2021. 

The activities of DEV-0530 are similar to other ransomware gangs out there. The group engages in double extortion, threatening to publish personal data stolen from victims unless a ransom is paid. 

In recent years, North Korean hackers have siphoned hundreds of millions of dollars from foreign businesses to help their country which is struggling economically due to the U.S. sanctions and the COVID-19 pandemic. However, it is equally possible that the hackers are employing ransomware for personal gain, which could explain an “often-random selection of victims.” 

According to Microsoft, the activities of DEV-0530 are partially linked to a group known as Plutonium (also known as DarkSeoul or Andariel). Both groups have been spotted operating from the same infrastructure, employing custom malware controllers with similar names, and emailing accounts belonging to each other. 

“MSTIC has observed known DEV-0530 email accounts communicating with known PLUTONIUM attacker accounts. MSTIC has also observed both groups operating from the same infrastructure set, and even using custom malware controllers with similar names,” Microsoft says. 

The researchers also identified that the hacker’s activities are consistent with the UTC+9 time zone employed in North Korea. DEV-0530’s first malicious payload was spotted in June last year, BLTC_C.exe, which was classified as SiennaPurple, despite its lack of complexity compared to other variants in the same ransomware family. More powerful derivatives of the malware were released later, between October 2021 and May 2022, and were based on the Go programming language. 

In November 2021 DEV-0530 successfully exploited several small-to-midsized businesses in the manufacturing, finance, education, and event and meeting planning sectors in multiple nations. Likely opportunistic, the attacks exploited vulnerabilities such as CVE-2022-26352 on public-facing web assets for initial access. 

Subsequently, the hackers would steal “a full copy of the victims’ files” and then shift to encrypt the contents on the system, appending the .h0lyenc extension to impacted files. In addition to dropping a ransom note, the attackers emailed the victim to inform them that their data was stolen and encrypted by H0lyGh0st. 

“Based on our investigation, the attackers frequently asked victims for anywhere from 1.2 to 5 Bitcoins. However, the attackers were usually willing to negotiate and, in some cases, lowered the price to less than one-third of the initial asking price. As of early July 2022, a review of the attackers’ wallet transactions shows that they have not successfully extorted ransom payments from their victims,” Microsoft researchers explained.
Read more »
Subscribe to: Posts (Atom)