Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Critical Infrastructure. Show all posts
Ransomwares
Backdoor Backdoor Attacks Critical Infrastructure Cyber Attacks RansomHub ransomware ransomware attacks Ransomwares

Betruger Backdoor Linked to RansomHub Ransomware Attacks on Critical Infrastructure

 

A newly discovered backdoor malware, dubbed Betruger, has been identified in multiple recent ransomware attacks. Researchers at Symantec believe at least one affiliate of the RansomHub ransomware-as-a-service (RaaS) operation is using this sophisticated tool to facilitate cyber intrusions. 

Unlike many conventional malware strains, Betruger functions as a multi-purpose backdoor designed to prepare networks for ransomware deployment while minimizing the need for additional malicious software. Betruger comes equipped with several advanced features commonly associated with pre-ransomware attack stages. These include keylogging, network scanning, privilege escalation, credential theft, screenshot capture, and the ability to upload files to a command-and-control (C2) server. 

Its design suggests that attackers are looking to streamline their intrusion process, reducing reliance on multiple external tools and instead using a single, custom-built malware to execute various attack functions. This approach is relatively rare, as ransomware operators typically rely on widely available tools such as Mimikatz and Cobalt Strike to conduct their attacks. To avoid detection, cybercriminals are disguising Betruger under the filenames ‘mailer.exe’ and ‘turbomailer.exe,’ making it appear like a legitimate email-related application. 

While other ransomware groups have developed proprietary tools for data exfiltration, such as BlackMatter’s Exmatter and BlackByte’s Exbyte, Betruger appears to have a broader range of capabilities beyond just stealing data. The emergence of Betruger coincides with ongoing attacks by RansomHub, a ransomware operation that has been active since February 2024. Previously known as Cyclops and Knight, RansomHub has gained a reputation for focusing on extortion through data theft rather than encrypting victim files. 

Over the past year, the group has targeted several major organizations, including Halliburton, Christie’s, Frontier Communications, Rite Aid, and Kawasaki’s EU division. It was also responsible for leaking Change Healthcare’s stolen data after the BlackCat/ALPHV group’s $22 million exit scam. More recently, RansomHub claimed responsibility for breaching BayMark Health Services, a leading addiction treatment provider in North America. 

The company operates over 400 treatment centers across the U.S. and Canada, serving approximately 75,000 patients daily. The FBI has linked RansomHub affiliates to more than 200 ransomware attacks affecting various critical infrastructure sectors in the U.S., including government agencies, healthcare institutions, and other essential services. With the deployment of Betruger, the group’s operations appear to be evolving, indicating a continued threat to businesses and organizations worldwide.
Read more »
social media platforms
Critical Infrastructure Cyber Security Data server Decentralised Platform Decentralization Digital Ocean Personal Data social media platforms

Bluesky’s Growth Spurs Scaling Challenges Amid Decentralization Goals

 

The new social media platform, Bluesky, received a huge number of new users over the past few weeks. This mass influx represents an alternative social networking experience, which is in demand. However, it also introduced notable technical challenges to the growth of the platforms, testing the current infrastructure and the vision for decentralization. Bluesky recently hit the servers hard, making most parts of the platform slow or unavailable. Users were affected by slow notifications, delayed updates in the timeline, and "Invalid Handle" errors. The platform was put into read-only mode as its stabilization was left to the technical team to take care of. This was worse when connectivity went down because of a severed fiber cable from one of the main bandwidth providers. 

Although it restored connectivity after an hour, the platform continued to experience increased traffic and record-breaking signups. Over 1.2 million new users had registered within the first day-an indication that the program held a great deal of promise and needed better infrastructure. Issues at Bluesky are reflected from the early times of Twitter, when server overloads were categorized by the "fabled Fail Whale." In a playful nod to history, users on Bluesky revived the Fail Whale images, taking the humor out of frustration. These instances of levity, again, prove the resilience of the community but indicate and highlight the urgency needed for adequate technical solutions. D ecentralized design is at the heart of Bluesky's identity, cutting reliance on a single server. In theory, users should be hosting their data on Personal Data Servers (PDS), thereby distributing the load across networks of independent, self-sufficient servers. That in its way is in line with creating a resilient and user-owned type of space. 

As things stand today, though, most of the users remain connected to the primary infrastructure, causing bottlenecks as the user base expands. The fully decentralized approach would be rather difficult to implement. Yes, building a PDS is relatively simple using current tools from providers like DigitalOcean; however, replicating the whole Bluesky infrastructure will be much more complex. The relay component alone needs nearly 5TB of storage, in addition to good computing power and bandwidth. Such demands make decentralization inaccessible to smaller organizations and individuals. To address these challenges, Bluesky may require resources from hyperscale cloud providers like AWS or Google Cloud. Such companies might host PDS instances along with support infrastructure. This will make it easy to scale Bluesky. It will also eliminate the current single points of failures in place and make sure that the growth of the platform is ensured. 

The path that Bluesky takes appears to represent two challenges: meeting short-term demand and building a decentralized future. With the right investment and infrastructure, the platform may well redefine the social media scenario it so plans, with a scalable and resilient network faithful to its vision of user ownership.
Read more »
ransomware attacks
Critical Infrastructure Cyber Attacks CyberCrime Cybersecurity CyberThreat Oilfield Supplier ransomware attacks

Texas Oilfield Supplier Operations Impacted by Ransomware Incident

 


About two months before the Newpark Resources attack, oilfield services giant Halliburton had been afflicted with a cyberattack that it then disclosed in a regulatory filing, which occurred about two months earlier.  Last week, Halliburton, the world's largest energy services provider, announced that about $35 million in expenses were incurred because of the attack. Still, the impact on the company's finances is relatively small, especially considering Halliburton is one of the world's largest energy services providers.  

There was an incident in August when Halliburton, a global provider of services for the energy industry, had to shut down the systems of some of its subsidiaries due to a cyber attack. In most cases, this type of breach involves unauthorized access by third parties; oftentimes, this leads to operations being disrupted, systems being shut down, and incident response plans being activated as a result of the breach. A cyber-response plan was activated at that time and a comprehensive investigation was conducted internally with the assistance of external advisors to assess and remedy any unauthorized activity that the company was aware of at that time.  

Halliburton announced last week that in its third-quarter results it incurred a pretax charge of $116 million as a result of severity costs, impairment of assets held for sale, expenses related to cybersecurity incidents, gains on equity investments, and other items. The company said in the release that it recorded a pretax charge of $116 million in the third quarter of 2024. In a report released on Tuesday, Halliburton's chairman, president, and CEO, Jeff Miller, said that Halliburton "experienced a $0.02 per share impact on its adjusted earnings from storms in the Gulf of Mexico and in the Gulf of Mexico due to the August cybersecurity event." 

While the update is not in any way noteworthy, Andy Watkin-Child, founding partner at Veritas GRC told LinkedIn it shows cyber incidents are moving to the top of the corporate agenda, in a post on the social media platform. The board of directors is more transparent, as required by the Securities and Exchange Commission when it comes to the impact of cyber incidents. Following the attack on Halliburton, the company had to postpone billing and collection activities, as well as put a halt on its share buyback program. 

According to the company, the full impact will not be material for the company's operations in the long run.   The Newpark Resources Group announced this week that access to certain information systems and business applications has been disrupted due to a ransomware attack that has hit their network. According to a filing with the Securities and Exchange Commission (SEC), the incident was discovered on October 29 and a cybersecurity response plan was activated immediately, the Texas-based company that provides drilling fluids systems and composite matting systems for the oilfield sector, said in its statement. 

In his statement, Newpark stated that "the incident has caused disruptions and limitations in access to certain of the company's information systems and business applications that support aspects of the company's operations and corporate functions, including financial and operational reporting systems", and the company is still paying the price. To continue operating uninterruptedly, the company reverted to downtime procedures, allowing it to safely continue manufacturing and field operations during the downtime period.  

Based on the company's current understanding of the facts and circumstances regarding this incident, this incident appears not to have a reasonably likely impact on the company's financial situation or its results of operations, the company said in a statement. Newpark declined to provide information about how the attackers accessed its network, as well as who might have been responsible for the incident, nor did it explain how they gained access. No ransomware group is known to be claiming responsibility for the attack, according to SecurityWeek. 

About two months before the Newpark Resources breach, there was also a cyberattack on oilfield services giant Halliburton that was also announced in a regulatory filing by that company.  The company has just reported that as a result of the attack, Halliburton has incurred approximately $35 million in expenses. However, given that the company is one of the leading energy service companies in the world, the financial impact is relatively small.  

The incident at Newpark Resources highlighted the importance of network segmentation in protecting networks, according to Chris Grove, director of cybersecurity strategy at Nozomi Networks. He says that when networks are under attack, network segmentation can ensure their security.  According to Grove, separating OT from IT is one way to minimize the risk of a security breach and possibly hurt key operations if there is a breach. However, organizations are facing an increasingly pressing challenge: securing the advantages of segmentation while enabling controlled connectivity, which is becoming increasingly difficult to maintain. 

Cybersecurity Dive has been informed by researchers from NCC Group via email that there has been no public leak of data from the Newpark Resources attack and that there has been no claim made regarding the leak.  Neither the company nor the company's shareholders have been able to determine what costs and financial impacts will be associated with this incident, but about the company's financial condition and results of operations, they believe that the attack "is not reasonably likely to have a material impact."

As a manufacturer, seller, and rental company, Newpark Resources is dedicated to serving the petroleum industry and various other sectors related to energy, such as pipelines, renewable energy, petrochemicals, construction, and oilfields. In its Thursday earnings report, the Woodlands, Texas-based company disclosed quarterly revenue exceeding $44 million and projected an annual revenue reaching up to $223 million. This performance underscores the company's strong market presence despite recent challenges, though it remains under pressure following a recent ransomware attack by unidentified cyber actors. 

As of Thursday, no specific hacking group had taken responsibility for the attack. The oil and gas sector recognized as a globally essential industry, has increasingly become a focal point for ransomware attacks. Due to the industry’s high financial stakes and critical role in infrastructure, it is often targeted by cybercriminals who expect ransom payments to restore access to compromised systems. Notably, ransomware incidents have affected major players in the sector. Over the past four years, corporations such as Shell, Halliburton, Colonial Pipeline, Encino Energy, Oiltanking, and Mabanaft have experienced cybersecurity breaches that have disrupted operations and prompted significant financial and reputational impacts.

These incidents have drawn heightened attention from government entities, prompting federal authorities to pursue enhanced cybersecurity measures across critical infrastructure sectors. The rise in ransomware attacks has spurred the government to implement stricter cybersecurity regulations, with mandates designed to bolster defense mechanisms within vulnerable industries.
Read more »
ransomware attacks
Critical Infrastructure Cyber Attacks cybersecurity in healthcare data security Healthcare Data Healthcare Industry ransomware attacks

WHO and Global Leaders Warn Against Rise of Ransomware Attacks Targeting Hospitals

 

On November 8, the World Health Organization (WHO) joined over 50 countries in issuing an urgent warning at the United Nations about the increase in ransomware attacks on healthcare systems worldwide. WHO Director-General Tedros Adhanom Ghebreyesus addressed the UN Security Council, emphasizing the critical risks these cyberattacks pose to public health and safety. He highlighted the growing frequency of attacks on hospitals, which could delay urgent care, disrupt essential services, and lead to life-threatening consequences. Calling for global cooperation, he described ransomware as an international security threat that demands a coordinated response. 

Ransomware is a form of cyberattack where hackers lock or encrypt a victim’s data and demand payment in exchange for releasing it. This form of digital extortion has escalated globally, affecting healthcare providers, institutions, and governments alike. In the healthcare sector, such attacks can be particularly devastating, compromising the safety of patients and healthcare workers. The joint statement, endorsed by nations such as Japan, South Korea, Argentina, France, Germany, and the United Kingdom, outlined the immediate dangers these attacks pose to public health and international security, calling on all governments to take stronger cybersecurity measures. The U.S., represented by Deputy National Security Adviser Anne Neuberger, directly blamed Russia for allowing ransomware groups to operate freely within its borders. 

According to Neuberger, some countries knowingly permit these actors to execute attacks that impact critical infrastructure globally. She called out Moscow for not addressing cybercriminals targeting foreign healthcare systems, implying that Russia’s inaction may indirectly support these malicious groups. Additional accusations were made against North Korea by delegates from France and South Korea, who highlighted the country’s alleged complicity in facilitating ransomware attacks. Russia’s UN representative, Ambassador Vassily Nebenzia, defended against these claims, arguing that the Security Council was not the right forum to address such issues. He asserted that Western nations were wasting valuable council time and resources by focusing on ransomware, suggesting instead that they address other pressing matters, including alleged attacks on hospitals in Gaza.  

WHO and the supporting nations warn that cybercrime, particularly ransomware, requires a global response to strengthen defenses in vulnerable sectors like healthcare. Dr. Ghebreyesus underscored that without collaboration, cybercriminals will continue to exploit critical systems, putting lives at risk. The joint statement also condemned nations that knowingly enable cybercriminals by allowing them to operate within their jurisdictions. This complicity, they argue, not only endangers healthcare systems but also threatens peace and security globally. 

As ransomware attacks continue to rise, healthcare systems worldwide face increasing pressure to strengthen cybersecurity defenses. The WHO’s call to action emphasizes that nations need to take ransomware threats as seriously as traditional security issues, working together to protect both patient safety and public health infrastructure.
Read more »
Spear Phishing
Critical Infrastructure Cyber Attacks cybercrime group Defense Kaspersky Russian Government Spear Phishing

Awaken Likho Targets Russian Agencies with MeshCentral Remote Access Tool

 

Awaken Likho, also referred to as Core Werewolf or PseudoGamaredon, is a cyber threat group targeting Russian government agencies and industrial entities. Since June 2024, a new campaign has been observed, where attackers have shifted from using UltraVNC to MeshCentral’s legitimate agent for remote access to compromised systems. The campaign primarily focuses on Russian government contractors and industrial enterprises, as reported by Kaspersky. Spear-phishing is a key method employed by Awaken Likho, with malicious executables disguised as Word or PDF files. 

These files trick victims by using double extensions such as “.doc.exe” or “.pdf.exe,” making them appear like standard document formats. When opened, these files trigger the installation of UltraVNC or, in the new campaign, MeshCentral’s MeshAgent tool, which grants the attackers full control over the compromised system. Awaken Likho’s cyberattacks date back to at least August 2021, first gaining attention through targeting Russia’s defense and critical infrastructure sectors. However, more recently, the group has shifted to using self-extracting archives (SFX) to covertly install UltraVNC, along with presenting decoy documents. 

In its latest campaigns, an SFX archive triggers the execution of a file named “MicrosoftStores.exe,” which unpacks an AutoIt script. This script eventually runs the MeshAgent tool, facilitating ongoing remote control via the MeshCentral server. By creating a scheduled task, Awaken Likho ensures persistence within the infected system. The scheduled task consistently runs the command file, which in turn launches MeshAgent, allowing communication with the MeshCentral server. This tactic gives the attackers access to the system long after the initial breach. Russian cybersecurity company Kaspersky has revealed that the campaign’s primary focus remains within Russian government bodies, contractors, and industrial enterprises. 

Additionally, earlier findings from BI.ZONE in June 2023 indicated that Awaken Likho has targeted sectors including defense and critical infrastructure, emphasizing the group’s intent on penetrating Russia’s most vital industries. A notable attack in May 2023 targeted a Russian military base in Armenia, as well as a research institute involved in weapons development. These actions suggest Awaken Likho’s primary focus on entities involved in Russia’s security and defense sectors, with significant consequences for the country’s critical infrastructure. 

This new chapter in Awaken Likho’s activity signals the group’s evolving tactics and its continued interest in leveraging spear-phishing attacks with more sophisticated tools. By transitioning to the MeshCentral platform, the group showcases its adaptability in maintaining control over systems while evading detection, making it a significant threat to Russian entities in the future.
Read more »
Software update
Critical Infrastructure critical infrastructure risk Cyber Security faulty software update software se Software update

Faulty Software Update Shuts Down Critical Infrastructure, Highlighting Major Risks

 

A recent incident involving a faulty software update has underscored the significant risks associated with system updates and the potential vulnerabilities in critical infrastructure. This incident, which caused a widespread shutdown of essential services, serves as a stark reminder of the importance of rigorous testing and robust cybersecurity protocols. The issue arose when a routine software update, intended to enhance performance and security, instead led to a catastrophic failure in several systems. 

The update, which was pushed out without adequate testing, contained a critical bug that disrupted the operation of numerous infrastructure services. As a result, vital operations were halted, causing widespread inconvenience and highlighting the fragility of digital infrastructure. One of the most affected sectors was the energy industry, where the software update caused several power plants to go offline. This led to significant disruptions in power supply, affecting both residential and commercial users. The outage also had a ripple effect on other critical services, including healthcare and transportation, further amplifying the impact of the incident. The problem was traced back to a flaw in the software update process. The update was not thoroughly vetted before being deployed, and the critical bug went unnoticed. Once the issue became apparent, emergency protocols were initiated to roll back the update and restore normal operations. 

However, the process was not straightforward, and it took several hours to bring all affected systems back online. This incident has raised serious concerns about the security and reliability of software updates, particularly for systems that underpin critical infrastructure. It has also highlighted the need for more stringent testing procedures and better contingency planning. Experts argue that while updates are necessary for maintaining security and performance, they must be handled with extreme caution to avoid such catastrophic failures. In response to the incident, several companies have announced plans to review and enhance their software update processes. This includes implementing more rigorous testing procedures, improving communication channels to quickly address any issues that arise, and developing more robust rollback mechanisms to quickly revert to previous versions in case of problems. 

Moreover, there is a growing call for industry-wide standards and best practices for software updates, particularly for critical infrastructure. These standards would ensure that updates are thoroughly tested and that there are adequate safeguards in place to prevent widespread disruptions. The incident serves as a sobering reminder of the delicate balance between maintaining security through updates and ensuring the stability of critical systems. As digital infrastructure becomes increasingly integral to everyday life, the stakes for getting this balance right have never been higher. 

Moving forward, it is imperative for companies and regulatory bodies to work together to strengthen the processes and protocols surrounding software updates, ensuring that they enhance security without compromising the reliability of essential services.
Read more »
Technology
Critical Infrastructure Ransom Payment Ransomware Sophos Technology

How Ransomware is Draining Resources from Critical Infrastructure

How Ransomware is Draining Resources from Critical Infrastructure

The Rising Cost of Ransomware Attacks on Critical Infrastructure

The costs of ransomware attacks on critical national infrastructure (CNI) firms have soared over the last year.

According to Sophos' newest numbers, which were revealed today, the typical ransom payment increased to $2.54 million, more than 41 times last year's total of $62,500. The mean payment for 2024 is considerably greater, at $3.225 million, representing a less dramatic 6-fold rise.

IT, technology, and telecoms were the least likely to pay large sums to hackers, with an average payment of $330,000, but lower education and federal government organizations reported the highest average payments of $6.6 million.

The figures are based solely on ransomware victims who were willing to reveal the specifics of their mistakes, thus they do not provide the full picture.

The Escalating Financial Burden

Only 86 of the 275 CNI organizations surveyed provided statistics on ransom payments. There's a significant risk that the results would be distorted if all of the CNI ransomware victims polled were completely upfront with their information.

Costs to recover from ransomware attacks have also increased dramatically since the researchers' findings last year, with some CNI industries' costs quadrupling to a median average of $3 million per event.

The Impact on Critical Infrastructure

According to the report, only one in every five people were able to recover in a week or less, down from 41 percent the previous year and 50 percent the year before that. The percentage of victims who take more than a month to recuperate has also increased to 55%, up from 36% last year. 

Sophos stated in its analysis that this could be due to attacks getting more sophisticated and complicated, requiring more work from the IT team to effectively repair all of the damage caused by the crimes. However, the vendor's global field CTO, Chester Wisniewski, believes the industries should reevaluate their propensity to pay ransoms.

Read more »
Ransomware
Colonial Pipeline Critical Infrastructure Cyber Attacks Data Leak Ransomware

Securing India’s Infrastructure: Key Takeaways from the Colonial Pipeline Hack

Securing India’s Infrastructure: Key Takeaways from the Colonial Pipeline Hack

In 2021, a major supplier of oil and gas to the American east coast, Colonial Pipeline, was taken offline, after a reported ransomware attack. The 5,500-mile pipeline attack triggered a call for increased regulations to protect and strengthen critical infrastructure against cyberattacks.

Since the incident, there’s been more awareness and willingness to invest in securing critical infrastructure in India, with the much-awaited Cybersecurity Bill 2024 being tabled in the Parliament in March this year. 

The Indian government has continuously increased its cybersecurity investment with successive incremental budgetary allotments towards this cause. Three years on, the attack still begs the question: How exposed to attacks is India’s critical infrastructure?

Changing landscape of operational technology (OT)

Traditionally, operational technology (OT) systems were isolated and “air-gapped” from the internet. However, the convergence of IT and OT has led to increased connectivity. The Colonial Pipeline attack exploited this connectivity, highlighting the need for robust security protocols. India’s critical infrastructure sectors (energy, transportation, and water supply) must assess their OT networks and implement necessary safeguards.

Compliance vs. security

While regulatory compliance provides a baseline, it alone is insufficient. Organizations should move beyond compliance and adopt a risk-based approach. Regular security assessments, vulnerability scans, and penetration testing are crucial. India’s proposed Cybersecurity Bill 2024 emphasizes the importance of proactive security measures.

Investment in cybersecurity

India must allocate adequate resources to strengthen its critical infrastructure cybersecurity. Budgetary provisions should cover training, threat intelligence, incident response, and technology upgrades. Collaborating with international partners and adopting best practices can enhance India’s cyber resilience.

Recommendations for India

The Colonial Pipeline incident demonstrated that critical infrastructure is becoming a significant issue in cybersecurity and that businesses must constantly be ready. This incident, one of the most disruptive attacks in history, forever altered the cybersecurity environment, paving the way for increased discussions about OT security among the general public, government officials, and the cybersecurity sector. It sparked a trend, pressing the public sector to be more proactive and invest more in operational technology security.

As a result, legislators and politicians are looking for measures to improve regulations to strengthen cyber defenses. More importantly, the attack emphasizes the importance of a comprehensive risk management approach and understanding the trajectory of where we want to be in terms of cyber security in ten years. With OT at the center of the discourse, strengthening our cyber defenses is more important than ever.

Read more »
Subscribe to: Posts (Atom)